From: David Howells <dhowells@redhat.com>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: dhowells@redhat.com, Tiezhu Yang <yangtiezhu@loongson.cn>,
linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] afs: Fix compile warning in afs_dynroot_lookup()
Date: Fri, 27 Dec 2019 09:10:12 +0000 [thread overview]
Message-ID: <12483.1577437812@warthog.procyon.org.uk> (raw)
In-Reply-To: <20191227000634.GS4203@ZenIV.linux.org.uk>
Al Viro <viro@zeniv.linux.org.uk> wrote:
> > - int len;
> > + int len = 0;
> >
> > if (!net->ws_cell)
> > return ERR_PTR(-ENOENT);
>
> NAK. This is really, really wrong - passing zero to lookup_one_len() is
> always a bug.
You can't create a cell with a name of "" as afs_alloc_cell() will object with
EINVAL, so if net->ws_cell points to an afs_cell struct, that should never
have a zero-length name.
> BTW, what guarantees that cell->name won't be "@cell"?
afs_alloc_cell() won't allow that a cell with that that name either.
> The same for net->sysnames in afs_lookup_atsys() - what makes sure we won't
> see "@sys" among those?
afs_proc_sysname_write() checks for it. Note that @sys substitutions are set
locally and are not obtained remotely.
> While we are at it,
> d = d_splice_alias(inode, dentry);
> if (!IS_ERR_OR_NULL(d)) {
> d->d_fsdata = dentry->d_fsdata;
> trace_afs_lookup(dvnode, &d->d_name,
> inode ? AFS_FS_I(inode) : NULL);
> } else {
> trace_afs_lookup(dvnode, &dentry->d_name,
> IS_ERR_OR_NULL(inode) ? NULL
> : AFS_FS_I(inode));
> }
> is _very_ suspicious-looking - d_splice_alias() consumes
> an inode reference, and if it ends up failing on non-ERR_PTR()
> inode, the inode will be dropped by the time it returns.
> IOW, that AFS_FS_I(inode) in the second branch can bloody
> well point to already freed memory.
Yeah, fair point. I need to save the fid before calling d_splice_alias().
> Tracepoints: Just Say No...
You can go and argue that one with David Miller if you like.
David
prev parent reply other threads:[~2019-12-27 9:10 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-19 13:14 [PATCH] afs: Fix compile warning in afs_dynroot_lookup() Tiezhu Yang
2019-12-27 0:06 ` Al Viro
2019-12-27 9:10 ` David Howells [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=12483.1577437812@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=linux-afs@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
--cc=yangtiezhu@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).