linux-kernel - Re: [PATCH v2] ntfs: Ensure $Extend is a directory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 11 May 2023 16:55:50 +0900
From:   Namjae Jeon <linkinjeon@...nel.org>
To:     Soumya Negi <soumya.negi97@...il.com>
Cc:     Anton Altaparmakov <anton@...era.com>,
        Shuah Khan <skhan@...uxfoundation.org>,
        linux-ntfs-dev@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
        linux-kernel-mentees@...ts.linuxfoundation.org,
        Christian Brauner <brauner@...nel.org>
Subject: Re: [PATCH v2] ntfs: Ensure $Extend is a directory

2022-08-30 0:03 GMT+09:00, Soumya Negi <soumya.negi97@...il.com>:
> On Tue, Jul 26, 2022 at 05:15:13PM -0700, Soumya Negi wrote:
>> Fix Syzbot bug: kernel BUG in ntfs_lookup_inode_by_name
>> https://syzkaller.appspot.com/bug?id=32cf53b48c1846ffc25a185a2e92e170d1a95d71
>>
>> Check whether $Extend is a directory or not( for NTFS3.0+) while
>> loading system files. If it isn't(as in the case of this bug where the
>> mft record for $Extend contains a regular file), load_system_files()
>> returns false.
>>
>> Reported-by: syzbot+30b7f850c6d98ea461d2@...kaller.appspotmail.com
>> CC: stable@...r.kernel.org # 4.9+
>> Signed-off-by: Soumya Negi <soumya.negi97@...il.com>
>> ---
>> Changes since v1:
>> * Added CC tag for stable
>> * Formatted changelog to fit within 72 cols
>>
>> ---
>>  fs/ntfs/super.c | 9 +++++++--
>>  1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
>> index 5ae8de09b271..18e2902531f9 100644
>> --- a/fs/ntfs/super.c
>> +++ b/fs/ntfs/super.c
>> @@ -2092,10 +2092,15 @@ static bool load_system_files(ntfs_volume *vol)
>>  	// TODO: Initialize security.
>>  	/* Get the extended system files' directory inode. */
>>  	vol->extend_ino = ntfs_iget(sb, FILE_Extend);
>> -	if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
>> +	if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
>> +	    !S_ISDIR(vol->extend_ino->i_mode)) {
>> +		static const char *es1 = "$Extend is not a directory";
>> +		static const char *es2 = "Failed to load $Extend";
>> +		const char *es = !S_ISDIR(vol->extend_ino->i_mode) ? es1 : es2;
>> +
>>  		if (!IS_ERR(vol->extend_ino))
>>  			iput(vol->extend_ino);
>> -		ntfs_error(sb, "Failed to load $Extend.");
>> +		ntfs_error(sb, "%s.", es);
>>  		goto iput_sec_err_out;
>>  	}
>>  #ifdef NTFS_RW
>> --
>> 2.17.1
>
> Hi Anton,
> Have you had a chance to look at this patch?
Hi,

Could you elaborate more ? Isn't MFT_RECORD_IS_DIRECTORY flags set in
mft record of $Extend ?

> Thanks,
> Soumya
>
>