Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1414532

[PATCH 3.14 17/23] ext4: fix hang when processing corrupted orphaned inode list

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit c9eb13a9105e2e418f72e46a2b6da3f49e696902 upstream.

If the orphaned inode list contains inode #5, ext4_iget() returns a
bad inode (since the bootloader inode should never be referenced
directly).  Because of the bad inode, we end up processing the inode
repeatedly and this hangs the machine.

This can be reproduced via:

   mke2fs -t ext4 /tmp/foo.img 100
   debugfs -w -R "ssv last_orphan 5" /tmp/foo.img
   mount -o loop /tmp/foo.img /mnt

(But don't do this if you are using an unpatched kernel if you care
about the system staying functional.  :-)

This bug was found by the port of American Fuzzy Lop into the kernel
to find file system problems[1].  (Since it *only* happens if inode #5
shows up on the orphan list --- 3, 7, 8, etc. won't do it, it's not
surprising that AFL needed two hours before it found it.)

[1] http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf

Reported by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/ialloc.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -1097,11 +1097,13 @@ struct inode *ext4_orphan_get(struct sup
 		goto iget_failed;
 
 	/*
-	 * If the orphans has i_nlinks > 0 then it should be able to be
-	 * truncated, otherwise it won't be removed from the orphan list
-	 * during processing and an infinite loop will result.
+	 * If the orphans has i_nlinks > 0 then it should be able to
+	 * be truncated, otherwise it won't be removed from the orphan
+	 * list during processing and an infinite loop will result.
+	 * Similarly, it must not be a bad inode.
 	 */
-	if (inode->i_nlink && !ext4_can_truncate(inode))
+	if ((inode->i_nlink && !ext4_can_truncate(inode)) ||
+	    is_bad_inode(inode))
 		goto bad_orphan;
 
 	if (NEXT_ORPHAN(inode) > max_ino)

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/23] 3.14.72-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-05 23:50 +0200
  [PATCH 3.14 07/23] aacraid: Fix for aac_command_thread hang Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-05 23:50 +0200
  [PATCH 3.14 11/23] pipe: Fix buffer offset after partially failed read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-05 23:50 +0200
    Re: [PATCH 3.14 11/23] pipe: Fix buffer offset after partially failed  read Jiri Slaby <jslaby@suse.cz> - 2016-06-07 16:00 +0200
      Re: [PATCH 3.14 11/23] pipe: Fix buffer offset after partially  failed read Ben Hutchings <ben@decadent.org.uk> - 2016-06-07 16:50 +0200
  [PATCH 3.14 08/23] cpuidle: Indicate when a device has been unregistered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-05 23:50 +0200
  [PATCH 3.14 03/23] MIPS: ath79: make bootconsole wait for both THRE and TEMT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 05/23] ath5k: Change led pin configuration for compaq c700 laptop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 19/23] ext4: silence UBSAN in ext4_mb_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 04/23] Input: uinput - handle compat ioctl for UI_SET_PHYS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 13/23] xen/events: Dont move disabled irqs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 10/23] rtlwifi: Fix logic error in enter/exit power-save mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 01/23] MIPS: math-emu: Fix jalr emulation when rd == $0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 06/23] aacraid: Relinquish CPU during timeout wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 17/23] ext4: fix hang when processing corrupted orphaned inode list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 02/23] MIPS: Fix siginfo.h to use strict posix types Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 18/23] ext4: address UBSAN warning in mb_find_order_for_block() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  [PATCH 3.14 15/23] drm/gma500: Fix possible out of bounds read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:10 +0200
  Re: [PATCH 3.14 00/23] 3.14.72-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-06 19:30 +0200
    Re: [PATCH 3.14 00/23] 3.14.72-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-08 02:30 +0200
  Re: [PATCH 3.14 00/23] 3.14.72-stable review Guenter Roeck <linux@roeck-us.net> - 2016-06-07 05:50 +0200

csiph-web