linux-ext4 - Re: [PATCH] ext4: fix bug for rename with RENAME

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <24f6a6ff-bfa9-f0e6-1ab0-cf56222d0d40@huawei.com>
Date:   Tue, 29 Dec 2020 16:57:47 +0800
From:   yangerkun <yangerkun@...wei.com>
To:     <linux-ext4@...r.kernel.org>, <tytso@....edu>,
        <adilger.kernel@...ger.ca>, <jack@...e.cz>
CC:     <yi.zhang@...wei.com>, <lihaotian9@...wei.com>,
        <lutianxiong@...wei.com>, <linfeilong@...wei.com>
Subject: Re: [PATCH] ext4: fix bug for rename with RENAME_WHITEOUT



在 2020/12/29 16:56, yangerkun 写道:
> ext4_rename will create a special inode for whiteout and use this 'ino'
> to replace the source file's dir entry 'ino'. Once error happens
> latter(small ext4 img, and consume all space, so the rename with dst
> path not exist will fail due to the ENOSPC return from ext4_add_entry in
> ext4_rename), the cleanup do drop the nlink for whiteout, but forget to
> restore 'ino' with source file. This will lead to "deleted inode
> referenced".
> 
> Signed-off-by: yangerkun <yangerkun@...wei.com>
> ---
>   fs/ext4/namei.c | 14 +++++++-------
>   1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index b17a082b7db1..0e89e5a0c758 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -3593,9 +3593,6 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent,
>   			return retval2;
>   		}
>   	}
> -	brelse(ent->bh);
> -	ent->bh = NULL;
> -
>   	return retval;
>   }
>   
> @@ -3794,6 +3791,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
>   		}
>   	}
>   
> +	old_file_type = old.de->file_type;
>   	if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir))
>   		ext4_handle_sync(handle);
>   
> @@ -3821,7 +3819,6 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
>   	force_reread = (new.dir->i_ino == old.dir->i_ino &&
>   			ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA));
>   
> -	old_file_type = old.de->file_type;
>   	if (whiteout) {
>   		/*
>   		 * Do this before adding a new entry, so the old entry is sure
> @@ -3919,15 +3916,18 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
>   	retval = 0;
>   
>   end_rename:
> -	brelse(old.dir_bh);
> -	brelse(old.bh);
> -	brelse(new.bh);
>   	if (whiteout) {
> +		ext4_setent(handle, &old,
> +			    old.inode->i_ino, old_file_type);
>   		if (retval)
>   			drop_nlink(whiteout);
>   		unlock_new_inode(whiteout);
>   		iput(whiteout);
> +

This is a mistake... Will send v2.

>   	}
> +	brelse(old.dir_bh);
> +	brelse(old.bh);
> +	brelse(new.bh);
>   	if (handle)
>   		ext4_journal_stop(handle);
>   	return retval;
>