Hi,
在 2023/04/12 17:04, 陈康 写道:
-----原始邮件----- 发件人: "Yu Kuai" yukuai3@huawei.com 发送时间: 2023-04-12 15:48:58 (星期三) 收件人: "Kang Chen" void0red@hust.edu.cn 抄送: kernel@openeuler.org 主题: Re: [PATCH v3] eulerfs: fix wrong dereferencing in eufs_lookup
Hi,
在 2023/04/11 11:19, Kang Chen 写道:
uniontech inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TN56 CVE: NA
smatch report: fs/eulerfs/namei.c:118 eufs_lookup() error: 'inode' dereferencing possible ERR_PTR() fix it by using the ino above in eufs_err.
Signed-off-by: Kang Chen void0red@hust.edu.cn
If we need to pass all errors?
v3 -> v2: use IS_ERR to handle all kind err v2 -> v1: use correct string format
fs/eulerfs/namei.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/eulerfs/namei.c b/fs/eulerfs/namei.c index e4c6c36575f2..9ef2da748a54 100644 --- a/fs/eulerfs/namei.c +++ b/fs/eulerfs/namei.c @@ -114,11 +114,12 @@ static struct dentry *eufs_lookup(struct inode *dir, struct dentry *dentry, goto not_found;
inode = eufs_iget(dir->i_sb, s2p(dir->i_sb, de->inode));
- if (inode == ERR_PTR(-ESTALE)) {
eufs_err(dir->i_sb, "deleted inode referenced: 0x%lx",inode->i_ino);return ERR_PTR(-EIO);
- if (IS_ERR(inode)) {
eufs_err(dir->i_sb, "eufs_iget failed ino 0x%llx err %d\n",le64_to_cpu(de->inode), inode);Please keep the return value as before, only return -EIO or -ENOMEM to user. And PTR_ERR(inode) should be used here.
By the way, de->inode is the address of eufs_inode, it's better to show user the actual i_ino.
What is the actual i_ino mean? I find "le64_to_cpu(de->inode) == inode->i_ino" in eufs_valid_inode_in_de, and replace the inode->i_ino with le64_to_cpu(de->inode). Or use eufs_pi2ino(sb, s2p(dir->i_sb, de->inode)) to get i_ino?
Sorry I was looking at dep_new_insert() and I confuse them... It's right de->inode is set to i_ino in nv_dict_add().
Thanks, Kuai
Thanks, Kuai
return inode;}
not_found:
if (inode)