linux-kernel - Re: [ 132/184] ext4: avoid hang when mounting non-journal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1370583872.4021.87.camel@deadeye.wl.decadent.org.uk>
Date:	Fri, 07 Jun 2013 06:44:32 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Willy Tarreau <w@....eu>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Theodore Tso <tytso@....edu>
Subject: Re: [ 132/184] ext4: avoid hang when mounting non-journal

On Tue, 2013-06-04 at 19:23 +0200, Willy Tarreau wrote:
> 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> 
> ------------------
>  filesystems with orphan list
> 
> From: Theodore Ts'o <tytso@....edu>

commit 0e9a9a1ad619e7e987815d20262d36a2f95717ca upstream.

> When trying to mount a file system which does not contain a journal,
> but which does have a orphan list containing an inode which needs to
> be truncated, the mount call with hang forever in
> ext4_orphan_cleanup() because ext4_orphan_del() will return
> immediately without removing the inode from the orphan list, leading
> to an uninterruptible loop in kernel code which will busy out one of
> the CPU's on the system.
> 
> This can be trivially reproduced by trying to mount the file system
> found in tests/f_orphan_extents_inode/image.gz from the e2fsprogs
> source tree.  If a malicious user were to put this on a USB stick, and
> mount it on a Linux desktop which has automatic mounts enabled, this
> could be considered a potential denial of service attack.  (Not a big
> deal in practice, but professional paranoids worry about such things,
> and have even been known to allocate CVE numbers for such problems.)
> 
> Signed-off-by: "Theodore Ts'o" <tytso@....edu>
> Reviewed-by: Zheng Liu <wenqing.lz@...bao.com>
> Cc: stable@...r.kernel.org
> Signed-off-by: Willy Tarreau <w@....eu>
> ---
>  fs/ext4/namei.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index 230bef5..3a1af19 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -2082,7 +2082,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
>  	struct ext4_iloc iloc;
>  	int err = 0;
>  
> -	if (!EXT4_SB(inode->i_sb)->s_journal)
> +	if ((!EXT4_SB(inode->i_sb)->s_journal) &&
> +	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
>  		return 0;
>  
>  	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);

-- 
Ben Hutchings
Theory and practice are closer in theory than in practice.
                                - John Levine, moderator of comp.compilers

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)