linux-kernel - RE: [PATCH 1/2] exfat: fix referencing wrong parent directory information after renaming

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 28 Mar 2022 06:18:28 +0000
From:   "Yuezhang.Mo@...y.com" <Yuezhang.Mo@...y.com>
To:     Namjae Jeon <linkinjeon@...nel.org>
CC:     "sj1557.seo@...sung.com" <sj1557.seo@...sung.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "Andy.Wu@...y.com" <Andy.Wu@...y.com>,
        "Wataru.Aoyama@...y.com" <Wataru.Aoyama@...y.com>,
        "Kohada.Tetsuhiro@...MitsubishiElectric.co.jp" 
        <Kohada.Tetsuhiro@...mitsubishielectric.co.jp>
Subject: RE: [PATCH 1/2] exfat: fix referencing wrong parent directory
 information after renaming

Hi Namjae Jeon,

The issue can be reproduced by

Step 1: create and rename the file as:

dir=${mount_point}/dir

rm -fr ${mount_point}/*
mkdir ${dir}
dirsize=$(du -b ${dir} | awk '{print $1}')

for ((i = 1; i <= dirsize / (32 * 3); i++)); do
        touch ${dir}/file-$i
done

mkdir ${mount_point}/dir2

mv ${dir}/file-1 ${dir}/long-file-name-1234567890-1234567890

> > (1) The renamed file can not be written.
> >
> >     [10768.175172] exFAT-fs (sda1): error, failed to bmap (inode :
> > 7afd50e4 iblock : 0, err : -5)
> >     [10768.184285] exFAT-fs (sda1): Filesystem has been set read-only
> >     ash: write error: Input/output error
> Could you please elaborate how to reproduce it ?

Step 2: Write data to the renamed file, such as:

echo xxx > ${dir}/file-1 ${dir}/long-file-name-1234567890-1234567890

> > (2) Some dentries of the renamed file/directory are not set
> >     to deleted after removing the file/directory.

After applying the debug patch,
```diff
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -824,6 +824,11 @@ static int exfat_unlink(struct inode *dir, struct dentry *dentry)
        num_entries++;
        brelse(bh);
 
+       if (num_entries != ep->dentry.file.num_ext + 1) {
+               pr_err("file has %d entries\n", ep->dentry.file.num_ext + 1);
+               pr_err("But only set %d entries to deleted\n", num_entries);
+       }
+
        exfat_set_volume_dirty(sb);
        /* update the directory entry */
        if (exfat_remove_entries(dir, &cdir, entry, 0, num_entries)) {
```

We can find that 4 entries are not set to delete. 

[  388.140802] file has 5 entries
[  388.144200] But only set 1 entries to deleted