linux-kernel - Re: [PATCH 3/5] fs/fs_parse: Fix 3 issues for validate_constant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1d59d38a-5674-4591-a866-27dfbc410b93@icloud.com>
Date: Fri, 11 Apr 2025 22:48:40 +0800
From: Zijun Hu <zijun_hu@...oud.com>
To: Christian Brauner <brauner@...nel.org>
Cc: Alexander Viro <viro@...iv.linux.org.uk>, Jan Kara <jack@...e.cz>,
 David Howells <dhowells@...hat.com>, linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org, Zijun Hu <quic_zijuhu@...cinc.com>
Subject: Re: [PATCH 3/5] fs/fs_parse: Fix 3 issues for
 validate_constant_table()

On 2025/4/11 22:37, Christian Brauner wrote:
>> - Potential NULL pointer dereference.
> I really dislike "potential NULL deref" without an explanation. Please
> explain how this supposed NULL deref can happen.
> 

okay.

>> Fixes: 31d921c7fb96 ("vfs: Add configuration parser helpers")
>> Signed-off-by: Zijun Hu <quic_zijuhu@...cinc.com>
>> ---
>>  fs/fs_parser.c | 7 +++++--
>>  1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/fs_parser.c b/fs/fs_parser.c
>> index e635a81e17d965df78ffef27f6885cd70996c6dd..ef7876340a917876bc40df9cdde9232204125a75 100644
>> --- a/fs/fs_parser.c
>> +++ b/fs/fs_parser.c
>> @@ -399,6 +399,9 @@ bool validate_constant_table(const struct constant_table *tbl, size_t tbl_size,
>>  	}
>>  
>>  	for (i = 0; i < tbl_size; i++) {
>> +		if (!tbl[i].name && (i + 1 == tbl_size))
>> +			break;
>> +
>>  		if (!tbl[i].name) {
>>  			pr_err("VALIDATE C-TBL[%zu]: Null\n", i);
>>  			good = false;
>> @@ -411,13 +414,13 @@ bool validate_constant_table(const struct constant_table *tbl, size_t tbl_size,
>>  				good = false;
>>  			}
>>  			if (c > 0) {
>> -				pr_err("VALIDATE C-TBL[%zu]: Missorted %s>=%s\n",
>> +				pr_err("VALIDATE C-TBL[%zu]: Missorted %s>%s\n",
>>  				       i, tbl[i-1].name, tbl[i].name);
>>  				good = false;
>>  			}
>>  		}
>>  
>> -		if (tbl[i].value != special &&
>> +		if (tbl[i].name && tbl[i].value != special &&
>>  		    (tbl[i].value < low || tbl[i].value > high)) {
>>  			pr_err("VALIDATE C-TBL[%zu]: %s->%d const out of range (%d-%d)\n",
>>  			       i, tbl[i].name, tbl[i].value, low, high);

for good constant table which ends with empty entry. for original logic,
when loop reach the last empty entry.  above pr_err() may access NULL
pointer tbl[i].name.


i find out this validate_constant_table() also has no callers.
fix it or remove it ?