Message ID | 20221116091255.84576-1-arefev@swemel.ru |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp39518wru; Wed, 16 Nov 2022 01:15:26 -0800 (PST) X-Google-Smtp-Source: AA0mqf7NJh8ViebNbdukzF4+sOxFgHEPvUducWwndrlrdO0nDFHr2x/KdKDnNxFj4JPMtA1xQOl1 X-Received: by 2002:a17:907:76f1:b0:7ae:129b:2d3a with SMTP id kg17-20020a17090776f100b007ae129b2d3amr16658873ejc.552.1668590125978; Wed, 16 Nov 2022 01:15:25 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668590125; cv=none; d=google.com; s=arc-20160816; b=FQpawRQjc7XuDQcGfDQERC/Jb1OrPlK4Qp7he7P6h2VwoQ/ywsB9ICfHNu5F5cUL+7 Zmx+91oOYrfUoQn2Z2w81u6/XPRLBIcynXT9BlGp1oHqLgetG0iEQ08lZ2EEjDxZd0ro ckT06Bx1TR43/29fmVROTedny/aTYv7YukeshsPcv+Br05YULdWyhiRFFHbEcBt72TmU eVe1w/bExft8Rx1tm5Uf6lN+XBBmnH6vrMDiGAcxIK1IKX8naV/5BKVzXgFAuryaSXn6 oiaK1JRcaPbIWiyK4M/11f9e7yKpDm0Ot7KRChoiWKMxt6s9Ico+UHSxh3VJtgvvgZs4 CaWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:dkim-signature:from; bh=gF8Pma3i+UWto/30oVrb3cq2B8kCqvhNBbFZrZ1f25o=; b=BTgvkt9QqOP55NnDYVInvlInhJDr67AUgN+KiLsfvO+iIDeK/YmUbb93e23GdTDwPO pOuYPFscdGl10qKrg4CkP7nE8EJ9Cz1T/NIKm75FK/mS8ExCpKlZST4lwzCEGL92Dgx0 7CxUtmqpOtY68Fc8PFHyr3lfPovgvqxR1gZ4Int82HnBO2zDh4Nb/2HZQk8V+fm+3Ulp WaeyCUYDzxOxayXU2vaCXfBOGAj9yTvqsczaijyvUey+UsVYiEOraOsyyxylAmy+wEmW lukqK+Wdd1A5ZinQ4J9KxocuoU0P9q98r9GQHllpUCb6+8NUcWy1jlhXi7edYJdNUJzf TSIA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@swemel.ru header.s=mail header.b=oju2c5k3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=swemel.ru Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i14-20020a50870e000000b0045fc914660csi12295405edb.200.2022.11.16.01.15.02; Wed, 16 Nov 2022 01:15:25 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@swemel.ru header.s=mail header.b=oju2c5k3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=swemel.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233285AbiKPJNH (ORCPT <rfc822;just.gull.subs@gmail.com> + 99 others); Wed, 16 Nov 2022 04:13:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37638 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232360AbiKPJM7 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Wed, 16 Nov 2022 04:12:59 -0500 Received: from mx.swemel.ru (mx.swemel.ru [95.143.211.150]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B9BD2B2; Wed, 16 Nov 2022 01:12:57 -0800 (PST) From: Denis Arefev <arefev@swemel.ru> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=swemel.ru; s=mail; t=1668589975; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=gF8Pma3i+UWto/30oVrb3cq2B8kCqvhNBbFZrZ1f25o=; b=oju2c5k3+pYhqmoNaSCAJuiQDpqo6UIsH1GdbaCIKxeI5tNwZhCEHInpzmEySQWWju1YP+ FvH3syLFFXJR4DuYjUvdnmKONh/OxPqNqlVWBng58RXP/wiFoigVybcvbAOatqq7pkPhrm 17siYxpKYIvDbG85zwSvxYzoKfyiL/8= To: Alexander Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, trufanov@swemel.ru, vfh@swemel.ru Subject: [PATCH] namespace: Added pointer check in copy_mnt_ns() Date: Wed, 16 Nov 2022 12:12:55 +0300 Message-Id: <20221116091255.84576-1-arefev@swemel.ru> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749643559657112145?= X-GMAIL-MSGID: =?utf-8?q?1749643559657112145?= |
Series |
namespace: Added pointer check in copy_mnt_ns()
|
|
Commit Message
Denis Arefev
Nov. 16, 2022, 9:12 a.m. UTC
Return value of a function 'next_mnt' is dereferenced at
namespace.c:3377 without checking for null,
but it is usually checked for this function
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
fs/namespace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Comments
On Wed, Nov 16, 2022 at 12:12:55PM +0300, Denis Arefev wrote: > Return value of a function 'next_mnt' is dereferenced at > namespace.c:3377 without checking for null, > but it is usually checked for this function > > Found by Linux Verification Center (linuxtesting.org) with SVACE. You need to do human analysis, not just send the results from a bot. What conditions can lead to this function returning NULL? Do we already know those conditions can or cannot hold?
Hi Denis, https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Denis-Arefev/namespace-Added-pointer-check-in-copy_mnt_ns/20221116-171424 patch link: https://lore.kernel.org/r/20221116091255.84576-1-arefev%40swemel.ru patch subject: [PATCH] namespace: Added pointer check in copy_mnt_ns() config: x86_64-randconfig-m001 compiler: gcc-11 (Debian 11.3.0-8) 11.3.0 If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot <lkp@intel.com> | Reported-by: Dan Carpenter <error27@gmail.com> New smatch warnings: fs/namespace.c:3518 copy_mnt_ns() error: we previously assumed 'p' could be null (see line 3518) Old smatch warnings: fs/namespace.c:4059 mount_setattr_prepare() error: uninitialized symbol 'err'. vim +/p +3518 fs/namespace.c ^1da177e4c3f41 Linus Torvalds 2005-04-16 3494 /* ^1da177e4c3f41 Linus Torvalds 2005-04-16 3495 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts ^1da177e4c3f41 Linus Torvalds 2005-04-16 3496 * as belonging to new namespace. We have already acquired a private ^1da177e4c3f41 Linus Torvalds 2005-04-16 3497 * fs_struct, so tsk->fs->lock is not needed. ^1da177e4c3f41 Linus Torvalds 2005-04-16 3498 */ 909b0a88ef2dc8 Al Viro 2011-11-25 3499 p = old; cb338d06e9716c Al Viro 2011-11-24 3500 q = new; ^1da177e4c3f41 Linus Torvalds 2005-04-16 3501 while (p) { 143c8c91cee7ef Al Viro 2011-11-25 3502 q->mnt_ns = new_ns; d29216842a85c7 Eric W. Biederman 2016-09-28 3503 new_ns->mounts++; 9559f68915024e Al Viro 2013-09-28 3504 if (new_fs) { 9559f68915024e Al Viro 2013-09-28 3505 if (&p->mnt == new_fs->root.mnt) { 9559f68915024e Al Viro 2013-09-28 3506 new_fs->root.mnt = mntget(&q->mnt); 315fc83e56c699 Al Viro 2011-11-24 3507 rootmnt = &p->mnt; 315fc83e56c699 Al Viro 2011-11-24 3508 } 9559f68915024e Al Viro 2013-09-28 3509 if (&p->mnt == new_fs->pwd.mnt) { 9559f68915024e Al Viro 2013-09-28 3510 new_fs->pwd.mnt = mntget(&q->mnt); 315fc83e56c699 Al Viro 2011-11-24 3511 pwdmnt = &p->mnt; ^1da177e4c3f41 Linus Torvalds 2005-04-16 3512 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 3513 } 909b0a88ef2dc8 Al Viro 2011-11-25 3514 p = next_mnt(p, old); 909b0a88ef2dc8 Al Viro 2011-11-25 3515 q = next_mnt(q, new); ff6985ba29d455 Denis Arefev 2022-11-16 3516 if (!q || !p) 4ce5d2b1a8fde8 Eric W. Biederman 2013-03-30 3517 break; ff6985ba29d455 Denis Arefev 2022-11-16 @3518 while (!p && (p->mnt.mnt_root != q->mnt.mnt_root)) ^ The ! needs to be removed. 4ce5d2b1a8fde8 Eric W. Biederman 2013-03-30 3519 p = next_mnt(p, old); ^1da177e4c3f41 Linus Torvalds 2005-04-16 3520 } 328e6d9014636a Al Viro 2013-03-16 3521 namespace_unlock(); ^1da177e4c3f41 Linus Torvalds 2005-04-16 3522 ^1da177e4c3f41 Linus Torvalds 2005-04-16 3523 if (rootmnt) f03c65993b98ee Al Viro 2011-01-14 3524 mntput(rootmnt); ^1da177e4c3f41 Linus Torvalds 2005-04-16 3525 if (pwdmnt) f03c65993b98ee Al Viro 2011-01-14 3526 mntput(pwdmnt); ^1da177e4c3f41 Linus Torvalds 2005-04-16 3527 741a2951306061 JANAK DESAI 2006-02-07 3528 return new_ns; ^1da177e4c3f41 Linus Torvalds 2005-04-16 3529 }
diff --git a/fs/namespace.c b/fs/namespace.c index cebaa3e81794..06472a110257 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3348,9 +3348,9 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, } p = next_mnt(p, old); q = next_mnt(q, new); - if (!q) + if (!q || !p) break; - while (p->mnt.mnt_root != q->mnt.mnt_root) + while (!p && (p->mnt.mnt_root != q->mnt.mnt_root)) p = next_mnt(p, old); } namespace_unlock();