* [PATCH v2] ntfs: Ensure $Extend is a directory
@ 2022-07-27 0:15 Soumya Negi
2022-08-29 15:03 ` Soumya Negi
0 siblings, 1 reply; 3+ messages in thread
From: Soumya Negi @ 2022-07-27 0:15 UTC (permalink / raw)
To: Anton Altaparmakov, Shuah Khan
Cc: linux-ntfs-dev, linux-kernel-mentees, linux-kernel, stable
Fix Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name
https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71
Check whether $Extend is a directory or not( for NTFS3.0+) while
loading system files. If it isn't(as in the case of this bug where the
mft record for $Extend contains a regular file), load_system_files()
returns false.
Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com
CC: stable@vger.kernel.org # 4.9+
Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
---
Changes since v1:
* Added CC tag for stable
* Formatted changelog to fit within 72 cols
---
fs/ntfs/super.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 5ae8de09b271..18e2902531f9 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol)
// TODO: Initialize security.
/* Get the extended system files' directory inode. */
vol->extend_ino = ntfs_iget(sb, FILE_Extend);
- if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
+ if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
+ !S_ISDIR(vol->extend_ino->i_mode)) {
+ static const char *es1 = "$Extend is not a directory";
+ static const char *es2 = "Failed to load $Extend";
+ const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2;
+
if (!IS_ERR(vol->extend_ino))
iput(vol->extend_ino);
- ntfs_error(sb, "Failed to load $Extend.");
+ ntfs_error(sb, "%s.", es);
goto iput_sec_err_out;
}
#ifdef NTFS_RW
--
2.17.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] ntfs: Ensure $Extend is a directory
2022-07-27 0:15 [PATCH v2] ntfs: Ensure $Extend is a directory Soumya Negi
@ 2022-08-29 15:03 ` Soumya Negi
2023-05-11 7:55 ` Namjae Jeon
0 siblings, 1 reply; 3+ messages in thread
From: Soumya Negi @ 2022-08-29 15:03 UTC (permalink / raw)
To: Anton Altaparmakov, Shuah Khan
Cc: linux-ntfs-dev, linux-kernel-mentees, linux-kernel, stable
On Tue, Jul 26, 2022 at 05:15:13PM -0700, Soumya Negi wrote:
> Fix Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name
> https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71
>
> Check whether $Extend is a directory or not( for NTFS3.0+) while
> loading system files. If it isn't(as in the case of this bug where the
> mft record for $Extend contains a regular file), load_system_files()
> returns false.
>
> Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com
> CC: stable@vger.kernel.org # 4.9+
> Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
> ---
> Changes since v1:
> * Added CC tag for stable
> * Formatted changelog to fit within 72 cols
>
> ---
> fs/ntfs/super.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
> index 5ae8de09b271..18e2902531f9 100644
> --- a/fs/ntfs/super.c
> +++ b/fs/ntfs/super.c
> @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol)
> // TODO: Initialize security.
> /* Get the extended system files' directory inode. */
> vol->extend_ino = ntfs_iget(sb, FILE_Extend);
> - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
> + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
> + !S_ISDIR(vol->extend_ino->i_mode)) {
> + static const char *es1 = "$Extend is not a directory";
> + static const char *es2 = "Failed to load $Extend";
> + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2;
> +
> if (!IS_ERR(vol->extend_ino))
> iput(vol->extend_ino);
> - ntfs_error(sb, "Failed to load $Extend.");
> + ntfs_error(sb, "%s.", es);
> goto iput_sec_err_out;
> }
> #ifdef NTFS_RW
> --
> 2.17.1
Hi Anton,
Have you had a chance to look at this patch?
Thanks,
Soumya
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] ntfs: Ensure $Extend is a directory
2022-08-29 15:03 ` Soumya Negi
@ 2023-05-11 7:55 ` Namjae Jeon
0 siblings, 0 replies; 3+ messages in thread
From: Namjae Jeon @ 2023-05-11 7:55 UTC (permalink / raw)
To: Soumya Negi
Cc: Christian Brauner, linux-ntfs-dev, linux-kernel,
linux-kernel-mentees, Anton Altaparmakov
2022-08-30 0:03 GMT+09:00, Soumya Negi <soumya.negi97@gmail.com>:
> On Tue, Jul 26, 2022 at 05:15:13PM -0700, Soumya Negi wrote:
>> Fix Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name
>> https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71
>>
>> Check whether $Extend is a directory or not( for NTFS3.0+) while
>> loading system files. If it isn't(as in the case of this bug where the
>> mft record for $Extend contains a regular file), load_system_files()
>> returns false.
>>
>> Reported-by: syzbot+30b7f850c6d98ea461d2@syzkaller.appspotmail.com
>> CC: stable@vger.kernel.org # 4.9+
>> Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
>> ---
>> Changes since v1:
>> * Added CC tag for stable
>> * Formatted changelog to fit within 72 cols
>>
>> ---
>> fs/ntfs/super.c | 9 +++++++--
>> 1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
>> index 5ae8de09b271..18e2902531f9 100644
>> --- a/fs/ntfs/super.c
>> +++ b/fs/ntfs/super.c
>> @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol)
>> // TODO: Initialize security.
>> /* Get the extended system files' directory inode. */
>> vol->extend_ino = ntfs_iget(sb, FILE_Extend);
>> - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
>> + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
>> + !S_ISDIR(vol->extend_ino->i_mode)) {
>> + static const char *es1 = "$Extend is not a directory";
>> + static const char *es2 = "Failed to load $Extend";
>> + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2;
>> +
>> if (!IS_ERR(vol->extend_ino))
>> iput(vol->extend_ino);
>> - ntfs_error(sb, "Failed to load $Extend.");
>> + ntfs_error(sb, "%s.", es);
>> goto iput_sec_err_out;
>> }
>> #ifdef NTFS_RW
>> --
>> 2.17.1
>
> Hi Anton,
> Have you had a chance to look at this patch?
Hi,
Could you elaborate more ? Isn't MFT_RECORD_IS_DIRECTORY flags set in
mft record of $Extend ?
> Thanks,
> Soumya
>
>
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-05-11 7:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-27 0:15 [PATCH v2] ntfs: Ensure $Extend is a directory Soumya Negi
2022-08-29 15:03 ` Soumya Negi
2023-05-11 7:55 ` Namjae Jeon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).