From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from 19.mo5.mail-out.ovh.net ([46.105.35.78]:46671 "EHLO 19.mo5.mail-out.ovh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753283AbcBTOEJ (ORCPT ); Sat, 20 Feb 2016 09:04:09 -0500 Received: from mail438.ha.ovh.net (b6.ovh.net [213.186.33.56]) by mo5.mail-out.ovh.net (Postfix) with SMTP id 1AC97FF9F9D for ; Sat, 20 Feb 2016 14:25:48 +0100 (CET) Subject: Re: fs: NULL deref in atime_needs_update To: Al Viro , Dmitry Vyukov References: <56C3B35E.6020109@digikod.net> <20160220032127.GA19926@ZenIV.linux.org.uk> <20160220035442.GE17997@ZenIV.linux.org.uk> Cc: "linux-fsdevel@vger.kernel.org" , LKML , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: <56C86954.6030101@digikod.net> Date: Sat, 20 Feb 2016 14:25:40 +0100 MIME-Version: 1.0 In-Reply-To: <20160220035442.GE17997@ZenIV.linux.org.uk> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf" Sender: linux-fsdevel-owner@vger.kernel.org List-ID: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 20/02/2016 04:54, Al Viro wrote: > On Sat, Feb 20, 2016 at 03:21:27AM +0000, Al Viro wrote: >> On Fri, Feb 19, 2016 at 08:32:10PM +0100, Dmitry Vyukov wrote: >>>> BUG: unable to handle kernel NULL pointer dereference at 00000000000= 00050 >> >> NULL inode->i_sb, by the look of the offset, but I really don't unders= tand >> where the hell is that code doing (or how is that instruction going to= >> generate dereferencing of 0x50, for that matter). >=20 > BTW, Micka=EBl's trace *does* make sense and it's definitely NULL inode= ->i_sb > (inode itself - in %rsi, inode->i_sb - in %rdx, offset of s_flags is 0x= 50, > the line in question is > if ((inode->i_sb->s_flags & MS_NODIRATIME) && S_ISDIR(inode->i_= mode)) >=20 > What I don't understand is what could possibly have NULL ->i_sb in *any= * > instance of struct inode. >=20 I can also trigger bugs with a bad inode pointer dereference in atime_nee= ds_update: if (inode->i_flags & S_NOATIME) I think the bug may be somewhere in the nd->depth handling (when its valu= e is 0) in fs/namei.c:get_link(): struct saved *last =3D nd->stack + nd->= depth - 1 Moreover, is it intentional that touch_atime() is called by get_link() ev= en if the access (previously checked with security_file_open(), e.g. by d= o_last) is denied? --w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJWyGlUAAoJECLe/t9zvWqV8UsIAJSYwe+V8ERiSK7pqmdR/ZUZ d3uVsojVL7lT5iJiZUhlJExAHG8OfMZ8QgXvUKi8CDO9yNyYJzba6/ERNAEvHrEA NLIwgTcqWlqZ41qElUIt7PlGbp9alHZ/7n8e2iY0mftyYLjWYJJNooi6Pc/f03WN ByZk/ovJ/flM91SN0iJH7+lIaiYKBrQvIDOzoml70lqmgofgtkaO3ia9OJwRFXB5 QR8/iUU2lFNJXnLZXNIO2F8KSn0x7XM1qdXksKswPWlDVLtu63kJXz6+y0zuEOqb T7Ef1SlC08y8quRKJY+qEg8lTJTooHiAPQQQtFUMYV3qqxkvM8eoFQSjPm0kGaA= =8DvU -----END PGP SIGNATURE----- --w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf--