From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qt0-f175.google.com ([209.85.216.175]:44243 "EHLO mail-qt0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730084AbeGVRSd (ORCPT ); Sun, 22 Jul 2018 13:18:33 -0400 Received: by mail-qt0-f175.google.com with SMTP id b15-v6so14421863qtp.11 for ; Sun, 22 Jul 2018 09:21:22 -0700 (PDT) Date: Sun, 22 Jul 2018 13:21:17 -0300 From: Ernesto =?utf-8?Q?A=2E_Fern=C3=A1ndez?= To: "Xu, Wen" Cc: "linux-fsdevel@vger.kernel.org" Subject: Re: A list of HFS+ kernel module bugs found in 4.18 Message-ID: <20180722162117.6nbw2zho5fiwpwlr@eaf> References: <7FDED3AF-78CD-4A62-8373-35F02435292D@gmail.com> <4BDF1324-8B60-4172-9743-35FC4F6877DC@gatech.edu> <20180710223355.5tcnxpz52str2mrq@eaf> <97A860F1-2E4B-4BFC-AA69-0B0A61667E93@gatech.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <97A860F1-2E4B-4BFC-AA69-0B0A61667E93@gatech.edu> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Sun, Jul 22, 2018 at 03:24:00PM +0000, Xu, Wen wrote: > Hi Ernesto, > > I checked the patch for > 200297 Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem > https://bugzilla.kernel.org/show_bug.cgi?id=200297 > > Is > > 200293 Out-of-bound access in hfsplus_bnode_read() > https://bugzilla.kernel.org/show_bug.cgi?id=200293 > > Also handled with any patch? Not yet, I'm afraid. As it turns out, that is also a bug in the xattr implementation. Fixing those will most likely require a big rewrite. Thanks, Ernest > > Thanks, > Wen > > > On Jul 10, 2018, at 6:33 PM, Ernesto A. Fernández wrote: > > > > Hi, thanks for the reports: > > > > On Tue, Jul 10, 2018 at 08:12:35PM +0000, Xu, Wen wrote: > >> Hi Ernesto, > >> > >> I reported the following bugs weeks before but did not get and respond. I saw you commit patches for HFS+, so could you > >> please take a look on these issue? > >> > >> Here are a list of bugs found in HFS+ filesystem by fuzzing. You can get the image and POC that cause kernel panic > >> in the following links: > >> > >> 200299 Kernel panic because mount() hfsplus image does not always return correct value > >> https://bugzilla.kernel.org/show_bug.cgi?id=200299 > > > > This was also found by syzbot a couple of months ago. It's already fixed > > in the -mm tree if you want to test it. > > > >> 200297 Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem > >> https://bugzilla.kernel.org/show_bug.cgi?id=200297 > >> > >> 200293 Out-of-bound access in hfsplus_bnode_read() > >> https://bugzilla.kernel.org/show_bug.cgi?id=200293 > > > > I'll try to fix these two and get back to you. It may take a couple of days. > > > >> 200295 BUG() in hfsplus_create_attributes_file() when calling setxattr() > >> https://bugzilla.kernel.org/show_bug.cgi?id=200295 > >> > >> 200291 Kernel panic when invoking setxattr() on a hfs+ image > >> https://bugzilla.kernel.org/show_bug.cgi?id=200291 > >> > >> 200289 Kernel panic when calling setxattr() on a corrupted hfs+ image > >> https://bugzilla.kernel.org/show_bug.cgi?id=200289 > >> > >> 200287 Out-of-bound access in hfsplus_bnode_copy() when calling setxattr() on a corrupted hfs+ image > >> https://bugzilla.kernel.org/show_bug.cgi?id=200287 > >> > >> 200285 Out-of-bound access in hfsplus_bmap_alloc() when calling setxattr() on a corrupted hfs+ image > >> https://bugzilla.kernel.org/show_bug.cgi?id=200285 > > > > The xattr implementation is a mess. I found many bugs myself just by > > attempting to use it. I will take a look, but I can't promise to be able > > to help. If it was up to me I would much rather get rid of xattr support > > entirely, although I suppose somebody might be using it. > > > > Ernest > > > >> I would like to provide any further help to analyze the crashes and fix the bugs. I am also willing to test the patches. > >> > >> Thanks, > >> Wen >