linux-ext4 - Bug with "fix partial page writes"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 8 Nov 2011 14:59:52 -0800
From:	Curt Wohlgemuth <curtw@...gle.com>
To:	Allison Henderson <achender@...ux.vnet.ibm.com>,
	ext4 development <linux-ext4@...r.kernel.org>
Cc:	Hugh Dickins <hughd@...gle.com>
Subject: Bug with "fix partial page writes"

It appears that there's a bug with this patch:

-------------------------------------------
commit 02fac1297eb3f471a27368271aadd285548297b0
Author: Allison Henderson <achender@...ux.vnet.ibm.com>
Date:   Tue Sep 6 21:53:01 2011 -0400

    ext4: fix partial page writes
...
-------------------------------------------

Hugh Dickens found a bug with some nasty testing and lockdep that
crashed in ext4_da_write_end(), and after looking at the code with
him, it appears that the call to
ext4_discard_partial_page_buffers_no_lock() in this routine is
manipulating an unlocked, and possibly non-existent page:


-------------------------------------------
...
	ret2 = generic_write_end(file, mapping, pos, len, copied,
							page, fsdata);

	page_len = PAGE_CACHE_SIZE -
			((pos + copied - 1) & (PAGE_CACHE_SIZE - 1));

	if (page_len > 0) {
		ret = ext4_discard_partial_page_buffers_no_lock(handle,
			inode, page, pos + copied - 1, page_len,
			EXT4_DISCARD_PARTIAL_PG_ZERO_UNMAPPED);
	}
...
-------------------------------------------

Note that generic_write_end() will unlock and release the page before
it returns.

I've no good answer for how to fix this properly, but I wanted to let
Allison know about this, if she hadn't already.  I looked but didn't
see any related email on the linux-ext4 list for this problem.

Thanks,
Curt
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html