linux-kernel - Re: [PATCH v3] ovl: fix null pointer when filesystemdoesn'tsupportdirect IO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Sep 2021 16:00:47 +0200
From:   Miklos Szeredi <miklos@...redi.hu>
To:     Chengguang Xu <cgxu519@....com>
Cc:     Huang Jianan <huangjianan@...o.com>,
        overlayfs <linux-unionfs@...r.kernel.org>,
        linux-erofs@...ts.ozlabs.org, xiang@...nel.org, chao@...nel.org,
        guoweichao@...o.com, yh@...o.com, zhangshiming@...o.com,
        guanyuwei@...o.com, jnhuang95@...il.com,
        linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        Chengguang Xu <cgxu519@...ernel.net>
Subject: Re: [PATCH v3] ovl: fix null pointer when filesystemdoesn'tsupportdirect
 IO

On Wed, 22 Sept 2021 at 15:21, Chengguang Xu <cgxu519@....com> wrote:
>
> 在 2021/9/22 16:24, Huang Jianan 写道:
> >
> >
> > 在 2021/9/22 16:06, Chengguang Xu 写道:
> >> 在 2021/9/22 15:23, Huang Jianan 写道:
> >>> From: Huang Jianan <huangjianan@...o.com>
> >>>
> >>> At present, overlayfs provides overlayfs inode to users. Overlayfs
> >>> inode provides ovl_aops with noop_direct_IO to avoid open failure
> >>> with O_DIRECT. But some compressed filesystems, such as erofs and
> >>> squashfs, don't support direct_IO.
> >>>
> >>> Users who use f_mapping->a_ops->direct_IO to check O_DIRECT support,
> >>> will read file through this way. This will cause overlayfs to access
> >>> a non-existent direct_IO function and cause panic due to null pointer:
> >>
> >> I just looked around the code more closely, in open_with_fake_path(),
> >>
> >> do_dentry_open() has already checked O_DIRECT open flag and
> >> a_ops->direct_IO of underlying real address_space.
> >>
> >> Am I missing something?
> >>
> >>
> >
> > It seems that loop_update_dio will set lo->use_dio after open file
> > without set O_DIRECT.
> > loop_update_dio will check f_mapping->a_ops->direct_IO but it deal
> > with ovl_aops with
> > noop _direct_IO.
> >
> > So I think we still need a new aops?
>
>
> It means we should only set ->direct_IO for overlayfs inodes whose
> underlying fs has DIRECT IO ability.

First let's fix the oops: ovl_read_iter()/ovl_write_iter() must check
real file's ->direct_IO if IOCB_DIRECT is set in iocb->ki_flags and
return -EINVAL if not.

To fix the loop -> overlay -> squashfs case your suggestion of having
separate aops depending on the real inode's ->direct_IO sounds good.

Thanks,
Miklos