linux-kernel - Re: [PATCH v2 1/2] hfs: Validate CNIDs in hfs_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aSTuaUFnXzoQeIpv@Bertha>
Date: Mon, 24 Nov 2025 23:46:49 +0000
From: George Anthony Vernon <contact@...rnon.com>
To: Viacheslav Dubeyko <Slava.Dubeyko@....com>
Cc: "glaubitz@...sik.fu-berlin.de" <glaubitz@...sik.fu-berlin.de>,
	"penguin-kernel@...ove.SAKURA.ne.jp" <penguin-kernel@...ove.sakura.ne.jp>,
	"slava@...eyko.com" <slava@...eyko.com>,
	"skhan@...uxfoundation.org" <skhan@...uxfoundation.org>,
	"linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
	"frank.li@...o.com" <frank.li@...o.com>,
	"linux-kernel-mentees@...ts.linux.dev" <linux-kernel-mentees@...ts.linux.dev>,
	"syzbot+97e301b4b82ae803d21b@...kaller.appspotmail.com" <syzbot+97e301b4b82ae803d21b@...kaller.appspotmail.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 1/2] hfs: Validate CNIDs in hfs_read_inode

On Tue, Nov 11, 2025 at 10:42:09PM +0000, Viacheslav Dubeyko wrote:
> On Tue, 2025-11-11 at 23:39 +0900, Tetsuo Handa wrote:
> > On 2025/11/04 10:47, George Anthony Vernon wrote:
> > > +	if (!is_valid_cnid(inode->i_ino,
> > > +			   S_ISDIR(inode->i_mode) ? HFS_CDR_DIR : HFS_CDR_FIL))
> > > +		BUG();
> > 
> > Is it guaranteed that hfs_write_inode() and make_bad_inode() never run in parallel?
> > If no, this check is racy because make_bad_inode() makes S_ISDIR(inode->i_mode) == false.
> >  
> 
> Any inode should be completely created before any hfs_write_inode() call can
> happen. So, I don't see how hfs_write_inode() and make_bad_inode() could run in
> parallel.
> 

Could we not read the same inode a second time, during the execution of
hfs_write_inode()?

Then I believe we could hit make_bad_inode() in hfs_read_inode() once we
had already entered hfs_write_inode(), and so test a cnid against the
wrong i_mode.

Thanks,

George