linux-kernel - Does ceph_fill_inode() mishandle I

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1385372.1741861062@warthog.procyon.org.uk>
Date: Thu, 13 Mar 2025 10:17:42 +0000
From: David Howells <dhowells@...hat.com>
To: Viacheslav Dubeyko <slava@...eyko.com>
cc: dhowells@...hat.com, Alex Markuze <amarkuze@...hat.com>,
    Xiubo Li <xiubli@...hat.com>, Ilya Dryomov <idryomov@...il.com>,
    Christian Brauner <brauner@...nel.org>, ceph-devel@...r.kernel.org,
    linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Does ceph_fill_inode() mishandle I_NEW?

ceph_fill_inode() seems to be mishandling I_NEW.  It only check I_NEW when
setting i_mode.  It then goes on to clobber a bunch of things in the inode
struct and ceph_inode_info struct (granted in some cases it's overwriting with
the same thing), irrespective of whether the inode is already set up
(i.e. if I_NEW isn't set).

It looks like I_NEW has been interpreted as to indicating that the inode is
being created as a filesystem object (e.g. by mkdir) whereas it's actually
merely about allocation and initialisation of struct inode in memory.

David