linux-kernel - Re: [PATCH] vfat: fix uninitialized i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_93CE617328A1683191A7418BCCE87AFE500A@qq.com>
Date: Wed, 20 Aug 2025 00:17:12 +0800
From: zhoumin <teczm@...mail.com>
To: hirofumi@...l.parknet.co.jp
Cc: linux-kernel@...r.kernel.org,
	teczm@...mail.com
Subject: Re: [PATCH] vfat: fix uninitialized i_pos error

Hi OGAWA-san,

Thank you for your review and feedback.

>> The i_pos field remains uninitialized when fat_fs_error_ratelimit() reports
>> error, e.g.,
>>
>> 	[ 1642.703550] FAT-fs (loop0): error, fat_get_cluster: invalid
>> 	cluster chain (i_pos 0)
>>
>> Since i_pos is assigned in fat_attach after fat_fill_inode, the error
>> message lacks useful debug info.
>>
>> Path:
>> vfat_lookup
>> 	fat_build_inode
>> 		fat_fill_inode
>> 			fat_calc_dir_size
>>           			fat_get_cluster /* report error */
>>       	fat_attach  /* i_pos assigned here */

> No. It is initialized as 0, and it must be unavailable outside
> between fat_attach and fat_detach.

I see that it was initialized to 0. What I meant is that when
fat_fs_error_ratelimit uses i_pos for debugging output, it doesn't get the
correct value.

> IOW, this is introducing the race.
I'm not quite clear about the race condition you mentioned here. Could you
give an example to explain it?

Actually, the modification I initially considered was as follows. I'm not
sure if this approach carries any risks. If it's acceptable, I'm ready to
submit a new version.

Thank you.


diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 3852bb66358c..837b1ad361ca 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -605,13 +605,14 @@ struct inode *fat_build_inode(struct super_block *sb,
        }
        inode->i_ino = iunique(sb, MSDOS_ROOT_INO);
        inode_set_iversion(inode, 1);
+       fat_attach(inode, i_pos);
        err = fat_fill_inode(inode, de);
        if (err) {
                iput(inode);
+               fat_detach(inode);
                inode = ERR_PTR(err);
                goto out;
-       }
-       fat_attach(inode, i_pos);
+       }
        insert_inode_hash(inode);
 out:
        fat_unlock_build_inode(MSDOS_SB(sb));

Best regards,
zhoumin