linux-ext4 - [RESEND PATCH]ext4: bugfix for mmaped pages in mpage_release_unused

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <OF1131FC37.F6A9396B-ON48258026.002F1164-48258026.002F395B@zte.com.cn>
Date:   Tue, 6 Sep 2016 16:36:03 +0800
From:   wang.guang55@....com.cn
To:     tytso@....edu
Cc:     linux-ext4@...r.kernel.org
Subject: [RESEND PATCH]ext4: bugfix for mmaped pages in mpage_release_unused_pages()

ext4: bugfix for mmaped pages  in mpage_release_unused_pages()

Pages clear buffers after ext4 delayed block allocation failed,
However, it does not clean its pte_dirty flag.
if the pages unmap ,in cording to the pte_dirty ,
unmap_page_range may try to call __set_page_dirty,

which may lead to the bugon at 
mpage_prepare_extent_to_map:head = page_buffers(page);.

This patch just call clear_page_dirty_for_io to clean pte_dirty 
at mpage_release_unused_pages for pages mmaped. 

 
Steps to reproduce the bug:
（1） mmap a file in ext4
addr = (char *)mmap(NULL, 4096, 
        PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
 memset(addr, 'i', 4096);
（2） return EIO at 
ext4_writepages->mpage_map_and_submit_extent->mpage_map_one_extent 
Cause the log:
                ext4_msg(sb, KERN_CRIT,
                        "Delayed block allocation failed for "
                        "inode %lu at logical offset %llu with"
                        " max blocks %u with error %d",
                        inode->i_ino,
                        (unsigned long long)map->m_lblk,
                        (unsigned)map->m_len, -err);

(3）Unmap the addr cause warning at 
__set_page_dirty:WARN_ON_ONCE(warn && !PageUptodate(page));
(4) wait for a minute,then bugon happen.


Signed-off-by: wangguang <wangguang03@....com>
--- old/fs/ext4/inode.c 2016-08-29 12:15:25.150764447 -0400
+++ new/fs/ext4/inode.c 2016-08-29 13:01:58.683559198 -0400
@@ -1649,6 +1649,8 @@ static void mpage_release_unused_pages(s
                        BUG_ON(!PageLocked(page));
                        BUG_ON(PageWriteback(page));
                        if (invalidate) {
+                               if (page_mapped(page))
+                                       clear_page_dirty_for_io(page);
                                block_invalidatepage(page, 0, PAGE_SIZE);
                                ClearPageUptodate(page);
                        }