* [PATCH] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-15 6:25 ` Yunlong Song
0 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-15 6:25 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..8ff4e4b 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -643,7 +643,7 @@ void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
u64 i_blocks = le64_to_cpu(node_blk->i.i_blocks);
int ofs = get_extra_isize(node_blk);
unsigned char *en;
- int namelen;
+ int namelen, i_namelen;
unsigned int idx = 0;
int need_fix = 0;
int ret;
@@ -850,8 +850,21 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ i_namelen = le32_to_cpu(node_blk->i.i_namelen);
+ namelen = strlen((const char *)node_blk->i.i_name);
+ if (i_namelen > F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, i_namelen, namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, i_namelen,
+ namelen);
+ node_blk->i.i_namelen = cpu_to_le32(namelen);
+ need_fix = 1;
+ }
+ i_namelen = namelen;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, i_namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
--
1.8.5.2
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [PATCH] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-15 6:25 ` Yunlong Song
0 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-15 6:25 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: shengyong1, linux-kernel, linux-f2fs-devel, heyunlei,
linux-fsdevel, miaoxie
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..8ff4e4b 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -643,7 +643,7 @@ void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
u64 i_blocks = le64_to_cpu(node_blk->i.i_blocks);
int ofs = get_extra_isize(node_blk);
unsigned char *en;
- int namelen;
+ int namelen, i_namelen;
unsigned int idx = 0;
int need_fix = 0;
int ret;
@@ -850,8 +850,21 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ i_namelen = le32_to_cpu(node_blk->i.i_namelen);
+ namelen = strlen((const char *)node_blk->i.i_name);
+ if (i_namelen > F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, i_namelen, namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, i_namelen,
+ namelen);
+ node_blk->i.i_namelen = cpu_to_le32(namelen);
+ need_fix = 1;
+ }
+ i_namelen = namelen;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, i_namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
--
1.8.5.2
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
^ permalink raw reply related [flat|nested] 18+ messages in thread
* Re: [PATCH] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-15 6:25 ` Yunlong Song
@ 2017-12-15 10:01 ` Sheng Yong
-1 siblings, 0 replies; 18+ messages in thread
From: Sheng Yong @ 2017-12-15 10:01 UTC (permalink / raw)
To: Yunlong Song, jaegeuk, chao, yuchao0, yunlong.song
Cc: miaoxie, bintian.wang, heyunlei, linux-fsdevel, linux-f2fs-devel,
linux-kernel
On 2017/12/15 14:25, Yunlong Song wrote:
> Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
> ---
> fsck/fsck.c | 19 ++++++++++++++++---
> 1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/fsck/fsck.c b/fsck/fsck.c
> index 2212aa3..8ff4e4b 100644
> --- a/fsck/fsck.c
> +++ b/fsck/fsck.c
> @@ -643,7 +643,7 @@ void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
> u64 i_blocks = le64_to_cpu(node_blk->i.i_blocks);
> int ofs = get_extra_isize(node_blk);
> unsigned char *en;
> - int namelen;
> + int namelen, i_namelen;
> unsigned int idx = 0;
> int need_fix = 0;
> int ret;
> @@ -850,8 +850,21 @@ skip_blkcnt_fix:
> en = malloc(F2FS_NAME_LEN + 1);
> ASSERT(en);
>
> - namelen = convert_encrypted_name(node_blk->i.i_name,
> - le32_to_cpu(node_blk->i.i_namelen),
> + i_namelen = le32_to_cpu(node_blk->i.i_namelen);
> + namelen = strlen((const char *)node_blk->i.i_name);
Hi, Yunlong
The strlen doesn't work for encrypted i_name. strlen may get a wrong namelen.
thanks,
Sheng
> + if (i_namelen > F2FS_NAME_LEN) {
> + ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
> + "but has %d characters for name",
> + nid, i_namelen, namelen);
> + if (c.fix_on) {
> + FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, i_namelen,
> + namelen);
> + node_blk->i.i_namelen = cpu_to_le32(namelen);
> + need_fix = 1;
> + }
> + i_namelen = namelen;
> + }
> + namelen = convert_encrypted_name(node_blk->i.i_name, i_namelen,
> en, file_enc_name(&node_blk->i));
> en[namelen] = '\0';
> if (ftype == F2FS_FT_ORPHAN)
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-15 10:01 ` Sheng Yong
0 siblings, 0 replies; 18+ messages in thread
From: Sheng Yong @ 2017-12-15 10:01 UTC (permalink / raw)
To: Yunlong Song, jaegeuk, chao, yuchao0, yunlong.song
Cc: miaoxie, bintian.wang, heyunlei, linux-fsdevel, linux-f2fs-devel,
linux-kernel
On 2017/12/15 14:25, Yunlong Song wrote:
> Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
> ---
> fsck/fsck.c | 19 ++++++++++++++++---
> 1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/fsck/fsck.c b/fsck/fsck.c
> index 2212aa3..8ff4e4b 100644
> --- a/fsck/fsck.c
> +++ b/fsck/fsck.c
> @@ -643,7 +643,7 @@ void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
> u64 i_blocks = le64_to_cpu(node_blk->i.i_blocks);
> int ofs = get_extra_isize(node_blk);
> unsigned char *en;
> - int namelen;
> + int namelen, i_namelen;
> unsigned int idx = 0;
> int need_fix = 0;
> int ret;
> @@ -850,8 +850,21 @@ skip_blkcnt_fix:
> en = malloc(F2FS_NAME_LEN + 1);
> ASSERT(en);
>
> - namelen = convert_encrypted_name(node_blk->i.i_name,
> - le32_to_cpu(node_blk->i.i_namelen),
> + i_namelen = le32_to_cpu(node_blk->i.i_namelen);
> + namelen = strlen((const char *)node_blk->i.i_name);
Hi, Yunlong
The strlen doesn't work for encrypted i_name. strlen may get a wrong namelen.
thanks,
Sheng
> + if (i_namelen > F2FS_NAME_LEN) {
> + ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
> + "but has %d characters for name",
> + nid, i_namelen, namelen);
> + if (c.fix_on) {
> + FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, i_namelen,
> + namelen);
> + node_blk->i.i_namelen = cpu_to_le32(namelen);
> + need_fix = 1;
> + }
> + i_namelen = namelen;
> + }
> + namelen = convert_encrypted_name(node_blk->i.i_name, i_namelen,
> en, file_enc_name(&node_blk->i));
> en[namelen] = '\0';
> if (ftype == F2FS_FT_ORPHAN)
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* [PATCH v2] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-15 6:25 ` Yunlong Song
@ 2017-12-18 11:15 ` Yunlong Song
-1 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-18 11:15 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 23 ++++++++++++++++++-----
fsck/fsck.h | 3 ++-
2 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..f25799c 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -539,7 +539,7 @@ int fsck_chk_node_blk(struct f2fs_sb_info *sbi, struct f2fs_inode *inode,
if (sanity_check_inode(sbi, node_blk))
goto err;
- fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni);
+ fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni, child);
quota_add_inode_usage(fsck->qctx, nid, &node_blk->i);
} else {
switch (ntype) {
@@ -633,7 +633,7 @@ unmatched:
/* start with valid nid and blkaddr */
void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
enum FILE_TYPE ftype, struct f2fs_node *node_blk,
- u32 *blk_cnt, struct node_info *ni)
+ u32 *blk_cnt, struct node_info *ni, struct child_info *child_d)
{
struct f2fs_fsck *fsck = F2FS_FSCK(sbi);
struct child_info child;
@@ -850,8 +850,20 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ namelen = le32_to_cpu(node_blk->i.i_namelen);
+ if (namelen > F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, namelen, child_d->i_namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, namelen,
+ child_d->i_namelen);
+ node_blk->i.i_namelen = cpu_to_le32(child_d->i_namelen);
+ need_fix = 1;
+ }
+ namelen = child_d->i_namelen;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
@@ -1414,9 +1426,10 @@ static int __chk_dentries(struct f2fs_sb_info *sbi, struct child_info *child,
dentry, max, i, last_blk, enc_name);
blk_cnt = 1;
+ child->i_namelen = name_len;
ret = fsck_chk_node_blk(sbi,
NULL, le32_to_cpu(dentry[i].ino),
- ftype, TYPE_INODE, &blk_cnt, NULL);
+ ftype, TYPE_INODE, &blk_cnt, child);
if (ret && c.fix_on) {
int j;
diff --git a/fsck/fsck.h b/fsck/fsck.h
index 0343fbd..d635c5a 100644
--- a/fsck/fsck.h
+++ b/fsck/fsck.h
@@ -54,6 +54,7 @@ struct child_info {
u32 pp_ino; /*parent parent ino*/
struct extent_info ei;
u32 last_blk;
+ u32 i_namelen; /* dentry namelen */
};
struct f2fs_fsck {
@@ -128,7 +129,7 @@ extern int fsck_chk_node_blk(struct f2fs_sb_info *, struct f2fs_inode *, u32,
enum FILE_TYPE, enum NODE_TYPE, u32 *,
struct child_info *);
extern void fsck_chk_inode_blk(struct f2fs_sb_info *, u32, enum FILE_TYPE,
- struct f2fs_node *, u32 *, struct node_info *);
+ struct f2fs_node *, u32 *, struct node_info *, struct child_info *);
extern int fsck_chk_dnode_blk(struct f2fs_sb_info *, struct f2fs_inode *,
u32, enum FILE_TYPE, struct f2fs_node *, u32 *,
struct child_info *, struct node_info *);
--
1.8.5.2
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [PATCH v2] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-18 11:15 ` Yunlong Song
0 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-18 11:15 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 23 ++++++++++++++++++-----
fsck/fsck.h | 3 ++-
2 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..f25799c 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -539,7 +539,7 @@ int fsck_chk_node_blk(struct f2fs_sb_info *sbi, struct f2fs_inode *inode,
if (sanity_check_inode(sbi, node_blk))
goto err;
- fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni);
+ fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni, child);
quota_add_inode_usage(fsck->qctx, nid, &node_blk->i);
} else {
switch (ntype) {
@@ -633,7 +633,7 @@ unmatched:
/* start with valid nid and blkaddr */
void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
enum FILE_TYPE ftype, struct f2fs_node *node_blk,
- u32 *blk_cnt, struct node_info *ni)
+ u32 *blk_cnt, struct node_info *ni, struct child_info *child_d)
{
struct f2fs_fsck *fsck = F2FS_FSCK(sbi);
struct child_info child;
@@ -850,8 +850,20 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ namelen = le32_to_cpu(node_blk->i.i_namelen);
+ if (namelen > F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, namelen, child_d->i_namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, namelen,
+ child_d->i_namelen);
+ node_blk->i.i_namelen = cpu_to_le32(child_d->i_namelen);
+ need_fix = 1;
+ }
+ namelen = child_d->i_namelen;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
@@ -1414,9 +1426,10 @@ static int __chk_dentries(struct f2fs_sb_info *sbi, struct child_info *child,
dentry, max, i, last_blk, enc_name);
blk_cnt = 1;
+ child->i_namelen = name_len;
ret = fsck_chk_node_blk(sbi,
NULL, le32_to_cpu(dentry[i].ino),
- ftype, TYPE_INODE, &blk_cnt, NULL);
+ ftype, TYPE_INODE, &blk_cnt, child);
if (ret && c.fix_on) {
int j;
diff --git a/fsck/fsck.h b/fsck/fsck.h
index 0343fbd..d635c5a 100644
--- a/fsck/fsck.h
+++ b/fsck/fsck.h
@@ -54,6 +54,7 @@ struct child_info {
u32 pp_ino; /*parent parent ino*/
struct extent_info ei;
u32 last_blk;
+ u32 i_namelen; /* dentry namelen */
};
struct f2fs_fsck {
@@ -128,7 +129,7 @@ extern int fsck_chk_node_blk(struct f2fs_sb_info *, struct f2fs_inode *, u32,
enum FILE_TYPE, enum NODE_TYPE, u32 *,
struct child_info *);
extern void fsck_chk_inode_blk(struct f2fs_sb_info *, u32, enum FILE_TYPE,
- struct f2fs_node *, u32 *, struct node_info *);
+ struct f2fs_node *, u32 *, struct node_info *, struct child_info *);
extern int fsck_chk_dnode_blk(struct f2fs_sb_info *, struct f2fs_inode *,
u32, enum FILE_TYPE, struct f2fs_node *, u32 *,
struct child_info *, struct node_info *);
--
1.8.5.2
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [PATCH v3] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-15 6:25 ` Yunlong Song
@ 2017-12-18 13:10 ` Yunlong Song
-1 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-18 13:10 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 26 +++++++++++++++++++++-----
fsck/fsck.h | 3 ++-
2 files changed, 23 insertions(+), 6 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..b52b6e4 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -539,7 +539,7 @@ int fsck_chk_node_blk(struct f2fs_sb_info *sbi, struct f2fs_inode *inode,
if (sanity_check_inode(sbi, node_blk))
goto err;
- fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni);
+ fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni, child);
quota_add_inode_usage(fsck->qctx, nid, &node_blk->i);
} else {
switch (ntype) {
@@ -633,7 +633,7 @@ unmatched:
/* start with valid nid and blkaddr */
void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
enum FILE_TYPE ftype, struct f2fs_node *node_blk,
- u32 *blk_cnt, struct node_info *ni)
+ u32 *blk_cnt, struct node_info *ni, struct child_info *child_d)
{
struct f2fs_fsck *fsck = F2FS_FSCK(sbi);
struct child_info child;
@@ -850,8 +850,23 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ namelen = le32_to_cpu(node_blk->i.i_namelen);
+ if (namelen > F2FS_NAME_LEN) {
+ if (child_d && child_d->i_namelen <= F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, namelen, child_d->i_namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, namelen,
+ child_d->i_namelen);
+ node_blk->i.i_namelen = cpu_to_le32(child_d->i_namelen);
+ need_fix = 1;
+ }
+ namelen = child_d->i_namelen;
+ } else
+ namelen = F2FS_NAME_LEN;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
@@ -1414,9 +1429,10 @@ static int __chk_dentries(struct f2fs_sb_info *sbi, struct child_info *child,
dentry, max, i, last_blk, enc_name);
blk_cnt = 1;
+ child->i_namelen = name_len;
ret = fsck_chk_node_blk(sbi,
NULL, le32_to_cpu(dentry[i].ino),
- ftype, TYPE_INODE, &blk_cnt, NULL);
+ ftype, TYPE_INODE, &blk_cnt, child);
if (ret && c.fix_on) {
int j;
diff --git a/fsck/fsck.h b/fsck/fsck.h
index 0343fbd..d635c5a 100644
--- a/fsck/fsck.h
+++ b/fsck/fsck.h
@@ -54,6 +54,7 @@ struct child_info {
u32 pp_ino; /*parent parent ino*/
struct extent_info ei;
u32 last_blk;
+ u32 i_namelen; /* dentry namelen */
};
struct f2fs_fsck {
@@ -128,7 +129,7 @@ extern int fsck_chk_node_blk(struct f2fs_sb_info *, struct f2fs_inode *, u32,
enum FILE_TYPE, enum NODE_TYPE, u32 *,
struct child_info *);
extern void fsck_chk_inode_blk(struct f2fs_sb_info *, u32, enum FILE_TYPE,
- struct f2fs_node *, u32 *, struct node_info *);
+ struct f2fs_node *, u32 *, struct node_info *, struct child_info *);
extern int fsck_chk_dnode_blk(struct f2fs_sb_info *, struct f2fs_inode *,
u32, enum FILE_TYPE, struct f2fs_node *, u32 *,
struct child_info *, struct node_info *);
--
1.8.5.2
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [PATCH v3] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-18 13:10 ` Yunlong Song
0 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-18 13:10 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 26 +++++++++++++++++++++-----
fsck/fsck.h | 3 ++-
2 files changed, 23 insertions(+), 6 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..b52b6e4 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -539,7 +539,7 @@ int fsck_chk_node_blk(struct f2fs_sb_info *sbi, struct f2fs_inode *inode,
if (sanity_check_inode(sbi, node_blk))
goto err;
- fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni);
+ fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni, child);
quota_add_inode_usage(fsck->qctx, nid, &node_blk->i);
} else {
switch (ntype) {
@@ -633,7 +633,7 @@ unmatched:
/* start with valid nid and blkaddr */
void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
enum FILE_TYPE ftype, struct f2fs_node *node_blk,
- u32 *blk_cnt, struct node_info *ni)
+ u32 *blk_cnt, struct node_info *ni, struct child_info *child_d)
{
struct f2fs_fsck *fsck = F2FS_FSCK(sbi);
struct child_info child;
@@ -850,8 +850,23 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ namelen = le32_to_cpu(node_blk->i.i_namelen);
+ if (namelen > F2FS_NAME_LEN) {
+ if (child_d && child_d->i_namelen <= F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, namelen, child_d->i_namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, namelen,
+ child_d->i_namelen);
+ node_blk->i.i_namelen = cpu_to_le32(child_d->i_namelen);
+ need_fix = 1;
+ }
+ namelen = child_d->i_namelen;
+ } else
+ namelen = F2FS_NAME_LEN;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
@@ -1414,9 +1429,10 @@ static int __chk_dentries(struct f2fs_sb_info *sbi, struct child_info *child,
dentry, max, i, last_blk, enc_name);
blk_cnt = 1;
+ child->i_namelen = name_len;
ret = fsck_chk_node_blk(sbi,
NULL, le32_to_cpu(dentry[i].ino),
- ftype, TYPE_INODE, &blk_cnt, NULL);
+ ftype, TYPE_INODE, &blk_cnt, child);
if (ret && c.fix_on) {
int j;
diff --git a/fsck/fsck.h b/fsck/fsck.h
index 0343fbd..d635c5a 100644
--- a/fsck/fsck.h
+++ b/fsck/fsck.h
@@ -54,6 +54,7 @@ struct child_info {
u32 pp_ino; /*parent parent ino*/
struct extent_info ei;
u32 last_blk;
+ u32 i_namelen; /* dentry namelen */
};
struct f2fs_fsck {
@@ -128,7 +129,7 @@ extern int fsck_chk_node_blk(struct f2fs_sb_info *, struct f2fs_inode *, u32,
enum FILE_TYPE, enum NODE_TYPE, u32 *,
struct child_info *);
extern void fsck_chk_inode_blk(struct f2fs_sb_info *, u32, enum FILE_TYPE,
- struct f2fs_node *, u32 *, struct node_info *);
+ struct f2fs_node *, u32 *, struct node_info *, struct child_info *);
extern int fsck_chk_dnode_blk(struct f2fs_sb_info *, struct f2fs_inode *,
u32, enum FILE_TYPE, struct f2fs_node *, u32 *,
struct child_info *, struct node_info *);
--
1.8.5.2
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-15 6:25 ` Yunlong Song
@ 2017-12-18 13:25 ` Yunlong Song
-1 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-18 13:25 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
v1 -> v2: use child_info to pass dentry namelen
v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
v3 -> v4: fix the i_namelen problem of dump.f2fs
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 28 +++++++++++++++++++++++-----
fsck/fsck.h | 3 ++-
2 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..5407cf2 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -539,7 +539,7 @@ int fsck_chk_node_blk(struct f2fs_sb_info *sbi, struct f2fs_inode *inode,
if (sanity_check_inode(sbi, node_blk))
goto err;
- fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni);
+ fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni, child);
quota_add_inode_usage(fsck->qctx, nid, &node_blk->i);
} else {
switch (ntype) {
@@ -633,7 +633,7 @@ unmatched:
/* start with valid nid and blkaddr */
void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
enum FILE_TYPE ftype, struct f2fs_node *node_blk,
- u32 *blk_cnt, struct node_info *ni)
+ u32 *blk_cnt, struct node_info *ni, struct child_info *child_d)
{
struct f2fs_fsck *fsck = F2FS_FSCK(sbi);
struct child_info child;
@@ -850,8 +850,23 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ namelen = le32_to_cpu(node_blk->i.i_namelen);
+ if (namelen > F2FS_NAME_LEN) {
+ if (child_d && child_d->i_namelen <= F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, namelen, child_d->i_namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, namelen,
+ child_d->i_namelen);
+ node_blk->i.i_namelen = cpu_to_le32(child_d->i_namelen);
+ need_fix = 1;
+ }
+ namelen = child_d->i_namelen;
+ } else
+ namelen = F2FS_NAME_LEN;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
@@ -1098,6 +1113,8 @@ int convert_encrypted_name(unsigned char *name, int len,
unsigned char *new, int enc_name)
{
if (!enc_name) {
+ if (len > F2FS_NAME_LEN)
+ len = F2FS_NAME_LEN;
memcpy(new, name, len);
new[len] = 0;
return len;
@@ -1414,9 +1431,10 @@ static int __chk_dentries(struct f2fs_sb_info *sbi, struct child_info *child,
dentry, max, i, last_blk, enc_name);
blk_cnt = 1;
+ child->i_namelen = name_len;
ret = fsck_chk_node_blk(sbi,
NULL, le32_to_cpu(dentry[i].ino),
- ftype, TYPE_INODE, &blk_cnt, NULL);
+ ftype, TYPE_INODE, &blk_cnt, child);
if (ret && c.fix_on) {
int j;
diff --git a/fsck/fsck.h b/fsck/fsck.h
index 0343fbd..d635c5a 100644
--- a/fsck/fsck.h
+++ b/fsck/fsck.h
@@ -54,6 +54,7 @@ struct child_info {
u32 pp_ino; /*parent parent ino*/
struct extent_info ei;
u32 last_blk;
+ u32 i_namelen; /* dentry namelen */
};
struct f2fs_fsck {
@@ -128,7 +129,7 @@ extern int fsck_chk_node_blk(struct f2fs_sb_info *, struct f2fs_inode *, u32,
enum FILE_TYPE, enum NODE_TYPE, u32 *,
struct child_info *);
extern void fsck_chk_inode_blk(struct f2fs_sb_info *, u32, enum FILE_TYPE,
- struct f2fs_node *, u32 *, struct node_info *);
+ struct f2fs_node *, u32 *, struct node_info *, struct child_info *);
extern int fsck_chk_dnode_blk(struct f2fs_sb_info *, struct f2fs_inode *,
u32, enum FILE_TYPE, struct f2fs_node *, u32 *,
struct child_info *, struct node_info *);
--
1.8.5.2
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-18 13:25 ` Yunlong Song
0 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-18 13:25 UTC (permalink / raw)
To: jaegeuk, chao, yuchao0, yunlong.song, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
v1 -> v2: use child_info to pass dentry namelen
v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
v3 -> v4: fix the i_namelen problem of dump.f2fs
Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
---
fsck/fsck.c | 28 +++++++++++++++++++++++-----
fsck/fsck.h | 3 ++-
2 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/fsck/fsck.c b/fsck/fsck.c
index 2212aa3..5407cf2 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -539,7 +539,7 @@ int fsck_chk_node_blk(struct f2fs_sb_info *sbi, struct f2fs_inode *inode,
if (sanity_check_inode(sbi, node_blk))
goto err;
- fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni);
+ fsck_chk_inode_blk(sbi, nid, ftype, node_blk, blk_cnt, &ni, child);
quota_add_inode_usage(fsck->qctx, nid, &node_blk->i);
} else {
switch (ntype) {
@@ -633,7 +633,7 @@ unmatched:
/* start with valid nid and blkaddr */
void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid,
enum FILE_TYPE ftype, struct f2fs_node *node_blk,
- u32 *blk_cnt, struct node_info *ni)
+ u32 *blk_cnt, struct node_info *ni, struct child_info *child_d)
{
struct f2fs_fsck *fsck = F2FS_FSCK(sbi);
struct child_info child;
@@ -850,8 +850,23 @@ skip_blkcnt_fix:
en = malloc(F2FS_NAME_LEN + 1);
ASSERT(en);
- namelen = convert_encrypted_name(node_blk->i.i_name,
- le32_to_cpu(node_blk->i.i_namelen),
+ namelen = le32_to_cpu(node_blk->i.i_namelen);
+ if (namelen > F2FS_NAME_LEN) {
+ if (child_d && child_d->i_namelen <= F2FS_NAME_LEN) {
+ ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, "
+ "but has %d characters for name",
+ nid, namelen, child_d->i_namelen);
+ if (c.fix_on) {
+ FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, namelen,
+ child_d->i_namelen);
+ node_blk->i.i_namelen = cpu_to_le32(child_d->i_namelen);
+ need_fix = 1;
+ }
+ namelen = child_d->i_namelen;
+ } else
+ namelen = F2FS_NAME_LEN;
+ }
+ namelen = convert_encrypted_name(node_blk->i.i_name, namelen,
en, file_enc_name(&node_blk->i));
en[namelen] = '\0';
if (ftype == F2FS_FT_ORPHAN)
@@ -1098,6 +1113,8 @@ int convert_encrypted_name(unsigned char *name, int len,
unsigned char *new, int enc_name)
{
if (!enc_name) {
+ if (len > F2FS_NAME_LEN)
+ len = F2FS_NAME_LEN;
memcpy(new, name, len);
new[len] = 0;
return len;
@@ -1414,9 +1431,10 @@ static int __chk_dentries(struct f2fs_sb_info *sbi, struct child_info *child,
dentry, max, i, last_blk, enc_name);
blk_cnt = 1;
+ child->i_namelen = name_len;
ret = fsck_chk_node_blk(sbi,
NULL, le32_to_cpu(dentry[i].ino),
- ftype, TYPE_INODE, &blk_cnt, NULL);
+ ftype, TYPE_INODE, &blk_cnt, child);
if (ret && c.fix_on) {
int j;
diff --git a/fsck/fsck.h b/fsck/fsck.h
index 0343fbd..d635c5a 100644
--- a/fsck/fsck.h
+++ b/fsck/fsck.h
@@ -54,6 +54,7 @@ struct child_info {
u32 pp_ino; /*parent parent ino*/
struct extent_info ei;
u32 last_blk;
+ u32 i_namelen; /* dentry namelen */
};
struct f2fs_fsck {
@@ -128,7 +129,7 @@ extern int fsck_chk_node_blk(struct f2fs_sb_info *, struct f2fs_inode *, u32,
enum FILE_TYPE, enum NODE_TYPE, u32 *,
struct child_info *);
extern void fsck_chk_inode_blk(struct f2fs_sb_info *, u32, enum FILE_TYPE,
- struct f2fs_node *, u32 *, struct node_info *);
+ struct f2fs_node *, u32 *, struct node_info *, struct child_info *);
extern int fsck_chk_dnode_blk(struct f2fs_sb_info *, struct f2fs_inode *,
u32, enum FILE_TYPE, struct f2fs_node *, u32 *,
struct child_info *, struct node_info *);
--
1.8.5.2
^ permalink raw reply related [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-18 13:25 ` Yunlong Song
@ 2017-12-23 3:05 ` Chao Yu
-1 siblings, 0 replies; 18+ messages in thread
From: Chao Yu @ 2017-12-23 3:05 UTC (permalink / raw)
To: Yunlong Song, jaegeuk, chao, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
On 2017/12/18 21:25, Yunlong Song wrote:
> v1 -> v2: use child_info to pass dentry namelen
> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
> v3 -> v4: fix the i_namelen problem of dump.f2fs、
There is no commit log, so what do you mean about "avoid double free"?
Other than that, looks good to me.
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Thanks,
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-23 3:05 ` Chao Yu
0 siblings, 0 replies; 18+ messages in thread
From: Chao Yu @ 2017-12-23 3:05 UTC (permalink / raw)
To: Yunlong Song, jaegeuk, chao, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
On 2017/12/18 21:25, Yunlong Song wrote:
> v1 -> v2: use child_info to pass dentry namelen
> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
> v3 -> v4: fix the i_namelen problem of dump.f2fs、
There is no commit log, so what do you mean about "avoid double free"?
Other than that, looks good to me.
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Thanks,
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-23 3:05 ` Chao Yu
@ 2017-12-23 3:19 ` Yunlong Song
-1 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-23 3:19 UTC (permalink / raw)
To: Chao Yu, jaegeuk, chao, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
Double free problem:
Since ddr bit jump makes i_namelen a larger value (> 255),when file is
not encrypted,
the convert_encrypted_name will memcpy out range of en[255], when en is
freed, there
will be double free problem.
On 2017/12/23 11:05, Chao Yu wrote:
> On 2017/12/18 21:25, Yunlong Song wrote:
>> v1 -> v2: use child_info to pass dentry namelen
>> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
>> v3 -> v4: fix the i_namelen problem of dump.f2fs、
> There is no commit log, so what do you mean about "avoid double free"?
>
> Other than that, looks good to me.
>
> Reviewed-by: Chao Yu <yuchao0@huawei.com>
>
> Thanks,
>
>
> .
>
--
Thanks,
Yunlong Song
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-23 3:19 ` Yunlong Song
0 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-23 3:19 UTC (permalink / raw)
To: Chao Yu, jaegeuk, chao, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
Double free problem:
Since ddr bit jump makes i_namelen a larger value (> 255),when file is
not encrypted,
the convert_encrypted_name will memcpy out range of en[255], when en is
freed, there
will be double free problem.
On 2017/12/23 11:05, Chao Yu wrote:
> On 2017/12/18 21:25, Yunlong Song wrote:
>> v1 -> v2: use child_info to pass dentry namelen
>> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
>> v3 -> v4: fix the i_namelen problem of dump.f2fs、
> There is no commit log, so what do you mean about "avoid double free"?
>
> Other than that, looks good to me.
>
> Reviewed-by: Chao Yu <yuchao0@huawei.com>
>
> Thanks,
>
>
> .
>
--
Thanks,
Yunlong Song
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-23 3:19 ` Yunlong Song
@ 2017-12-23 3:35 ` Chao Yu
-1 siblings, 0 replies; 18+ messages in thread
From: Chao Yu @ 2017-12-23 3:35 UTC (permalink / raw)
To: Yunlong Song, jaegeuk, chao, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
On 2017/12/23 11:19, Yunlong Song wrote:
> Double free problem:
> Since ddr bit jump makes i_namelen a larger value (> 255),when file is
> not encrypted,
> the convert_encrypted_name will memcpy out range of en[255], when en is
> freed, there
> will be double free problem.
It looks there is only memcpy overflow problem here.
Thanks,
>
> On 2017/12/23 11:05, Chao Yu wrote:
>> On 2017/12/18 21:25, Yunlong Song wrote:
>>> v1 -> v2: use child_info to pass dentry namelen
>>> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
>>> v3 -> v4: fix the i_namelen problem of dump.f2fs、
>> There is no commit log, so what do you mean about "avoid double free"?
>>
>> Other than that, looks good to me.
>>
>> Reviewed-by: Chao Yu <yuchao0@huawei.com>
>>
>> Thanks,
>>
>>
>> .
>>
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-23 3:35 ` Chao Yu
0 siblings, 0 replies; 18+ messages in thread
From: Chao Yu @ 2017-12-23 3:35 UTC (permalink / raw)
To: Yunlong Song, jaegeuk, chao, yunlong.song
Cc: shengyong1, linux-kernel, linux-f2fs-devel, heyunlei,
linux-fsdevel, miaoxie
On 2017/12/23 11:19, Yunlong Song wrote:
> Double free problem:
> Since ddr bit jump makes i_namelen a larger value (> 255),when file is
> not encrypted,
> the convert_encrypted_name will memcpy out range of en[255], when en is
> freed, there
> will be double free problem.
It looks there is only memcpy overflow problem here.
Thanks,
>
> On 2017/12/23 11:05, Chao Yu wrote:
>> On 2017/12/18 21:25, Yunlong Song wrote:
>>> v1 -> v2: use child_info to pass dentry namelen
>>> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
>>> v3 -> v4: fix the i_namelen problem of dump.f2fs、
>> There is no commit log, so what do you mean about "avoid double free"?
>>
>> Other than that, looks good to me.
>>
>> Reviewed-by: Chao Yu <yuchao0@huawei.com>
>>
>> Thanks,
>>
>>
>> .
>>
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
2017-12-23 3:35 ` Chao Yu
@ 2017-12-23 3:40 ` Yunlong Song
-1 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-23 3:40 UTC (permalink / raw)
To: Chao Yu, jaegeuk, chao, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
And there is en[namelen] = '\0', should fix namelen to its right value.
On 2017/12/23 11:35, Chao Yu wrote:
> On 2017/12/23 11:19, Yunlong Song wrote:
>> Double free problem:
>> Since ddr bit jump makes i_namelen a larger value (> 255),when file is
>> not encrypted,
>> the convert_encrypted_name will memcpy out range of en[255], when en is
>> freed, there
>> will be double free problem.
> It looks there is only memcpy overflow problem here.
>
> Thanks,
>
>> On 2017/12/23 11:05, Chao Yu wrote:
>>> On 2017/12/18 21:25, Yunlong Song wrote:
>>>> v1 -> v2: use child_info to pass dentry namelen
>>>> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
>>>> v3 -> v4: fix the i_namelen problem of dump.f2fs、
>>> There is no commit log, so what do you mean about "avoid double free"?
>>>
>>> Other than that, looks good to me.
>>>
>>> Reviewed-by: Chao Yu <yuchao0@huawei.com>
>>>
>>> Thanks,
>>>
>>>
>>> .
>>>
>
> .
>
--
Thanks,
Yunlong Song
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH v4] fsck.f2fs: check and fix i_namelen to avoid double free
@ 2017-12-23 3:40 ` Yunlong Song
0 siblings, 0 replies; 18+ messages in thread
From: Yunlong Song @ 2017-12-23 3:40 UTC (permalink / raw)
To: Chao Yu, jaegeuk, chao, yunlong.song
Cc: miaoxie, bintian.wang, shengyong1, heyunlei, linux-fsdevel,
linux-f2fs-devel, linux-kernel
And there is en[namelen] = '\0', should fix namelen to its right value.
On 2017/12/23 11:35, Chao Yu wrote:
> On 2017/12/23 11:19, Yunlong Song wrote:
>> Double free problem:
>> Since ddr bit jump makes i_namelen a larger value (> 255),when file is
>> not encrypted,
>> the convert_encrypted_name will memcpy out range of en[255], when en is
>> freed, there
>> will be double free problem.
> It looks there is only memcpy overflow problem here.
>
> Thanks,
>
>> On 2017/12/23 11:05, Chao Yu wrote:
>>> On 2017/12/18 21:25, Yunlong Song wrote:
>>>> v1 -> v2: use child_info to pass dentry namelen
>>>> v2 -> v3: check child != NULL to include the F2FS_FT_ORPHAN file type
>>>> v3 -> v4: fix the i_namelen problem of dump.f2fs、
>>> There is no commit log, so what do you mean about "avoid double free"?
>>>
>>> Other than that, looks good to me.
>>>
>>> Reviewed-by: Chao Yu <yuchao0@huawei.com>
>>>
>>> Thanks,
>>>
>>>
>>> .
>>>
>
> .
>
--
Thanks,
Yunlong Song
^ permalink raw reply [flat|nested] 18+ messages in thread
end of thread, other threads:[~2017-12-23 3:41 UTC | newest]
Thread overview: 18+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-15 6:25 [PATCH] fsck.f2fs: check and fix i_namelen to avoid double free Yunlong Song
2017-12-15 6:25 ` Yunlong Song
2017-12-15 10:01 ` Sheng Yong
2017-12-15 10:01 ` Sheng Yong
2017-12-18 11:15 ` [PATCH v2] " Yunlong Song
2017-12-18 11:15 ` Yunlong Song
2017-12-18 13:10 ` [PATCH v3] " Yunlong Song
2017-12-18 13:10 ` Yunlong Song
2017-12-18 13:25 ` [PATCH v4] " Yunlong Song
2017-12-18 13:25 ` Yunlong Song
2017-12-23 3:05 ` Chao Yu
2017-12-23 3:05 ` Chao Yu
2017-12-23 3:19 ` Yunlong Song
2017-12-23 3:19 ` Yunlong Song
2017-12-23 3:35 ` Chao Yu
2017-12-23 3:35 ` Chao Yu
2017-12-23 3:40 ` Yunlong Song
2017-12-23 3:40 ` Yunlong Song
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.