linux-ext4 - [PATCH v1 0/5] ext4: Shut down block groups when damage is detected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 19 Jul 2013 16:55:32 -0700
From:	"Darrick J. Wong" <darrick.wong@...cle.com>
To:	"Theodore Ts'o" <tytso@....edu>,
	"Darrick J. Wong" <darrick.wong@...cle.com>
Cc:	linux-ext4@...r.kernel.org
Subject: [PATCH v1 0/5] ext4: Shut down block groups when damage is detected

Right now, ext4 doesn't do quite a good enough job shutting off allocation and
freeing activity in block groups when damage is detected, which means that ext4
can obliviously load a corrupt bitmap, base allocation decisions off of that,
and trash the filesystem.  We'd like to be able to freeze the block group when
this happens, so hopefully the next fsck can repair the damage.

The first patch fixes the behavior that a corrupt bitmap can be returned to
mballoc as if it was accurate.  The second patch is a trivial fix, and the two
after it provide for detecting damage in either the block bitmap or the inode
bitmap, and disabling all allocation/deallocation activity in the block group.
The final patch changes runtime block group descriptor validation failure
behavior to use the corruption flag to mark off the block group.

This patchset has been tested (albeit lightly) against 3.11-rc1 on x64.  I'm
wondering about a few things -- if we detect corrupt *inodes*, should we invoke
this mechanism as well?  Second, as I mentioned a few days ago, maybe it's time
for block_validity to be set always, since it seems to have a low speed impact?
Third, the block bitmap corruption flag patch is based off of Aditya Kali's
patch that you forwarded; can a proper Signed-off-by be attached since I mostly
just massaged that one into 3.11?

Comments and questions are, as always, welcome.

--D
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html