linux-kernel - Regression caused by commit c83ed4c9dbb3 "ubifs: Abort readdir on error"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 25 Oct 2016 21:39:55 +0200
From:   Peter Rosin <peda@...ntia.se>
To:     Richard Weinberger <richard@....at>, linux-mtd@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Regression caused by commit c83ed4c9dbb3 "ubifs: Abort readdir on
 error"

Hi!

Early on in my boot procedure I create an overlay and shuffle
things around a bit so that the original rootfs stays readonly
at the bottom of an overlayed readwrite fs. This way I can just
toss out the overlayed fs and have a clean and reliable way to
do a "factory-reset". Both the read-only root and and the overlay
are ubifs on nand.

Bisection points to commit c83ed4c9dbb3 "ubifs: Abort readdir
on error". Reverting that commit on top of v4.9-rc2 fixes things.

My "shuffle script" is as follows (with an added comment
indicating the first point of failure) and runs as the first
script by init.

If I add a line
	ls -l /mnt || echo "ls -l /mnt failed"
where that comment is right before the failure, I get no failure
indication even with the broken commit, so directory traversal
seems ok.

Cheers,
Peter

#! /bin/bash

test "x$1" == xstart || exit 0

mkdir /tmp/log

/bin/mount -o remount,rw /dev

/bin/mount | /bin/grep -q "^overlay on / type overlay" && exit 0

if test -e /etc/factory-reset; then
  /usr/sbin/ubiformat /dev/mtd7
  rm /etc/factory-reset
fi

/usr/sbin/ubiattach /dev/ubi_ctrl -m 7
/usr/sbin/ubimkvol /dev/ubi1 -N ovl -m

/bin/mkdir -p /mnt/ovl
/bin/mkdir -p /mnt/roroot
/bin/mkdir -p /mnt/merge
/bin/mount -t ubifs /dev/ubi1_0 /mnt/ovl

/bin/mkdir -p /mnt/ovl/ovl
/bin/mkdir -p /mnt/ovl/work
# with c83ed4c9dbb3, the following mount fails with
# mount: mounting overlay on /mnt/merge failed: No such file or directory
/bin/mount -t overlay -o lowerdir=/,upperdir=/mnt/ovl/ovl,workdir=/mnt/ovl/work overlay /mnt/merge

cd /mnt/merge

/sbin/pivot_root . /mnt/merge/mnt/roroot

/bin/mount --rbind /mnt/roroot/proc /proc
/bin/mount --rbind /mnt/roroot/sys /sys
/bin/mount --rbind /mnt/roroot/dev /dev
/bin/mount --rbind /mnt/roroot/tmp /tmp
/bin/mount --rbind /mnt/roroot/run /run
/bin/mount --rbind /mnt/roroot/mnt/ovl /mnt/ovl

kill $PPID
kill -QUIT 1