linux-kernel - Re: Regression caused by commit c83ed4c9dbb3 "ubifs: Abort readdir on error"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e4cbe883-003e-5522-400a-da79a98a0ec4@nod.at>
Date:   Tue, 25 Oct 2016 22:09:59 +0200
From:   Richard Weinberger <richard@....at>
To:     Peter Rosin <peda@...ntia.se>, linux-mtd@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Re: Regression caused by commit c83ed4c9dbb3 "ubifs: Abort readdir on
 error"

Peter,

On 25.10.2016 21:39, Peter Rosin wrote:
> Hi!
> 
> Early on in my boot procedure I create an overlay and shuffle
> things around a bit so that the original rootfs stays readonly
> at the bottom of an overlayed readwrite fs. This way I can just
> toss out the overlayed fs and have a clean and reliable way to
> do a "factory-reset". Both the read-only root and and the overlay
> are ubifs on nand.
> 
> Bisection points to commit c83ed4c9dbb3 "ubifs: Abort readdir
> on error". Reverting that commit on top of v4.9-rc2 fixes things.
> 
> My "shuffle script" is as follows (with an added comment
> indicating the first point of failure) and runs as the first
> script by init.
> 
> If I add a line
> 	ls -l /mnt || echo "ls -l /mnt failed"
> where that comment is right before the failure, I get no failure
> indication even with the broken commit, so directory traversal
> seems ok.
> 
> Cheers,
> Peter
> 
> #! /bin/bash
> 
> test "x$1" == xstart || exit 0
> 
> mkdir /tmp/log
> 
> /bin/mount -o remount,rw /dev
> 
> /bin/mount | /bin/grep -q "^overlay on / type overlay" && exit 0
> 
> if test -e /etc/factory-reset; then
>   /usr/sbin/ubiformat /dev/mtd7
>   rm /etc/factory-reset
> fi
> 
> /usr/sbin/ubiattach /dev/ubi_ctrl -m 7
> /usr/sbin/ubimkvol /dev/ubi1 -N ovl -m
> 
> /bin/mkdir -p /mnt/ovl
> /bin/mkdir -p /mnt/roroot
> /bin/mkdir -p /mnt/merge
> /bin/mount -t ubifs /dev/ubi1_0 /mnt/ovl
> 
> /bin/mkdir -p /mnt/ovl/ovl
> /bin/mkdir -p /mnt/ovl/work
> # with c83ed4c9dbb3, the following mount fails with
> # mount: mounting overlay on /mnt/merge failed: No such file or directory
> /bin/mount -t overlay -o lowerdir=/,upperdir=/mnt/ovl/ovl,workdir=/mnt/ovl/work overlay /mnt/merge

Uhhhh! Thanks for catching this.
I think I know what is going on, the fix exposes now internal UBIFS return codes to VFS.
Let me prepare a fix.

Thanks,
//richard