linux-ext4 - Re: [PATCH] ext4: evict inline data when writing to memory map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 30 Apr 2017 00:13:57 -0400
From:   Theodore Ts'o <tytso@....edu>
To:     Eric Biggers <ebiggers3@...il.com>
Cc:     Christoph Hellwig <hch@...radead.org>, linux-ext4@...r.kernel.org,
        Andreas Dilger <adilger.kernel@...ger.ca>,
        Nick Alcock <nick.alcock@...cle.com>,
        Eric Biggers <ebiggers@...gle.com>, stable@...r.kernel.org
Subject: Re: [PATCH] ext4: evict inline data when writing to memory map

On Tue, Mar 14, 2017 at 04:32:39PM -0700, Eric Biggers wrote:
> I'm working on this, and I discovered there's still a bug.  After the data is
> written with mwrite, if the filesystem is then mount-cycled, the contents of the
> file are the old contents rather than the new contents.
> 
> I believe this is caused by a bug in ext4_convert_inline_data().  Specifically,
> the new block containing the evicted data is journalled using a buffer_head
> associated with the block device.  This is wrong because it can overwrite data
> that is later written through non-journalled writeback.

I'll apply this patch for now, since it fixes a userspace-triggerable
BUG, but you're right.  ext4_convert_inline_data() is busted; it
should not be using data journalling, but rather it should check to
make sure the page is already in memory (and creating it if
necessary), and just write it out to memory.

This is a separate bug, and we should fix it, but the first patch is
correct and should go in.

					- Ted