From: Chao Yu <chao@kernel.org>
To: Jakob Koschel <jakobkoschel@gmail.com>, Jaegeuk Kim <jaegeuk@kernel.org>
Cc: linux-kernel@vger.kernel.org, "Bos, H.J." <h.j.bos@vu.nl>,
Brian Johannesmeyer <bjohannesmeyer@gmail.com>,
Cristiano Giuffrida <c.giuffrida@vu.nl>,
linux-f2fs-devel@lists.sourceforge.net,
Mike Rapoport <rppt@kernel.org>
Subject: Re: [f2fs-dev] [PATCH] f2fs: fix dereference of stale list iterator after loop body
Date: Tue, 12 Apr 2022 17:49:17 +0800 [thread overview]
Message-ID: <8b62a788-d5ba-b244-d9f1-2edecba9769f@kernel.org> (raw)
In-Reply-To: <20220331223414.901960-1-jakobkoschel@gmail.com>
On 2022/4/1 6:34, Jakob Koschel wrote:
> The list iterator variable will be a bogus pointer if no break was hit.
> Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined
> value making it unsafe to use that in the comparision to determine if the
> specific element was found.
>
> Since 'cur->page' *can* be out-ouf-bounds it cannot be guaranteed that
> by chance (or intention of an attacker) it matches the value of 'page'
> even though the correct element was not found.
>
> This is fixed by using a separate list iterator variable for the loop
> and only setting the original variable if a suitable element was found.
> Then determing if the element was found is simply checking if the
> variable is set.
>
> Fixes: 8c242db9b8c0 ("f2fs: fix stale ATOMIC_WRITTEN_PAGE private pointer")
> Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Thanks,
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
prev parent reply other threads:[~2022-04-12 9:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-31 22:34 [f2fs-dev] [PATCH] f2fs: fix dereference of stale list iterator after loop body Jakob Koschel
2022-04-12 9:49 ` Chao Yu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8b62a788-d5ba-b244-d9f1-2edecba9769f@kernel.org \
--to=chao@kernel.org \
--cc=bjohannesmeyer@gmail.com \
--cc=c.giuffrida@vu.nl \
--cc=h.j.bos@vu.nl \
--cc=jaegeuk@kernel.org \
--cc=jakobkoschel@gmail.com \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=rppt@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).