linux-kernel - Re: [PATCH 3.16 043/157] ext4: brelse all indirect buffer inext4_ind_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5D523729.B7BF986@users.sourceforge.net>
Date:   Tue, 13 Aug 2019 07:06:01 +0300
From:   Jari Ruusu <jariruusu@...rs.sourceforge.net>
To:     Ben Hutchings <ben@...adent.org.uk>
CC:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        akpm@...ux-foundation.org, Denis Kirjanov <kda@...ux-powerpc.org>,
        Hulk Robot <hulkci@...wei.com>, Jan Kara <jack@...e.cz>,
        "zhangyi (F)" <yi.zhang@...wei.com>, Theodore Ts'o <tytso@....edu>
Subject: Re: [PATCH 3.16 043/157] ext4: brelse all indirect buffer 
 inext4_ind_remove_space()

Ben Hutchings wrote:
> From: "zhangyi (F)" <yi.zhang@...wei.com>
> 
> commit 674a2b27234d1b7afcb0a9162e81b2e53aeef217 upstream.

[snip]

> --- a/fs/ext4/indirect.c
> +++ b/fs/ext4/indirect.c
> @@ -1481,10 +1481,14 @@ end_range:
>                                            partial->p + 1,
>                                            partial2->p,
>                                            (chain+n-1) - partial);
> -                       BUFFER_TRACE(partial->bh, "call brelse");
> -                       brelse(partial->bh);
> -                       BUFFER_TRACE(partial2->bh, "call brelse");
> -                       brelse(partial2->bh);
> +                       while (partial > chain) {
> +                               BUFFER_TRACE(partial->bh, "call brelse");
> +                               brelse(partial->bh);
> +                       }
> +                       while (partial2 > chain2) {
> +                               BUFFER_TRACE(partial2->bh, "call brelse");
> +                               brelse(partial2->bh);
> +                       }
>                         return 0;
>                 }
> 

Above patch is really messed up. Alone that patch is livelocking
and file system corrupting. Look at those new while loops. Once the
while condition is true once, it is ALWAYS true, so it livelocks.

It absolutely needs follow-up patch from <yi.zhang@...wei.com>
"ext4: cleanup bh release code in ext4_ind_remove_space()"
upstream commit 5e86bdda41534e17621d5a071b294943cae4376e.

For more info about how to trigger that bug, see this earlier email

https://marc.info/?l=linux-kernel&m=155419973129522&w=2

For 3.16 kernels you may need to set CONFIG_EXT4_USE_FOR_EXT23=y
so that ext4 code handles ext3 file systems.

-- 
Jari Ruusu  4096R/8132F189 12D6 4C3A DCDA 0AA4 27BD  ACDF F073 3C80 8132 F189