From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752058AbbCWChT (ORCPT ); Sun, 22 Mar 2015 22:37:19 -0400 Received: from mailout2.samsung.com ([203.254.224.25]:28133 "EHLO mailout2.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751935AbbCWChP (ORCPT ); Sun, 22 Mar 2015 22:37:15 -0400 X-AuditID: cbfee61a-f79c06d000004e71-88-550f7c4c809c From: Chao Yu To: Jaegeuk Kim , Changman Lee Cc: linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: [PATCH 3/4] f2fs: avoid NULL pointer dereference in f2fs_xattr_advise_get Date: Mon, 23 Mar 2015 10:36:15 +0800 Message-id: <002401d06512$3d3da050$b7b8e0f0$@samsung.com> MIME-version: 1.0 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-index: AdBlEg5OBdudV1giTSeSsonpe/f6Vw== Content-language: zh-cn X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrMLMWRmVeSWpSXmKPExsVy+t9jQV2fGv5QgxNb9C2u7Wtksniyfhaz xaVF7haXd81hc2Dx2LSqk81j94LPTB59W1YxenzeJBfAEsVlk5Kak1mWWqRvl8CVsf18I1vB HemKs5c2sDUwtol3MXJySAiYSPw58IARwhaTuHBvPVsXIxeHkMB0RolPy45AOa8YJZ6/3AdW xSagIrG84z8TiC0i4CUxaf8JFhCbWcBDorHjOyuILSwQIvHz9UqwehYBVYkP3z6yg9i8ApYS j7/tY4KwBSV+TL4H1aslsXlbEyuELS+xec1bZoiLFCR2nH3NCLFLT+L01A3sEDXiEhuP3GKZ wCgwC8moWUhGzUIyahaSlgWMLKsYRVMLkguKk9JzDfWKE3OLS/PS9ZLzczcxgoP6mdQOxpUN FocYBTgYlXh4G8L5Q4VYE8uKK3MPMUpwMCuJ8MbaA4V4UxIrq1KL8uOLSnNSiw8xSnOwKInz Ktm3hQgJpCeWpGanphakFsFkmTg4pRoYHZi+fp7yf79EQWeDghPPU4sXqvKLsg+/XHevaMYs jZImXq8O17xXVtnTdK3ePGK1viwyS2funZ9dTllNcy3Wyd7gVFjYev8xv0Ann6+qwZ/jd76G BVyx4wxqrdq5Kc1J8VDZfQ3u5y42evf5pBakh/FNOR1wb68JgwCjxM4P6ub+Rc6+CfFKLMUZ iYZazEXFiQCgeoygZgIAAA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We will encounter oops by executing below command. getfattr -n system.advise /mnt/f2fs/file Killed message log: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] f2fs_xattr_advise_get+0x29/0x40 [f2fs] *pdpt = 00000000319b7001 *pde = 0000000000000000 Oops: 0002 [#1] SMP Modules linked in: f2fs(O) snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq joydev snd_seq_device snd_timer bnep snd rfcomm microcode bluetooth soundcore i2c_piix4 mac_hid serio_raw parport_pc ppdev lp parport binfmt_misc hid_generic psmouse usbhid hid e1000 [last unloaded: f2fs] CPU: 3 PID: 3134 Comm: getfattr Tainted: G O 4.0.0-rc1 #6 Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 task: f3a71b60 ti: f19a6000 task.ti: f19a6000 EIP: 0060:[] EFLAGS: 00010246 CPU: 3 EIP is at f2fs_xattr_advise_get+0x29/0x40 [f2fs] EAX: 00000000 EBX: f19a7e71 ECX: 00000000 EDX: f8b5b467 ESI: 00000000 EDI: f2008570 EBP: f19a7e14 ESP: f19a7e08 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 CR0: 80050033 CR2: 00000000 CR3: 319b8000 CR4: 000007f0 Stack: f8b5a634 c0cbb580 00000000 f19a7e34 c1193850 00000000 00000007 f19a7e71 f19a7e64 c0cbb580 c1193810 f19a7e50 c1193c00 00000000 00000000 00000000 c0cbb580 00000000 f19a7f70 c1194097 00000000 00000000 00000000 74737973 Call Trace: [] generic_getxattr+0x40/0x50 [] ? xattr_resolve_name+0x80/0x80 [] vfs_getxattr+0x70/0xa0 [] getxattr+0x87/0x190 [] ? path_lookupat+0x57/0x5f0 [] ? putname+0x32/0x50 [] ? kmem_cache_alloc+0x2a/0x130 [] ? putname+0x32/0x50 [] ? putname+0x32/0x50 [] ? putname+0x32/0x50 [] ? user_path_at_empty+0x49/0x70 [] ? user_path_at+0x1f/0x30 [] path_getxattr+0x47/0x80 [] SyS_getxattr+0x27/0x30 [] sysenter_do_call+0x12/0x12 Code: 66 90 55 89 e5 57 56 53 66 66 66 66 90 8b 78 20 89 d3 ba 67 b4 b5 f8 89 d8 89 ce e8 42 7c 7b c8 85 c0 75 16 0f b6 87 44 01 00 00 <88> 06 b8 01 00 00 00 5b 5e 5f 5d c3 8d 76 00 b8 ea ff ff ff eb EIP: [] f2fs_xattr_advise_get+0x29/0x40 [f2fs] SS:ESP 0068:f19a7e08 CR2: 0000000000000000 ---[ end trace 860260654f1f416a ]--- The reason is that in getfattr there are two steps which is indicated by strace info: 1) try to lookup and get size of specified xattr. 2) get value of the extented attribute. strace info: getxattr("/mnt/f2fs/file", "system.advise", 0x0, 0) = 1 getxattr("/mnt/f2fs/file", "system.advise", "\x00", 256) = 1 For the first step, getfattr may pass a NULL pointer in @value and zero in @size as parameters for ->getxattr, but we access this @value pointer directly without checking whether the pointer is valid or not in f2fs_xattr_advise_get, so the oops occurs. This patch fixes this issue by verifying @value pointer before using. Signed-off-by: Chao Yu --- fs/f2fs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 5072bf9..55649be 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -135,7 +135,8 @@ static int f2fs_xattr_advise_get(struct dentry *dentry, const char *name, if (strcmp(name, "") != 0) return -EINVAL; - *((char *)buffer) = F2FS_I(inode)->i_advise; + if (buffer) + *((char *)buffer) = F2FS_I(inode)->i_advise; return sizeof(char); } -- 2.3.3