linux-kernel - Re: [PATCH] bcachefs: fix uninitialised-access bug in bch2_alloc_sectors_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <y3ojfcuvlj4vk3fz7z7meky4ccvbgcb24hdzfrxldvpungvmgy@oiwjlmqbut7c>
Date: Fri, 30 May 2025 00:39:18 -0400
From: Kent Overstreet <kent.overstreet@...ux.dev>
To: Qasim Ijaz <qasdev00@...il.com>
Cc: linux-bcachefs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] bcachefs: fix uninitialised-access bug in
 bch2_alloc_sectors_start_trans

On Wed, May 28, 2025 at 08:06:10PM +0100, Qasim Ijaz wrote:
> During bch2_alloc_sectors_start_trans() if bch2_trans_relock() fails
> the code jumps to label "err", skipping "cl" initialisation. Once at
> the "err" label "cl" could potentially be accessed leading to a uinit
> access.
> 
> Fix this by moving "cl" initialisation before bch2_trans_relock().
> 
> Fixes: c2e7fa88544d ("bcachefs: Use a loop for open_bucket_add_buckets() retries")
> Signed-off-by: Qasim Ijaz <qasdev00@...il.com>

Thanks, folded this in.

> ---
>  fs/bcachefs/alloc_foreground.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/bcachefs/alloc_foreground.c b/fs/bcachefs/alloc_foreground.c
> index 1410a4afb36a..ccd51bcbcec5 100644
> --- a/fs/bcachefs/alloc_foreground.c
> +++ b/fs/bcachefs/alloc_foreground.c
> @@ -1277,6 +1277,11 @@ int bch2_alloc_sectors_start_trans(struct btree_trans *trans,
>  
>  	req->data_type		= req->wp->data_type;
>  
> +	/* If we're going to fall back to the whole fs, try nonblocking first */
> +	struct closure *cl = req->target && !(flags & BCH_WRITE_only_specified_devs)
> +		? _cl
> +		: NULL;
> +
>  	ret = bch2_trans_relock(trans);
>  	if (ret)
>  		goto err;
> @@ -1285,10 +1290,6 @@ int bch2_alloc_sectors_start_trans(struct btree_trans *trans,
>  	if (req->data_type != BCH_DATA_user)
>  		req->have_cache = true;
>  
> -	/* If we're going to fall back to the whole fs, try nonblocking first */
> -	struct closure *cl = req->target && !(flags & BCH_WRITE_only_specified_devs)
> -		? _cl
> -		: NULL;
>  	while (1) {
>  		ret = open_bucket_add_buckets(trans, req, cl);
>  		if (!ret ||
> -- 
> 2.39.5
>