linux-kernel - [PATCH] fat: fix corruption in fat_alloc_new

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  3 Sep 2019 01:59:36 +0200
From:   Jan Stancek <jstancek@...hat.com>
To:     hirofumi@...l.parknet.co.jp
Cc:     linux-kernel@...r.kernel.org, jstancek@...hat.com
Subject: [PATCH] fat: fix corruption in fat_alloc_new_dir()

sb_getblk does not guarantee that buffer_head is uptodate. If there is
async read running in parallel for same buffer_head, it can overwrite
just initialized msdos_dir_entry, leading to corruption:
  FAT-fs (loop0): error, corrupted directory (invalid entries)
  FAT-fs (loop0): Filesystem has been set read-only

This can happen for example during LTP statx04, which creates loop
device, formats it (mkfs.vfat), mounts it and immediately creates
a new directory. In parallel, systemd-udevd is probing new block
device, which leads to async read.

  do_mkdirat                      ksys_read
   vfs_mkdir                       vfs_read
    vfat_mkdir                      __vfs_read
     fat_alloc_new_dir               new_sync_read
       /* init de[0], de[1] */        blkdev_read_iter
                                       generic_file_read_iter
                                        generic_file_buffered_read
                                         blkdev_readpage
                                          block_read_full_page

Faster reproducer (based on LTP statx04):
--------------------------------- 8< ---------------------------------
int main(void)
{
	int i, j, ret, fd, loop_fd, ctrl_fd;
	int loop_num;
	char loopdev[256], tmp[256], testfile[256];

	mkdir("/tmp/mntpoint", 0777);
	for (i = 0; ; i++) {
		printf("Iteration: %d\n", i);
		sprintf(testfile, "/tmp/test.img.%d", getpid());

		ctrl_fd = open("/dev/loop-control", O_RDWR);
		loop_num = ioctl(ctrl_fd, LOOP_CTL_GET_FREE);
		close(ctrl_fd);
		sprintf(loopdev, "/dev/loop%d", loop_num);

		fd = open(testfile, O_WRONLY|O_CREAT|O_TRUNC, 0600);
		fallocate(fd, 0, 0, 256*1024*1024);
		close(fd);

		fd = open(testfile, O_RDWR);
		loop_fd = open(loopdev, O_RDWR);
		ioctl(loop_fd, LOOP_SET_FD, fd);
		close(loop_fd);
		close(fd);

		sprintf(tmp, "mkfs.vfat %s", loopdev);
		system(tmp);
		mount(loopdev, "/tmp/mntpoint", "vfat", 0, NULL);

		for (j = 0; j < 200; j++) {
			sprintf(tmp, "/tmp/mntpoint/testdir%d", j);
			ret = mkdir(tmp, 0777);
			if (ret) {
				perror("mkdir");
				break;
			}
		}

		umount("/tmp/mntpoint");
		loop_fd = open(loopdev, O_RDWR);
		ioctl(loop_fd, LOOP_CLR_FD, fd);
		close(loop_fd);
		unlink(testfile);

		if (ret)
			break;
	}

	return 0;
}
--------------------------------- 8< ---------------------------------

Issue triggers within minute on HPE Apollo 70 (arm64, 64GB RAM, 224 CPUs).

Signed-off-by: Jan Stancek <jstancek@...hat.com>
Cc: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
---
 fs/fat/dir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 1bda2ab6745b..474fd6873ec8 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -1149,7 +1149,7 @@ int fat_alloc_new_dir(struct inode *dir, struct timespec64 *ts)
 		goto error;
 
 	blknr = fat_clus_to_blknr(sbi, cluster);
-	bhs[0] = sb_getblk(sb, blknr);
+	bhs[0] = sb_bread(sb, blknr);
 	if (!bhs[0]) {
 		err = -ENOMEM;
 		goto error_free;
-- 
1.8.3.1