linux-kernel - Re: [PATCH v1] fs: improve dump_inode() to safely access inode fields.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d73zx7srt4todun77vlhx4k4o5sv4q4vu2nk3iecz4eu7cih4i@6fillvgbgpgq>
Date: Tue, 6 Jan 2026 09:15:06 +0100
From: Jan Kara <jack@...e.cz>
To: Yuto Ohnuki <ytohnuki@...zon.com>
Cc: Alexander Viro <viro@...iv.linux.org.uk>, 
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] fs: improve dump_inode() to safely access inode
 fields.

On Thu 01-01-26 16:53:04, Yuto Ohnuki wrote:
> Use get_kernel_nofault() to safely access inode and related structures
> (superblock, file_system_type) to avoid crashing when the inode pointer
> is invalid. This allows the same pattern as dump_mapping().
> 
> Note: The original access method for i_state and i_count is preserved,
> as get_kernel_nofault() is unnecessary once the inode structure is
> verified accessible.
> 
> Signed-off-by: Yuto Ohnuki <ytohnuki@...zon.com>

Very nice, thanks! Just one nit below:

> +	state = inode_state_read_once(inode);
> +	count = atomic_read(&inode->i_count);
>  
> +	if (!sb) {
> +		pr_warn("mode:%ho opflags:0x%x flags:0x%x state:0x%x count:%d\n",
> +			mode, opflags, flags, state, count);
> +		return;
> +	}

I'd merge this variant with the variant below because NULL inode->i_sb is
invalid as well and I think it's better to print that sb is invalid
explicitely instead of just not printing sb info. Otherwise feel free to
add:

Reviewed-by: Jan Kara <jack@...e.cz>

								Honza

> +
> +	if (get_kernel_nofault(s_type, &sb->s_type) || !s_type ||
> +	    get_kernel_nofault(fs_name_ptr, &s_type->name) || !fs_name_ptr) {
> +		pr_warn("invalid sb:%px mode:%ho opflags:0x%x flags:0x%x state:0x%x count:%d\n",
> +			sb, mode, opflags, flags, state, count);
> +		return;
> +	}
> +
> +	if (strncpy_from_kernel_nofault(fs_name, fs_name_ptr, sizeof(fs_name) - 1) < 0)
> +		strscpy(fs_name, "<invalid>");
> +
> +	pr_warn("fs:%s mode:%ho opflags:0x%x flags:0x%x state:0x%x count:%d\n",
> +		fs_name, mode, opflags, flags, state, count);
> +}
>  EXPORT_SYMBOL(dump_inode);
>  #endif
> -- 
> 2.50.1
> 
> 
> 
> 
> Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284
> 
> Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705
> 
> 
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR