linux-ext4 - Re: BUG_ON at mballoc.c:3752

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 4 Feb 2008 11:30:55 +0530
From:	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>
To:	Eric Sesterhenn <snakebyte@....de>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: BUG_ON at mballoc.c:3752

On Thu, Jan 31, 2008 at 04:42:07PM +0100, Eric Sesterhenn wrote:
> * Eric Sesterhenn (snakebyte@....de) wrote:
> > hi,
> > 
> > while running a modified version of fsfuzzer i triggered the BUG() in
> > ext4_mb_release_inode_pa(). Sadly I am not able to reproduce this using
> > the generated image, but running the fuzzer will usually trigger this in
> > less than 40 attempts. Increasing the JBD2 Debug level didnt give more
> > information. The kernel is current git with
> > ext4-fix-null-pointer-deref-in-journal_wait_on_commit_record.patch
> > applied. 
> 
> I am now able to reproduce this using this image:
> http://www.cccmz.de/~snakebyte/ext4.24.img.bz2
> 
> the following commands will trigger the oops for me
> 
> mount cfs/ext4.24.img /media/test -t ext4dev -o extents -o loop
> mkdir /media/test/stress
> chown snakebyte:snakebyte /media/test/stress && sudo -u snakebyte fstest -n 10 -l 10 -f 5 -s 40000 -p /media/test/stress/
> 

The file system is corrupted. The BUG_ON indicate that the free spcae
marked in the prealloc space and found by looking at the bitmap are not
same. Do you have a set of steps that i can follow to reproduce this ?
on a clean file system ? Where do i find the fsfuzzer that you are using ?


kvaneesh@...walker:/tmp$/home/opensource/patches/e2fsprogs-1.40.4.cfs1/e2fsck/e2fsck.static  -f ./ext4.24.img
e2fsck 1.40.4.cfs1 (31-Dec-2007)
Superblock has an invalid ext3 journal (inode 8).
Clear<y>? yes

*** ext3 journal has been deleted - filesystem is now ext2 only ***

Pass 1: Checking inodes, blocks, and sizes
Inode 7 has illegal block(s).  Clear<y>? yes

Illegal block #552 (9568256) in inode 7.  CLEARED.
Illegal block #647 (4063232) in inode 7.  CLEARED.
Illegal block #659 (12517376) in inode 7.  CLEARED.
Illegal block #766 (2600468480) in inode 7.  CLEARED.
Illegal block #944 (51200) in inode 7.  CLEARED.
Illegal block #1135 (2583691264) in inode 7.  CLEARED.
Illegal block #1214 (15925248) in inode 7.  CLEARED.
Illegal block #1345 (771751936) in inode 7.  CLEARED.
Illegal block #1384 (10092544) in inode 7.  CLEARED.
Illegal block #1416 (14811136) in inode 7.  CLEARED.
Illegal block #1470 (10420224) in inode 7.  CLEARED.
Illegal block #1709 (10158080) in inode 7.  CLEARED.
Too many illegal blocks in inode 7.
Clear inode<y>? yes

Journal inode is not in use, but contains data.  Clear<y>? yes

Deleted inode 160 has zero dtime.  Fix<y>? yes

Deleted inode 257 has zero dtime.  Fix<y>? yes

Deleted inode 638 has zero dtime.  Fix<y>? yes

Deleted inode 1407 has zero dtime.  Fix<y>? yes

Deleted inode 1650 has zero dtime.  Fix<y>? yes

Deleted inode 1656 has zero dtime.  Fix<y>? yes

Deleted inode 1677 has zero dtime.  Fix<y>? yes

Deleted inode 1720 has zero dtime.  Fix<y>? yes

Inode 11 has illegal block(s).  Clear<y>? yes

Illegal block #249 (15990784) in inode 11.  CLEARED.
Inode 11, i_size is 12288, should be 33792.  Fix<y>? yes

Inode 11, i_blocks is 24, should be 28.  Fix<y>? yes

Recreate journal to make the filesystem ext3 again?
Fix<y>? yes

-aneesh
-
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html