linux-ext4 - Re: [PATCH] ext4: Fix data corruption when writing to prealloc area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 18 Jul 2008 10:02:33 -0700
From:	Mingming Cao <cmm@...ibm.com>
To:	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>
Cc:	tytso@....edu, sandeen@...hat.com, linux-ext4@...r.kernel.org,
	Shehjar Tikoo <shehjart@....unsw.edu.au>
Subject: Re: [PATCH] ext4: Fix data corruption when writing to prealloc area

I tried this patch, with nodelalloc, the kernel did not crash! Previous
it crashes in a few minutes.

 but the test did not stop after fill the file by specified 2G size


I noticed the write() to write to the last fallocate extent(up to 2G)
returns junk value.


The testcase I got from Shehjart (who originally reported the problem)
is  

http://www.gelato.unsw.edu.au/~shehjart/writefallocate.c

command I use to reproduce the problem is 

./writefallocate --filesize 2147483648 --wrblksize 65536 --fallocate
1048576 --filename /mnt/ext4/a --nounlink

.............
offset: 2147024896, written: 65536^M
offset: 2147090432, written: 65536^M
offset: 2147155968, written: 65536^M
offset: 2147221504, written: 65536^M
offset: 2147287040, written: 65536^M
offset: 2147352576, written: 65536^M
offset: 2147418112, written: 65535^M
offset: 2147483647, written: 18446744073709551615^M
fallocate offset: 2147483647^M
offset: 2147483646, written: 18446744073709551615^M
offset: 2147483645, written: 18446744073709551615^M
offset: 2147483644, written: 18446744073709551615^M
offset: 2147483643, written: 18446744073709551615^M
offset: 2147483642, written: 18446744073709551615^M
offset: 2147483641, written: 18446744073709551615^M
offset: 2147483640, written: 18446744073709551615^M


Appearently the test has fallocate/fill the 2G file, but since the last
write() returns 18446744073709551615, the offset is decreased, cause the
test continue with a break,  and writes to wrong offset




在 2008-07-18五的 18:47 +0530，Aneesh Kumar K.V写道：
> We need to recalucate the path information on extent insert
> even if depth doesn't change.
> 
> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@...ux.vnet.ibm.com>
> ---
>  fs/ext4/extents.c |   41 +++++++++++++++++++++++------------------
>  1 files changed, 23 insertions(+), 18 deletions(-)
> 
> diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
> index 7bdaeec..9c8541e 100644
> --- a/fs/ext4/extents.c
> +++ b/fs/ext4/extents.c
> @@ -2462,7 +2462,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
>  		unsigned int newdepth;
>  		/* If extent has less than EXT4_EXT_ZERO_LEN zerout directly */
>  		if (allocated <= EXT4_EXT_ZERO_LEN) {
> -			/* Mark first half uninitialized.
> +			/*
> +			 * iblock == ee_block is handled by the zerouout
> +			 * at the beginning.
> +			 * Mark first half uninitialized.
>  			 * Mark second half initialized and zero out the
>  			 * initialized extent
>  			 */
> @@ -2485,7 +2488,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
>  				ex->ee_len   = orig_ex.ee_len;
>  				ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
>  				ext4_ext_dirty(handle, inode, path + depth);
> -				/* zeroed the full extent */
> +				/* blocks available from iblock */
>  				return allocated;
> 
>  			} else if (err)
> @@ -2513,6 +2516,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
>  					err = PTR_ERR(path);
>  					return err;
>  				}
> +				/* get the second half extent details */
>  				ex = path[depth].p_ext;
>  				err = ext4_ext_get_access(handle, inode,
>  								path + depth);
> @@ -2542,6 +2546,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
>  			ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
>  			ext4_ext_dirty(handle, inode, path + depth);
>  			/* zeroed the full extent */
> +			/* blocks available from iblock */
>  			return allocated;
> 
>  		} else if (err)
> @@ -2557,23 +2562,22 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
>  		 */
>  		orig_ex.ee_len = cpu_to_le16(ee_len -
>  						ext4_ext_get_actual_len(ex3));
> -		if (newdepth != depth) {
> -			depth = newdepth;
> -			ext4_ext_drop_refs(path);
> -			path = ext4_ext_find_extent(inode, iblock, path);
> -			if (IS_ERR(path)) {
> -				err = PTR_ERR(path);
> -				goto out;
> -			}
> -			eh = path[depth].p_hdr;
> -			ex = path[depth].p_ext;
> -			if (ex2 != &newex)
> -				ex2 = ex;
> -
> -			err = ext4_ext_get_access(handle, inode, path + depth);
> -			if (err)
> -				goto out;
> +		depth = newdepth;
> +		ext4_ext_drop_refs(path);
> +		path = ext4_ext_find_extent(inode, iblock, path);
> +		if (IS_ERR(path)) {
> +			err = PTR_ERR(path);
> +			goto out;
>  		}
> +		eh = path[depth].p_hdr;
> +		ex = path[depth].p_ext;
> +		if (ex2 != &newex)
> +			ex2 = ex;
> +
> +		err = ext4_ext_get_access(handle, inode, path + depth);
> +		if (err)
> +			goto out;
> +
>  		allocated = max_blocks;
> 
>  		/* If extent has less than EXT4_EXT_ZERO_LEN and we are trying
> @@ -2591,6 +2595,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
>  			ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
>  			ext4_ext_dirty(handle, inode, path + depth);
>  			/* zero out the first half */
> +			/* blocks available from iblock */
>  			return allocated;
>  		}
>  	}

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html