Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1414306

[PATCH 4.6 102/121] ext4: fix hang when processing corrupted orphaned inode list

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.6 102/121] ext4: fix hang when processing corrupted orphaned inode list
Date 2016-06-06 00:10 +0200
Message-ID <rGOp4-463-29@gated-at.bofh.it> (permalink)
References <rGOfn-3Nj-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit c9eb13a9105e2e418f72e46a2b6da3f49e696902 upstream.

If the orphaned inode list contains inode #5, ext4_iget() returns a
bad inode (since the bootloader inode should never be referenced
directly).  Because of the bad inode, we end up processing the inode
repeatedly and this hangs the machine.

This can be reproduced via:

   mke2fs -t ext4 /tmp/foo.img 100
   debugfs -w -R "ssv last_orphan 5" /tmp/foo.img
   mount -o loop /tmp/foo.img /mnt

(But don't do this if you are using an unpatched kernel if you care
about the system staying functional.  :-)

This bug was found by the port of American Fuzzy Lop into the kernel
to find file system problems[1].  (Since it *only* happens if inode #5
shows up on the orphan list --- 3, 7, 8, etc. won't do it, it's not
surprising that AFL needed two hours before it found it.)

[1] http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf

Reported by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/ialloc.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -1183,11 +1183,13 @@ struct inode *ext4_orphan_get(struct sup
 		goto iget_failed;
 
 	/*
-	 * If the orphans has i_nlinks > 0 then it should be able to be
-	 * truncated, otherwise it won't be removed from the orphan list
-	 * during processing and an infinite loop will result.
+	 * If the orphans has i_nlinks > 0 then it should be able to
+	 * be truncated, otherwise it won't be removed from the orphan
+	 * list during processing and an infinite loop will result.
+	 * Similarly, it must not be a bad inode.
 	 */
-	if (inode->i_nlink && !ext4_can_truncate(inode))
+	if ((inode->i_nlink && !ext4_can_truncate(inode)) ||
+	    is_bad_inode(inode))
 		goto bad_orphan;
 
 	if (NEXT_ORPHAN(inode) > max_ino)

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.6 000/121] 4.6.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 031/121] Input: xpad - prevent spurious input from wired Xbox 360 controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 023/121] MIPS: Fix sigreturn via VDSO on microMIPS kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 082/121] xen: use same main loop for counting and remapping pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 075/121] QE-UART: add "fsl,t1040-ucc-uart" to of_device_id Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 003/121] MIPS: math-emu: Fix jalr emulation when rd == $0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 072/121] mm: use phys_addr_t for reserve_bootmem_region() arguments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 071/121] PKCS#7: fix missing break on OID_sha224 case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 004/121] MIPS: MSA: Fix a link error on `_init_msa_upper with older GCC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 049/121] rtlwifi: pci: use dev_kfree_skb_irq instead of kfree_skb in rtl_pci_reset_trx_ring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:00 +0200
  [PATCH 4.6 117/121] xfs: xfs_iflush_cluster fails to abort on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 103/121] ext4: clean up error handling when orphan list is corrupted Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 001/121] f2fs: fix deadlock when flush inline data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 106/121] ext4: address UBSAN warning in mb_find_order_for_block() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 090/121] drm/i915: Discard previous atomic state on resume if connectors change Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 118/121] xfs: fix inode validity check in xfs_iflush_cluster Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 087/121] drm/amdgpu: Fix hdmi deep color support. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 104/121] ext4: fix check of dqget() return value in ext4_ioctl_setproject() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 102/121] ext4: fix hang when processing corrupted orphaned inode list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 116/121] xfs: remove xfs_fs_evict_inode() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 050/121] Revert "lpfc: Delete unnecessary checks before the function call mempool_destroy" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 108/121] nfs: avoid race that crashes nfs_init_commit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 109/121] PM / sleep: Handle failures in device_suspend_late() consistently Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 091/121] drm/atomic: Verify connector->funcs != NULL when clearing states Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 065/121] clk: bcm2835: pll_off should only update CM_PLL_ANARST Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 089/121] drm/fb_helper: Fix references to dev->mode_config.num_connector Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 055/121] regulator: Try to resolve regulators supplies on registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 113/121] gcov: disable tree-loop-im to reduce stack usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 088/121] drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 114/121] xfs: disallow rw remount on fs with unknown ro-compat features Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 115/121] xfs: Dont wrap growfs AGFL indexes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 120/121] drm: msm: remove unused variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 107/121] ext4: silence UBSAN in ext4_mb_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 086/121] drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 105/121] ext4: fix oops on corrupted filesystem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 063/121] clk: bcm2835: Fix PLL poweron Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 064/121] clk: at91: fix check of clk_register() returned value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 084/121] drm/gma500: Fix possible out of bounds read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 119/121] xfs: skip stale inodes in xfs_iflush_cluster Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 054/121] aacraid: Fix for KDUMP driver hang Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 046/121] rtlwifi: rtl8723be: Add antenna select module parameter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 092/121] Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 101/121] ext4: fix data exposure after a crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 111/121] scripts/package/Makefile: rpmbuild add support of RPMOPTS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 112/121] mm: thp: avoid false positive VM_BUG_ON_PAGE in page_move_anon_rmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:10 +0200
  [PATCH 4.6 040/121] ath10k: fix debugfs pktlog_filter write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 007/121] MIPS: Fix siginfo.h to use strict posix types Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 035/121] ARM: dts: at91: fix typo in sama5d2 PIN_PD24 description Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 008/121] MIPS: Fix uapi include in exported asm/siginfo.h Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 027/121] affs: fix remount failure when there are no options changed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 037/121] ARM: dts: imx35: restore existing used clock enumeration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 010/121] MIPS: Handle highmem pages in __update_cache Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 041/121] ath10k: fix firmware assert in monitor mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 051/121] aacraid: Start adapter after updating number of MSIX vectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 057/121] mfd: intel_quark_i2c_gpio: Remove clock tree on error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 061/121] cpuidle: Indicate when a device has been unregistered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 038/121] ath9k: Add a module parameter to invert LED polarity. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 028/121] ASoC: ak4642: Enable cache usage to fix crashes on resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 052/121] aacraid: Relinquish CPU during timeout wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 014/121] MIPS: Reserve nosave data for hibernation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 024/121] MIPS: Build microMIPS VDSO for microMIPS kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 034/121] ARM: mvebu: fix GPIO config on the Linksys boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 047/121] rtlwifi: btcoexist: Implement antenna selection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 025/121] MIPS: lib: Mark intrinsics notrace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 033/121] ARM: sun7i: dt: Enable dram gate 5 (tve0 clock) for simplefb TV output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 060/121] PM / Runtime: Fix error path in pm_runtime_force_resume() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 043/121] ath10k: fix kernel panic, move arvifs list head init before htt init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 036/121] ARM: dts: exynos: Add interrupt line to MAX8997 PMIC on exynos4210-trats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 062/121] cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 026/121] MIPS: VDSO: Build with `-fno-strict-aliasing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 056/121] hwmon: (ads7828) Enable internal reference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 006/121] MIPS: Avoid using unwind_stack() with usermode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 042/121] ath10k: fix rx_channel during hw reconfigure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 039/121] ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 005/121] MIPS: Dont unwind to user mode with EVA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 053/121] aacraid: Fix for aac_command_thread hang Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 058/121] mfd: intel-lpss: Save register context on suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 044/121] ath5k: Change led pin configuration for compaq c700 laptop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 032/121] ARM: sun4i: dt: Enable dram gate 5 (tve0 clock) for simplefb TV output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 029/121] Input: uinput - handle compat ioctl for UI_SET_PHYS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 012/121] MIPS: Loongson-3: Fix build error after ld-version.sh modification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:20 +0200
  [PATCH 4.6 015/121] MIPS: Loongson-3: Reserve 32MB for RS780E integrated GPU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 121/121] IB/hfi1: Fix hard lockup due to not using save/restore spin lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 002/121] MIPS64: R6: R2 emulation bugfix Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 018/121] MIPS: Force CPUs to lose FP context during mode switches Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 020/121] MIPS: Disable preemption during prctl(PR_SET_FP_MODE, ...) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 022/121] MIPS: ptrace: Prevent writes to read-only FCSR bits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 017/121] MIPS: Fix MSA ld_*/st_* asm macros to use PTR_ADDU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 019/121] MIPS: Prevent "restoration" of MSA context in non-MSA kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 013/121] MIPS: ath79: make bootconsole wait for both THRE and TEMT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 016/121] MIPS: Use copy_s.fmt rather than copy_u.fmt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  [PATCH 4.6 021/121] MIPS: ptrace: Fix FP context restoration FCSR regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 00:30 +0200
  Re: [PATCH 4.6 000/121] 4.6.2-stable review Guenter Roeck <linux@roeck-us.net> - 2016-06-06 18:20 +0200
    Re: [PATCH 4.6 000/121] 4.6.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 18:40 +0200
    Re: [PATCH 4.6 000/121] 4.6.2-stable review Guenter Roeck <linux@roeck-us.net> - 2016-06-07 22:10 +0200
  Re: [PATCH 4.6 000/121] 4.6.2-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-06 19:30 +0200
  Re: [PATCH 4.6 000/121] 4.6.2-stable review Javier Martinez Canillas <javier@osg.samsung.com> - 2016-06-07 00:50 +0200
    Re: [PATCH 4.6 000/121] 4.6.2-stable review Mark Brown <broonie@kernel.org> - 2016-06-07 01:40 +0200
    Re: [PATCH 4.6 000/121] 4.6.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-07 01:40 +0200
      Re: [PATCH 4.6 000/121] 4.6.2-stable review Mark Brown <broonie@kernel.org> - 2016-06-07 01:50 +0200
      Re: [PATCH 4.6 000/121] 4.6.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-08 03:00 +0200
  Re: [PATCH 4.6 000/121] 4.6.2-stable review Tyler Baker <tyler.baker@linaro.org> - 2016-06-07 00:50 +0200
  Re: [PATCH 4.6 000/121] 4.6.2-stable review Guenter Roeck <linux@roeck-us.net> - 2016-06-07 15:50 +0200
    Re: [PATCH 4.6 000/121] 4.6.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-08 03:10 +0200
      Re: [PATCH 4.6 000/121] 4.6.2-stable review Guenter Roeck <linux@roeck-us.net> - 2016-06-08 05:20 +0200

csiph-web