linux-kernel - Re: [PATCH] ufs: Add table lookup to set d_type based on mode & S

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 14 Jun 2024 00:17:17 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Abhinav Jain <jain.abhinav177@...il.com>
Cc: dushistov@...l.ru, linux-kernel@...r.kernel.org,
	skhan@...uxfoundation.org, javier.carrasco.cruz@...il.com
Subject: Re: [PATCH] ufs: Add table lookup to set d_type based on mode &
 S_IFMT

On Thu, Jun 13, 2024 at 09:40:47PM +0100, Al Viro wrote:

> should've raised an arseload of mental red flags.  That loop is
> bloody ridiculous, even if you don't bother to check what other
> similar filesystems actually do in the counterpart of that logics.
> 
> "Table lookup" does *NOT* refer to that.  What you've got is strictly
> worse than the original switch, and that takes some doing.
> 
> NAK.

Note, BTW, that for DT_... values are exactly the same as bits 12..15 of
mode_t.  That's not accidental.  So for valid mode values it's simply

{
        if ((UFS_SB(sb)->s_flags & UFS_DE_MASK) == UFS_DE_44BSD)
		de->d_u.d_44.d_type = (mode & S_IFMT) >> 12;
}

The 'mode' argument is always inode->i_mode for some inode.  Two possible
variants: put validation into ufs_set_inode_ops() and make it fail when
the type is bad (note that init_special_inode() will already scream bloody
murder in that case) or put the validation in ufs_set_de_type() - that
would be

{
        if ((UFS_SB(sb)->s_flags & UFS_DE_MASK) == UFS_DE_44BSD) {
		unsigned char v = (mode & S_IFMT) >> 12;
		switch (v) {
		case DT_REG: case DT_DIR: case DT_LNK: case DT_SOCK:
		case DT_CHR: case DT_BLK: case DT_FIFO:
			break;
		default:
			v = DT_UNKNOWN;
		}
		de->d_u.d_44.d_type = v;
	}
}

The first variant has a potential weakness - you might be unable to
unlink() junk on corrupted filesystem, but then you really don't
want to do that; it's likely to be not only thing that got corrupted
there.