linux-ext4 - Re: [syzbot] kernel BUG in ext4_es_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <032b3468-4328-eda6-d3ce-6fda6673ab14@gmail.com>
Date:   Wed, 20 Apr 2022 21:57:25 +0800
From:   Phi Nguyen <phind.uet@...il.com>
To:     Jan Kara <jack@...e.cz>
Cc:     syzbot <syzbot+c7358a3cd05ee786eb31@...kaller.appspotmail.com>,
        adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org,
        linux-kernel@...r.kernel.org, tytso@....edu
Subject: Re: [syzbot] kernel BUG in ext4_es_cache_extent

On 4/20/2022 8:16 PM, Jan Kara wrote:
> On Mon 14-02-22 02:03:37, Phi Nguyen wrote:
>> The non-journal mounted fs is corrupted, syzbot was able to mount it because
>> a [fast commit] patch exclude its inodes from verification process.
>>
>> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>> master
> 
> This patch seems to have fallen through the cracks. Phi, care to submit it
> properly with your Signed-off-by etc?
> 
> 								Honza
> 
>> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
>> index 01c9e4f743ba..385f4ae71573 100644
>> --- a/fs/ext4/inode.c
>> +++ b/fs/ext4/inode.c
>> @@ -4912,7 +4912,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
>>   		goto bad_inode;
>>   	} else if (!ext4_has_inline_data(inode)) {
>>   		/* validate the block references in the inode */
>> -		if (!(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
>> +		if (!(journal && EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
>>   			(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
>>   			(S_ISLNK(inode->i_mode) &&
>>   			!ext4_inode_is_fast_symlink(inode)))) {
> 

Okay, I will send a patch.

BR,
Phi