linux-ext4 - [Bug 218820] New: The empty file occupies incorrect blocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <bug-218820-13602@https.bugzilla.kernel.org/>
Date: Wed, 08 May 2024 13:33:56 +0000
From: bugzilla-daemon@...nel.org
To: linux-ext4@...r.kernel.org
Subject: [Bug 218820] New: The empty file occupies incorrect blocks

https://bugzilla.kernel.org/show_bug.cgi?id=218820

            Bug ID: 218820
           Summary: The empty file occupies incorrect blocks
           Product: File System
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: ext4
          Assignee: fs_ext4@...nel-bugs.osdl.org
          Reporter: zhangchi_seg@...il.nju.edu.cn
        Regression: No

Created attachment 306275
  --> https://bugzilla.kernel.org/attachment.cgi?id=306275&action=edit
reproduce.c

Hi,

I mounted an ext4 image, created a file, and wrote to it, but the blocks
occupied by this file were incorrect after I `truncate` it. I can reproduce
this with the latest linux kernel
https://git.kernel.org/torvalds/t/linux-6.9-rc7.tar.gz


The following is the triggering script:
```
dd if=/dev/zero of=ext4-0.img bs=1M count=120
mkfs.ext4 ext4-0.img
g++ -static reproduce.c
losetup /dev/loop0 ext4-0.img
mkdir /root/mnt
./a.out
stat /root/mnt/a
```

After run the script, you will get the following outputs:
```
  File: /root/mnt/a
  Size: 0               Blocks: 82         IO Block: 1024   regular empty file
Device: 700h/1792d      Inode: 12          Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:unlabeled_t:s0
Access: 2024-05-08 11:47:48.000000000 +0000
Modify: 2024-05-08 11:47:48.000000000 +0000
Change: 2024-05-08 11:47:48.000000000 +0000
 Birth: -
```

The size of file `a` is 0, yet it occupies 82 blocks. Normally, it should only
occupy 2 blocks.

The contents of `reproduce.c` :
```
#include <assert.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>
#include <stddef.h>
#include <unistd.h>
#include <pthread.h>
#include <errno.h>
#include <dirent.h>

#include <string>

#include <sys/mount.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <sys/wait.h>
#include <sys/xattr.h>
#include <sys/mount.h>
#include <sys/statfs.h>
#include <fcntl.h>

#define ALIGN 4096

void* align_alloc(size_t size) {
    void *ptr = NULL;
    int ret = posix_memalign(&ptr, ALIGN, size);
    if (ret) {
      printf("align error\n");
      exit(1);
    }
    return ptr;
}

int main()
{
    mount("/dev/loop0", "/root/mnt", "ext4", 0, "");

    creat("/root/mnt/a", S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH);
    int fd = open("/root/mnt/a", O_RDWR);
    mount(NULL, "/root/mnt/", NULL, MS_REMOUNT, "nodelalloc");
    sync();

    char *buf = (char*)align_alloc(4096*20);
    memset(buf, 'a' + 15, 4096*20);
    write(fd, buf, 4096*10);

    truncate("/root/mnt/a", 0);
    close(fd);
    return 0;
}
```

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.