From: Al Viro <viro@ZenIV.linux.org.uk>
To: Hugh Dickins <hughd@google.com>
Cc: Sasha Levin <levinsasha928@gmail.com>,
Dave Jones <davej@redhat.com>, Sage Weil <sage@inktank.com>,
Steven Whitehouse <swhiteho@redhat.com>,
Christoph Hellwig <hch@infradead.org>,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: Re: vfs: oops on open_by_handle_at() in linux-next
Date: Mon, 8 Oct 2012 04:49:55 +0100 [thread overview]
Message-ID: <20121008034955.GP2616@ZenIV.linux.org.uk> (raw)
In-Reply-To: <alpine.LSU.2.00.1210072027370.11615@eggly.anvils>
On Sun, Oct 07, 2012 at 08:32:51PM -0700, Hugh Dickins wrote:
> Thank you, Sasha: this should fix it, and similar in other FSes.
>
>
> [PATCH] tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
>
> Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
> u64 inum = fid->raw[2];
> which is unhelpfully reported as at the end of shmem_alloc_inode():
>
> BUG: unable to handle kernel paging request at ffff880061cd3000
> IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
> Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
> Call Trace:
> [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
> [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
> [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
> [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6
>
> Right, tmpfs is being stupid to access fid->raw[2] before validating that
> fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
> fall at the end of a page, and the next page not be present.
>
> But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
> careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
> could oops in the same way: add the missing fh_len checks to those.
TBH, I really don't like it. How about putting minimal acceptable fhandle
length into export_operations instead?
next prev parent reply other threads:[~2012-10-08 3:50 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-07 13:28 vfs: oops on open_by_handle_at() in linux-next Sasha Levin
2012-10-08 3:32 ` Hugh Dickins
2012-10-08 3:49 ` Al Viro [this message]
2012-10-08 4:02 ` Hugh Dickins
2012-10-09 17:56 ` Sage Weil
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121008034955.GP2616@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=davej@redhat.com \
--cc=hch@infradead.org \
--cc=hughd@google.com \
--cc=levinsasha928@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sage@inktank.com \
--cc=swhiteho@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.