From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
To: Pavel Skripkin <paskripkin@gmail.com>, <ntfs3@lists.linux.dev>
Cc: <syzbot+c95173762127ad76a824@syzkaller.appspotmail.com>,
<linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 1/2] ntfs3: fix NULL deref in ntfs_update_mftmirr
Date: Thu, 9 Jun 2022 19:42:07 +0300 [thread overview]
Message-ID: <7bfc9b09-e7ee-d781-5ea3-ac31d42c34e1@paragon-software.com> (raw)
In-Reply-To: <89d2979c-7e8a-f63f-327e-1969a4c03c11@gmail.com>
On 6/4/22 14:42, Pavel Skripkin wrote:
> On 4/21/22 23:53, Pavel Skripkin wrote:
>> If ntfs_fill_super() wasn't called then sbi->sb will be equal to NULL.
>> Code should check this ptr before dereferencing. Syzbot hit this issue
>> via passing wrong mount param as can be seen from log below
>>
>> Fail log:
>> ntfs3: Unknown parameter 'iochvrset'
>> general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
>> KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
>> CPU: 1 PID: 3589 Comm: syz-executor210 Not tainted 5.18.0-rc3-syzkaller-00016-gb253435746d9 #0
>> ...
>> Call Trace:
>> <TASK>
>> put_ntfs+0x1ed/0x2a0 fs/ntfs3/super.c:463
>> ntfs_fs_free+0x6a/0xe0 fs/ntfs3/super.c:1363
>> put_fs_context+0x119/0x7a0 fs/fs_context.c:469
>> do_new_mount+0x2b4/0xad0 fs/namespace.c:3044
>> do_mount fs/namespace.c:3383 [inline]
>> __do_sys_mount fs/namespace.c:3591 [inline]
>>
>> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
>> Reported-and-tested-by: syzbot+c95173762127ad76a824@syzkaller.appspotmail.com
>> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
>
> gentle ping
>
>
>
>
> With regards,
> Pavel Skripkin
1st patch is correct.
2nd patch is a good catch, but I'm not sure if simply ignoring is good.
If mftmirr is broken / missing, then theoretically we can continue working.
But still it's a major fs error.
I'm thinking about exiting mount with error, and if "force" is present,
then continue with mount.
I'll reply again when I'll be sure what is correct behavior.
Thank you for your work!
next prev parent reply other threads:[~2022-06-09 16:42 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-21 20:53 [PATCH 1/2] ntfs3: fix NULL deref in ntfs_update_mftmirr Pavel Skripkin
2022-04-21 20:53 ` [PATCH 2/2] ntfs3: make ntfs_update_mftmirr return void Pavel Skripkin
2022-06-04 11:42 ` [PATCH 1/2] ntfs3: fix NULL deref in ntfs_update_mftmirr Pavel Skripkin
2022-06-09 16:42 ` Konstantin Komarov [this message]
2022-07-05 13:34 ` Konstantin Komarov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7bfc9b09-e7ee-d781-5ea3-ac31d42c34e1@paragon-software.com \
--to=almaz.alexandrovich@paragon-software.com \
--cc=linux-kernel@vger.kernel.org \
--cc=ntfs3@lists.linux.dev \
--cc=paskripkin@gmail.com \
--cc=syzbot+c95173762127ad76a824@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox