linux-kernel - Re: [PATCH] exfat: fix random stack corruption after get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <PUZPR04MB6316CA3B8281D08C2A85435A81D82@PUZPR04MB6316.apcprd04.prod.outlook.com>
Date: Thu, 20 Mar 2025 08:16:41 +0000
From: "Yuezhang.Mo@...y.com" <Yuezhang.Mo@...y.com>
To: Sungjong Seo <sj1557.seo@...sung.com>,
        "linkinjeon@...nel.org"
	<linkinjeon@...nel.org>
CC: "sjdev.seo@...il.com" <sjdev.seo@...il.com>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "cpgs@...sung.com" <cpgs@...sung.com>,
        "stable@...r.kernel.org"
	<stable@...r.kernel.org>,
        Yeongjin Gil <youngjin.gil@...sung.com>
Subject: Re: [PATCH] exfat: fix random stack corruption after get_block

+                       /*
+                        * No buffer_head is allocated.
+                        * (1) bmap: It's enough to fill bh_result without I/O.
+                        * (2) read: The unwritten part should be filled with 0
+                        *           If a folio does not have any buffers,
+                        *           let's returns -EAGAIN to fallback to
+                        *           per-bh IO like block_read_full_folio().
+                        */
+                       if (!folio_buffers(bh_result->b_folio)) {
+                               err = -EAGAIN;
+                               goto done;
+                       }

bh_result is set as mapped by map_bh(), should we need to clear it if return an error?

+
+                       BUG_ON(size > sb->s_blocksize);

This check is equivalent to the following condition and is not necessary.

                } else if (iblock == valid_blks &&
                           (ei->valid_size & (sb->s_blocksize - 1))) {