linux-kernel - Re: [PATCH v3] fs: improve dump_inode() to safely access inode fields

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGudoHGcOciFD4MeEn-G7DP7vtrig1czi-saqmpB8_oQxvro7A@mail.gmail.com>
Date: Mon, 12 Jan 2026 19:19:21 +0100
From: Mateusz Guzik <mjguzik@...il.com>
To: Yuto Ohnuki <ytohnuki@...zon.com>
Cc: Alexander Viro <viro@...iv.linux.org.uk>, Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] fs: improve dump_inode() to safely access inode fields

On Mon, Jan 12, 2026 at 7:14 PM Yuto Ohnuki <ytohnuki@...zon.com> wrote:
>
> Use get_kernel_nofault() to safely access inode and related structures
> (superblock, file_system_type) to avoid crashing when the inode pointer
> is invalid. This allows the same pattern as dump_mapping().
>
> Note: The original access method for i_state and i_count is preserved,
> as get_kernel_nofault() is unnecessary once the inode structure is
> verified accessible.
>
> Reviewed-by: Jan Kara <jack@...e.cz>
> Signed-off-by: Yuto Ohnuki <ytohnuki@...zon.com>
> ---
> Changes in v3:
> - Avoided pr_warn duplication for long-term maintainability.
> - Changed "invalid inode" to "unreadable inode", and clearly denote the
>   situation where sb is unreadable as suggested by Mateusz Guzik.
> - Added passed reason to all pr_warn outputs.
> - Used %# format specifier for printing hex values, verified to
>   work as expected.
> - Link to v2: https://lore.kernel.org/linux-fsdevel/20260109154019.74717-1-ytohnuki@amazon.com/
>
> Changes in v2:
> - Merged NULL inode->i_sb check with invalid sb check as pointed out
>   by Jan Kara.
> - Link to v1: https://lore.kernel.org/linux-fsdevel/20260101165304.34516-1-ytohnuki@amazon.com/
> ---
>  fs/inode.c | 47 ++++++++++++++++++++++++++++++++++-------------
>  1 file changed, 34 insertions(+), 13 deletions(-)
>
> diff --git a/fs/inode.c b/fs/inode.c
> index 521383223d8a..440ae05f9df5 100644
> --- a/fs/inode.c
> +++ b/fs/inode.c
> @@ -2984,24 +2984,45 @@ umode_t mode_strip_sgid(struct mnt_idmap *idmap,
>  EXPORT_SYMBOL(mode_strip_sgid);
>
>  #ifdef CONFIG_DEBUG_VFS
> -/*
> - * Dump an inode.
> - *
> - * TODO: add a proper inode dumping routine, this is a stub to get debug off the
> - * ground.
> +/**
> + * dump_inode - dump an inode.
> + * @inode: inode to dump
> + * @reason: reason for dumping
>   *
> - * TODO: handle getting to fs type with get_kernel_nofault()?
> - * See dump_mapping() above.
> + * If inode is an invalid pointer, we don't want to crash accessing it,
> + * so probe everything depending on it carefully with get_kernel_nofault().
>   */
>  void dump_inode(struct inode *inode, const char *reason)
>  {
> -       struct super_block *sb = inode->i_sb;
> +       struct super_block *sb;
> +       struct file_system_type *s_type;
> +       const char *fs_name_ptr;
> +       char fs_name[32] = {};
> +       umode_t mode;
> +       unsigned short opflags;
> +       unsigned int flags;
> +       unsigned int state;
> +       int count;
> +
> +       if (get_kernel_nofault(sb, &inode->i_sb) ||
> +           get_kernel_nofault(mode, &inode->i_mode) ||
> +           get_kernel_nofault(opflags, &inode->i_opflags) ||
> +           get_kernel_nofault(flags, &inode->i_flags)) {
> +               pr_warn("%s: unreadable inode:%px\n", reason, inode);
> +               return;
> +       }
>
> -       pr_warn("%s encountered for inode %px\n"
> -               "fs %s mode %ho opflags 0x%hx flags 0x%x state 0x%x count %d\n",
> -               reason, inode, sb->s_type->name, inode->i_mode, inode->i_opflags,
> -               inode->i_flags, inode_state_read_once(inode), atomic_read(&inode->i_count));
> -}
> +       state = inode_state_read_once(inode);
> +       count = atomic_read(&inode->i_count);
>
> +       if (!sb ||
> +           get_kernel_nofault(s_type, &sb->s_type) || !s_type ||
> +           get_kernel_nofault(fs_name_ptr, &s_type->name) || !fs_name_ptr ||
> +           strncpy_from_kernel_nofault(fs_name, fs_name_ptr, sizeof(fs_name) - 1) < 0)
> +               strscpy(fs_name, "<unknown, sb unreadable>");
> +
> +       pr_warn("%s: inode:%px fs:%s mode:%ho opflags:%#x flags:%#x state:%#x count:%d\n",
> +               reason, inode, fs_name, mode, opflags, flags, state, count);
> +}
>  EXPORT_SYMBOL(dump_inode);
>  #endif

nice, thank you

Reviewed-by: Mateusz Guzik <mjguzik@...il.com>

> --
> 2.50.1
>
>
>
>
> Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284
>
> Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705
>
>
>