linux-ext4 - Re: [e2fsprogs] Bug in salvage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070709182923.GB2343@thunk.org>
Date:	Mon, 9 Jul 2007 14:29:23 -0400
From:	Theodore Tso <tytso@....edu>
To:	Kalpak Shah <kalpak@...sterfs.com>
Cc:	linux-ext4 <linux-ext4@...r.kernel.org>,
	Andreas Dilger <adilger@...sterfs.com>
Subject: Re: [e2fsprogs] Bug in salvage_directory

On Mon, Jul 09, 2007 at 11:22:05PM +0530, Kalpak Shah wrote:
> On Mon, 2007-07-09 at 12:50 -0400, Theodore Tso wrote:
> > On Mon, Jul 09, 2007 at 03:02:02PM +0530, Kalpak Shah wrote:
> > > Hi Ted,
> > > 
> > > Recently, one of our customers found this message in pass2 of e2fsck while doing some regression testing:
> > > "Entry '4, 0x695a, 0x81ff, 0x0040, 0x8320, 0xa192, 0x0021' in ??? (136554) has
> > > rec_len of 14200, should be 26908."
> > > 
> > > Both the displayed rec_len and the "should be" value are bogus. The
> > > reason is that salvage_directory sets a offset beyond blocksize
> > > leading to bogus messages.
> > 
> > Do you have a test case where this happens?  I don't think your patch
> > is right, because if dirent->rec_len is too big, this yes, your patch
> > will make sure offset doesn't get set beyond fs->blocksize, but it
> > ends up leaving prev->rec_len also pointing beyond fs->blocksize ---
> > which means a 2nd e2fsck should result in a complaint about that.
> 
> Yes even prev->rec_len cannot be beyond fs->blocksize. 

Really?  Even after this:

               prev->rec_len += dirent->rec_len;
                             ^^^^^^^^^^^^^^^^^^^

... when *offset + dirent->rec_len > fs->blocksize?  If the else part
of your conditional triggers, then dirent->rec_len is too big; it
could potentially be huge.  So just blindly adding that invalid value
to prev->rec_len can't be right.

> I do have the corrupt filesystem image but it is a large one. 

Can you use debugfs's "dump" command to dump out the contents of the
directory in question?  i.e.:

<tytso.root@...dygram> {/usr/projects/ext4-patch-queue}, level 2  [master]
504# debugfs /dev/sda2
debugfs 1.40.1 (08-Jul-2007)
debugfs:  dump /home/tytso/isync/mit/new /tmp/new-dir.img
debugfs:  q
<tytso.root@...dygram> {/usr/projects/ext4-patch-queue}, level 2  [master]
505# ls -l /tmp/new-dir.img
408 -rw-r--r-- 1 root root 409600 2007-07-09 14:28 /tmp/new-dir.img

    	       	      	   	  	     - Ted
-
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html