| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20240925143325.518508-2-aleksandr.mikhalitsyn@canonical.com>
Date: Wed, 25 Sep 2024 16:33:24 +0200
From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@...onical.com>
To: tytso@....edu
Cc: stable@...r.kernel.org,
Andreas Dilger <adilger.kernel@...ger.ca>,
Jan Kara <jack@...e.cz>,
Baokun Li <libaokun1@...wei.com>,
Stéphane Graber <stgraber@...raber.org>,
Christian Brauner <brauner@...nel.org>,
linux-kernel@...r.kernel.org,
linux-fsdevel@...r.kernel.org,
linux-ext4@...r.kernel.org,
Wesley Hershberger <wesley.hershberger@...onical.com>,
Alexander Mikhalitsyn <aleksandr.mikhalitsyn@...onical.com>
Subject: [PATCH 1/1] ext4: fix crash on BUG_ON in ext4_alloc_group_tables
[ 33.882936] EXT4-fs (dm-5): mounted filesystem 8aaf41b2-6ac0-4fa8-b92b-77d10e1d16ca r/w with ordered data mode. Quota mode: none.
[ 33.888365] EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks
[ 33.888740] ------------[ cut here ]------------
[ 33.888742] kernel BUG at fs/ext4/resize.c:324!
[ 33.889075] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[ 33.889503] CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27
[ 33.890039] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 33.890705] RIP: 0010:ext4_resize_fs+0x1212/0x12d0
[ 33.891063] Code: b8 45 31 c0 4c 89 ff 45 31 c9 31 c9 ba 0e 08 00 00 48 c7 c6 68 75 65 b8 e8 2b 79 01 00 41 b8 ea ff ff ff 41 5f e9 8d f1 ff ff <0f> 0b 48 83 bd 70 ff ff ff 00 75 32 45 31 c0 e9 53 f1 ff ff 41 b8
[ 33.892701] RSP: 0018:ffffa97f413f3cc8 EFLAGS: 00010202
[ 33.893081] RAX: 0000000000000018 RBX: 0000000000000001 RCX: 00000000fffffff0
[ 33.893639] RDX: 0000000000000017 RSI: 0000000000000016 RDI: 00000000e8c2c810
[ 33.894197] RBP: ffffa97f413f3d90 R08: 0000000000000000 R09: 0000000000008000
[ 33.894755] R10: ffffa97f413f3cc8 R11: ffffa2c1845bfc80 R12: 0000000000000000
[ 33.895317] R13: ffffa2c1843d6000 R14: 0000000000008000 R15: ffffa2c199963000
[ 33.895877] FS: 00007f46efd17000(0000) GS:ffffa2c89fc40000(0000) knlGS:0000000000000000
[ 33.896524] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 33.896954] CR2: 00005630a4a1cc88 CR3: 000000010532c000 CR4: 0000000000350eb0
[ 33.897516] Call Trace:
[ 33.897638] <TASK>
[ 33.897728] ? show_regs+0x6d/0x80
[ 33.897942] ? die+0x3c/0xa0
[ 33.898106] ? do_trap+0xe5/0x110
[ 33.898311] ? do_error_trap+0x6e/0x90
[ 33.898555] ? ext4_resize_fs+0x1212/0x12d0
[ 33.898844] ? exc_invalid_op+0x57/0x80
[ 33.899101] ? ext4_resize_fs+0x1212/0x12d0
[ 33.899387] ? asm_exc_invalid_op+0x1f/0x30
[ 33.899675] ? ext4_resize_fs+0x1212/0x12d0
[ 33.899961] ? ext4_resize_fs+0x745/0x12d0
[ 33.900239] __ext4_ioctl+0x4e0/0x1800
[ 33.900489] ? srso_alias_return_thunk+0x5/0xfbef5
[ 33.900832] ? putname+0x5b/0x70
[ 33.901028] ? srso_alias_return_thunk+0x5/0xfbef5
[ 33.901374] ? do_sys_openat2+0x87/0xd0
[ 33.901632] ? srso_alias_return_thunk+0x5/0xfbef5
[ 33.901981] ? srso_alias_return_thunk+0x5/0xfbef5
[ 33.902324] ? __x64_sys_openat+0x59/0xa0
[ 33.902595] ext4_ioctl+0x12/0x20
[ 33.902802] ? ext4_ioctl+0x12/0x20
[ 33.903031] __x64_sys_ioctl+0x99/0xd0
[ 33.903277] x64_sys_call+0x1206/0x20d0
[ 33.903534] do_syscall_64+0x72/0x110
[ 33.903771] ? srso_alias_return_thunk+0x5/0xfbef5
[ 33.904115] ? irqentry_exit+0x3f/0x50
[ 33.904362] ? srso_alias_return_thunk+0x5/0xfbef5
[ 33.904707] ? exc_page_fault+0x1aa/0x7b0
[ 33.904979] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 33.905349] RIP: 0033:0x7f46efe3294f
[ 33.905579] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00
[ 33.907321] RSP: 002b:00007ffe9b8833a0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 33.907926] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f46efe3294f
[ 33.908487] RDX: 00007ffe9b8834a0 RSI: 0000000040086610 RDI: 0000000000000004
[ 33.909046] RBP: 00005630a4a0b0e0 R08: 0000000000000000 R09: 00007ffe9b8832d7
[ 33.909605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[ 33.910165] R13: 00005630a4a0c580 R14: 00005630a4a10400 R15: 0000000000000000
[ 33.910740] </TASK>
[ 33.910837] Modules linked in:
[ 33.911049] ---[ end trace 0000000000000000 ]---
[ 33.911428] RIP: 0010:ext4_resize_fs+0x1212/0x12d0
[ 33.911810] Code: b8 45 31 c0 4c 89 ff 45 31 c9 31 c9 ba 0e 08 00 00 48 c7 c6 68 75 65 b8 e8 2b 79 01 00 41 b8 ea ff ff ff 41 5f e9 8d f1 ff ff <0f> 0b 48 83 bd 70 ff ff ff 00 75 32 45 31 c0 e9 53 f1 ff ff 41 b8
[ 33.913928] RSP: 0018:ffffa97f413f3cc8 EFLAGS: 00010202
[ 33.914313] RAX: 0000000000000018 RBX: 0000000000000001 RCX: 00000000fffffff0
[ 33.914909] RDX: 0000000000000017 RSI: 0000000000000016 RDI: 00000000e8c2c810
[ 33.915482] RBP: ffffa97f413f3d90 R08: 0000000000000000 R09: 0000000000008000
[ 33.916258] R10: ffffa97f413f3cc8 R11: ffffa2c1845bfc80 R12: 0000000000000000
[ 33.917027] R13: ffffa2c1843d6000 R14: 0000000000008000 R15: ffffa2c199963000
[ 33.917884] FS: 00007f46efd17000(0000) GS:ffffa2c89fc40000(0000) knlGS:0000000000000000
[ 33.918818] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 33.919322] CR2: 00005630a4a1cc88 CR3: 000000010532c000 CR4: 0000000000350eb0
[ 44.072293] ------------[ cut here ]------------
Cc: stable@...r.kernel.org # v6.8+
Fixes: 665d3e0af4d3 ("ext4: reduce unnecessary memory allocation in alloc_flex_gd()")
Cc: "Theodore Ts'o" <tytso@....edu>
Cc: Andreas Dilger <adilger.kernel@...ger.ca>
Cc: Jan Kara <jack@...e.cz>
Cc: Baokun Li <libaokun1@...wei.com>
Cc: Stéphane Graber <stgraber@...raber.org>
Cc: Christian Brauner <brauner@...nel.org>
Cc: <linux-kernel@...r.kernel.org>
Cc: <linux-fsdevel@...r.kernel.org>
Cc: <linux-ext4@...r.kernel.org>
Reported-by: Wesley Hershberger <wesley.hershberger@...onical.com>
Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2081231
Reported-by: Stéphane Graber <stgraber@...raber.org>
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@...onical.com>
---
fs/ext4/resize.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index e04eb08b9060..c057a7867363 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -300,8 +300,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd)
* block group.
*/
static int ext4_alloc_group_tables(struct super_block *sb,
- struct ext4_new_flex_group_data *flex_gd,
- unsigned int flexbg_size)
+ struct ext4_new_flex_group_data *flex_gd)
{
struct ext4_new_group_data *group_data = flex_gd->groups;
ext4_fsblk_t start_blk;
@@ -313,7 +312,7 @@ static int ext4_alloc_group_tables(struct super_block *sb,
ext4_group_t group;
ext4_group_t last_group;
unsigned overhead;
- __u16 uninit_mask = (flexbg_size > 1) ? ~EXT4_BG_BLOCK_UNINIT : ~0;
+ __u16 uninit_mask = (flex_gd->resize_bg > 1) ? ~EXT4_BG_BLOCK_UNINIT : ~0;
int i;
BUG_ON(flex_gd->count == 0 || group_data == NULL);
@@ -321,8 +320,8 @@ static int ext4_alloc_group_tables(struct super_block *sb,
src_group = group_data[0].group;
last_group = src_group + flex_gd->count - 1;
- BUG_ON((flexbg_size > 1) && ((src_group & ~(flexbg_size - 1)) !=
- (last_group & ~(flexbg_size - 1))));
+ BUG_ON((flex_gd->resize_bg > 1) && ((src_group & ~(flex_gd->resize_bg - 1)) !=
+ (last_group & ~(flex_gd->resize_bg - 1))));
next_group:
group = group_data[0].group;
if (src_group >= group_data[0].group + flex_gd->count)
@@ -403,7 +402,7 @@ static int ext4_alloc_group_tables(struct super_block *sb,
printk(KERN_DEBUG "EXT4-fs: adding a flex group with "
"%u groups, flexbg size is %u:\n", flex_gd->count,
- flexbg_size);
+ flex_gd->resize_bg);
for (i = 0; i < flex_gd->count; i++) {
ext4_debug(
@@ -2158,7 +2157,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
ext4_blocks_count(es));
last_update_time = jiffies;
}
- if (ext4_alloc_group_tables(sb, flex_gd, flexbg_size) != 0)
+ if (ext4_alloc_group_tables(sb, flex_gd) != 0)
break;
err = ext4_flex_group_add(sb, resize_inode, flex_gd);
if (unlikely(err))
--
2.34.1
Powered by blists - more mailing lists