Re: [PATCH] exfat: Fix use after free in exfat_load_upcase_table()

Re: [PATCH] exfat: Fix use after free in exfat_load_upcase_table()

[Markus Elfring]

> This code calls brelse(bh) and then dereferences "bh" on the next line
> resulting in a possible use after free.

There is an unfortunate function call sequence.


> The brelse() should just be moved down a line.

How do you think about a wording variant like the following?

   Thus move a call of the function “brelse” one line down.


Would you like to omit a word from the patch subject so that
a typo will be avoided there?

Regards,
Markus

Re: [PATCH] exfat: Fix use after free in exfat_load_upcase_table()

[Matthew Wilcox]

On Mon, Jun 08, 2020 at 05:07:33PM +0200, Markus Elfring wrote:
> > This code calls brelse(bh) and then dereferences "bh" on the next line
> > resulting in a possible use after free.
> 
> There is an unfortunate function call sequence.
> 
> 
> > The brelse() should just be moved down a line.
> 
> How do you think about a wording variant like the following?
> 
>    Thus move a call of the function “brelse” one line down.
> 
> 
> Would you like to omit a word from the patch subject so that
> a typo will be avoided there?

Markus, please go away.  This comment is entirely unhelpful.

Re: exfat: Fix use after free in exfat_load_upcase_table()

[Markus Elfring]

>>> The brelse() should just be moved down a line.
>>
>> How do you think about a wording variant like the following?
>>
>>    Thus move a call of the function “brelse” one line down.
>>
>>
>> Would you like to omit a word from the patch subject so that
>> a typo will be avoided there?
>
> Markus, please go away.  This comment is entirely unhelpful.

I hope that other contributors can get also more positive impressions
(as it happened before).

Regards,
Markus

Re: [PATCH] exfat: Fix use after free in exfat_load_upcase_table()

[Greg KH]

On Mon, Jun 08, 2020 at 05:07:33PM +0200, Markus Elfring wrote:
> > This code calls brelse(bh) and then dereferences "bh" on the next line
> > resulting in a possible use after free.
> 
> There is an unfortunate function call sequence.
> 
> 
> > The brelse() should just be moved down a line.
> 
> How do you think about a wording variant like the following?
> 
>    Thus move a call of the function “brelse” one line down.
> 
> 
> Would you like to omit a word from the patch subject so that
> a typo will be avoided there?

Hi,

This is the semi-friendly patch-bot of Greg Kroah-Hartman.

Markus, you seem to have sent a nonsensical or otherwise pointless
review comment to a patch submission on a Linux kernel developer mailing
list.  I strongly suggest that you not do this anymore.  Please do not
bother developers who are actively working to produce patches and
features with comments that, in the end, are a waste of time.

Patch submitter, please ignore Markus's suggestion; you do not need to
follow it at all.  The person/bot/AI that sent it is being ignored by
almost all Linux kernel maintainers for having a persistent pattern of
behavior of producing distracting and pointless commentary, and
inability to adapt to feedback.  Please feel free to also ignore emails
from them.

thanks,

greg k-h's patch email bot

Re: exfat: Improving exception handling in two functions

[Markus Elfring]

Hello,

I have taken another look at pointer usage after calls of the function “brelse”.
My source code analysis approach pointed implementation details
like the following out for further software development considerations.
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/fs/exfat/namei.c?id=3d155ae4358baf4831609c2f9cd09396a2b8badf#n1078

…
		epold = exfat_get_dentry(sb, p_dir, oldentry + 1, &old_bh,
			&sector_old);
		epnew = exfat_get_dentry(sb, p_dir, newentry + 1, &new_bh,
			&sector_new);
		if (!epold || !epnew)
			return -EIO;
…

I suggest to split such an error check.
How do you think about to release a buffer head object for the desired
exception handling if one of these function calls succeeded?

Would you like to adjust such code in the functions “exfat_rename_file”
and “exfat_move_file”?

Regards,
Markus

[PATCH] exfat: call brelse() on error path

[Dan Carpenter]

If the second exfat_get_dentry() call fails then we need to release
"old_bh" before returning.

Reported-by: Markus Elfring <Markus.Elfring@web.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 fs/exfat/namei.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 5b0f35329d63e..fda92c824ff11 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -1077,10 +1077,14 @@ static int exfat_rename_file(struct inode *inode, struct exfat_chain *p_dir,
 
 		epold = exfat_get_dentry(sb, p_dir, oldentry + 1, &old_bh,
 			&sector_old);
+		if (!epold)
+			return -EIO;
 		epnew = exfat_get_dentry(sb, p_dir, newentry + 1, &new_bh,
 			&sector_new);
-		if (!epold || !epnew)
+		if (!epnew) {
+			brelse(old_bh);
 			return -EIO;
+		}
 
 		memcpy(epnew, epold, DENTRY_SIZE);
 		exfat_update_bh(sb, new_bh, sync);
-- 
2.26.2

Re: exfat: Improving exception handling in two functions

[Markus Elfring]

> My source code analysis approach pointed implementation details
> like the following out for further software development considerations.

The clarification of corresponding collateral evolution will be continued
with the update suggestion “exfat: call brelse() on error path”.
https://lore.kernel.org/linux-fsdevel/20200610095934.GA35167@mwanda/
https://lore.kernel.org/patchwork/patch/1254515/

Regards,
Markus

Re: exfat: Improving exception handling in two functions

[Greg KH]

On Wed, Jun 10, 2020 at 11:27:58AM +0200, Markus Elfring wrote:
> Hello,
> 
> I have taken another look at pointer usage after calls of the function “brelse”.
> My source code analysis approach pointed implementation details
> like the following out for further software development considerations.
> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/fs/exfat/namei.c?id=3d155ae4358baf4831609c2f9cd09396a2b8badf#n1078
> 
> …
> 		epold = exfat_get_dentry(sb, p_dir, oldentry + 1, &old_bh,
> 			&sector_old);
> 		epnew = exfat_get_dentry(sb, p_dir, newentry + 1, &new_bh,
> 			&sector_new);
> 		if (!epold || !epnew)
> 			return -EIO;
> …
> 
> I suggest to split such an error check.
> How do you think about to release a buffer head object for the desired
> exception handling if one of these function calls succeeded?
> 
> Would you like to adjust such code in the functions “exfat_rename_file”
> and “exfat_move_file”?
> 
> Regards,
> Markus

Hi,

This is the semi-friendly patch-bot of Greg Kroah-Hartman.

Markus, you seem to have sent a nonsensical or otherwise pointless
review comment to a patch submission on a Linux kernel developer mailing
list.  I strongly suggest that you not do this anymore.  Please do not
bother developers who are actively working to produce patches and
features with comments that, in the end, are a waste of time.

Patch submitter, please ignore Markus's suggestion; you do not need to
follow it at all.  The person/bot/AI that sent it is being ignored by
almost all Linux kernel maintainers for having a persistent pattern of
behavior of producing distracting and pointless commentary, and
inability to adapt to feedback.  Please feel free to also ignore emails
from them.

thanks,

greg k-h's patch email bot