linux-kernel - Re: [PATCH 3/5] fs/fs_parse: Fix 3 issues for validate_constant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <nskvmomemvl47levkp4dmckwkyju7kjnn6wkp5go2igryfwzgv@pt2yuvjwrhoa>
Date: Mon, 14 Apr 2025 14:39:47 +0200
From: Jan Kara <jack@...e.cz>
To: Zijun Hu <zijun_hu@...oud.com>
Cc: Christian Brauner <brauner@...nel.org>, 
	Alexander Viro <viro@...iv.linux.org.uk>, Jan Kara <jack@...e.cz>, David Howells <dhowells@...hat.com>, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, Zijun Hu <quic_zijuhu@...cinc.com>
Subject: Re: [PATCH 3/5] fs/fs_parse: Fix 3 issues for
 validate_constant_table()

On Fri 11-04-25 22:48:40, Zijun Hu wrote:
> On 2025/4/11 22:37, Christian Brauner wrote:
> >> - Potential NULL pointer dereference.
> > I really dislike "potential NULL deref" without an explanation. Please
> > explain how this supposed NULL deref can happen.
> > 
> 
> okay.
> 
> >> Fixes: 31d921c7fb96 ("vfs: Add configuration parser helpers")
> >> Signed-off-by: Zijun Hu <quic_zijuhu@...cinc.com>
> >> ---
> >>  fs/fs_parser.c | 7 +++++--
> >>  1 file changed, 5 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/fs/fs_parser.c b/fs/fs_parser.c
> >> index e635a81e17d965df78ffef27f6885cd70996c6dd..ef7876340a917876bc40df9cdde9232204125a75 100644
> >> --- a/fs/fs_parser.c
> >> +++ b/fs/fs_parser.c
> >> @@ -399,6 +399,9 @@ bool validate_constant_table(const struct constant_table *tbl, size_t tbl_size,
> >>  	}
> >>  
> >>  	for (i = 0; i < tbl_size; i++) {
> >> +		if (!tbl[i].name && (i + 1 == tbl_size))
> >> +			break;
> >> +
> >>  		if (!tbl[i].name) {
> >>  			pr_err("VALIDATE C-TBL[%zu]: Null\n", i);
> >>  			good = false;
> >> @@ -411,13 +414,13 @@ bool validate_constant_table(const struct constant_table *tbl, size_t tbl_size,
> >>  				good = false;
> >>  			}
> >>  			if (c > 0) {
> >> -				pr_err("VALIDATE C-TBL[%zu]: Missorted %s>=%s\n",
> >> +				pr_err("VALIDATE C-TBL[%zu]: Missorted %s>%s\n",
> >>  				       i, tbl[i-1].name, tbl[i].name);
> >>  				good = false;
> >>  			}
> >>  		}
> >>  
> >> -		if (tbl[i].value != special &&
> >> +		if (tbl[i].name && tbl[i].value != special &&
> >>  		    (tbl[i].value < low || tbl[i].value > high)) {
> >>  			pr_err("VALIDATE C-TBL[%zu]: %s->%d const out of range (%d-%d)\n",
> >>  			       i, tbl[i].name, tbl[i].value, low, high);
> 
> for good constant table which ends with empty entry. for original logic,
> when loop reach the last empty entry.  above pr_err() may access NULL
> pointer tbl[i].name.
> 
> 
> i find out this validate_constant_table() also has no callers.
> fix it or remove it ?

Yeah, just drop it. In the kernel we are pretty aggressive in dropping
unused code :)

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR