From patchwork Mon Oct 24 11:29:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8418 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp400344wru; Mon, 24 Oct 2022 04:46:57 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6VFffwG4VqcywIz/sCPehw4K+olppSZDoet+PPTR3/XH/pirVE8D68PCzNz2hhkWz81X+t X-Received: by 2002:a05:6402:144a:b0:461:8e34:d07b with SMTP id d10-20020a056402144a00b004618e34d07bmr9345340edx.426.1666612017407; Mon, 24 Oct 2022 04:46:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666612017; cv=none; d=google.com; s=arc-20160816; b=Y20k+3jnRsBn15ev5DAU/EbeAiqYjbo5WMdJ1qSkgusG0Ug+urpG/HCuq1Snkfwr+B R2HYiIUcbdnp/cfR1KQUHpgcPe5XCVlp7X4dKNa4iOEv9pIYAZvODHYxu049xi2ymLXa aNE/4ui1Dv3F66ym4UAPAAecRuLvoqF0GtKY8PZCNDPzgH81v/ojy/bThdc6M4qBDIxu I/POy8FhIdfcx7sadgf3WvIUdjf8mo/nR0bBqgQnAHIyzxiH/D41FIazKRVG3SIZ3hcr uoaZvZY2+tiK1WernqWtJWueTnBgu6R+dHJu75miayCWMBly17SSMbF08bUha/7OKvCK mOuQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=/CwINnO6kkuCU/+NvgukRUPTcsftgoURdE1JZc0rRgo=; b=rZYefbUsGvc+1wk+RhcTcP7WCuFbUPZl7Axonbe9M2cVyfHxAWOmu7e4Mf0S74qDRL PYZ1Jfcqzxe6fguTP3+yZN+3GVX6gx/PfKV262YbfYlWWUgQjUgiu/CxwN7/driAuAjM 0jtsTS9/nxvq6oWoXLlLQcrq3NeD3Usnho+e8cmzVDMNPZI+cI0xhAhtg2QH6jI8IrEk fUxG4h43OM7pRDN9nbS2M8jFCuI5QKxNdwHXtZnAmCX6YTvA4CMYOBNRbSR2IWxK5gcI 3OC8fXB8yz49Vk/H4bdutWQgz4LpoJ6bu96O8lWHIKqstm/UU3/S9n9/xTt0zhfbOPf1 bMwg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=tMC+rg2r; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id hc32-20020a17090716a000b0078ddd8656d9si28318189ejc.9.2022.10.24.04.46.34; Mon, 24 Oct 2022 04:46:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=tMC+rg2r; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231246AbiJXLnd (ORCPT + 99 others); Mon, 24 Oct 2022 07:43:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42796 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231419AbiJXLnM (ORCPT ); Mon, 24 Oct 2022 07:43:12 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9728D481E4; Mon, 24 Oct 2022 04:40:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id E26DACE1316; Mon, 24 Oct 2022 11:39:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D8541C433D6; Mon, 24 Oct 2022 11:38:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666611540; bh=2wJzM/OpT+moIcK13Z8XJcyYyeF+rkw2CkY7TGKvMG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tMC+rg2rpUtig8/KWYN6KytYmwXQ42EsJVecrk4aI7epXH4eh4DXPFm71PETqF8BZ SxxO6YzfdbntjGTSq8qjoXkv74Cv4hux5O8wFZSHsHk6Ye/5PfAcxQT0pzg+F8pgFC 8m0jFanwdXQizg4ZrRL0qquEbO1rOSh84m4U2Y2s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, ChenXiaoSong , Anton Altaparmakov , Andrew Morton Subject: [PATCH 4.9 005/159] ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() Date: Mon, 24 Oct 2022 13:29:19 +0200 Message-Id: <20221024112949.566093029@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024112949.358278806@linuxfoundation.org> References: <20221024112949.358278806@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747569362822376328?= X-GMAIL-MSGID: =?utf-8?q?1747569362822376328?= From: ChenXiaoSong commit 1b513f613731e2afc05550e8070d79fac80c661e upstream. Syzkaller reported BUG_ON as follows: ------------[ cut here ]------------ kernel BUG at fs/ntfs/dir.c:86! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 758 Comm: a.out Not tainted 5.19.0-next-20220808 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:ntfs_lookup_inode_by_name+0xd11/0x2d10 Code: ff e9 b9 01 00 00 e8 1e fe d6 fe 48 8b 7d 98 49 8d 5d 07 e8 91 85 29 ff 48 c7 45 98 00 00 00 00 e9 5a fb ff ff e8 ff fd d6 fe <0f> 0b e8 f8 fd d6 fe 0f 0b e8 f1 fd d6 fe 48 8b b5 50 ff ff ff 4c RSP: 0018:ffff888079607978 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000008000 RCX: 0000000000000000 RDX: ffff88807cf10000 RSI: ffffffff82a4a081 RDI: 0000000000000003 RBP: ffff888079607a70 R08: 0000000000000001 R09: ffff88807a6d01d7 R10: ffffed100f4da03a R11: 0000000000000000 R12: ffff88800f0fb110 R13: ffff88800f0ee000 R14: ffff88800f0fb000 R15: 0000000000000001 FS: 00007f33b63c7540(0000) GS:ffff888108580000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f33b635c090 CR3: 000000000f39e005 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: load_system_files+0x1f7f/0x3620 ntfs_fill_super+0xa01/0x1be0 mount_bdev+0x36a/0x440 ntfs_mount+0x3a/0x50 legacy_get_tree+0xfb/0x210 vfs_get_tree+0x8f/0x2f0 do_new_mount+0x30a/0x760 path_mount+0x4de/0x1880 __x64_sys_mount+0x2b3/0x340 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f33b62ff9ea Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd0c471aa8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f33b62ff9ea RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd0c471be0 RBP: 00007ffd0c471c60 R08: 00007ffd0c471ae0 R09: 00007ffd0c471c24 R10: 0000000000000000 R11: 0000000000000202 R12: 000055bac5afc160 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- Fix this by adding sanity check on extended system files' directory inode to ensure that it is directory, just like ntfs_extend_init() when mounting ntfs3. Link: https://lkml.kernel.org/r/20220809064730.2316892-1-chenxiaosong2@huawei.com Signed-off-by: ChenXiaoSong Cc: Anton Altaparmakov Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- fs/ntfs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ntfs/super.c +++ b/fs/ntfs/super.c @@ -2108,7 +2108,8 @@ get_ctx_vol_failed: // TODO: Initialize security. /* Get the extended system files' directory inode. */ vol->extend_ino = ntfs_iget(sb, FILE_Extend); - if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) { + if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) || + !S_ISDIR(vol->extend_ino->i_mode)) { if (!IS_ERR(vol->extend_ino)) iput(vol->extend_ino); ntfs_error(sb, "Failed to load $Extend.");