Re: kern/56160: Mount ntfs usb disk

["J. Hannken-Illjes" <hannken%eis.cs.tu-bs.de@localhost>]

The following reply was made to PR kern/56160; it has been noted by GNATS.

From: "J. Hannken-Illjes" <hannken%eis.cs.tu-bs.de@localhost>
To: NetBSD GNATS <gnats-bugs%netbsd.org@localhost>
Cc: 
Subject: Re: kern/56160: Mount ntfs usb disk
Date: Sun, 9 May 2021 17:21:48 +0200

 --Apple-Mail=_DE512F8E-4A55-45B5-A6A3-BFD527EEE5F9
 Content-Transfer-Encoding: 7bit
 Content-Type: text/plain;
 	charset=us-ascii
 
 > On 9. May 2021, at 17:00, Michael van Elst <mlelstv%serpens.de@localhost> wrote:
 <snip>
 > The code tries to create the system vnodes in ntfs_mountfs():
 > 
 >         int pi[3] = { NTFS_MFTINO, NTFS_ROOTINO, NTFS_BITMAPINO };
 >         for (i = 0; i < 3; i++) {
 >                 error = VFS_VGET(mp, pi[i], LK_EXCLUSIVE,
 >                     &(ntmp->ntm_sysvn[pi[i]]));
 >                 ...
 >         }
 > 
 > which triggers ntfs_findvattr which calls ntfs_loadntnode() that
 > assumes that the system vnodes are alrady fetched:
 > 
 >         if (ip->i_number < NTFS_SYSNODESNUM) {
 >             :
 >         } else {
 >                 struct vnode   *vp;
 >                 vp = ntmp->ntm_sysvn[NTFS_MFTINO];
 >                 error = ntfs_readattr(ntmp, VTONT(vp), NTFS_A_DATA, NULL,
 >                 ...
 >         }
 
 This path called with inumber 0, 5 or 6 should take the
 top after if as NTFS_SYSNODESNUM is 0x0b ...
 
 > There vp is still NULL and VTONT(vp) dereferences it.
 > 
 > 
 > This code path seems to be mostly unchanged since netbsd-7 when
 > the vnode cache was introduced and that code was refactored.
 
 I'm quite sure I did mount a bunch of ntfs images after
 to vnode cache.
 
 
 The image triggering this crash could help if it doesn't
 contain private or confidential information.
 
 --
 J. Hannken-Illjes - hannken%eis.cs.tu-bs.de@localhost - TU Braunschweig
 
 --Apple-Mail=_DE512F8E-4A55-45B5-A6A3-BFD527EEE5F9
 Content-Transfer-Encoding: 7bit
 Content-Disposition: attachment;
 	filename=signature.asc
 Content-Type: application/pgp-signature;
 	name=signature.asc
 Content-Description: Message signed with OpenPGP
 
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAEBCAAdFiEE2BL3ha7Xao4WUZVYKoaVJdNr+uEFAmCX/gwACgkQKoaVJdNr
 +uHCKwgAj24nz8kxX32rPD8x6dLceinCEXCxalCElXhMfCJnUPalXUZ/sU0KX7Ba
 a40WcYAtdRQszj86dHjY1taeq34N0c9CqgjWcAKvnQf3e/h0vQQmrnjjIOEztZRh
 XV69IZxqteAtscWLlwVSUOycv9REI5ygALensu9rtKFCGdzOt+nXvFtGTzqguMkS
 WtxTy+BAlCu0bZfre1FDQBjD7eUnY21EAU7BXcvjUZ8bA9NdZDDrD0K/lsFTEVTL
 MIWIG+plGYJ92R5RKXsrhrm+5any1DWMvaTIecOgnYuuF9R/Lvwd6ucSi5yySmCC
 G9SxpGx5Fqf5kOftkA8AK3xNdBcxTg==
 =PBsX
 -----END PGP SIGNATURE-----
 
 --Apple-Mail=_DE512F8E-4A55-45B5-A6A3-BFD527EEE5F9--