From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758761AbcBTPyN (ORCPT ); Sat, 20 Feb 2016 10:54:13 -0500 Received: from 12.mo5.mail-out.ovh.net ([46.105.39.65]:45447 "EHLO 12.mo5.mail-out.ovh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758092AbcBTPyL (ORCPT ); Sat, 20 Feb 2016 10:54:11 -0500 X-Greylist: delayed 6603 seconds by postgrey-1.27 at vger.kernel.org; Sat, 20 Feb 2016 10:54:11 EST Subject: Re: fs: NULL deref in atime_needs_update To: Al Viro , Dmitry Vyukov References: <56C3B35E.6020109@digikod.net> <20160220032127.GA19926@ZenIV.linux.org.uk> <20160220035442.GE17997@ZenIV.linux.org.uk> Cc: "linux-fsdevel@vger.kernel.org" , LKML , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= X-Enigmail-Draft-Status: N1110 Message-ID: <56C86954.6030101@digikod.net> Date: Sat, 20 Feb 2016 14:25:40 +0100 User-Agent: MIME-Version: 1.0 In-Reply-To: <20160220035442.GE17997@ZenIV.linux.org.uk> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf" X-Ovh-Tracer-Id: 7591380123718428999 X-Ovh-Remote: 94.23.54.103 (ns3096276.ip-94-23-54.eu) X-Ovh-Local: 213.186.33.20 (ns0.ovh.net) X-OVH-SPAMSTATE: OK X-OVH-SPAMSCORE: -100 X-OVH-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeekjedrhedvucetufdoteggodftvfcurfhrohhfihhlvgemucfqggfjnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeekjedrhedvgdeglecutefuodetggdotffvucfrrhhofhhilhgvmecuqfggjfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 20/02/2016 04:54, Al Viro wrote: > On Sat, Feb 20, 2016 at 03:21:27AM +0000, Al Viro wrote: >> On Fri, Feb 19, 2016 at 08:32:10PM +0100, Dmitry Vyukov wrote: >>>> BUG: unable to handle kernel NULL pointer dereference at 00000000000= 00050 >> >> NULL inode->i_sb, by the look of the offset, but I really don't unders= tand >> where the hell is that code doing (or how is that instruction going to= >> generate dereferencing of 0x50, for that matter). >=20 > BTW, Micka=EBl's trace *does* make sense and it's definitely NULL inode= ->i_sb > (inode itself - in %rsi, inode->i_sb - in %rdx, offset of s_flags is 0x= 50, > the line in question is > if ((inode->i_sb->s_flags & MS_NODIRATIME) && S_ISDIR(inode->i_= mode)) >=20 > What I don't understand is what could possibly have NULL ->i_sb in *any= * > instance of struct inode. >=20 I can also trigger bugs with a bad inode pointer dereference in atime_nee= ds_update: if (inode->i_flags & S_NOATIME) I think the bug may be somewhere in the nd->depth handling (when its valu= e is 0) in fs/namei.c:get_link(): struct saved *last =3D nd->stack + nd->= depth - 1 Moreover, is it intentional that touch_atime() is called by get_link() ev= en if the access (previously checked with security_file_open(), e.g. by d= o_last) is denied? --w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJWyGlUAAoJECLe/t9zvWqV8UsIAJSYwe+V8ERiSK7pqmdR/ZUZ d3uVsojVL7lT5iJiZUhlJExAHG8OfMZ8QgXvUKi8CDO9yNyYJzba6/ERNAEvHrEA NLIwgTcqWlqZ41qElUIt7PlGbp9alHZ/7n8e2iY0mftyYLjWYJJNooi6Pc/f03WN ByZk/ovJ/flM91SN0iJH7+lIaiYKBrQvIDOzoml70lqmgofgtkaO3ia9OJwRFXB5 QR8/iUU2lFNJXnLZXNIO2F8KSn0x7XM1qdXksKswPWlDVLtu63kJXz6+y0zuEOqb T7Ef1SlC08y8quRKJY+qEg8lTJTooHiAPQQQtFUMYV3qqxkvM8eoFQSjPm0kGaA= =8DvU -----END PGP SIGNATURE----- --w1Ch6WQwUm7ovfGiKlERD1aaSIbfsfFuf--