| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <565DCDFC.3010300@oracle.com>
Date: Tue, 1 Dec 2015 17:42:36 +0100
From: Vegard Nossum <vegard.nossum@...cle.com>
To: "Theodore Ts'o" <tytso@....edu>,
Andreas Dilger <adilger.kernel@...ger.ca>
Cc: linux-ext4@...r.kernel.org
Subject: ext4 endless "orphan list check failed!" spew/lockup
Hi,
Mounting the attached filesystem image (fuzzed) on latest linus/master
causes an endless stream of the following output on the console:
EXT4-fs (loop0): Inode 5 (ffff8800153ed720): orphan list check failed!
ffff8800153ed720: 00000000 00000000 00000000 00000000 ................
ffff8800153ed730: 00000000 00000000 00000000 00000000 ................
ffff8800153ed740: 00000000 00000000 00000000 00000000 ................
ffff8800153ed750: 00000000 00000000 00000000 00000000 ................
ffff8800153ed760: 00000000 00000000 00000000 00000000 ................
ffff8800153ed770: 00000000 00000000 00000000 00000000 ................
ffff8800153ed780: 153ed780 ffff8800 153ed780 ffff8800 ..>.......>.....
ffff8800153ed790: 00000000 00000000 00000000 00000000 ................
ffff8800153ed7a0: 153edcc0 ffff8800 15a0b920 ffff8800 ..>..... .......
ffff8800153ed7b0: 00000000 00000000 00000000 00000000 ................
ffff8800153ed7c0: 153ed7c0 ffff8800 153ed7c0 ffff8800 ..>.......>.....
ffff8800153ed7d0: 00000000 00000000 00000000 00000000 ................
ffff8800153ed7e0: 00008000 00000000 00000000 00000000 ................
ffff8800153ed7f0: ffffffff ffffffff ffffffff ffffffff ................
ffff8800153ed800: 82080e80 ffffffff 15a0c050 ffff8800 ........P.......
ffff8800153ed810: 153ed938 ffff8800 0007dc80 ffff8800 8.>.............
ffff8800153ed820: 00000005 00000000 00000000 00000000 ................
ffff8800153ed830: 00000000 00000000 565dc7b8 00000000 ..........]V....
ffff8800153ed840: 00000000 00000000 565dc7b8 00000000 ..........]V....
ffff8800153ed850: 00000000 00000000 565dc7b8 00000000 ..........]V....
ffff8800153ed860: 00000000 00000000 00000000 00000000 ................
ffff8800153ed870: 0000000a 00000000 00000000 00000000 ................
ffff8800153ed880: 00000060 00000000 00000001 00000000 `...............
ffff8800153ed890: 153ed890 ffff8800 153ed890 ffff8800 ..>.......>.....
ffff8800153ed8a0: 00000000 00000000 00000000 00000000 ................
ffff8800153ed8b0: 00000000 00000000 00000000 00000000 ................
ffff8800153ed8c0: 00000000 00000000 00000000 00000000 ................
ffff8800153ed8d0: 153ed8d0 ffff8800 153ed8d0 ffff8800 ..>.......>.....
ffff8800153ed8e0: 153ed8e0 ffff8800 153ed8e0 ffff8800 ..>.......>.....
ffff8800153ed8f0: 153ed8f0 ffff8800 153ed8f0 ffff8800 ..>.......>.....
ffff8800153ed900: 00000000 00000000 81317bc0 ffffffff .........{1.....
ffff8800153ed910: 00000000 00000000 00000000 00000000 ................
ffff8800153ed920: 00000000 00000000 82080fa0 ffffffff ................
ffff8800153ed930: 00000000 00000000 153ed7e0 ffff8800 ..........>.....
ffff8800153ed940: 00000000 02080020 00000000 00000000 .... ...........
ffff8800153ed950: 00000000 00000000 00000000 00000000 ................
ffff8800153ed960: 00000000 00000000 153ed968 ffff8800 ........h.>.....
ffff8800153ed970: 153ed968 ffff8800 00000000 00000000 h.>.............
ffff8800153ed980: 00000000 00000000 00000000 00000000 ................
ffff8800153ed990: 00000000 00000000 00000000 00000000 ................
ffff8800153ed9a0: 82080d80 ffffffff 024200ca 00000000 ..........B.....
ffff8800153ed9b0: 00000000 00000000 153ed9b8 ffff8800 ..........>.....
ffff8800153ed9c0: 153ed9b8 ffff8800 00000000 00000000 ..>.............
ffff8800153ed9d0: 153ed9d0 ffff8800 153ed9d0 ffff8800 ..>.......>.....
ffff8800153ed9e0: 00000000 00000000 00000000 00000000 ................
ffff8800153ed9f0: 00000000 00000000 00000000 00000000 ................
ffff8800153eda00: 00000000 00000000 00000000 00000000 ................
ffff8800153eda10: 00000000 00000000 00000000 00000000 ................
ffff8800153eda20: 153eda20 ffff8800 153eda20 ffff8800 .>..... .>.....
ffff8800153eda30: 00000000 00000000 00000000 00000000 ................
ffff8800153eda40: 00000000 00000000 00000000 00000000 ................
ffff8800153eda50: 153eda50 ffff8800 153eda50 ffff8800 P.>.....P.>.....
ffff8800153eda60: 00000000 00000000 00000000 ffffffff ................
ffff8800153eda70: 00000000 00000000 00000000 00000000 ................
ffff8800153eda80: 00000000 00000000 00000000 00000000 ................
ffff8800153eda90: 00000000 00000000 00000000 00000000 ................
ffff8800153edaa0: 153edaa0 ffff8800 153edaa0 ffff8800 ..>.......>.....
ffff8800153edab0: 00000000 00000000 ffffffe0 0000000f ................
ffff8800153edac0: 153edac0 ffff8800 153edac0 ffff8800 ..>.......>.....
ffff8800153edad0: 81302e40 ffffffff 00000000 00000003 @.0.............
ffff8800153edae0: 00000003 00000000 00000000 00000000 ................
ffff8800153edaf0: 00000000 00000000 00000000 00000000 ................
ffff8800153edb00: 00000000 00000000 ........
CPU: 1 PID: 957 Comm: mount Not tainted 4.4.0-rc3+ #244
ffffffff820ac0c0 ffff88001562f868 ffffffff81610cc9 ffff8800153ed7e0
ffff88001562f8a0 ffffffff8133097a 00000000000003e8 ffffffff00000001
ffff8800153ed7e0 ffffffff820ac0c0 ffff8800153ed880 ffff88001562f8c0
Call Trace:
[<ffffffff81610cc9>] dump_stack+0x44/0x5b
[<ffffffff8133097a>] ext4_destroy_inode+0xba/0xc0
[<ffffffff8125440f>] destroy_inode+0x5f/0x80
[<ffffffff81254d75>] evict+0x1e5/0x270
[<ffffffff81256217>] iput+0x297/0x350
[<ffffffff813393c5>] ext4_fill_super+0x4fa5/0x53b0
[<ffffffff8121f53a>] ? deactivate_slab+0x32a/0x3e0
[<ffffffff8161e1e1>] ? strnlen+0x31/0x60
[<ffffffff81334420>] ? ext4_calculate_overhead+0x530/0x530
[<ffffffff816233f8>] ? snprintf+0x88/0xa0
[<ffffffff810e2e91>] ? up_write+0x11/0x30
[<ffffffff811c902a>] ? register_shrinker+0xca/0x110
[<ffffffff8128329e>] ? set_blocksize+0x8e/0x140
[<ffffffff81232614>] mount_bdev+0x284/0x2e0
[<ffffffff81334420>] ? ext4_calculate_overhead+0x530/0x530
[<ffffffff81232390>] ? mount_ns+0xc0/0xc0
[<ffffffff8122356e>] ? __kmalloc_track_caller+0xbe/0x190
[<ffffffff811d656e>] ? kstrdup_const+0x1e/0x20
[<ffffffff81224796>] ? memcpy+0x36/0x40
[<ffffffff81317da0>] ext4_mount+0x10/0x20
[<ffffffff812328e6>] mount_fs+0x56/0x1b0
[<ffffffff8125ba32>] ? alloc_vfsmnt+0x2f2/0x350
[<ffffffff8125e116>] vfs_kern_mount+0x66/0x190
[<ffffffff8125fc32>] do_mount+0x362/0x16b0
[<ffffffff8121fb72>] ? ___slab_alloc+0x152/0x470
[<ffffffff8125f8d0>] ? copy_mount_string+0x20/0x20
[<ffffffff81223986>] ? kasan_unpoison_shadow+0x36/0x50
[<ffffffff81223bbe>] ? kasan_kmalloc+0x5e/0x70
[<ffffffff81223bdd>] ? kasan_slab_alloc+0xd/0x10
[<ffffffff8122356e>] ? __kmalloc_track_caller+0xbe/0x190
[<ffffffff811d66c1>] ? strndup_user+0x41/0x70
[<ffffffff8125f703>] ? copy_mount_options+0x23/0x1d0
[<ffffffff811d664d>] ? memdup_user+0x3d/0x70
[<ffffffff812614b6>] SyS_mount+0xf6/0x160
[<ffffffff812613c0>] ? copy_mnt_ns+0x440/0x440
[<ffffffff81f7d82e>] entry_SYSCALL_64_fastpath+0x12/0x71
This seems to lock up the VM as well.
A quick look/guess suggests maybe a cycle in the orphan list, maybe
something in ext4_orphan_del() could cause an infinite loop in the cleanup?
I can test patches. Thanks,
Vegard
Download attachment "ext4.1.bz2" of type "application/x-bzip" (1200 bytes)
Powered by blists - more mailing lists