[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Yt1NVQEOC6Ki3eUI@kroah.com>
Date: Sun, 24 Jul 2022 15:47:01 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Soumya Negi <soumya.negi97@...il.com>
Cc: Anton Altaparmakov <anton@...era.com>,
Shuah Khan <skhan@...uxfoundation.org>,
linux-ntfs-dev@...ts.sourceforge.net,
linux-kernel-mentees@...ts.linuxfoundation.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ntfs: Ensure $Extend is a directory
On Sun, Jul 24, 2022 at 06:21:07AM -0700, Soumya Negi wrote:
> Fixes Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name
> https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71
>
> Check whether $Extend is a directory or not( for NTFS3.0+) while loading
> system files. If it isn't(as in the case of this bug where the mft record for
> $Extend contains a regular file), load_system_files() returns false.
Please wrap your changelog text at 72 columns like your editor asked you
to when writing this :)
>
> Reported-by: syzbot+30b7f850c6d98ea461d2@...kaller.appspotmail.com
> Signed-off-by: Soumya Negi <soumya.negi97@...il.com>
What commit caused this problem? What Fixes: tag should go here?
Should it go to stable kernels? If so, how far back?
> ---
> fs/ntfs/super.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
> index 5ae8de09b271..18e2902531f9 100644
> --- a/fs/ntfs/super.c
> +++ b/fs/ntfs/super.c
> @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol)
> // TODO: Initialize security.
> /* Get the extended system files' directory inode. */
> vol->extend_ino = ntfs_iget(sb, FILE_Extend);
> - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
> + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
> + !S_ISDIR(vol->extend_ino->i_mode)) {
> + static const char *es1 = "$Extend is not a directory";
> + static const char *es2 = "Failed to load $Extend";
> + const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2;
> +
> if (!IS_ERR(vol->extend_ino))
> iput(vol->extend_ino);
> - ntfs_error(sb, "Failed to load $Extend.");
> + ntfs_error(sb, "%s.", es);
Are you allowing the system log to be spammed by an untrusted user with
this change?
thanks,
greg k-h
Powered by blists - more mailing lists