From: Soumya Negi <soumya.negi97@gmail.com> To: Anton Altaparmakov <anton@tuxera.com>, Shuah Khan <skhan@linuxfoundation.org> Cc: Soumya Negi <soumya.negi97@gmail.com>, linux-ntfs-dev@lists.sourceforge.net, linux-kernel@vger.kernel.org, linux-kernel-mentees@lists.linuxfoundation.org, stable@vger.kernel.org Subject: [PATCH v2] ntfs: Ensure $Extend is a directory Date: Tue, 26 Jul 2022 17:15:13 -0700 [thread overview] Message-ID: <20220727001513.11902-1-soumya.negi97@gmail.com> (raw) Fix Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 Check whether $Extend is a directory or not( for NTFS3.0+) while loading system files. If it isn't(as in the case of this bug where the mft record for $Extend contains a regular file), load_system_files() returns false. Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> --- Changes since v1: * Added CC tag for stable * Formatted changelog to fit within 72 cols --- fs/ntfs/super.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c index 5ae8de09b271..18e2902531f9 100644 --- a/fs/ntfs/super.c +++ b/fs/ntfs/super.c @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol) // TODO: Initialize security. /* Get the extended system files' directory inode. */ vol->extend_ino = ntfs_iget(sb, FILE_Extend); - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) { + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) || + !S_ISDIR(vol->extend_ino->i_mode)) { + static const char *es1 = "$Extend is not a directory"; + static const char *es2 = "Failed to load $Extend"; + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2; + if (!IS_ERR(vol->extend_ino)) iput(vol->extend_ino); - ntfs_error(sb, "Failed to load $Extend."); + ntfs_error(sb, "%s.", es); goto iput_sec_err_out; } #ifdef NTFS_RW -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Soumya Negi <soumya.negi97@gmail.com> To: Anton Altaparmakov <anton@tuxera.com>, Shuah Khan <skhan@linuxfoundation.org> Cc: linux-ntfs-dev@lists.sourceforge.net, linux-kernel-mentees@lists.linuxfoundation.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2] ntfs: Ensure $Extend is a directory Date: Tue, 26 Jul 2022 17:15:13 -0700 [thread overview] Message-ID: <20220727001513.11902-1-soumya.negi97@gmail.com> (raw) Fix Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71 Check whether $Extend is a directory or not( for NTFS3.0+) while loading system files. If it isn't(as in the case of this bug where the mft record for $Extend contains a regular file), load_system_files() returns false. Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> --- Changes since v1: * Added CC tag for stable * Formatted changelog to fit within 72 cols --- fs/ntfs/super.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c index 5ae8de09b271..18e2902531f9 100644 --- a/fs/ntfs/super.c +++ b/fs/ntfs/super.c @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol) // TODO: Initialize security. /* Get the extended system files' directory inode. */ vol->extend_ino = ntfs_iget(sb, FILE_Extend); - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) { + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) || + !S_ISDIR(vol->extend_ino->i_mode)) { + static const char *es1 = "$Extend is not a directory"; + static const char *es2 = "Failed to load $Extend"; + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2; + if (!IS_ERR(vol->extend_ino)) iput(vol->extend_ino); - ntfs_error(sb, "Failed to load $Extend."); + ntfs_error(sb, "%s.", es); goto iput_sec_err_out; } #ifdef NTFS_RW -- 2.17.1 _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
next reply other threads:[~2022-07-27 0:15 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-07-27 0:15 Soumya Negi [this message] 2022-07-27 0:15 ` [PATCH v2] ntfs: Ensure $Extend is a directory Soumya Negi 2022-08-29 15:03 ` Soumya Negi 2022-08-29 15:03 ` Soumya Negi 2023-05-11 7:55 ` Namjae Jeon 2023-05-11 7:55 ` Namjae Jeon
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220727001513.11902-1-soumya.negi97@gmail.com \ --to=soumya.negi97@gmail.com \ --cc=anton@tuxera.com \ --cc=linux-kernel-mentees@lists.linuxfoundation.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-ntfs-dev@lists.sourceforge.net \ --cc=skhan@linuxfoundation.org \ --cc=stable@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.