linux-kernel - Re: mount -o loop with truncated dosdisk.img uses 100% cpu and can't be killed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Jul 2012 14:39:46 -0500
From:	"Steven J. Magnani" <steve@...idescorp.com>
To:	OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
Cc:	Stevie Trujillo <stevie.trujillo@...il.com>,
	linux-kernel@...r.kernel.org, Jens Axboe <axboe@...nel.dk>
Subject: Re: mount -o loop with truncated dosdisk.img uses 100% cpu and
 can't be killed

On Fri, 2012-07-13 at 04:21 +0900, OGAWA Hirofumi wrote: 
> > On Thu, 2012-07-12 at 16:28 +0200, Stevie Trujillo wrote: 
> >> Hello,
> >> 
> >> I was trying to create a bootdisk to update my BIOS, and accidentially
> >> made a 512byte image with only the FreeDOS header in it.
> >> 
> >> ( Linux 3.4.4 )
> >> # mount -o loop dosdisk.img /tmp
> >> ^C^C^C
> >> It uses 100% CPU and doesn't listen to me when I do ^C, kill -9 etc. I
> >> think this means it's stuck in the kernel?
> It looks like the bug of __getblk_slow(). If requested block was beyond
> end of device, __find_get_block() will find buffer_mapped()'s buffer,
> but block >= end_block is unmapped. So, it can be loop.
> 
> The following patch fixes it? If it fix, there are some options to check
> it.
> 
> a) Check it like this patch and warn.
> b) (a), but without warn.
> c) Check it in init_page_buffers() and return -EIO or such
> 
> Well, anyway, Cc to Jens.
> 
> Signed-off-by: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
> ---
> 
>  fs/buffer.c |    7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff -puN fs/buffer.c~debug fs/buffer.c
> --- tux3fs/fs/buffer.c~debug	2012-07-13 04:10:40.000000000 +0900
> +++ tux3fs-hirofumi/fs/buffer.c	2012-07-13 04:11:50.000000000 +0900
> @@ -1055,6 +1055,13 @@ __getblk_slow(struct block_device *bdev,
>  		dump_stack();
>  		return NULL;
>  	}
> +	if (block >= blkdev_max_block(I_BDEV(bdev->bd_inode))) {
> +		printk(KERN_ERR "getblk(): block %llu, end_block %llu\n",
> +		       (unsigned long long)block,
> +		       (unsigned long long)blkdev_max_block(I_BDEV(bdev->bd_inode)));
> +		dump_stack();
> +		return NULL;
> +	}
>  
>  	for (;;) {
>  		struct buffer_head * bh;
> _

This fixes the hang, but I'm not sure dump_stack() is a good idea. I get
almost 100 lines of stack dumps and error messages in my kernel log.
Also, I was a little surprised to see that mount completes successfully.
------------------------------------------------------------------------
Steven J. Magnani               "I claim this network for MARS!
www.digidescorp.com              Earthling, return my space modulator!"

#include <standard.disclaimer>


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/