Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1458178
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 39/68] ext4: verify extent header depth |
| Date | 2016-08-08 21:50 +0200 |
| Message-ID | <s3YIH-5FD-51@gated-at.bofh.it> (permalink) |
| References | <s3YfD-5sp-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
commit 7bc9491645118c9461bd21099c31755ff6783593 upstream.
Although the extent tree depth of 5 should enough be for the worst
case of 2*32 extents of length 1, the extent tree code does not
currently to merge nodes which are less than half-full with a sibling
node, or to shrink the tree depth if possible. So it's possible, at
least in theory, for the tree depth to be greater than 5. However,
even in the worst case, a tree depth of 32 is highly unlikely, and if
the file system is maliciously corrupted, an insanely large eh_depth
can cause memory allocation failures that will trigger kernel warnings
(here, eh_depth = 65280):
JBD2: ext4.exe wants too many credits credits:195849 rsv_credits:0 max:256
------------[ cut here ]------------
WARNING: CPU: 0 PID: 50 at fs/jbd2/transaction.c:293 start_this_handle+0x569/0x580
CPU: 0 PID: 50 Comm: ext4.exe Not tainted 4.7.0-rc5+ #508
Stack:
604a8947 625badd8 0002fd09 00000000
60078643 00000000 62623910 601bf9bc
62623970 6002fc84 626239b0 900000125
Call Trace:
[<6001c2dc>] show_stack+0xdc/0x1a0
[<601bf9bc>] dump_stack+0x2a/0x2e
[<6002fc84>] __warn+0x114/0x140
[<6002fdff>] warn_slowpath_null+0x1f/0x30
[<60165829>] start_this_handle+0x569/0x580
[<60165d4e>] jbd2__journal_start+0x11e/0x220
[<60146690>] __ext4_journal_start_sb+0x60/0xa0
[<60120a81>] ext4_truncate+0x131/0x3a0
[<60123677>] ext4_setattr+0x757/0x840
[<600d5d0f>] notify_change+0x16f/0x2a0
[<600b2b16>] do_truncate+0x76/0xc0
[<600c3e56>] path_openat+0x806/0x1300
[<600c55c9>] do_filp_open+0x89/0xf0
[<600b4074>] do_sys_open+0x134/0x1e0
[<600b4140>] SyS_open+0x20/0x30
[<6001ea68>] handle_syscall+0x88/0x90
[<600295fd>] userspace+0x3fd/0x500
[<6001ac55>] fork_handler+0x85/0x90
---[ end trace 08b0b88b6387a244 ]---
[ Commit message modified and the extent tree depath check changed
from 5 to 32 -- tytso ]
Cc: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/extents.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -469,6 +469,10 @@ static int __ext4_ext_check(const char *
error_msg = "invalid extent entries";
goto corrupted;
}
+ if (unlikely(depth > 32)) {
+ error_msg = "too large eh_depth";
+ goto corrupted;
+ }
/* Verify checksum on non-root extent tree nodes */
if (ext_depth(inode) != depth &&
!ext4_extent_block_csum_verify(inode, eh)) {
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 36/68] locks: use file_inode() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 32/68] pinctrl: single: Fix missing flush of posted write for a wakeirq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 15/68] pps: do not crash when failed to register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 58/68] ipr: Clear interrupt on croc/crocodile when running with LSI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 10/68] fs/nilfs2: fix potential underflow in call to crc32_le Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 17/68] arc: unwind: warn only once if DW2_UNWIND is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 35/68] power_supply: power_supply_read_temp only if use_cnt > 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 56/68] RDS: fix rds_tcp_init() error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 68/68] vfs: fix deadlock in file_remove_privs() on overlayfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 26/68] Input: elantech - add more IC body types to the list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 42/68] spi: sunxi: fix transfer timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 47/68] block: fix use-after-free in sys_ioprio_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 37/68] Revert "ecryptfs: forbid opening files without mmap handler" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 25/68] Input: vmmouse - remove port reservation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 49/68] sched/fair: Fix effective_load() to consistently use smoothed load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 21/68] xenbus: dont bail early from xenbus_dev_request_and_reply() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 28/68] Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 09/68] mm, compaction: abort free scanner if split fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 07/68] dmaengine: at_xdmac: double FIFO flush needed to compute residue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 55/68] can: fix oops caused by wrong rtnl dellink usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 52/68] can: at91_can: RX queue could get stuck at high bus load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 06/68] dmaengine: at_xdmac: fix residue corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 61/68] i2c: qup: Fix wrong value of index variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 45/68] platform/chrome: cros_ec_dev - double fetch bug in ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
[PATCH 4.4 64/68] libceph: apply new_state before new_up_client on incrementals Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 16/68] kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 51/68] perf/x86: fix PEBS issues on Intel Atom/Core2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 14/68] vmlinux.lds: account for destructor sections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 38/68] ecryptfs: dont allow mmap when the lower fs doesnt support it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 46/68] qeth: delete napi struct when removing a qeth device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 08/68] mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 66/68] intel_th: pci: Add Kaby Lake PCH-H support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 41/68] namespace: update event counter when umounting a deleted dentry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 60/68] posix_cpu_timer: Exit early when process has been reaped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 54/68] can: fix handling of unmodifiable configuration options fix Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 67/68] intel_th: Fix a deadlock in modprobing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 43/68] spi: sun4i: fix FIFO limit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 11/68] mm, compaction: prevent VM_BUG_ON when terminating freeing scanner Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 39/68] ext4: verify extent header depth Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 12/68] mm, meminit: always return a valid node from early_pfn_to_nid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 63/68] libata: LITE-ON CX1-JB256-HP needs lower max_sectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 40/68] 9p: use file_dentry() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 57/68] SCSI: fix new bug in scsi_dev_info_list string matching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 50/68] ovl: handle ATTR_KILL* Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 44/68] clk: rockchip: initialize flags of clk_init_data in mmc-phase clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 59/68] media: fix airspy usb probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 53/68] can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 13/68] mm, meminit: ensure node is online before checking whether pages are uninitialised Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 48/68] mmc: block: fix packed command header endianness Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
[PATCH 4.4 34/68] cgroup: set css->id to -1 during init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
[PATCH 4.4 18/68] ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
[PATCH 4.4 27/68] Input: xpad - fix oops when attaching an unknown Xbox One gamepad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
[PATCH 4.4 29/68] Input: xpad - validate USB endpoint count during probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
[PATCH 4.4 19/68] xen/pciback: Fix conf_space read/write overlap check. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
[PATCH 4.4 03/68] x86/quirks: Reintroduce scanning of secondary buses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
[PATCH 4.4 31/68] pvclock: Add CPU barriers to get correct version value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
Re: [PATCH 4.4 00/68] 4.4.17-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-09 06:30 +0200
Re: [PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-09 10:30 +0200
Re: [PATCH 4.4 00/68] 4.4.17-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-09 18:20 +0200
Re: [PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-09 19:30 +0200
Re: [PATCH 4.4 00/68] 4.4.17-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-09 17:20 +0200
csiph-web