linux-kernel - Re: [PATCH 3.16 043/157] ext4: brelse all indirect buffer inext4_ind_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 13 Aug 2019 12:37:27 +0100
From:   Ben Hutchings <ben@...adent.org.uk>
To:     Jari Ruusu <jariruusu@...rs.sourceforge.net>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        akpm@...ux-foundation.org, Denis Kirjanov <kda@...ux-powerpc.org>,
        Hulk Robot <hulkci@...wei.com>, Jan Kara <jack@...e.cz>,
        "zhangyi (F)" <yi.zhang@...wei.com>, Theodore Ts'o <tytso@....edu>
Subject: Re: [PATCH 3.16 043/157] ext4: brelse all indirect buffer 
 inext4_ind_remove_space()

On Tue, 2019-08-13 at 07:06 +0300, Jari Ruusu wrote:
> Ben Hutchings wrote:
> > From: "zhangyi (F)" <yi.zhang@...wei.com>
> > 
> > commit 674a2b27234d1b7afcb0a9162e81b2e53aeef217 upstream.
> 
> [snip]
> 
> > --- a/fs/ext4/indirect.c
> > +++ b/fs/ext4/indirect.c
> > @@ -1481,10 +1481,14 @@ end_range:
> >                                            partial->p + 1,
> >                                            partial2->p,
> >                                            (chain+n-1) - partial);
> > -                       BUFFER_TRACE(partial->bh, "call brelse");
> > -                       brelse(partial->bh);
> > -                       BUFFER_TRACE(partial2->bh, "call brelse");
> > -                       brelse(partial2->bh);
> > +                       while (partial > chain) {
> > +                               BUFFER_TRACE(partial->bh, "call brelse");
> > +                               brelse(partial->bh);
> > +                       }
> > +                       while (partial2 > chain2) {
> > +                               BUFFER_TRACE(partial2->bh, "call brelse");
> > +                               brelse(partial2->bh);
> > +                       }
> >                         return 0;
> >                 }
> > 
> 
> Above patch is really messed up. Alone that patch is livelocking
> and file system corrupting. Look at those new while loops. Once the
> while condition is true once, it is ALWAYS true, so it livelocks.

Thank you very much for this information.

> It absolutely needs follow-up patch from <yi.zhang@...wei.com>
> "ext4: cleanup bh release code in ext4_ind_remove_space()"
> upstream commit 5e86bdda41534e17621d5a071b294943cae4376e.
> 
> For more info about how to trigger that bug, see this earlier email
> 
> https://marc.info/?l=linux-kernel&m=155419973129522&w=2
> 
> For 3.16 kernels you may need to set CONFIG_EXT4_USE_FOR_EXT23=y
> so that ext4 code handles ext3 file systems.

As I want to release the update right now, I'll defer both of these.

Ben.

-- 
Ben Hutchings
When in doubt, use brute force. - Ken Thompson



Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)