linux-ext4 - [Bug 219136] New: ext4: dax: overflowing extents beyond inode size when partially writing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <bug-219136-13602@https.bugzilla.kernel.org/>
Date: Wed, 07 Aug 2024 12:52:24 +0000
From: bugzilla-daemon@...nel.org
To: linux-ext4@...r.kernel.org
Subject: [Bug 219136] New: ext4: dax: overflowing extents beyond inode size
 when partially writing

https://bugzilla.kernel.org/show_bug.cgi?id=219136

            Bug ID: 219136
           Summary: ext4: dax: overflowing extents beyond inode size when
                    partially writing
           Product: File System
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: ext4
          Assignee: fs_ext4@...nel-bugs.osdl.org
          Reporter: chengzhihao1@...wei.com
        Regression: No

The dax_iomap_rw() does two things in each iteration: map written blocks
    and copy user data to blocks. If the process is killed by user(See signal
    handling in dax_iomap_iter()), the copied data will be returned and added
    on inode size, which means that the length of written extents may exceed
    the inode size, then fsck will fail. An example is given as:

    dd if=/dev/urandom of=file bs=4M count=1
     dax_iomap_rw
      iomap_iter // round 1
       ext4_iomap_begin
        ext4_iomap_alloc // allocate 0~2M extents(written flag)
      dax_iomap_iter // copy 2M data
      iomap_iter // round 2
       iomap_iter_advance
        iter->pos += iter->processed // iter->pos = 2M
       ext4_iomap_begin
        ext4_iomap_alloc // allocate 2~4M extents(written flag)
      dax_iomap_iter
       fatal_signal_pending
      done = iter->pos - iocb->ki_pos // done = 2M
     ext4_handle_inode_extension
      ext4_update_inode_size // inode size = 2M

    fsck reports: Inode 13, i_size is 2097152, should be 4194304.  Fix?

Reproducer:
1. Apply diff and compile kernel
2. ./test.sh
mke2fs 1.47.0 (5-Feb-2023)
Creating filesystem with 524288 4k blocks and 131072 inodes
Filesystem UUID: e2c71b4e-3315-4463-8613-ea3f40bf1efb
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done 

./test.sh: line 18:  1559 Terminated              dd if=/dev/urandom
of=$MNT/file bs=4M count=1
e2fsck 1.47.0 (5-Feb-2023)
Pass 1: Checking inodes, blocks, and sizes
Inode 13, i_size is 2097152, should be 4194304.  Fix? no

Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

/dev/pmem2: ********** WARNING: Filesystem still has errors **********

/dev/pmem2: 13/131072 files (0.0% non-contiguous), 27308/524288 blocks

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.