linux-kernel - Re: [syzbot] [erofs?] [fat?] WARNING in erofs_kill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Jul 2023 14:43:33 +0200
From:   Christian Brauner <brauner@...nel.org>
To:     Christoph Hellwig <hch@....de>
Cc:     Gao Xiang <hsiangkao@...ux.alibaba.com>,
        syzbot <syzbot+69c477e882e44ce41ad9@...kaller.appspotmail.com>,
        chao@...nel.org, huyue2@...lpad.com, jack@...e.cz,
        jefflexu@...ux.alibaba.com, linkinjeon@...nel.org,
        linux-erofs@...ts.ozlabs.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, sj1557.seo@...sung.com,
        syzkaller-bugs@...glegroups.com, xiang@...nel.org
Subject: Re: [syzbot] [erofs?] [fat?] WARNING in erofs_kill_sb

On Mon, Jul 31, 2023 at 01:16:22PM +0200, Christoph Hellwig wrote:
> On Mon, Jul 31, 2023 at 06:58:14PM +0800, Gao Xiang wrote:
> > Previously, deactivate_locked_super() or .kill_sb() will only be
> > called after fill_super is called, and .s_magic will be set at
> > the very beginning of erofs_fc_fill_super().
> >
> > After ("fs: open block device after superblock creation"), such
> > convension is changed now.  Yet at a quick glance,
> >
> > WARN_ON(sb->s_magic != EROFS_SUPER_MAGIC);
> >
> > in erofs_kill_sb() can be removed since deactivate_locked_super()
> > will also be called if setup_bdev_super() is falled.  I'd suggest
> > that removing this WARN_ON() in the related commit, or as
> > a following commit of the related branch of the pull request if
> > possible.
> 
> Agreed.  I wonder if we should really call into ->kill_sb before
> calling into fill_super, but I need to carefull look into the
> details.

I think checking for s_magic in erofs kill sb is wrong as it introduces
a dependency on both fill_super() having been called and that s_magic is
initialized first. If someone reorders erofs_kill_sb() such that s_magic
is only filled in once everything else succeeded it would cause the same
bug. That doesn't sound nice to me.

I think ->fill_super() should only be called after successfull
superblock allocation and after the device has been successfully opened.
Just as this code does now. So ->kill_sb() should only be called after
we're guaranteed that ->fill_super() has been called.

We already mostly express that logic through the fs_context object.
Anything that's allocated in fs_context->init_fs_context() is freed in
fs_context->free() before fill_super() is called. After ->fill_super()
is called fs_context->s_fs_info will have been transferred to
sb->s_fs_info and will have to be killed via ->kill_sb().

Does that make sense?