Re: [LTP] [PATCH v2] fsconfig: New case cover CVE-2022-0185

[Wei Gao via ltp <ltp@lists.linux.it>]

On Thu, Feb 09, 2023 at 03:52:37PM +0100, Cyril Hrubis wrote:
> Hi!

> > Results on my machine (6.2.0-rc6)
> > 
> > tst_test.c:1634: TINFO: === Testing on ext2 ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with ext2 opts='' extra opts=''
> > mke2fs 1.46.5 (30-Dec-2021)
> > note ext2 is *not* using new mount API
> > fsconfig03.c:50: TPASS: fsconfig() overflow on ext2 haven't triggerred crash
> > tst_test.c:1634: TINFO: === Testing on ext3 ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with ext3 opts='' extra opts=''
> > mke2fs 1.46.5 (30-Dec-2021)
> > fsconfig03.c:50: TPASS: fsconfig() overflow on ext3 haven't triggerred crash
> > tst_test.c:1634: TINFO: === Testing on ext4 ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with ext4 opts='' extra opts=''
> > mke2fs 1.46.5 (30-Dec-2021)
> > fsconfig03.c:50: TPASS: fsconfig() overflow on ext4 haven't triggerred crash
> > tst_test.c:1634: TINFO: === Testing on xfs ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with xfs opts='' extra opts=''
> > fsconfig03.c:50: TPASS: fsconfig() overflow on xfs haven't triggerred crash
> > tst_test.c:1634: TINFO: === Testing on btrfs ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with btrfs opts='' extra opts=''
> > fsconfig03.c:44: TFAIL: fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0) succeeded
> > Btrfs should be investigated (IMHO btrfs is using new mount API).
> > 
> > tst_test.c:1634: TINFO: === Testing on vfat ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with vfat opts='' extra opts=''
> > fsconfig03.c:44: TFAIL: fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0) succeeded
> > 
> > tst_test.c:1634: TINFO: === Testing on exfat ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with exfat opts='' extra opts=''
> > fsconfig03.c:50: TPASS: fsconfig() overflow on exfat haven't triggerred crash
> > Interesting, exfat works :) It also uses new mount API.
> > 
> > tst_test.c:1634: TINFO: === Testing on ntfs ===
> > tst_test.c:1093: TINFO: Formatting /dev/loop0 with ntfs opts='' extra opts=''
> > The partition start sector was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
> > The number of sectors per track was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
> > The number of heads was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
> > To boot from a device, Windows needs the 'partition start sector', the 'sectors per track' and the 'number of heads' to be set.
> > Windows will not be able to boot from this device.
> > fsconfig03.c:29: TBROK: fsopen() failed: ENODEV (19)
> > Hm, that's strange
> 
> ENODEV means that filesystem is not compiled in kernel, that's strage,
> that would mean that you have a broken system, e.g. kernel modules that
> support these filesystems are not installed properly or something like
> that.
> 
> If you look at fs/filesystems.c the get_fs_type() function called from
> the fsopen() uses the very same array that is used by the
> /proc/filesystems we parse in LTP to get list of supported filesystems.
> 
> This is the place where you can get ENODEV:
> 
> https://elixir.bootlin.com/linux/latest/source/fs/fsopen.c#L132
> 
> And this is the place where it can fail:
> 
> https://elixir.bootlin.com/linux/latest/source/fs/filesystems.c#L261
> 
> > Due above, I suggest this:
> > 	.skip_filesystems = (const char *const []){"ntfs", "vfat", NULL},
> 

Result in my machine 6.0.0-rc5, the ntfs check no failed with ENODEV but show succeeded when do fsconfig.
I will do further check on btrfs why it show success, will notify you once i got result.


tst_test.c:1634: TINFO: === Testing on ext2 ===
tst_test.c:1093: TINFO: Formatting /dev/loop0 with ext2 opts='' extra opts=''
mke2fs 1.46.6 (1-Feb-2023)
fsconfig03.c:50: TPASS: fsconfig() overflow on ext2 haven't triggerred crash
tst_test.c:1634: TINFO: === Testing on ext3 ===
tst_test.c:1093: TINFO: Formatting /dev/loop0 with ext3 opts='' extra opts=''
mke2fs 1.46.6 (1-Feb-2023)
fsconfig03.c:50: TPASS: fsconfig() overflow on ext3 haven't triggerred crash
tst_test.c:1634: TINFO: === Testing on ext4 ===
tst_test.c:1093: TINFO: Formatting /dev/loop0 with ext4 opts='' extra opts=''
mke2fs 1.46.6 (1-Feb-2023)
fsconfig03.c:50: TPASS: fsconfig() overflow on ext4 haven't triggerred crash
tst_test.c:1634: TINFO: === Testing on btrfs ===
tst_test.c:1093: TINFO: Formatting /dev/loop0 with btrfs opts='' extra opts=''
fsconfig03.c:44: TFAIL: fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0) succeeded
tst_test.c:1634: TINFO: === Testing on vfat ===
tst_test.c:1093: TINFO: Formatting /dev/loop0 with vfat opts='' extra opts=''
fsconfig03.c:44: TFAIL: fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0) succeeded
tst_test.c:1634: TINFO: === Testing on ntfs ===
tst_test.c:1093: TINFO: Formatting /dev/loop0 with ntfs opts='' extra opts=''
Failed to set locale, using default 'C'.
The partition start sector was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
The number of sectors per track was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
The number of heads was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
To boot from a device, Windows needs the 'partition start sector', the 'sectors per track' and the 'number of heads' to be set.
Windows will not be able to boot from this device.
fsconfig03.c:44: TFAIL: fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0) succeeded
tst_test.c:1634: TINFO: === Testing on tmpfs ===
tst_test.c:1093: TINFO: Skipping mkfs for TMPFS filesystem

> 
> -- 
> Cyril Hrubis
> chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp