linux-kernel - Re: [PATCH] vfs: show filesystem name at dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGudoHEowsc290kfSgCjDJfB+RKOv2gLYS6y4OxyjhjPW07vMQ@mail.gmail.com>
Date: Mon, 11 Aug 2025 21:45:52 +0200
From: Mateusz Guzik <mjguzik@...il.com>
To: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc: Alexander Viro <viro@...iv.linux.org.uk>, Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>, 
	linux-fsdevel <linux-fsdevel@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] vfs: show filesystem name at dump_inode()

On Mon, Aug 11, 2025 at 8:50 AM Tetsuo Handa
<penguin-kernel@...ove.sakura.ne.jp> wrote:
>
> Commit 8b17e540969a ("vfs: add initial support for CONFIG_DEBUG_VFS") added
> dump_inode(), but dump_inode() currently reports only raw pointer address.
> Comment says that adding a proper inode dumping routine is a TODO.
>
> However, syzkaller concurrently tests multiple filesystems, and several
> filesystems started calling dump_inode() due to hitting VFS_BUG_ON_INODE()
> added by commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
> before a proper inode dumping routine is implemented.
>
> Show filesystem name at dump_inode() so that we can find which filesystem
> has passed an invalid mode to may_open() from syzkaller's crash reports.
>
> Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> ---
>  fs/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/inode.c b/fs/inode.c
> index 01ebdc40021e..8a60aec94245 100644
> --- a/fs/inode.c
> +++ b/fs/inode.c
> @@ -2914,7 +2914,7 @@ EXPORT_SYMBOL(mode_strip_sgid);
>   */
>  void dump_inode(struct inode *inode, const char *reason)
>  {
> -       pr_warn("%s encountered for inode %px", reason, inode);
> +       pr_warn("%s encountered for inode %px (%s)\n", reason, inode, inode->i_sb->s_type->name);
>  }
>
>  EXPORT_SYMBOL(dump_inode);
> --
> 2.50.1

Better printing is a TODO in part because the routine must not trip
over arbitrarily bogus state, in this case notably that's unset
->i_sb.

See mm/debug.c:dump_vmg for an example.

I could swear one of the dumping routines in mm was using something
special to deref pointers without tripping over it either, but now I
can't find it.

All that said, I suggest this direction:
diff --git a/fs/inode.c b/fs/inode.c
index 01ebdc40021e..113fcb8da983 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -2914,7 +2914,9 @@ EXPORT_SYMBOL(mode_strip_sgid);
  */
 void dump_inode(struct inode *inode, const char *reason)
 {
-       pr_warn("%s encountered for inode %px", reason, inode);
+       struct super_block *sb = inode->i_sb; /* will be careful deref later */
+
+       pr_warn("%s encountered for inode %px [fs %s]", reason, inode,
sb ? sb->s_type->name : "NOT SET");
 }

 EXPORT_SYMBOL(dump_inode);

Can't do a proper submission at the moment and I'm not going to argue
about authorship should this land. :)

-- 
Mateusz Guzik <mjguzik gmail.com>