Re: [PATCH] f2fs: fix dereference of stale list iterator after loop body

[Chao Yu]

On 2022/4/1 6:34, Jakob Koschel wrote:
> The list iterator variable will be a bogus pointer if no break was hit.
> Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined
> value making it unsafe to use that in the comparision to determine if the
> specific element was found.
>
> Since 'cur->page' *can* be out-ouf-bounds it cannot be guaranteed that
> by chance (or intention of an attacker) it matches the value of 'page'
> even though the correct element was not found.
>
> This is fixed by using a separate list iterator variable for the loop
> and only setting the original variable if a suitable element was found.
> Then determing if the element was found is simply checking if the
> variable is set.
>
> Fixes: 8c242db9b8c0 ("f2fs: fix stale ATOMIC_WRITTEN_PAGE private pointer")
> Signed-off-by: Jakob Koschel <jakobkoschel@xxxxxxxxx>

Reviewed-by: Chao Yu <chao@xxxxxxxxxx>

Thanks,