From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-fsdevel-owner@vger.kernel.org>
Received: from zeniv.linux.org.uk ([195.92.253.2]:60020 "EHLO
        ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751334AbcLJB7C (ORCPT
        <rfc822;linux-fsdevel@vger.kernel.org>);
        Fri, 9 Dec 2016 20:59:02 -0500
Date: Sat, 10 Dec 2016 01:59:00 +0000
From: Al Viro <viro@ZenIV.linux.org.uk>
To: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
        linux-fsdevel <linux-fsdevel@vger.kernel.org>
Subject: Re: [PATCH] vfs: reject inodes with negative size to prevent kernel
 hang
Message-ID: <20161210015859.GF1555@ZenIV.linux.org.uk>
References: <20161207003222.GI16807@birch.djwong.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20161207003222.GI16807@birch.djwong.org>
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

On Tue, Dec 06, 2016 at 04:32:22PM -0800, Darrick J. Wong wrote:
> Due to insufficient input validation, various filesystem drivers can
> load an inode with a negative size from a maliciously crafted fs image.
> If this happens, a subsequent write-append operation can cause integer
> overflows in the writeback code, causing the kernel to lock up.
> 
> Therefore, if we catch anyone trying to link a dentry to a garbage
> inode, reject the whole attempt.

Yecchh...  This is completely wrong place for such checks.  Sorry,
NAK.  The set of spots chosen for those tests is random *and* it's
not even sufficient (consider e.g. d_obtain_alias()).  The things
go wrong when such inode is set up, not when a dentry is attached
to it.