From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, ChenXiaoSong <chenxiaosong2@huawei.com>,
Anton Altaparmakov <anton@tuxera.com>,
Andrew Morton <akpm@linux-foundation.org>
Subject: [PATCH 5.15 18/83] ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()
Date: Mon, 3 Oct 2022 09:10:43 +0200 [thread overview]
Message-ID: <20221003070722.440859023@linuxfoundation.org> (raw)
In-Reply-To: <20221003070721.971297651@linuxfoundation.org>
From: ChenXiaoSong <chenxiaosong2@huawei.com>
commit 1b513f613731e2afc05550e8070d79fac80c661e upstream.
Syzkaller reported BUG_ON as follows:
------------[ cut here ]------------
kernel BUG at fs/ntfs/dir.c:86!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 3 PID: 758 Comm: a.out Not tainted 5.19.0-next-20220808 #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:ntfs_lookup_inode_by_name+0xd11/0x2d10
Code: ff e9 b9 01 00 00 e8 1e fe d6 fe 48 8b 7d 98 49 8d 5d 07 e8 91 85 29 ff 48 c7 45 98 00 00 00 00 e9 5a fb ff ff e8 ff fd d6 fe <0f> 0b e8 f8 fd d6 fe 0f 0b e8 f1 fd d6 fe 48 8b b5 50 ff ff ff 4c
RSP: 0018:ffff888079607978 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000008000 RCX: 0000000000000000
RDX: ffff88807cf10000 RSI: ffffffff82a4a081 RDI: 0000000000000003
RBP: ffff888079607a70 R08: 0000000000000001 R09: ffff88807a6d01d7
R10: ffffed100f4da03a R11: 0000000000000000 R12: ffff88800f0fb110
R13: ffff88800f0ee000 R14: ffff88800f0fb000 R15: 0000000000000001
FS: 00007f33b63c7540(0000) GS:ffff888108580000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f33b635c090 CR3: 000000000f39e005 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
load_system_files+0x1f7f/0x3620
ntfs_fill_super+0xa01/0x1be0
mount_bdev+0x36a/0x440
ntfs_mount+0x3a/0x50
legacy_get_tree+0xfb/0x210
vfs_get_tree+0x8f/0x2f0
do_new_mount+0x30a/0x760
path_mount+0x4de/0x1880
__x64_sys_mount+0x2b3/0x340
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f33b62ff9ea
Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd0c471aa8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f33b62ff9ea
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd0c471be0
RBP: 00007ffd0c471c60 R08: 00007ffd0c471ae0 R09: 00007ffd0c471c24
R10: 0000000000000000 R11: 0000000000000202 R12: 000055bac5afc160
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
Fix this by adding sanity check on extended system files' directory inode
to ensure that it is directory, just like ntfs_extend_init() when mounting
ntfs3.
Link: https://lkml.kernel.org/r/20220809064730.2316892-1-chenxiaosong2@huawei.com
Signed-off-by: ChenXiaoSong <chenxiaosong2@huawei.com>
Cc: Anton Altaparmakov <anton@tuxera.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -2092,7 +2092,8 @@ get_ctx_vol_failed:
// TODO: Initialize security.
/* Get the extended system files' directory inode. */
vol->extend_ino = ntfs_iget(sb, FILE_Extend);
- if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
+ if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
+ !S_ISDIR(vol->extend_ino->i_mode)) {
if (!IS_ERR(vol->extend_ino))
iput(vol->extend_ino);
ntfs_error(sb, "Failed to load $Extend.");
next prev parent reply other threads:[~2022-10-03 7:50 UTC|newest]
Thread overview: 97+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-03 7:10 [PATCH 5.15 00/83] 5.15.72-rc1 review Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 01/83] ALSA: hda: Do disconnect jacks at codec unbind Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 02/83] ALSA: hda: Fix hang at HD-audio codec unbinding due to refcount saturation Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 03/83] ALSA: hda: Fix Nvidia dp infoframe Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 04/83] ALSA: hda/realtek: fix speakers and micmute on HP 855 G8 Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 05/83] cgroup: reduce dependency on cgroup_mutex Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 06/83] cgroup: cgroup_get_from_id() must check the looked-up kn is a directory Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 07/83] uas: add no-uas quirk for Hiksemi usb_disk Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 08/83] usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 09/83] uas: ignore UAS for Thinkplus chips Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 10/83] usb: typec: ucsi: Remove incorrect warning Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 11/83] thunderbolt: Explicitly reset plug events delay back to USB4 spec value Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 12/83] net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 13/83] Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 14/83] can: c_can: dont cache TX messages for C_CAN cores Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 15/83] clk: ingenic-tcu: Properly enable registers before accessing timers Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 16/83] x86/sgx: Do not fail on incomplete sanitization on premature stop of ksgxd Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 17/83] ARM: dts: integrator: Tag PCI host with device_type Greg Kroah-Hartman
2022-10-03 7:10 ` Greg Kroah-Hartman [this message]
2022-10-03 7:10 ` [PATCH 5.15 19/83] mm/damon/dbgfs: fix memory leak when using debugfs_lookup() Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 20/83] net: mt7531: only do PLL once after the reset Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 21/83] Revert "firmware: arm_scmi: Add clock management to the SCMI power domain" Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 22/83] powerpc/64s/radix: dont need to broadcast IPI for radix pmd collapse flush Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 23/83] drm/i915/gt: Restrict forced preemption to the active context Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 24/83] drm/amdgpu: Add amdgpu suspend-resume code path under SRIOV Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 25/83] vduse: prevent uninitialized memory accesses Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 26/83] libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 27/83] mmc: moxart: fix 4-bit bus width and remove 8-bit bus width Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 28/83] mmc: hsq: Fix data stomping during mmc recovery Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 29/83] mm/page_alloc: fix race condition between build_all_zonelists and page allocation Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 30/83] mm: prevent page_frag_alloc() from corrupting the memory Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 31/83] mm: fix dereferencing possible ERR_PTR Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 32/83] mm/migrate_device.c: flush TLB while holding PTL Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 33/83] mm: fix madivse_pageout mishandling on non-LRU page Greg Kroah-Hartman
2022-10-03 7:10 ` [PATCH 5.15 34/83] mm,hwpoison: check mm when killing accessing process Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 35/83] media: dvb_vb2: fix possible out of bound access Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 36/83] media: rkvdec: Disable H.264 error detection Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 37/83] media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 38/83] swiotlb: max mapping size takes min align mask into account Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 39/83] ARM: dts: am33xx: Fix MMCHS0 dma properties Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 40/83] reset: imx7: Fix the iMX8MP PCIe PHY PERST support Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 41/83] ARM: dts: am5748: keep usb4_tm disabled Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 42/83] soc: sunxi: sram: Actually claim SRAM regions Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 43/83] soc: sunxi: sram: Prevent the driver from being unbound Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 44/83] soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 45/83] soc: sunxi: sram: Fix probe function ordering issues Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 46/83] soc: sunxi: sram: Fix debugfs info for A64 SRAM C Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 47/83] ASoC: imx-card: Fix refcount issue with of_node_put Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 48/83] arm64: dts: qcom: sm8350: fix UFS PHY serdes size Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 49/83] ASoC: tas2770: Reinit regcache on reset Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 50/83] drm/bridge: lt8912b: add vsync hsync Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 51/83] drm/bridge: lt8912b: set hdmi or dvi mode Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 52/83] drm/bridge: lt8912b: fix corrupted image output Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 53/83] Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 54/83] Input: melfas_mip4 - fix return value check in mip4_probe() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 55/83] gpio: mvebu: Fix check for pwm support on non-A8K platforms Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 56/83] usbnet: Fix memory leak in usbnet_disconnect() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 57/83] net: sched: act_ct: fix possible refcount leak in tcf_ct_init() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 58/83] cxgb4: fix missing unlock on ETHOFLD desc collect fail path Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 59/83] net/mlxbf_gige: Fix an IS_ERR() vs NULL bug in mlxbf_gige_mdio_probe Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 60/83] nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 61/83] wifi: mac80211: fix regression with non-QoS drivers Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 62/83] net: stmmac: power up/down serdes in stmmac_open/release Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 63/83] net: phy: Dont WARN for PHY_UP state in mdio_bus_phy_resume() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 64/83] selftests: Fix the if conditions of in test_extra_filter() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 65/83] vdpa/ifcvf: fix the calculation of queuepair Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 66/83] fs: split off setxattr_copy and do_setxattr function from setxattr Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 67/83] dont use __kernel_write() on kmap_local_page() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 68/83] clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 69/83] clk: iproc: Do not rely on node name for correct PLL setup Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 70/83] KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 71/83] perf metric: Add documentation and rename a variable Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 72/83] perf metric: Only add a referenced metric once Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 73/83] perf parse-events: Add const to evsel name Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 74/83] perf parse-events: Add new "metric-id" term Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 75/83] perf parse-events: Identify broken modifiers Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 76/83] perf list: Display hybrid PMU events with cpu type Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 77/83] perf tools: Check vmlinux/kallsyms arguments in all tools Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 78/83] perf tools: Enhance the matching of sub-commands abbreviations Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 79/83] perf list: Print all available tool events Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 80/83] x86/alternative: Fix race in try_get_desc() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 81/83] drm/i915/gem: Really move i915_gem_context.link under ref protection Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 82/83] perf pmu: Fix alias events list Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.15 83/83] perf evsel: Add tool event helpers Greg Kroah-Hartman
2022-10-03 11:31 ` [PATCH 5.15 00/83] 5.15.72-rc1 review Jon Hunter
2022-10-03 14:26 ` Guenter Roeck
2022-10-03 18:23 ` Florian Fainelli
2022-10-04 17:45 ` Greg Kroah-Hartman
2022-10-03 17:52 ` Guenter Roeck
2022-10-03 18:40 ` Ron Economos
2022-10-03 21:30 ` Shuah Khan
2022-10-03 22:12 ` Shuah Khan
2022-10-03 21:30 ` Slade Watkins
2022-10-04 4:02 ` Bagas Sanjaya
2022-10-04 8:05 ` Naresh Kamboju
2022-10-04 11:41 ` Sudip Mukherjee (Codethink)
2022-10-05 1:45 ` Kelsey Steele
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221003070722.440859023@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=anton@tuxera.com \
--cc=chenxiaosong2@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).