lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 30 Dec 2020 11:29:14 +0800 From: yangerkun <yangerkun@...wei.com> To: Theodore Ts'o <tytso@....edu> CC: <linux-ext4@...r.kernel.org>, <adilger.kernel@...ger.ca>, <jack@...e.cz>, <yi.zhang@...wei.com>, <lihaotian9@...wei.com>, <lutianxiong@...wei.com>, <linfeilong@...wei.com> Subject: Re: [PATCH v2] ext4: fix bug for rename with RENAME_WHITEOUT 在 2020/12/30 6:24, Theodore Ts'o 写道: > On Tue, Dec 29, 2020 at 05:02:08PM +0800, yangerkun wrote: >> ext4_rename will create a special inode for whiteout and use this 'ino' >> to replace the source file's dir entry 'ino'. Once error happens >> latter(small ext4 img, and consume all space, so the rename with dst >> path not exist will fail due to the ENOSPC return from ext4_add_entry in >> ext4_rename), the cleanup do drop the nlink for whiteout, but forget to >> restore 'ino' with source file. This will lead to "deleted inode >> referenced". > > Could you sendhave instructions how to reproduce this failure? Many thanks!! Hi, Follow step will reproduce it easily! cd /dev/shm mkdir test/ fallocate -l 128M img mkfs.ext4 -b 1024 img mount img test/ dd if=/dev/zero of=test/foo bs=1M count=128 mkdir test/dir/ && cd test/dir/ for ((i=0;i<1000;i++)); do touch file$i; done # consume all block cd ~ && renameat2(AT_FDCWD, /dev/shm/test/dir/file1, AT_FDCWD, /dev/shm/test/dir/dst_file, RENAME_WHITEOUT) # ext4_add_entry in ext4_rename will return ENOSPC!! cd /dev/shm/ && mount img test/ && ls -li test/dir/file1 We will get the output: "ls: cannot access 'test/dir/file1': Structure needs cleaning" and the dmesg show: "EXT4-fs error (device loop0): ext4_lookup:1626: inode #2049: comm ls: deleted inode referenced: 139" static int ext4_rename(...) { ... whiteout = ext4_whiteout_for_rename(&old, credits, &handle); ... retval = ext4_setent(handle, &old, whiteout->i_ino, EXT4_FT_CHRDEV); // will replace dir entry with ... if (!new.bh) { retval = ext4_add_entry(handle, new.dentry, old.inode); // will fail with ENOSPC if (retval) goto end_rename; ... end_rename: ... if (whiteout) { // forget to restore the dir entry's ino if (retval) drop_nlink(whiteout); unlock_new_inode(whiteout); iput(whiteout); } ... } Thanks, Kun. > > - Ted > . >
Powered by blists - more mailing lists