Hi Yong,
On 2025/5/13 19:34, Sheng Yong wrote:
From: Sheng Yong <shengyo...@xiaomi.com>
For multiple devices, both primary and extra devices should be the
same type. `erofs_init_device` has already guaranteed that if the
primary is a file-backed device, extra devices should also be
regular files.
However, if the primary is a block device while the extra device
is a file-backed device, `erofs_init_device` will get an ENOTBLK,
which is not treated as an error in `erofs_fc_get_tree`, and that
leads to an UAF:
erofs_fc_get_tree
get_tree_bdev_flags(erofs_fc_fill_super)
erofs_read_superblock
erofs_init_device // sbi->dif0 is not inited yet,
// return -ENOTBLK
deactivate_locked_super
free(sbi)
if (err is -ENOTBLK)
sbi->dif0.file = filp_open() // sbi UAF
So if -ENOTBLK is hitted in `erofs_init_device`, it means the
primary device must be a block device, and the extra device
is not a block device. The error can be converted to -EINVAL.
Yeah, nice catch.
As Hongbo said, it'd be better to add "Fixes:" tag
in the next version.
Signed-off-by: Sheng Yong <shengyo...@xiaomi.com>
---
fs/erofs/super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 512877d7d855..16b5b1f66584 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -165,8 +165,11 @@ static int erofs_init_device(struct erofs_buf *buf, struct
super_block *sb,
filp_open(dif->path, O_RDONLY | O_LARGEFILE, 0)
:
bdev_file_open_by_path(dif->path,
BLK_OPEN_READ, sb->s_type,
NULL);
- if (IS_ERR(file))
+ if (IS_ERR(file)) {
+ if (PTR_ERR(file) == -ENOTBLK)
It's preferred to use:
if (file == ERR_PTR(-ENOTBLK))
return -EINVAL;
Otherwise it looks good to me.
Could you submit it as a seperate patch so I
could apply directly?
Thanks,
Gao Xiang
