[PATCH 1/2] hfs: fix potential refcnt problem of nls module

[PATCH 1/2] hfs: fix potential refcnt problem of nls module

[Chengguang Xu]

When specifying iocharset/codepage multiple times in a mount,
current option parsing will cause inaccurate refcount of nls
module. Hence, call unload_nls for previous one in this case.

Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
---
 fs/hfs/super.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 1738767..6a5f6fd 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -329,8 +329,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
 				return 0;
 			}
 			p = match_strdup(&args[0]);
-			if (p)
+			if (p) {
+				unload_nls(hsb->nls_disk);
 				hsb->nls_disk = load_nls(p);
+			}
 			if (!hsb->nls_disk) {
 				pr_err("unable to load codepage \"%s\"\n", p);
 				kfree(p);
@@ -344,8 +346,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
 				return 0;
 			}
 			p = match_strdup(&args[0]);
-			if (p)
+			if (p) {
+				unload_nls(hsb->nls_io);
 				hsb->nls_io = load_nls(p);
+			}
 			if (!hsb->nls_io) {
 				pr_err("unable to load iocharset \"%s\"\n", p);
 				kfree(p);
-- 
1.8.3.1

[PATCH 2/2] hfsplus: fix potential refcnt problem of nls module

[Chengguang Xu]

When specifying nls option multiple times in a mount,
current option parsing will cause inaccurate refcount of nls
module. Hence, call unload_nls for previous one in this case.

Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
---
 fs/hfsplus/options.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index 047e05c..068d4e2 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -171,8 +171,10 @@ int hfsplus_parse_options(char *input, struct hfsplus_sb_info *sbi)
 				return 0;
 			}
 			p = match_strdup(&args[0]);
-			if (p)
+			if (p) {
+				unload_nls(sbi->nls);
 				sbi->nls = load_nls(p);
+			}
 			if (!sbi->nls) {
 				pr_err("unable to load nls mapping \"%s\"\n",
 				       p);
-- 
1.8.3.1

Re: [PATCH 2/2] hfsplus: fix potential refcnt problem of nls module

[Viacheslav Dubeyko]

On Tue, 2018-04-17 at 15:05 +0800, Chengguang Xu wrote:
> When specifying nls option multiple times in a mount,
> current option parsing will cause inaccurate refcount of nls
> module. Hence, call unload_nls for previous one in this case.
> 
> Signed-off-by: Chengguang Xu <cgxu519@gmx.com>


Looks good.

Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>

Thanks,
Vyacheslav Dubeyko.


> ---
>  fs/hfsplus/options.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
> index 047e05c..068d4e2 100644
> --- a/fs/hfsplus/options.c
> +++ b/fs/hfsplus/options.c
> @@ -171,8 +171,10 @@ int hfsplus_parse_options(char *input, struct
> hfsplus_sb_info *sbi)
>  				return 0;
>  			}
>  			p = match_strdup(&args[0]);
> -			if (p)
> +			if (p) {
> +				unload_nls(sbi->nls);
>  				sbi->nls = load_nls(p);
> +			}
>  			if (!sbi->nls) {
>  				pr_err("unable to load nls mapping
> \"%s\"\n",
>  				       p);

Re: [PATCH 2/2] hfsplus: fix potential refcnt problem of nls module

[Andrew Morton]

On Tue, 17 Apr 2018 15:05:33 +0800 Chengguang Xu <cgxu519@gmx.com> wrote:

> When specifying nls option multiple times in a mount,
> current option parsing will cause inaccurate refcount of nls
> module. Hence, call unload_nls for previous one in this case.
> 
> --- a/fs/hfsplus/options.c
> +++ b/fs/hfsplus/options.c
> @@ -171,8 +171,10 @@ int hfsplus_parse_options(char *input, struct hfsplus_sb_info *sbi)
>  				return 0;
>  			}
>  			p = match_strdup(&args[0]);
> -			if (p)
> +			if (p) {
> +				unload_nls(sbi->nls);
>  				sbi->nls = load_nls(p);
> +			}
>  			if (!sbi->nls) {
>  				pr_err("unable to load nls mapping \"%s\"\n",
>  				       p);

Same problem as in [patch 1/2]

Re: [PATCH 1/2] hfs: fix potential refcnt problem of nls module

[Viacheslav Dubeyko]

On Tue, 2018-04-17 at 15:05 +0800, Chengguang Xu wrote:
> When specifying iocharset/codepage multiple times in a mount,
> current option parsing will cause inaccurate refcount of nls
> module. Hence, call unload_nls for previous one in this case.
> 
> Signed-off-by: Chengguang Xu <cgxu519@gmx.com>


Looks good.

Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>

Thanks,
Vyacheslav Dubeyko.


> ---
>  fs/hfs/super.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/hfs/super.c b/fs/hfs/super.c
> index 1738767..6a5f6fd 100644
> --- a/fs/hfs/super.c
> +++ b/fs/hfs/super.c
> @@ -329,8 +329,10 @@ static int parse_options(char *options, struct
> hfs_sb_info *hsb)
>  				return 0;
>  			}
>  			p = match_strdup(&args[0]);
> -			if (p)
> +			if (p) {
> +				unload_nls(hsb->nls_disk);
>  				hsb->nls_disk = load_nls(p);
> +			}
>  			if (!hsb->nls_disk) {
>  				pr_err("unable to load codepage
> \"%s\"\n", p);
>  				kfree(p);
> @@ -344,8 +346,10 @@ static int parse_options(char *options, struct
> hfs_sb_info *hsb)
>  				return 0;
>  			}
>  			p = match_strdup(&args[0]);
> -			if (p)
> +			if (p) {
> +				unload_nls(hsb->nls_io);
>  				hsb->nls_io = load_nls(p);
> +			}
>  			if (!hsb->nls_io) {
>  				pr_err("unable to load iocharset
> \"%s\"\n", p);
>  				kfree(p);

Re: [PATCH 1/2] hfs: fix potential refcnt problem of nls module

[Andrew Morton]

On Tue, 17 Apr 2018 15:05:32 +0800 Chengguang Xu <cgxu519@gmx.com> wrote:

> When specifying iocharset/codepage multiple times in a mount,
> current option parsing will cause inaccurate refcount of nls
> module. Hence, call unload_nls for previous one in this case.
> 
> ...
>
> --- a/fs/hfs/super.c
> +++ b/fs/hfs/super.c
> @@ -329,8 +329,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
>  				return 0;
>  			}
>  			p = match_strdup(&args[0]);
> -			if (p)
> +			if (p) {
> +				unload_nls(hsb->nls_disk);
>  				hsb->nls_disk = load_nls(p);
> +			}
>  			if (!hsb->nls_disk) {
>  				pr_err("unable to load codepage \"%s\"\n", p);
>  				kfree(p);
> @@ -344,8 +346,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
>  				return 0;
>  			}
>  			p = match_strdup(&args[0]);
> -			if (p)
> +			if (p) {
> +				unload_nls(hsb->nls_io);
>  				hsb->nls_io = load_nls(p);
> +			}
>  			if (!hsb->nls_io) {
>  				pr_err("unable to load iocharset \"%s\"\n", p);
>  				kfree(p);

Confused.

			break;
: 		case opt_codepage:
: 			if (hsb->nls_disk) {
: 				pr_err("unable to change codepage\n");
: 				return 0;
: 			}

Here, hsb->nls_disk is known to be zero.

: 			p = match_strdup(&args[0]);
: 			if (p) {
: 				unload_nls(hsb->nls_disk);

So this will always do unload_nls(0).

: 				hsb->nls_disk = load_nls(p);
: 			}

And the same applies to your opt_iocharset change.

Re: [PATCH 1/2] hfs: fix potential refcnt problem of nls module

[cgxu519]

锟斤拷 2018锟斤拷4锟斤拷19锟秸ｏ拷锟斤拷锟斤拷3:42锟斤拷Andrew Morton <akpm@linux-foundation.org> 写锟斤拷锟斤拷
> 
> On Tue, 17 Apr 2018 15:05:32 +0800 Chengguang Xu <cgxu519@gmx.com> wrote:
> 
>> When specifying iocharset/codepage multiple times in a mount,
>> current option parsing will cause inaccurate refcount of nls
>> module. Hence, call unload_nls for previous one in this case.
>> 
>> ...
>> 
>> --- a/fs/hfs/super.c
>> +++ b/fs/hfs/super.c
>> @@ -329,8 +329,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
>> 				return 0;
>> 			}
>> 			p = match_strdup(&args[0]);
>> -			if (p)
>> +			if (p) {
>> +				unload_nls(hsb->nls_disk);
>> 				hsb->nls_disk = load_nls(p);
>> +			}
>> 			if (!hsb->nls_disk) {
>> 				pr_err("unable to load codepage \"%s\"\n", p);
>> 				kfree(p);
>> @@ -344,8 +346,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
>> 				return 0;
>> 			}
>> 			p = match_strdup(&args[0]);
>> -			if (p)
>> +			if (p) {
>> +				unload_nls(hsb->nls_io);
>> 				hsb->nls_io = load_nls(p);
>> +			}
>> 			if (!hsb->nls_io) {
>> 				pr_err("unable to load iocharset \"%s\"\n", p);
>> 				kfree(p);
> 
> Confused.
> 
> 			break;
> : 		case opt_codepage:
> : 			if (hsb->nls_disk) {
> : 				pr_err("unable to change codepage\n");
> : 				return 0;
> : 			}
> 
> Here, hsb->nls_disk is known to be zero.
> 
> : 			p = match_strdup(&args[0]);
> : 			if (p) {
> : 				unload_nls(hsb->nls_disk);
> 
> So this will always do unload_nls(0).
> 
> : 				hsb->nls_disk = load_nls(p);
> : 			}
> 
> And the same applies to your opt_iocharset change.

You are right. Sorry I just misread this part, please just drop the patch.

Thanks.