lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 16 May 2019 13:56:15 -0700
From:   Ira Weiny <ira.weiny@...el.com>
To:     Theodore Ts'o <tytso@....edu>, linux-ext4@...r.kernel.org,
        Jan Kara <jack@...e.cz>
Cc:     Dan Williams <dan.j.williams@...el.com>
Subject: Can ext4_break_layouts() ever fail?


While testing truncate failure options for FS DAX with GUP pins; I discovered
that if ext4_break_layouts() returns an error it can result in orphan'ed inodes
being left on the orphan list resulting in the following error when the FS is
unmounted.

        EXT4-fs (pmem0): Inode 12 (00000000d274c438): orphan list check failed!
        00000000d274c438: 0001f30a 00000004 00000000 00000000 ................
        000000001fa30de6: 0000000a 00008600 00000000 00000000 ................
        000000003948cb2f: 00000000 00000000 00000000 00000000 ................

        [snip]

        000000009acf82ac: 00000003 00000003 00000000 00000000 ................
        00000000d0cb8f52: 00000000 00000000 00000000 00000000 ................
        000000001edc0c35: bf718fee 00000000 ..q.....
        CPU: 5 PID: 1806 Comm: umount Not tainted 5.1.0-rc2+ #56
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180724_192412-buildhw-07.phx2.fedoraproject.org-1.fc29 04/01/4
        Call Trace:
         dump_stack+0x5c/0x80
         ext4_destroy_inode+0x86/0x90
         dispose_list+0x48/0x60
         evict_inodes+0x160/0x1b0
         generic_shutdown_super+0x3f/0x100
         kill_block_super+0x21/0x50
         deactivate_locked_super+0x34/0x70
         cleanup_mnt+0x3b/0x70
         task_work_run+0x8a/0xb0
         exit_to_usermode_loop+0xb9/0xc0
         do_syscall_64+0x153/0x180
         entry_SYSCALL_64_after_hwframe+0x44/0xa9
        RIP: 0033:0x7fc5ed56f6bb
        Code: 27 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 90 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 008
        RSP: 002b:00007ffd524be128 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
        RAX: 0000000000000000 RBX: 000055867f9b2fb0 RCX: 00007fc5ed56f6bb
        RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055867f9b3190
        RBP: 0000000000000000 R08: 000055867f9b31b0 R09: 00007fc5ed5f1e80
        R10: 0000000000000000 R11: 0000000000000246 R12: 000055867f9b3190
        R13: 00007fc5ed7261a4 R14: 0000000000000000 R15: 00007ffd524be398
        EXT4-fs (pmem0): sb orphan head is 12
        sb_info orphan list:
          inode pmem0:12 at 00000000120c1727: mode 100644, nlink 1, next 0

Followed by this panic:

        ------------[ cut here ]------------
        kernel BUG at fs/ext4/super.c:1022!
        invalid opcode: 0000 [#1] SMP PTI
        CPU: 5 PID: 1806 Comm: umount Not tainted 5.1.0-rc2+ #56
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180724_192412-buildhw-07.phx2.fedoraproject.org-1.fc29 04/01/4
        RIP: 0010:ext4_put_super+0x369/0x370
        Code: 24 d0 03 00 00 48 8b 40 68 83 60 60 fb 0f b7 83 a0 00 00 00 66 41 89 46 3a 41 f6 44 24 50 01 0f 85 71 fd ff ff e9 5f fd8
        RSP: 0018:ffffc900029cfe68 EFLAGS: 00010206
        RAX: ffff888000691dd0 RBX: ffff88800e78f800 RCX: 0000000000000000
        RDX: 0000000000000000 RSI: ffff88800fc96838 RDI: ffff88800fc96838
        RBP: ffff88800e78f9f8 R08: 0000000000000603 R09: 0000000000aaaaaa
        R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800e78e800
        R13: ffff88800e78f9f8 R14: ffffffff820b3a50 R15: ffff888016521f70
        FS:  00007fc5ed3b8080(0000) GS:ffff88800fc80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00007f55f82181a0 CR3: 0000000015e9a000 CR4: 00000000000006e0
        Call Trace:
         generic_shutdown_super+0x6c/0x100
         kill_block_super+0x21/0x50
         deactivate_locked_super+0x34/0x70
         cleanup_mnt+0x3b/0x70
         task_work_run+0x8a/0xb0
         exit_to_usermode_loop+0xb9/0xc0
         do_syscall_64+0x153/0x180
         entry_SYSCALL_64_after_hwframe+0x44/0xa9
        RIP: 0033:0x7fc5ed56f6bb
        Code: 27 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 90 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 008
        RSP: 002b:00007ffd524be128 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
        RAX: 0000000000000000 RBX: 000055867f9b2fb0 RCX: 00007fc5ed56f6bb
        RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055867f9b3190
        RBP: 0000000000000000 R08: 000055867f9b31b0 R09: 00007fc5ed5f1e80
        R10: 0000000000000000 R11: 0000000000000246 R12: 000055867f9b3190
        R13: 00007fc5ed7261a4 R14: 0000000000000000 R15: 00007ffd524be398
        Modules linked in: xfs libcrc32c ib_isert iscsi_target_mod rpcrdma ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_c
        ---[ end trace c300122aad5fcd86 ]---
        RIP: 0010:ext4_put_super+0x369/0x370
        Code: 24 d0 03 00 00 48 8b 40 68 83 60 60 fb 0f b7 83 a0 00 00 00 66 41 89 46 3a 41 f6 44 24 50 01 0f 85 71 fd ff ff e9 5f fd8
        RSP: 0018:ffffc900029cfe68 EFLAGS: 00010206
        RAX: ffff888000691dd0 RBX: ffff88800e78f800 RCX: 0000000000000000
        RDX: 0000000000000000 RSI: ffff88800fc96838 RDI: ffff88800fc96838
        RBP: ffff88800e78f9f8 R08: 0000000000000603 R09: 0000000000aaaaaa
        R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800e78e800
        R13: ffff88800e78f9f8 R14: ffffffff820b3a50 R15: ffff888016521f70
        FS:  00007fc5ed3b8080(0000) GS:ffff88800fc80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00007f55f82181a0 CR3: 0000000015e9a000 CR4: 00000000000006e0
        Kernel panic - not syncing: Fatal exception
        Kernel Offset: disabled
        ---[ end Kernel panic - not syncing: Fatal exception ]---
        ------------[ cut here ]------------

I kind of worked around this by removing the orphan inode from the orphan list
if ext4_break_layouts() fails.[1]  But I don't think this unwinds everything
properly.

Failing the truncate for GUP'ed pages could be done outside of
ext4_break_layouts() so it is not absolutely necessary that it return an error.

But this begs the question can ext4_break_layouts() fail?

It looks to me like it is possible for ext4_break_layouts() to fail if
prepare_to_wait_event() sees a pending signal.  Therefore I think this is a bug
in ext4 regardless of how I may implement a truncate failure.

Is that true?
Ira



[1] as shown here.

---
 fs/ext4/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 41eb643d75ff..134f5eebee4a 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5648,6 +5648,8 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
                if (rc) {  
                        up_write(&EXT4_I(inode)->i_mmap_sem);
                        error = rc;
+                       if (orphan)
+                               ext4_orphan_del(NULL, inode);
                        goto err_out;
                }


Powered by blists - more mailing lists