[PATCH] ocfs2: handle system file flag mismatches gracefully

[PATCH] ocfs2: handle system file flag mismatches gracefully

[ZhengYuan Huang]

[BUG]
Mounting a crafted OCFS2 image can trip:

kernel BUG at fs/ocfs2/inode.c:609!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ocfs2_read_locked_inode+0x1038/0x10c0 fs/ocfs2/inode.c:609
Call Trace:
 <TASK>
 ocfs2_iget+0x7fa/0x9b0 fs/ocfs2/inode.c:157
 _ocfs2_get_system_file_inode fs/ocfs2/sysfile.c:142 [inline]
 ocfs2_get_system_file_inode+0x389/0x820 fs/ocfs2/sysfile.c:112
 ocfs2_init_local_system_inodes fs/ocfs2/super.c:491 [inline]
 ocfs2_mount_volume fs/ocfs2/super.c:1756 [inline]
 ocfs2_fill_super+0x1330/0x3cd0 fs/ocfs2/super.c:1083
 get_tree_bdev_flags+0x38b/0x640 fs/super.c:1698
 get_tree_bdev+0x24/0x40 fs/super.c:1721
 ocfs2_get_tree+0x21/0x30 fs/ocfs2/super.c:1184
 vfs_get_tree+0x9a/0x370 fs/super.c:1758
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3642 [inline]
 do_new_mount fs/namespace.c:3718 [inline]
 path_mount+0x5b8/0x1ea0 fs/namespace.c:4028
 do_mount fs/namespace.c:4041 [inline]
 __do_sys_mount fs/namespace.c:4229 [inline]
 __se_sys_mount fs/namespace.c:4206 [inline]
 __x64_sys_mount+0x282/0x320 fs/namespace.c:4206
 ...

[CAUSE]
ocfs2_read_locked_inode() assumes any mismatch between
OCFS2_FI_FLAG_SYSFILE and the dinode's OCFS2_SYSTEM_FL bit is a pure
caller bug, so it routes the condition through mlog_bug_on_msg(). A
crafted filesystem can violate that assumption by making a system
directory entry point at a non-system inode that still passes generic
dinode validation.

[FIX]
Keep the mismatch check in ocfs2_read_locked_inode(), where the caller
context is available, but replace the BUG assertion with an error log
and the existing bail path. That turns crafted on-disk input into a
failed inode read and mount failure instead of a kernel crash.

Fixes: 24c19ef40474 ("ocfs2: Remove i_generation from inode lock names")
Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
---
 fs/ocfs2/inode.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index fcc89856ab95..0a60de5d46fe 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -602,14 +602,17 @@ static int ocfs2_read_locked_inode(struct inode *inode,
 	fe = (struct ocfs2_dinode *) bh->b_data;
 
 	/*
-	 * This is a code bug. Right now the caller needs to
-	 * understand whether it is asking for a system file inode or
-	 * not so the proper lock names can be built.
+	 * The caller has to tell us whether it expects a system file inode
+	 * so the lock names can be built correctly. A corrupted system
+	 * directory can violate that expectation, so fail the read instead
+	 * of crashing.
 	 */
-	mlog_bug_on_msg(!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
-			!!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE),
-			"Inode %llu: system file state is ambiguous\n",
-			(unsigned long long)args->fi_blkno);
+	if (!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
+	    !!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE)) {
+		mlog(ML_ERROR, "Inode %llu: system file state is ambiguous\n",
+		     (unsigned long long)args->fi_blkno);
+		goto bail;
+	}
 
 	if (S_ISCHR(le16_to_cpu(fe->i_mode)) ||
 	    S_ISBLK(le16_to_cpu(fe->i_mode)))
-- 
2.43.0

Re: [PATCH] ocfs2: handle system file flag mismatches gracefully

[Joseph Qi]

On 4/9/26 6:58 PM, ZhengYuan Huang wrote:
> [BUG]
> Mounting a crafted OCFS2 image can trip:
> 
> kernel BUG at fs/ocfs2/inode.c:609!
> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
> RIP: 0010:ocfs2_read_locked_inode+0x1038/0x10c0 fs/ocfs2/inode.c:609
> Call Trace:
>  <TASK>
>  ocfs2_iget+0x7fa/0x9b0 fs/ocfs2/inode.c:157
>  _ocfs2_get_system_file_inode fs/ocfs2/sysfile.c:142 [inline]
>  ocfs2_get_system_file_inode+0x389/0x820 fs/ocfs2/sysfile.c:112
>  ocfs2_init_local_system_inodes fs/ocfs2/super.c:491 [inline]
>  ocfs2_mount_volume fs/ocfs2/super.c:1756 [inline]
>  ocfs2_fill_super+0x1330/0x3cd0 fs/ocfs2/super.c:1083
>  get_tree_bdev_flags+0x38b/0x640 fs/super.c:1698
>  get_tree_bdev+0x24/0x40 fs/super.c:1721
>  ocfs2_get_tree+0x21/0x30 fs/ocfs2/super.c:1184
>  vfs_get_tree+0x9a/0x370 fs/super.c:1758
>  fc_mount fs/namespace.c:1199 [inline]
>  do_new_mount_fc fs/namespace.c:3642 [inline]
>  do_new_mount fs/namespace.c:3718 [inline]
>  path_mount+0x5b8/0x1ea0 fs/namespace.c:4028
>  do_mount fs/namespace.c:4041 [inline]
>  __do_sys_mount fs/namespace.c:4229 [inline]
>  __se_sys_mount fs/namespace.c:4206 [inline]
>  __x64_sys_mount+0x282/0x320 fs/namespace.c:4206
>  ...
> 
> [CAUSE]
> ocfs2_read_locked_inode() assumes any mismatch between
> OCFS2_FI_FLAG_SYSFILE and the dinode's OCFS2_SYSTEM_FL bit is a pure
> caller bug, so it routes the condition through mlog_bug_on_msg(). A
> crafted filesystem can violate that assumption by making a system
> directory entry point at a non-system inode that still passes generic
> dinode validation.
> 
> [FIX]
> Keep the mismatch check in ocfs2_read_locked_inode(), where the caller
> context is available, but replace the BUG assertion with an error log
> and the existing bail path. That turns crafted on-disk input into a
> failed inode read and mount failure instead of a kernel crash.
> 
> Fixes: 24c19ef40474 ("ocfs2: Remove i_generation from inode lock names")
> Signed-off-by: ZhengYuan Huang <gality369@gmail.com>

Looks fine.
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>

> ---
>  fs/ocfs2/inode.c | 16 +++++++++-------
>  1 file changed, 9 insertions(+), 7 deletions(-)
> 
> diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
> index fcc89856ab95..0a60de5d46fe 100644
> --- a/fs/ocfs2/inode.c
> +++ b/fs/ocfs2/inode.c
> @@ -602,14 +602,17 @@ static int ocfs2_read_locked_inode(struct inode *inode,
>  	fe = (struct ocfs2_dinode *) bh->b_data;
>  
>  	/*
> -	 * This is a code bug. Right now the caller needs to
> -	 * understand whether it is asking for a system file inode or
> -	 * not so the proper lock names can be built.
> +	 * The caller has to tell us whether it expects a system file inode
> +	 * so the lock names can be built correctly. A corrupted system
> +	 * directory can violate that expectation, so fail the read instead
> +	 * of crashing.
>  	 */
> -	mlog_bug_on_msg(!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
> -			!!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE),
> -			"Inode %llu: system file state is ambiguous\n",
> -			(unsigned long long)args->fi_blkno);
> +	if (!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
> +	    !!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE)) {
> +		mlog(ML_ERROR, "Inode %llu: system file state is ambiguous\n",
> +		     (unsigned long long)args->fi_blkno);
> +		goto bail;
> +	}
>  
>  	if (S_ISCHR(le16_to_cpu(fe->i_mode)) ||
>  	    S_ISBLK(le16_to_cpu(fe->i_mode)))