linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Hawkins Jiawei <yin31149@gmail.com>
To: viro@zeniv.linux.org.uk, raven@themaw.net
Cc: 18801353760@163.com, linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org, yin31149@gmail.com,
	akpm@linux-foundation.org, cmaiolino@redhat.com,
	dhowells@redhat.com, hughd@google.com, miklos@szeredi.hu,
	oliver.sang@intel.com, penguin-kernel@i-love.sakura.ne.jp,
	siddhesh@gotplt.org,
	syzbot+db1d2ea936378be0e4ea@syzkaller.appspotmail.com,
	syzkaller-bugs@googlegroups.com, tytso@mit.edu,
	smfrench@gmail.com, pc@cjr.nz, lsahlber@redhat.com,
	sprasad@microsoft.com, tom@talpey.com
Subject: Re: [PATCH -next 0/5] fs: fix possible null-ptr-deref when parsing param
Date: Mon, 24 Oct 2022 08:42:57 +0800	[thread overview]
Message-ID: <20221024004257.18689-1-yin31149@gmail.com> (raw)
In-Reply-To: <Y1VwdUYGvDE4yUoI@ZenIV>

On Mon, 24 Oct 2022 at 00:48, Al Viro <viro@zeniv.linux.org.uk> wrote:
>
> On Mon, Oct 24, 2022 at 12:39:41AM +0800, Hawkins Jiawei wrote:
> > According to commit "vfs: parse: deal with zero length string value",
> > kernel will set the param->string to null pointer in vfs_parse_fs_string()
> > if fs string has zero length.
> >
> > Yet the problem is that, when fs parses its mount parameters, it will
> > dereferences the param->string, without checking whether it is a
> > null pointer, which may trigger a null-ptr-deref bug.
> >
> > So this patchset reviews all functions for fs to parse parameters,
> > by using `git grep -n "\.parse_param" fs/*`, and adds sanity check
> > on param->string if its function will dereference param->string
> > without check.
>
> How about reverting the commit in question instead?  Or dropping it
> from patch series, depending upon the way akpm handles the pile
> these days...

I think both are OK.

On one hand, commit "vfs: parse: deal with zero length string value"
seems just want to make output more informattive, which probably is not
the one which must be applied immediately to fix the
panic.

On the other hand, commit "vfs: parse: deal with zero length string value"
affects so many file systems, so there are probably some deeper
null-ptr-deref bugs I ignore, which may take time to review.

  reply	other threads:[~2022-10-24  0:43 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-10-23 16:39 [PATCH -next 0/5] fs: fix possible null-ptr-deref when parsing param Hawkins Jiawei
2022-10-23 16:39 ` [PATCH -next 1/5] smb3: " Hawkins Jiawei
2022-10-23 16:39 ` [PATCH -next 2/5] nfs: " Hawkins Jiawei
2022-10-24 10:53   ` Jeff Layton
2022-10-23 16:39 ` [PATCH -next 3/5] ceph: " Hawkins Jiawei
2022-10-24  0:38   ` Xiubo Li
2022-10-24  0:55   ` Xiubo Li
2022-10-24  2:04     ` Hawkins Jiawei
2022-10-24  2:17       ` Xiubo Li
2022-10-23 16:39 ` [PATCH -next 4/5] gfs2: " Hawkins Jiawei
2022-10-24  9:42   ` Andreas Grünbacher
2022-10-23 16:39 ` [PATCH -next 5/5] proc: " Hawkins Jiawei
2022-10-23 16:48 ` [PATCH -next 0/5] fs: " Al Viro
2022-10-24  0:42   ` Hawkins Jiawei [this message]
2022-10-24  3:34     ` Ian Kent
2022-10-31 11:28       ` Tetsuo Handa
2022-11-01  0:32         ` Ian Kent

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221024004257.18689-1-yin31149@gmail.com \
    --to=yin31149@gmail.com \
    --cc=18801353760@163.com \
    --cc=akpm@linux-foundation.org \
    --cc=cmaiolino@redhat.com \
    --cc=dhowells@redhat.com \
    --cc=hughd@google.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lsahlber@redhat.com \
    --cc=miklos@szeredi.hu \
    --cc=oliver.sang@intel.com \
    --cc=pc@cjr.nz \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=raven@themaw.net \
    --cc=siddhesh@gotplt.org \
    --cc=smfrench@gmail.com \
    --cc=sprasad@microsoft.com \
    --cc=syzbot+db1d2ea936378be0e4ea@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tom@talpey.com \
    --cc=tytso@mit.edu \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).