linux-ext4 - Re: [PATCH] ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140401051516.GO4911@thunk.org>
Date:	Tue, 1 Apr 2014 01:15:16 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	Kazuya Mio <k-mio@...jp.nec.com>
Cc:	"adilger.kernel@...ger.ca" <adilger.kernel@...ger.ca>,
	"linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Subject: Re: [PATCH] ext4: FIBMAP ioctl causes BUG_ON due to handle
 EXT_MAX_BLOCKS

On Wed, Mar 26, 2014 at 05:20:54AM +0000, Kazuya Mio wrote:
> When we try to get 2^32-1 block of the file which has the extent
> (ee_block=2^32-2, ee_len=1) with FIBMAP ioctl, it causes BUG_ON
> in ext4_ext_put_gap_in_cache().

We should be returning an error when we pass in an lblk >=
EXT4_MAX_BLOCKS in ext4_map_blocks(), long before we even get to
ext4_ext_put_gap_in_cache().  And if we fix it there, we may catch
other cases which might lead to the BUG_ON() firing.

Also, how ext4_bmap() is currently being implemented is spectacularly
ugly; I have no idea why we are calling generic_block_bmap() instead
of calling ext4_map_blocks() directly.

Since FIBMAP requires root privs, I'd much rather fix this at our
leisure post merge-window.  If this same bug can be triggered by
FIEMAP, then we really do need to fix this right away, since FIEMAP
can be used by anybody.  (But then we should be fixing it in
ext4_map_blocks, not in ext4_bmap.)

Did you check whether the same bug can be triggered via FIEMAP?

Thanks,

					- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html