From: David Sterba <dsterba@suse.cz>
To: Qu Wenruo <wqu@suse.com>
Cc: linux-btrfs@vger.kernel.org, Yoon Jungyeon <jungyeon@gatech.edu>,
Nikolay Borisov <nborisov@suse.com>
Subject: Re: [PATCh v2 9/9] btrfs: inode: Verify inode mode to avoid NULL pointer dereference
Date: Thu, 28 Mar 2019 14:53:28 +0100 [thread overview]
Message-ID: <20190328135328.GE29086@twin.jikos.cz> (raw)
In-Reply-To: <20190320063717.31770-10-wqu@suse.com>
On Wed, Mar 20, 2019 at 02:37:17PM +0800, Qu Wenruo wrote:
> @@ -5726,18 +5734,29 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
> struct btrfs_root *root = BTRFS_I(dir)->root;
> struct btrfs_root *sub_root = root;
> struct btrfs_key location;
> + u8 di_type = 0;
> int index;
> int ret = 0;
>
> if (dentry->d_name.len > BTRFS_NAME_LEN)
> return ERR_PTR(-ENAMETOOLONG);
>
> - ret = btrfs_inode_by_name(dir, dentry, &location);
> + ret = btrfs_inode_by_name(dir, dentry, &location, &di_type);
> if (ret < 0)
> return ERR_PTR(ret);
>
> if (location.type == BTRFS_INODE_ITEM_KEY) {
> inode = btrfs_iget(dir->i_sb, &location, root, NULL);
> +
> + /* Do extra check against inode mode with di_type */
> + if (btrfs_inode_type(inode) != di_type) {
> + btrfs_crit(fs_info,
> +"inode mode mismatch with dir: inode mode=0%o btrfs type=%u dir type=%u",
> + inode->i_mode, btrfs_inode_type(inode),
> + di_type);
> + iput(inode);
The iput here seems suspicious.
> + return ERR_PTR(-EUCLEAN);
> + }
> return inode;
> }
5792 index = srcu_read_lock(&fs_info->subvol_srcu);
5793 ret = fixup_tree_root_location(fs_info, dir, dentry,
5794 &location, &sub_root);
5795 if (ret < 0) {
5796 if (ret != -ENOENT)
5797 inode = ERR_PTR(ret);
5798 else
5799 inode = new_simple_dir(dir->i_sb, &location, sub_root);
5800 } else {
5801 inode = btrfs_iget(dir->i_sb, &location, sub_root, NULL);
5802 }
The iget happens after this block so either there's another one in the caller
to pair, or the above iput is wrong.
next prev parent reply other threads:[~2019-03-28 13:52 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-20 6:37 [PATCh v2 0/9] btrfs: tree-checker: More enhancement for fuzzed Qu Wenruo
2019-03-20 6:37 ` [PATCh v2 1/9] btrfs: Move btrfs_check_chunk_valid() to tree-check.[ch] and export it Qu Wenruo
2019-03-20 10:34 ` Johannes Thumshirn
2019-03-25 17:06 ` David Sterba
2019-03-25 23:02 ` Qu Wenruo
2019-03-26 14:34 ` David Sterba
2019-03-20 6:37 ` [PATCh v2 2/9] btrfs: tree-checker: Make chunk item checker more readable Qu Wenruo
2019-03-20 10:41 ` Johannes Thumshirn
2019-03-26 15:08 ` David Sterba
2019-03-20 6:37 ` [PATCh v2 3/9] btrfs: tree-checker: Make btrfs_check_chunk_valid() return EUCLEAN instead of EIO Qu Wenruo
2019-03-20 10:44 ` Johannes Thumshirn
2019-03-20 6:37 ` [PATCh v2 4/9] btrfs: tree-checker: Check chunk item at tree block read time Qu Wenruo
2019-03-20 10:56 ` Johannes Thumshirn
2019-03-20 6:37 ` [PATCh v2 5/9] btrfs: tree-checker: Verify dev item Qu Wenruo
2019-03-20 11:51 ` Johannes Thumshirn
2019-03-20 11:53 ` Qu Wenruo
2019-03-25 17:04 ` David Sterba
2019-04-06 1:07 ` Qu Wenruo
2019-03-20 6:37 ` [PATCh v2 6/9] btrfs: Check the first key and level for cached extent buffer Qu Wenruo
2019-03-20 12:02 ` Johannes Thumshirn
2019-03-20 6:37 ` [PATCh v2 7/9] btrfs: tree-checker: Enhance chunk checker to validate chunk profiler Qu Wenruo
2019-03-20 12:38 ` Johannes Thumshirn
2019-03-20 6:37 ` [PATCh v2 8/9] btrfs: tree-checker: Verify inode item Qu Wenruo
2019-03-20 13:27 ` Johannes Thumshirn
2019-03-25 4:27 ` Qu Wenruo
2019-03-26 16:02 ` David Sterba
2019-03-27 0:13 ` Qu Wenruo
2019-03-26 15:27 ` David Sterba
2019-03-28 13:38 ` David Sterba
2019-03-28 13:42 ` Qu Wenruo
2019-03-28 13:57 ` David Sterba
2019-03-28 14:00 ` Qu Wenruo
2019-03-28 14:07 ` David Sterba
2019-03-28 14:13 ` Qu Wenruo
2019-03-28 14:25 ` David Sterba
2019-03-28 23:49 ` Qu Wenruo
2019-03-20 6:37 ` [PATCh v2 9/9] btrfs: inode: Verify inode mode to avoid NULL pointer dereference Qu Wenruo
2019-03-20 13:33 ` Johannes Thumshirn
2019-03-28 13:53 ` David Sterba [this message]
2019-03-28 13:58 ` Qu Wenruo
2019-03-28 14:02 ` David Sterba
2019-03-28 15:48 ` [PATCh v2 0/9] btrfs: tree-checker: More enhancement for fuzzed David Sterba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190328135328.GE29086@twin.jikos.cz \
--to=dsterba@suse.cz \
--cc=jungyeon@gatech.edu \
--cc=linux-btrfs@vger.kernel.org \
--cc=nborisov@suse.com \
--cc=wqu@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).