Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: i31e841b0:Fastmail
Message-ID: <55fad458-e2ef-3e5f-e1fa-b389167858f4@themaw.net>
Date:   Mon, 24 Oct 2022 08:06:51 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.3.1
Subject: Re: [syzbot] general protection fault in _parse_integer_fixup_radix
Content-Language: en-US
To:     Hugh Dickins <hughd@google.com>,
        Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc:     syzbot <syzbot+db1d2ea936378be0e4ea@syzkaller.appspotmail.com>,
        syzkaller-bugs@googlegroups.com,
        Andrew Morton <akpm@linux-foundation.org>,
        linux-kernel@vger.kernel.org, Al Viro <viro@zeniv.linux.org.uk>,
        Carlos Maiolino <cmaiolino@redhat.com>,
        David Howells <dhowells@redhat.com>,
        kernel test robot <oliver.sang@intel.com>,
        Miklos Szeredi <miklos@szeredi.hu>,
        Siddhesh Poyarekar <siddhesh@gotplt.org>,
        Theodore Ts'o <tytso@mit.edu>,
        Hawkins Jiawei <yin31149@gmail.com>
References: <0000000000002feb6605eb71458e@google.com>
 <ce198a72-92c9-e09a-ca92-2860326c2938@I-love.SAKURA.ne.jp>
 <17a1fdc-14a0-cf3c-784f-baa939895aef@google.com>
From:   Ian Kent <raven@themaw.net>
In-Reply-To: <17a1fdc-14a0-cf3c-784f-baa939895aef@google.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 24/10/22 02:50, Hugh Dickins wrote:
> On Sun, 23 Oct 2022, Tetsuo Handa wrote:
>
>> syzbot is reporting that "vfs: parse: deal with zero length string value"
>> in linux-next.git broke tmpfs's mount option parsing, for tmpfs is expecting that
>> vfs_parse_fs_string() returning 0 implies that param.string != NULL.
>>
>> The "nr_inodes" parameter for tmpfs is interpreted as "nr_inodes=$integer", but
>> the addition of
>>
>> 	if (!v_size) {
>> 		param.string = NULL;
>> 		param.type = fs_value_is_empty;
>> 	} else {
>>
>> to vfs_parse_fs_string() and
>>
>> 	if (param->type == fs_value_is_empty)
>> 		return 0;
>>
>> to fs_param_is_string() broke expectation by tmpfs.
>>
>>    Parsing an fs string that has zero length should result in the parameter
>>    being set to NULL so that downstream processing handles it correctly.
>>
>> is wrong and
>>
>>    Parsing an fs string that has zero length should result in invalid argument
>>    error so that downstream processing does not dereference NULL param.string
>>    field.

It's not quite as simple at that.


Not allowing a zero length string will break cases where mount "source"

can be empty.


Maybe parsing of "source" would be better handled separately, rather than

with options handling code, it is slightly different ... mmm ... I'll check

the reported cases ...


Ian