linux-kernel - Re: [PATCH] afs: Fix endless loop in directory parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 23 Feb 2024 09:28:28 -0400
From: Marc Dionne <marc.dionne@...istor.com>
To: David Howells <dhowells@...hat.com>
Cc: Markus Suvanto <markus.suvanto@...il.com>, Christian Brauner <brauner@...nel.org>, 
	linux-afs@...ts.infradead.org, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] afs: Fix endless loop in directory parsing

On Fri, Feb 23, 2024 at 9:15 AM David Howells <dhowells@...hat.com> wrote:
>
>
> If a directory has a block with only ".__afsXXXX" files in it (from
> uncompleted silly-rename), these .__afsXXXX files are skipped but without
> advancing the file position in the dir_context.  This leads to
> afs_dir_iterate() repeating the block again and again.
>
> Fix this by making the code that skips the .__afsXXXX file also manually
> advance the file position.
>
> The symptoms are a soft lookup:
>
>         watchdog: BUG: soft lockup - CPU#3 stuck for 52s! [check:5737]
>         ...
>         RIP: 0010:afs_dir_iterate_block+0x39/0x1fd
>         ...
>          ? watchdog_timer_fn+0x1a6/0x213
>         ...
>          ? asm_sysvec_apic_timer_interrupt+0x16/0x20
>          ? afs_dir_iterate_block+0x39/0x1fd
>          afs_dir_iterate+0x10a/0x148
>          afs_readdir+0x30/0x4a
>          iterate_dir+0x93/0xd3
>          __do_sys_getdents64+0x6b/0xd4
>
> This is almost certainly the actual fix for:
>
>         https://bugzilla.kernel.org/show_bug.cgi?id=218496
>
> Fixes: 57e9d49c5452 ("afs: Hide silly-rename files from userspace")
> Signed-off-by: David Howells <dhowells@...hat.com>
> cc: Marc Dionne <marc.dionne@...istor.com>
> cc: Markus Suvanto <markus.suvanto@...il.com>
> cc: linux-afs@...ts.infradead.org
> ---
>  fs/afs/dir.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/afs/dir.c b/fs/afs/dir.c
> index b5b8de521f99..8a67fc427e74 100644
> --- a/fs/afs/dir.c
> +++ b/fs/afs/dir.c
> @@ -479,8 +479,10 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
>                     dire->u.name[0] == '.' &&
>                     ctx->actor != afs_lookup_filldir &&
>                     ctx->actor != afs_lookup_one_filldir &&
> -                   memcmp(dire->u.name, ".__afs", 6) == 0)
> +                   memcmp(dire->u.name, ".__afs", 6) == 0) {
> +                       ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent);
>                         continue;
> +               }
>
>                 /* found the next entry */
>                 if (!dir_emit(ctx, dire->u.name, nlen,

Reviewed-by: Marc Dionne <marc.dionne@...istor.com>

Marc