linux-ext4 - Re: [PATCH e2fsprogs] lib/quota: fix checksum mismatch on uninitialized PRJQUOTA inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <25z7f7wug2hsciq7iriagtnhoajoanx2h6z6jg6pwcmih4e6ee@kbfsk42u5h6g>
Date: Wed, 10 Dec 2025 10:47:18 +0100
From: Jan Kara <jack@...e.cz>
To: libaokun@...weicloud.com
Cc: linux-ext4@...r.kernel.org, tytso@....edu, adilger.kernel@...ger.ca, 
	jack@...e.cz, yangerkun@...wei.com, libaokun1@...wei.com
Subject: Re: [PATCH e2fsprogs] lib/quota: fix checksum mismatch on
 uninitialized PRJQUOTA inode

On Wed 10-12-25 16:15:58, libaokun@...weicloud.com wrote:
> From: Baokun Li <libaokun1@...wei.com>
> 
> In quota_inode_init_new(), we attempt to read and truncate an existing
> quota inode before proceeding with its initialization.
> 
> This read operation verifies the inode's checksum. This works fine for
> USRQUOTA and GRPQUOTA inodes because write_reserved_inodes() is always
> called during ext4 image creation to set appropriate checksums for these
> reserved inodes.
> 
> However, the PRJQUOTA inode is not reserved, and its corresponding inode
> table block may not have been zeroed, potentially containing stale data.
> Consequently, reading this inode can fail due to a checksum mismatch.
> 
> This can be reproduced by running the following sequence:
> 
>   dd if=/dev/random of=$DISK bs=1M count=128
>   mkfs.ext4 -F -q -b 1024 $DISK 5G
>   tune2fs -O quota,project $DISK
> 
> Which results in the following error output:
> 
>  tune2fs 1.47.3 (8-Jul-2025)
>  [ERROR] quotaio.c:279:quota_inode_init_new: ex2fs_read_inode failed
>  [ERROR] quotaio.c:341:quota_file_create: init_new_quota_inode failed
>  tune2fs: Inode checksum does not match inode while writing quota file (2)
> 
> While running `kvm-xfstests -c ext4/1k -C 1 generic/383`, the test itself
> does not fail, but checksum verification failures are reported even
> without fault injection, which led to discovering this issue.
> 
> To fix this, we stop attempting to read the quota inode that is about
> to be initialized inside quota_inode_init_new(). Instead, the logic
> to attempt truncation of an existing quota inode is moved to be handled
> inside quota_file_create().
> 
> Fixes: 080e09b4 ("Add project quota support")
> Signed-off-by: Baokun Li <libaokun1@...wei.com>

Looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@...e.cz>

								Honza

> ---
>  lib/support/quotaio.c | 30 +++++++++++++-----------------
>  1 file changed, 13 insertions(+), 17 deletions(-)
> 
> diff --git a/lib/support/quotaio.c b/lib/support/quotaio.c
> index f5f2c7f7..827df85b 100644
> --- a/lib/support/quotaio.c
> +++ b/lib/support/quotaio.c
> @@ -274,18 +274,6 @@ static errcode_t quota_inode_init_new(ext2_filsys fs, ext2_ino_t ino)
>  	errcode_t err = 0;
>  	time_t now;
>  
> -	err = ext2fs_read_inode(fs, ino, &inode);
> -	if (err) {
> -		log_err("ex2fs_read_inode failed");
> -		return err;
> -	}
> -
> -	if (EXT2_I_SIZE(&inode)) {
> -		err = quota_inode_truncate(fs, ino);
> -		if (err)
> -			return err;
> -	}
> -
>  	memset(&inode, 0, sizeof(struct ext2_inode));
>  	ext2fs_iblk_set(fs, &inode, 0);
>  	now = fs->now ? fs->now : time(0);
> @@ -319,6 +307,10 @@ errcode_t quota_file_create(struct quota_handle *h, ext2_filsys fs,
>  	if (fmt == -1)
>  		fmt = QFMT_VFS_V1;
>  
> +	err = ext2fs_read_bitmaps(fs);
> +	if (err)
> +		goto out_err;
> +
>  	h->qh_qf.fs = fs;
>  	qf_inum = quota_type2inum(qtype, fs->super);
>  	if (qf_inum == 0 && qtype == PRJQUOTA) {
> @@ -330,15 +322,19 @@ errcode_t quota_file_create(struct quota_handle *h, ext2_filsys fs,
>  		ext2fs_mark_ib_dirty(fs);
>  	} else if (qf_inum == 0) {
>  		return EXT2_ET_BAD_INODE_NUM;
> +	} else {
> +		err = quota_inode_truncate(fs, qf_inum);
> +		if (err) {
> +			log_err("quota_inode_truncate failed, ino=%u, type=%d",
> +				qf_inum, qtype);
> +			return err;
> +		}
>  	}
>  
> -	err = ext2fs_read_bitmaps(fs);
> -	if (err)
> -		goto out_err;
> -
>  	err = quota_inode_init_new(fs, qf_inum);
>  	if (err) {
> -		log_err("init_new_quota_inode failed");
> +		log_err("init_new_quota_inode failed, ino=%u, type=%d",
> +			qf_inum, qtype);
>  		goto out_err;
>  	}
>  	h->qh_qf.ino = qf_inum;
> -- 
> 2.46.1
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR