linux-ext4 - 2.6.20 ext3 rename() returns success but doesn't unlink the source

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 23 Mar 2007 19:15:27 +0200
From:	Timo Sirainen <tss@....fi>
To:	linux-ext4@...r.kernel.org
Subject: 2.6.20 ext3 rename() returns success but doesn't unlink the source

The problem happened when I was stress testing my IMAP server using a
ext3 filesystem created inside 1GB file in XFS.

The ext3 image can be downloaded from
http://dovecot.org/tmp/broken-ext3fs.gz

Then do:

	rename("/mnt/Maildir/.Trash/new/1174635781.P25986Q0M341350.hurina",
	       "/mnt/Maildir/.Trash/cur/1174635781.P25986Q0M341350.hurina:2,");

You'll see that the source file won't get unlinked from new/ directory,
even though rename() returns 0. (Don't use /bin/mv for testing, it'll
unlink(), not rename()).

This is fully reproduceable with me. Vanilla 2.6.20 kernel, x86-64 SMP.

Other renames that are broken:

/mnt/Maildir/.Trash/cur/1174634032.P23859Q0M8966.hurina:2,FR -> /mnt/Maildir/.Trash/cur/1174634032.P23859Q0M8966.hurina:2,RSe
/mnt/Maildir/.Trash/cur/1174655534.P24036Q0M568306.hurina:2, -> /mnt/Maildir/.Trash/cur/1174655534.P24036Q0M568306.hurina:2,FRde
/mnt/Maildir/.Trash/cur/1174634141.P26381Q0M456574.hurina:2,DRce -> /mnt/Maildir/.Trash/cur/1174634141.P26381Q0M456574.hurina:2,DFRce
/mnt/Maildir/.Trash/cur/1174634674.P4936Q0M158888.hurina:2,b -> /mnt/Maildir/.Trash/cur/1174634674.P4936Q0M158888.hurina:2,Dae
/mnt/Maildir/.Trash/cur/1174635529.P21439Q0M369287.hurina:2,FRabd -> /mnt/Maildir/.Trash/cur/1174635529.P21439Q0M369287.hurina:2,Sab
/mnt/Maildir/.Trash/cur/1174633952.P22125Q1M462390.hurina:2,Sbc -> /mnt/Maildir/.Trash/cur/1174633952.P22125Q1M462390.hurina:2,DFRSbc
/mnt/Maildir/.Trash/cur/1174635536.P21699Q0M303872.hurina:2,FRSde -> /mnt/Maildir/.Trash/cur/1174635536.P21699Q0M303872.hurina:2,Sab
/mnt/Maildir/.Trash/cur/1174634168.P26948Q0M641713.hurina:2,bdc -> /mnt/Maildir/.Trash/cur/1174634168.P26948Q0M641713.hurina:2,Rbdc
/mnt/Maildir/.Trash/cur/1174635988.P29139Q0M957075.hurina:2,DRd -> /mnt/Maildir/.Trash/cur/1174635988.P29139Q0M957075.hurina:2,be
/mnt/Maildir/.Trash/cur/1174635746.P25391Q0M231431.hurina:2, -> /mnt/Maildir/.Trash/cur/1174635746.P25391Q0M231431.hurina:2,abe
/mnt/Maildir/.Trash/cur/1174634129.P26063Q0M629252.hurina:2,DRde -> /mnt/Maildir/.Trash/cur/1174634129.P26063Q0M629252.hurina:2,DRd
/mnt/Maildir/.Trash/cur/1174635744.P25345Q0M695919.hurina:2,c -> /mnt/Maildir/.Trash/cur/1174635744.P25345Q0M695919.hurina:2,abc
/mnt/Maildir/.Trash/cur/1174634548.P2478Q0M911503.hurina:2,DFSad -> /mnt/Maildir/.Trash/cur/1174634548.P2478Q0M911503.hurina:2,DSa
/mnt/Maildir/.Trash/cur/1174635164.P14762Q0M158308.hurina:2, -> /mnt/Maildir/.Trash/cur/1174635164.P14762Q0M158308.hurina
/mnt/Maildir/.Trash/cur/1174634671.P4940Q0M644537.hurina:2,Re -> /mnt/Maildir/.Trash/cur/1174634671.P4940Q0M644537.hurina:2,bd
/mnt/Maildir/.Trash/cur/1174634633.P3937Q0M292724.hurina:2,FRSd -> /mnt/Maildir/.Trash/cur/1174634633.P3937Q0M292724.hurina:2,FRSabdce
/mnt/Maildir/.Trash/cur/1174633952.P22146Q0M723956.hurina:2,Rbde -> /mnt/Maildir/.Trash/cur/1174633952.P22146Q0M723956.hurina:2,Sbde
/mnt/Maildir/.Trash/cur/1174635616.P23078Q4.hurina:2,DFR -> /mnt/Maildir/.Trash/cur/1174635616.P23078Q4.hurina:2,Rb


Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)