2019-07-25 13:04:18

by Jia-Ju Bai

Subject: [BUG] fs: f2fs: Possible null-pointer dereferences in update_general_status()

In update_general_status(), there are two if statements to
check whether SM_I(sbi) is NULL:
LINE 70:     if (SM_I(sbi) && SM_I(sbi)->fcc_info)
LINE 78:     if (SM_I(sbi) && SM_I(sbi)->dcc_info)

When SM_I(sbi) is NULL, it is used at some places, such as:
LINE 88: reserved_segments(sbi)
                  return SM_I(sbi)->reserved_segments;
LINE 89: overprovision_segments(sbi)
                  return SM_I(sbi)->ovp_segments;
LINE 112: MAIN_SEGS(sbi)
                    (SM_I(sbi)->main_segments)

Thus, possible null-pointer dereferences may occur.

These bugs are found by a static analysis tool STCheck written by us.

I do not know how to correctly fix these bugs, so I only report them.


Best wishes,
Jia-Ju Bai

2019-07-26 03:22:32

by Chao Yu

Subject: Re: [BUG] fs: f2fs: Possible null-pointer dereferences in update_general_status()

Hi Jiaju,

Thanks for the report, I checked the code, and found it doesn't need to check
SM_I(sbi) pointer, this is because in fill_super() and put_super(), we will call
f2fs_destroy_stats() in prior to f2fs_destroy_segment_manager(), so if current
sbi can still be visited in global stat list, SM_I(sbi) should be released yet.
So anyway, let's remove unneeded check in line 70/78. :)

Thanks,

On 2019/7/25 17:49, Jia-Ju Bai wrote:
> In update_general_status(), there are two if statements to
> check whether SM_I(sbi) is NULL:
> LINE 70:     if (SM_I(sbi) && SM_I(sbi)->fcc_info)
> LINE 78:     if (SM_I(sbi) && SM_I(sbi)->dcc_info)
>
> When SM_I(sbi) is NULL, it is used at some places, such as:
> LINE 88: reserved_segments(sbi)
>                   return SM_I(sbi)->reserved_segments;
> LINE 89: overprovision_segments(sbi)
>                   return SM_I(sbi)->ovp_segments;
> LINE 112: MAIN_SEGS(sbi)
>                     (SM_I(sbi)->main_segments)
>
> Thus, possible null-pointer dereferences may occur.
>
> These bugs are found by a static analysis tool STCheck written by us.
>
> I do not know how to correctly fix these bugs, so I only report them.
>
>
> Best wishes,
> Jia-Ju Bai
> .
>

2019-07-26 03:41:39

by Jia-Ju Bai

Subject: Re: [BUG] fs: f2fs: Possible null-pointer dereferences in update_general_status()

On 2019/7/26 11:19, Chao Yu wrote:
> Hi Jiaju,
>
> Thanks for the report, I checked the code, and found it doesn't need to check
> SM_I(sbi) pointer, this is because in fill_super() and put_super(), we will call
> f2fs_destroy_stats() in prior to f2fs_destroy_segment_manager(), so if current
> sbi can still be visited in global stat list, SM_I(sbi) should be released yet.
> So anyway, let's remove unneeded check in line 70/78. :)

Okay, I will send a patch to remove unneeded checks.


Best wishes,
Jia-Ju Bai