Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2194109/?format=api
{ "id": 2194109, "url": "http://patchwork.ozlabs.org/api/patches/2194109/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-ext4/patch/20260206212654.work.035-kees@kernel.org/", "project": { "id": 8, "url": "http://patchwork.ozlabs.org/api/projects/8/?format=api", "name": "Linux ext4 filesystem development", "link_name": "linux-ext4", "list_id": "linux-ext4.vger.kernel.org", "list_email": "linux-ext4@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260206212654.work.035-kees@kernel.org>", "list_archive_url": null, "date": "2026-02-06T21:27:03", "name": "ext4: Reject on-disk mount options with missing NUL-terminator", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "2c8e10399e6995aeb3f2cf6a9130b1fab1ba69f6", "submitter": { "id": 85255, "url": "http://patchwork.ozlabs.org/api/people/85255/?format=api", "name": "Kees Cook", "email": "kees@kernel.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-ext4/patch/20260206212654.work.035-kees@kernel.org/mbox/", "series": [ { "id": 491335, "url": "http://patchwork.ozlabs.org/api/series/491335/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-ext4/list/?series=491335", "date": "2026-02-06T21:27:03", "name": "ext4: Reject on-disk mount options with missing NUL-terminator", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/491335/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2194109/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2194109/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <SRS0=z/pl=AK=vger.kernel.org=linux-ext4+bounces-13604-patchwork-incoming=ozlabs.org@ozlabs.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-ext4@vger.kernel.org" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "patchwork-incoming@ozlabs.org" ], "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=Nf0CKj74;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=ozlabs.org\n (client-ip=150.107.74.76; helo=mail.ozlabs.org;\n envelope-from=srs0=z/pl=ak=vger.kernel.org=linux-ext4+bounces-13604-patchwork-incoming=ozlabs.org@ozlabs.org;\n receiver=patchwork.ozlabs.org)", "gandalf.ozlabs.org;\n arc=pass smtp.remote-ip=104.64.211.4 arc.chain=subspace.kernel.org", "gandalf.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=kernel.org", "gandalf.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=Nf0CKj74;\n\tdkim-atps=neutral", "gandalf.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=104.64.211.4; helo=sin.lore.kernel.org;\n envelope-from=linux-ext4+bounces-13604-patchwork-incoming=ozlabs.org@vger.kernel.org;\n receiver=ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=\"Nf0CKj74\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=10.30.226.201" ], "Received": [ "from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1 raw public key)\n server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4f76cQ17Xgz1xvh\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 07 Feb 2026 08:27:17 +1100 (AEDT)", "from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3])\n\tby gandalf.ozlabs.org (Postfix) with ESMTP id 4f76cP0Llrz4wCP\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 07 Feb 2026 08:27:17 +1100 (AEDT)", "by gandalf.ozlabs.org (Postfix)\n\tid 4f76cP04s9z4w0L; Sat, 07 Feb 2026 08:27:17 +1100 (AEDT)", "from sin.lore.kernel.org (sin.lore.kernel.org [104.64.211.4])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby gandalf.ozlabs.org (Postfix) with ESMTPS id 4f76cK01xRz4wCp\n\tfor <patchwork-incoming@ozlabs.org>; Sat, 07 Feb 2026 08:27:12 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 53F223004C9E\n\tfor <patchwork-incoming@ozlabs.org>; Fri, 6 Feb 2026 21:27:09 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 04C023101AA;\n\tFri, 6 Feb 2026 21:27:08 +0000 (UTC)", "from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org\n [10.30.226.201])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id BA94B168BD;\n\tFri, 6 Feb 2026 21:27:07 +0000 (UTC)", "by smtp.kernel.org (Postfix) with ESMTPSA id 38600C116C6;\n\tFri, 6 Feb 2026 21:27:07 +0000 (UTC)" ], "ARC-Seal": [ "i=2; a=rsa-sha256; d=ozlabs.org; s=201707; t=1770413237; cv=pass;\n\tb=oqBKgThV5Fa//VzjSm83kNs9qmBlICIY4uAVpH154hSZRHuamHVW7i+65/0HNUZ9m4X88O5LOR00lU8+PgcmD0kCj3xkhBNgvVp/r9866jFqCJEdqpBK+LgeWDpFdw88HKoLR8HTpm7inWt/KkcBcrlMUcwF66TGGNrZZXJnSYdp/B9oLT5ik42HNr2uSWbW5WbuBszqy2gTPjX5U1AfqjlWY2QbKjEftow6zDu/97vFdEH2ndSNpnkFcYyikf5dJqQ7pf/iuevTqxMmRkFw+AtLBUc+pc/L/YJA1QSzI5Q0Y425j9xc0Gbq4XgfhE4cGaHut305F8wY7dYRvmZDzQ==", "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1770413227; cv=none;\n b=HY0cgfU8MLtKGOu/2BxQiiZ0b61+6d/0uQLIWS3iiRHCRo0SUIkMhFtmVI9n8mvpZ8S2WnGPcNPLu5LaBsheQO9JfSzUlAeYKjDWsj+A/rmwJB4WEhAmkb8sc6K9PazfVZaBzCvAPzLAV/u/dor6YbruZdkbMdkhVvyEmUJ8N9Y=" ], "ARC-Message-Signature": [ "i=2; a=rsa-sha256; d=ozlabs.org; s=201707;\n\tt=1770413237; c=relaxed/relaxed;\n\tbh=A7J4xWnv5WmrHHbA8Pyb8UOlqQkfhr49NetVINJMGd0=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type;\n b=f4obDQ/7aVVKAAHwIxXfiiGjLdh2hqR0ntzystDiMGB6eKxf3JbnJBC2eSM24dXpot/FvAvfU8TW+ex7igiF2jQu1D7SUWj2Lw1ONDKqXkc5gTCiODNu6wtNloubRK8oksJe0KPR6pVhu81zJ3bHcdH4wCbrZ8VXe3DmvRkfKufpdkIxPmdHcVPdf1hf+M2z7+NJHFF+P/BxeH0D0pO1NVV1a/GTCr00SgZdLU6oxGH3eDNfAnYcKCj7zYl8+AwZqGMMxhIRw7U+Qp63/2mirefeaz7/a0gOAFcE1ktE60HdeYb/IaEcO9h79WMdymTfV5BER6VBpWXBOcKIa5uZPA==", "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1770413227; c=relaxed/simple;\n\tbh=OiXVY1vI80wzSxaGlo+lQpLE1RdgdtyDMpPUx9FkJVk=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type;\n b=WWgAIhmFD+5dZv8bGU4zRvf9ejfBCw+CBMI5wKftPWKcVK/ZkuyUb/7eOFk87GfGS/7fRP+S7uLOTwBBq37bqoyFkc3qL54qWbmDW2bSU4neJlOKrqjgqwNRutFd9q8nehbSEa8c2JDnlzbgeh3/qiU3I7/ZUAek8MriNWfEIFA=" ], "ARC-Authentication-Results": [ "i=2; gandalf.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=kernel.org;\n dkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=Nf0CKj74; dkim-atps=neutral;\n spf=pass (client-ip=104.64.211.4; helo=sin.lore.kernel.org;\n envelope-from=linux-ext4+bounces-13604-patchwork-incoming=ozlabs.org@vger.kernel.org;\n receiver=ozlabs.org) smtp.mailfrom=vger.kernel.org", "i=1; smtp.subspace.kernel.org;\n dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=Nf0CKj74; arc=none smtp.client-ip=10.30.226.201" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;\n\ts=k20201202; t=1770413227;\n\tbh=OiXVY1vI80wzSxaGlo+lQpLE1RdgdtyDMpPUx9FkJVk=;\n\th=From:To:Cc:Subject:Date:From;\n\tb=Nf0CKj74pfsoJHwPLVWnNVdihiG8LQWiNZz0vSPmEkWtlzOx7IlgcHikgEdzOBEPq\n\t he/zBElOCyoFNwvK6eYNWCj2IMadprCCx0NWQ3VpTiJ+FIR37stEiuN0Ibk0bc/g0J\n\t 5xF1h1DVep9Fb/lVRM7K5GrFkCJNGyACzDLHGpC6jd0NMuqg5AYgubU1183F3hJtaG\n\t LR8GXMqIaDSKvHpB79xvJNORC1Fom3SJclmlMVAnu+q+52/8wMfJIzW6XyX77Srdej\n\t Dm9wk1vAjrwe+EAxVdq97BZpXkBhMtRgZkEM/n/KH1W4WvUp4q6xhM9LhHKQj0n5Ro\n\t fxjJCjnpJGq2w==", "From": "Kees Cook <kees@kernel.org>", "To": "\"Theodore Ts'o\" <tytso@mit.edu>", "Cc": "Kees Cook <kees@kernel.org>,\n =?utf-8?b?5p2O6b6Z5YW0?= <coregee2000@gmail.com>,\n Andreas Dilger <adilger.kernel@dilger.ca>,\n Andy Shevchenko <andriy.shevchenko@intel.com>, linux-ext4@vger.kernel.org,\n linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org", "Subject": "[PATCH] ext4: Reject on-disk mount options with missing\n NUL-terminator", "Date": "Fri, 6 Feb 2026 13:27:03 -0800", "Message-Id": "<20260206212654.work.035-kees@kernel.org>", "X-Mailer": "git-send-email 2.34.1", "Precedence": "bulk", "X-Mailing-List": "linux-ext4@vger.kernel.org", "List-Id": "<linux-ext4.vger.kernel.org>", "List-Subscribe": "<mailto:linux-ext4+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-ext4+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "X-Developer-Signature": "v=1; a=openpgp-sha256; l=4850; i=kees@kernel.org;\n h=from:subject:message-id; bh=OiXVY1vI80wzSxaGlo+lQpLE1RdgdtyDMpPUx9FkJVk=;\n b=owGbwMvMwCVmps19z/KJym7G02pJDJltMcs3tfI+cCzorHHbEZC1uZKB813cHluzuu2ZWYsF1\n Vew6bzpKGVhEONikBVTZAmyc49z8XjbHu4+VxFmDisTyBAGLk4BmEhDCiPDIoFJf6cuY+oOLj8k\n q718xXa+t1JvrGzyEi6WHDn3b8PsTYwMVxmtZJsWs5gtWJV+9ttWJrtkHRYh+63n7m+Tq7hbx6L\n KCwA=", "X-Developer-Key": "i=kees@kernel.org; a=openpgp;\n fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026", "Content-Transfer-Encoding": "8bit", "X-Spam-Status": "No, score=-1.2 required=5.0 tests=ARC_SIGNED,ARC_VALID,\n\tDKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DMARC_PASS,\n\tMAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=disabled\n\tversion=4.0.1", "X-Spam-Checker-Version": "SpamAssassin 4.0.1 (2024-03-25) on gandalf.ozlabs.org" }, "content": "When mounting an ext4 filesystem, the on-disk superblock's s_mount_opts\nfield (which stores default mount options set via tune2fs) is read and\nparsed. Unlike userspace-provided mount options which are validated by\nthe VFS layer before reaching the filesystem, the on-disk s_mount_opts\nis read directly from the disk buffer without NUL-termination validation.\n\nThe two option paths use the same parser but arrive differently:\n\n Userspace mount options:\n VFS -> ext4_parse_param()\n\n On-disk default options:\n parse_apply_sb_mount_options() -> parse_options() -> ext4_parse_param()\n\nWhen s_mount_opts lacks NUL-termination, strscpy_pad()'s internal\nfortified strnlen() detects reading beyond the 64-byte field, triggering\nan Oops:\n\n strnlen: detected buffer overflow: 65 byte read of buffer size 64\n WARNING: CPU: 0 PID: 179 at lib/string_helpers.c:1035 __fortify_report+0x5a/0x100\n ...\n Call Trace:\n strnlen+0x71/0xa0 lib/string.c:155\n sized_strscpy+0x48/0x2a0 lib/string.c:298\n parse_apply_sb_mount_options+0x94/0x4a0 fs/ext4/super.c:2486\n __ext4_fill_super+0x31d6/0x51b0 fs/ext4/super.c:5306\n ext4_fill_super+0x3972/0xaf70 fs/ext4/super.c:5736\n get_tree_bdev_flags+0x38c/0x620 fs/super.c:1698\n vfs_get_tree+0x8e/0x340 fs/super.c:1758\n fc_mount fs/namespace.c:1199\n do_new_mount fs/namespace.c:3718\n path_mount+0x7b9/0x23a0 fs/namespace.c:4028\n ...\n\nReject the mount with an error instead. While there is an existing similar\ncheck in the ioctl path (which validates userspace input before writing\nTO disk), this check validates data read FROM disk before parsing.\n\nThe painful history here is:\n\n8b67f04ab9de (\"ext4: Add mount options in superblock\")\n s_mount_opts is created and treated as __nonstring: kstrndup is used to\n make sure all 64 potential characters are available for use (i.e. up\n to 65 bytes may be allocated).\n\n04a91570ac67 (\"ext4: implemet new ioctls to set and get superblock parameters\")\n Created ext4_tune_sb_params::mount_opts as 64 bytes in size but\n incorrectly treated it and s_mount_opts as a C strings (it used\n strscpy_pad() to copy between them).\n\n8ecb790ea8c3 (\"ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()\")\n As a prerequisite to the ioctl treating s_mount_opts as a C string, this\n attempted to switch to using strscpy_pad() with a 65 byte destination\n for the case of an unterminated s_mount_opts. (But strscpy_pad() will\n fail due to the over-read of s_mount_opts by strnlen().)\n\n3db63d2c2d1d (\"ext4: check if mount_opts is NUL-terminated in ext4_ioctl_set_tune_sb()\")\n As a continuation of trying to solve the 64/65 mismatch, this started\n enforcing a 63 character limit (i.e. 64 bytes total) to incoming values\n from userspace to the ioctl API. (But did not check s_mount_opts coming\n from disk.)\n\nee5a977b4e77 (\"ext4: fix string copying in parse_apply_sb_mount_options()\")\n Notices the loud failures of strscpy_pad() introduced by 8ecb790ea8c3,\n and attempted to silence them by making the destination 64 and rejecting\n too-long strings from the on-disk copy of s_mount_opts, but didn't\n actually solve it at all, since the problem was always the over-read\n of the source seen by strnlen(). (Note that the report quoted in this\n commit exactly matches the report today.)\n\nThe other option is to go back in time and mark both s_mount_opts and\nmount_opts as __nonstring and switch to using memcpy_and_pad() to copy\nthem around between userspace and kernel and disk instead of making them\nC strings.\n\nWhat do the ext4 regression tests expect for s_mount_opts? Is there a\ntest for a non-terminated s_mount_opts in an image?\n\nReported-by: 李龙兴 <coregee2000@gmail.com>\nCloses: https://lore.kernel.org/lkml/CAHPqNmzBb2LruMA6jymoHXQRsoiAKMFZ1wVEz8JcYKg4U6TBbw@mail.gmail.com/\nFixes: ee5a977b4e77 (\"ext4: fix string copying in parse_apply_sb_mount_options()\")\nSigned-off-by: Kees Cook <kees@kernel.org>\n---\nCc: \"Theodore Ts'o\" <tytso@mit.edu>\nCc: Andreas Dilger <adilger.kernel@dilger.ca>\nCc: Andy Shevchenko <andriy.shevchenko@intel.com>\nCc: <linux-ext4@vger.kernel.org>\n---\n fs/ext4/super.c | 7 +++++++\n 1 file changed, 7 insertions(+)", "diff": "diff --git a/fs/ext4/super.c b/fs/ext4/super.c\nindex 87205660c5d0..9ad6005615d8 100644\n--- a/fs/ext4/super.c\n+++ b/fs/ext4/super.c\n@@ -2485,6 +2485,13 @@ static int parse_apply_sb_mount_options(struct super_block *sb,\n \tif (!sbi->s_es->s_mount_opts[0])\n \t\treturn 0;\n \n+\tif (strnlen(sbi->s_es->s_mount_opts, sizeof(sbi->s_es->s_mount_opts)) ==\n+\t sizeof(sbi->s_es->s_mount_opts)) {\n+\t\text4_msg(sb, KERN_ERR,\n+\t\t\t \"Mount options in superblock are not NUL-terminated\");\n+\t\treturn -EINVAL;\n+\t}\n+\n \tif (strscpy_pad(s_mount_opts, sbi->s_es->s_mount_opts) < 0)\n \t\treturn -E2BIG;\n \n", "prefixes": [] }