Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756525AbdLOKDL (ORCPT ); Fri, 15 Dec 2017 05:03:11 -0500 Received: from szxga05-in.huawei.com ([45.249.212.191]:12002 "EHLO szxga05-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756461AbdLOKDB (ORCPT ); Fri, 15 Dec 2017 05:03:01 -0500 Subject: Re: [PATCH] fsck.f2fs: check and fix i_namelen to avoid double free To: Yunlong Song , , , , CC: , , , , , References: <1513319130-114230-1-git-send-email-yunlong.song@huawei.com> From: Sheng Yong Message-ID: <506aa086-5cba-a2ee-332d-07e79e5aa764@huawei.com> Date: Fri, 15 Dec 2017 18:01:53 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 MIME-Version: 1.0 In-Reply-To: <1513319130-114230-1-git-send-email-yunlong.song@huawei.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [10.111.221.165] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090204.5A339DC8.014A,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 1ba426637ad16408861a90a175f50a48 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1585 Lines: 51 On 2017/12/15 14:25, Yunlong Song wrote: > Signed-off-by: Yunlong Song > --- > fsck/fsck.c | 19 ++++++++++++++++--- > 1 file changed, 16 insertions(+), 3 deletions(-) > > diff --git a/fsck/fsck.c b/fsck/fsck.c > index 2212aa3..8ff4e4b 100644 > --- a/fsck/fsck.c > +++ b/fsck/fsck.c > @@ -643,7 +643,7 @@ void fsck_chk_inode_blk(struct f2fs_sb_info *sbi, u32 nid, > u64 i_blocks = le64_to_cpu(node_blk->i.i_blocks); > int ofs = get_extra_isize(node_blk); > unsigned char *en; > - int namelen; > + int namelen, i_namelen; > unsigned int idx = 0; > int need_fix = 0; > int ret; > @@ -850,8 +850,21 @@ skip_blkcnt_fix: > en = malloc(F2FS_NAME_LEN + 1); > ASSERT(en); > > - namelen = convert_encrypted_name(node_blk->i.i_name, > - le32_to_cpu(node_blk->i.i_namelen), > + i_namelen = le32_to_cpu(node_blk->i.i_namelen); > + namelen = strlen((const char *)node_blk->i.i_name); Hi, Yunlong The strlen doesn't work for encrypted i_name. strlen may get a wrong namelen. thanks, Sheng > + if (i_namelen > F2FS_NAME_LEN) { > + ASSERT_MSG("ino: 0x%x has i_namelen: 0x%x, " > + "but has %d characters for name", > + nid, i_namelen, namelen); > + if (c.fix_on) { > + FIX_MSG("[0x%x] i_namelen=0x%x -> 0x%x", nid, i_namelen, > + namelen); > + node_blk->i.i_namelen = cpu_to_le32(namelen); > + need_fix = 1; > + } > + i_namelen = namelen; > + } > + namelen = convert_encrypted_name(node_blk->i.i_name, i_namelen, > en, file_enc_name(&node_blk->i)); > en[namelen] = '\0'; > if (ftype == F2FS_FT_ORPHAN) >