* [PATCH] ntfs: Ensure $Extend is a directory @ 2022-07-24 13:21 Soumya Negi 2022-07-24 13:47 ` Greg KH 0 siblings, 1 reply; 7+ messages in thread From: Soumya Negi @ 2022-07-24 13:21 UTC (permalink / raw) To: Anton Altaparmakov, Shuah Khan Cc: Soumya Negi, linux-ntfs-dev, linux-kernel, linux-kernel-mentees Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 Check whether $Extend is a directory or not( for NTFS3.0+) while loading system files. If it isn't(as in the case of this bug where the mft record for $Extend contains a regular file), load_system_files() returns false. Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> --- fs/ntfs/super.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c index 5ae8de09b271..18e2902531f9 100644 --- a/fs/ntfs/super.c +++ b/fs/ntfs/super.c @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol) // TODO: Initialize security. /* Get the extended system files' directory inode. */ vol->extend_ino = ntfs_iget(sb, FILE_Extend); - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) { + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) || + !S_ISDIR(vol->extend_ino->i_mode)) { + static const char *es1 = "$Extend is not a directory"; + static const char *es2 = "Failed to load $Extend"; + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2; + if (!IS_ERR(vol->extend_ino)) iput(vol->extend_ino); - ntfs_error(sb, "Failed to load $Extend."); + ntfs_error(sb, "%s.", es); goto iput_sec_err_out; } #ifdef NTFS_RW -- 2.17.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] ntfs: Ensure $Extend is a directory 2022-07-24 13:21 [PATCH] ntfs: Ensure $Extend is a directory Soumya Negi @ 2022-07-24 13:47 ` Greg KH 2022-07-24 15:34 ` Soumya Negi 0 siblings, 1 reply; 7+ messages in thread From: Greg KH @ 2022-07-24 13:47 UTC (permalink / raw) To: Soumya Negi Cc: Anton Altaparmakov, Shuah Khan, linux-ntfs-dev, linux-kernel-mentees, linux-kernel On Sun, Jul 24, 2022 at 06:21:07AM -0700, Soumya Negi wrote: > Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name > https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 > > Check whether $Extend is a directory or not( for NTFS3.0+) while loading > system files. If it isn't(as in the case of this bug where the mft record for > $Extend contains a regular file), load_system_files() returns false. Please wrap your changelog text at 72 columns like your editor asked you to when writing this :) > > Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com > Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> What commit caused this problem? What Fixes: tag should go here? Should it go to stable kernels? If so, how far back? > --- > fs/ntfs/super.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c > index 5ae8de09b271..18e2902531f9 100644 > --- a/fs/ntfs/super.c > +++ b/fs/ntfs/super.c > @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol) > // TODO: Initialize security. > /* Get the extended system files' directory inode. */ > vol->extend_ino = ntfs_iget(sb, FILE_Extend); > - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) { > + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) || > + !S_ISDIR(vol->extend_ino->i_mode)) { > + static const char *es1 = "$Extend is not a directory"; > + static const char *es2 = "Failed to load $Extend"; > + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2; > + > if (!IS_ERR(vol->extend_ino)) > iput(vol->extend_ino); > - ntfs_error(sb, "Failed to load $Extend."); > + ntfs_error(sb, "%s.", es); Are you allowing the system log to be spammed by an untrusted user with this change? thanks, greg k-h ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ntfs: Ensure $Extend is a directory 2022-07-24 13:47 ` Greg KH @ 2022-07-24 15:34 ` Soumya Negi 2022-07-24 15:54 ` Greg KH 0 siblings, 1 reply; 7+ messages in thread From: Soumya Negi @ 2022-07-24 15:34 UTC (permalink / raw) To: Greg KH Cc: Anton Altaparmakov, Shuah Khan, linux-ntfs-dev, linux-kernel-mentees, linux-kernel On Sun, Jul 24, 2022 at 03:47:01PM +0200, Greg KH wrote: > On Sun, Jul 24, 2022 at 06:21:07AM -0700, Soumya Negi wrote: > > Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name > > https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 > > > > Check whether $Extend is a directory or not( for NTFS3.0+) while loading > > system files. If it isn't(as in the case of this bug where the mft record for > > $Extend contains a regular file), load_system_files() returns false. > > Please wrap your changelog text at 72 columns like your editor asked you > to when writing this :) I will correct the changelog(Don't think I can wrap the bug report link. Checkpatch will still give a warning. Is that okay?). > > Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com > > Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> > > What commit caused this problem? What Fixes: tag should go here? I don't think this was caused by any specific commit.The $Extend directory check is not present in any previous releases. Syzbot has also not been able to produce a cause bisection for the bug. So no fixes tag(please correct me if I am wrong). > Should it go to stable kernels? If so, how far back? Since the NTFS extension file was new to NTFS 3.0, perhaps the patch should apply all the way back to the first release with NTFS3.0 support? I checked the stable tree history and 2.6.11 is the oldest release I could find. > > --- > > fs/ntfs/super.c | 9 +++++++-- > > 1 file changed, 7 insertions(+), 2 deletions(-) > > > > diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c > > index 5ae8de09b271..18e2902531f9 100644 > > --- a/fs/ntfs/super.c > > +++ b/fs/ntfs/super.c > > @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol) > > // TODO: Initialize security. > > /* Get the extended system files' directory inode. */ > > vol->extend_ino = ntfs_iget(sb, FILE_Extend); > > - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) { > > + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) || > > + !S_ISDIR(vol->extend_ino->i_mode)) { > > + static const char *es1 = "$Extend is not a directory"; > > + static const char *es2 = "Failed to load $Extend"; > > + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2; > > + > > if (!IS_ERR(vol->extend_ino)) > > iput(vol->extend_ino); > > - ntfs_error(sb, "Failed to load $Extend."); > > + ntfs_error(sb, "%s.", es); > > Are you allowing the system log to be spammed by an untrusted user with > this change? The error message is written to the system log while trying to mount the file system(which will fail if the error occurs). I don't understand how an untrusted user will be involved. > thanks, > > greg k-h Thanks, Soumya ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ntfs: Ensure $Extend is a directory 2022-07-24 15:34 ` Soumya Negi @ 2022-07-24 15:54 ` Greg KH 2022-07-24 22:17 ` Soumya Negi 0 siblings, 1 reply; 7+ messages in thread From: Greg KH @ 2022-07-24 15:54 UTC (permalink / raw) To: Soumya Negi Cc: Anton Altaparmakov, Shuah Khan, linux-ntfs-dev, linux-kernel-mentees, linux-kernel On Sun, Jul 24, 2022 at 08:34:48AM -0700, Soumya Negi wrote: > On Sun, Jul 24, 2022 at 03:47:01PM +0200, Greg KH wrote: > > On Sun, Jul 24, 2022 at 06:21:07AM -0700, Soumya Negi wrote: > > > Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name > > > https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 > > > > > > Check whether $Extend is a directory or not( for NTFS3.0+) while loading > > > system files. If it isn't(as in the case of this bug where the mft record for > > > $Extend contains a regular file), load_system_files() returns false. > > > > Please wrap your changelog text at 72 columns like your editor asked you > > to when writing this :) > > I will correct the changelog(Don't think I can wrap the bug report > link. Checkpatch will still give a warning. Is that okay?). Yes, do not wrap links. > > > Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com > > > Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> > > > > What commit caused this problem? What Fixes: tag should go here? > > I don't think this was caused by any specific commit.The $Extend > directory check is not present in any previous releases. Syzbot has > also not been able to produce a cause bisection for the bug. So no fixes > tag(please correct me if I am wrong). > > > Should it go to stable kernels? If so, how far back? > > Since the NTFS extension file was new to NTFS 3.0, perhaps the patch > should apply all the way back to the first release with NTFS3.0 support? Yes, mark it there. thanks, greg k-h ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ntfs: Ensure $Extend is a directory 2022-07-24 15:54 ` Greg KH @ 2022-07-24 22:17 ` Soumya Negi 2022-07-25 19:06 ` Soumya Negi 0 siblings, 1 reply; 7+ messages in thread From: Soumya Negi @ 2022-07-24 22:17 UTC (permalink / raw) To: Greg KH Cc: Anton Altaparmakov, Shuah Khan, linux-ntfs-dev, linux-kernel-mentees, linux-kernel On Sun, Jul 24, 2022 at 05:54:43PM +0200, Greg KH wrote: > On Sun, Jul 24, 2022 at 08:34:48AM -0700, Soumya Negi wrote: > > On Sun, Jul 24, 2022 at 03:47:01PM +0200, Greg KH wrote: > > > On Sun, Jul 24, 2022 at 06:21:07AM -0700, Soumya Negi wrote: > > > > Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name > > > > https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 > > > > > > > > Check whether $Extend is a directory or not( for NTFS3.0+) while loading > > > > system files. If it isn't(as in the case of this bug where the mft record for > > > > $Extend contains a regular file), load_system_files() returns false. > > > > > > Please wrap your changelog text at 72 columns like your editor asked you > > > to when writing this :) > > > > I will correct the changelog(Don't think I can wrap the bug report > > link. Checkpatch will still give a warning. Is that okay?). > > Yes, do not wrap links. > > > > > Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com > > > > Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> > > > > > > What commit caused this problem? What Fixes: tag should go here? > > > > I don't think this was caused by any specific commit.The $Extend > > directory check is not present in any previous releases. Syzbot has > > also not been able to produce a cause bisection for the bug. So no fixes > > tag(please correct me if I am wrong). > > > > > Should it go to stable kernels? If so, how far back? > > > > Since the NTFS extension file was new to NTFS 3.0, perhaps the patch > > should apply all the way back to the first release with NTFS3.0 support? > Yes, mark it there. Thanks. I will send v2 of the patch. Just want to make sure that the patch will apply to 2.6.11.y before marking it. -Soumya ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ntfs: Ensure $Extend is a directory 2022-07-24 22:17 ` Soumya Negi @ 2022-07-25 19:06 ` Soumya Negi 2022-07-26 16:40 ` Greg KH 0 siblings, 1 reply; 7+ messages in thread From: Soumya Negi @ 2022-07-25 19:06 UTC (permalink / raw) To: Greg KH Cc: Anton Altaparmakov, Shuah Khan, linux-ntfs-dev, linux-kernel-mentees, linux-kernel Hi, On Sun, Jul 24, 2022 at 03:17:45PM -0700, Soumya Negi wrote: > On Sun, Jul 24, 2022 at 05:54:43PM +0200, Greg KH wrote: > > On Sun, Jul 24, 2022 at 08:34:48AM -0700, Soumya Negi wrote: > > > On Sun, Jul 24, 2022 at 03:47:01PM +0200, Greg KH wrote: > > > > On Sun, Jul 24, 2022 at 06:21:07AM -0700, Soumya Negi wrote: > > > > > Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name > > > > > https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 > > > > > > > > > > Check whether $Extend is a directory or not( for NTFS3.0+) while loading > > > > > system files. If it isn't(as in the case of this bug where the mft record for > > > > > $Extend contains a regular file), load_system_files() returns false. > > > > > > > > Please wrap your changelog text at 72 columns like your editor asked you > > > > to when writing this :) > > > > > > I will correct the changelog(Don't think I can wrap the bug report > > > link. Checkpatch will still give a warning. Is that okay?). > > > > Yes, do not wrap links. > > > > > > > Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com > > > > > Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> > > > > > > > > What commit caused this problem? What Fixes: tag should go here? > > > > > > I don't think this was caused by any specific commit.The $Extend > > > directory check is not present in any previous releases. Syzbot has > > > also not been able to produce a cause bisection for the bug. So no fixes > > > tag(please correct me if I am wrong). > > > > > > > Should it go to stable kernels? If so, how far back? > > > > > > Since the NTFS extension file was new to NTFS 3.0, perhaps the patch > > > should apply all the way back to the first release with NTFS3.0 support? > > > Yes, mark it there. > > Thanks. I will send v2 of the patch. Just want to make sure that the > patch will apply to 2.6.11.y before marking it. 2.6.11 is where I think NTFS3.0 support was first present and till where the patch should go. But I am not able to build 2.6.11 on my system and test the patch. I tried the patch on 4.14 and it works. Should I mark it to be backported till 4.14 instead? With thanks, Soumya ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ntfs: Ensure $Extend is a directory 2022-07-25 19:06 ` Soumya Negi @ 2022-07-26 16:40 ` Greg KH 0 siblings, 0 replies; 7+ messages in thread From: Greg KH @ 2022-07-26 16:40 UTC (permalink / raw) To: Soumya Negi Cc: Anton Altaparmakov, Shuah Khan, linux-ntfs-dev, linux-kernel-mentees, linux-kernel On Mon, Jul 25, 2022 at 12:06:56PM -0700, Soumya Negi wrote: > Hi, > > On Sun, Jul 24, 2022 at 03:17:45PM -0700, Soumya Negi wrote: > > On Sun, Jul 24, 2022 at 05:54:43PM +0200, Greg KH wrote: > > > On Sun, Jul 24, 2022 at 08:34:48AM -0700, Soumya Negi wrote: > > > > On Sun, Jul 24, 2022 at 03:47:01PM +0200, Greg KH wrote: > > > > > On Sun, Jul 24, 2022 at 06:21:07AM -0700, Soumya Negi wrote: > > > > > > Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name > > > > > > https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 > > > > > > > > > > > > Check whether $Extend is a directory or not( for NTFS3.0+) while loading > > > > > > system files. If it isn't(as in the case of this bug where the mft record for > > > > > > $Extend contains a regular file), load_system_files() returns false. > > > > > > > > > > Please wrap your changelog text at 72 columns like your editor asked you > > > > > to when writing this :) > > > > > > > > I will correct the changelog(Don't think I can wrap the bug report > > > > link. Checkpatch will still give a warning. Is that okay?). > > > > > > Yes, do not wrap links. > > > > > > > > > Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com > > > > > > Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> > > > > > > > > > > What commit caused this problem? What Fixes: tag should go here? > > > > > > > > I don't think this was caused by any specific commit.The $Extend > > > > directory check is not present in any previous releases. Syzbot has > > > > also not been able to produce a cause bisection for the bug. So no fixes > > > > tag(please correct me if I am wrong). > > > > > > > > > Should it go to stable kernels? If so, how far back? > > > > > > > > Since the NTFS extension file was new to NTFS 3.0, perhaps the patch > > > > should apply all the way back to the first release with NTFS3.0 support? > > > > > Yes, mark it there. > > > > Thanks. I will send v2 of the patch. Just want to make sure that the > > patch will apply to 2.6.11.y before marking it. > > 2.6.11 is where I think NTFS3.0 support was first present and till where > the patch should go. But I am not able to build 2.6.11 on my system and > test the patch. I tried the patch on 4.14 and it works. Should I mark it > to be backported till 4.14 instead? Say 4.9 and you will get an email saying it failed to apply there when it gets merged into Linus's tree, and then you can provide a working patch for us to add to stable. thanks, greg k-h ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-07-26 16:41 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2022-07-24 13:21 [PATCH] ntfs: Ensure $Extend is a directory Soumya Negi 2022-07-24 13:47 ` Greg KH 2022-07-24 15:34 ` Soumya Negi 2022-07-24 15:54 ` Greg KH 2022-07-24 22:17 ` Soumya Negi 2022-07-25 19:06 ` Soumya Negi 2022-07-26 16:40 ` Greg KH
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox