linux-kernel - Re: [PATCH v2] ext4: fix a NULL pointer when validating an inode bitmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d357e15b-e44a-1e3b-41c3-0b732e4685ed@huawei.com>
Date:   Tue, 29 Nov 2022 11:18:34 +0800
From:   Baokun Li <libaokun1@...wei.com>
To:     Theodore Ts'o <tytso@....edu>,
        Luís Henriques <lhenriques@...e.de>
CC:     Andreas Dilger <adilger.kernel@...ger.ca>,
        <linux-ext4@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <stable@...r.kernel.org>
Subject: Re: [PATCH v2] ext4: fix a NULL pointer when validating an inode
 bitmap

On 2022/11/29 6:28, Theodore Ts'o wrote:
> On Tue, Nov 08, 2022 at 02:06:29PM +0000, Luís Henriques wrote:
>>> What makes you believe that?  Look at how s_group_info is initialized
>>> in ext4_mb_alloc_groupinfo() in fs/ext4/mballoc.c.  It's pretty
>>> careful to make sure this is not the case.
>> Right.  I may be missing something, but I don't think we get that far.
>> __ext4_fill_super() will first call ext4_setup_system_zone() (which is
>> where this bug occurs) and only after that ext4_mb_init() will be invoked
>> (which is where ext4_mb_alloc_groupinfo() will eventually be called).
> I finally got around to taking a closer look at this, and I have a
> much better understandign of what is going on.  For more details, and
> a suggested fix, please see:
>
>       https://bugzilla.kernel.org/show_bug.cgi?id=216541#c1
>
> 						- Ted
>
>
Hi Theodore,

In my opinion, the s_journal_inum should not be modified when the file 
system is
mounted, especially after we have successfully loaded and replayed the 
journal with
the current s_journal_inum. Even if the s_journal_inumon the disk is 
modified, we should
use the current one. This is how journal_devnum is handled in 
ext4_load_journal():

          if (!really_read_only && journal_devnum &&
              journal_devnum != le32_to_cpu(es->s_journal_dev)) {
                  es->s_journal_dev = cpu_to_le32(journal_devnum);

                  /* Make sure we flush the recovery flag to disk. */
                  ext4_commit_super(sb);
          }

We can avoid this problem by adding a similar check for journal_inum in 
ext4_load_journal().

-- 
With Best Regards,
Baokun Li