linux-kernel - Re: WARNING in jbd2_journal_update_sb_log

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADCV8srwww_--oOvi1sdS4JfUafidPOPr0srG1bWO66py2WTtQ@mail.gmail.com>
Date: Wed, 15 Jan 2025 09:32:27 +0800
From: Liebes Wang <wanghaichi0403@...il.com>
To: Heming Zhao <heming.zhao@...e.com>
Cc: "Theodore Ts'o" <tytso@....edu>, Jan Kara <jack@...e.cz>, jack@...e.com, 
	linux-ext4@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzkaller@...glegroups.com, Joseph Qi <joseph.qi@...ux.alibaba.com>, 
	ocfs2-devel@...ts.linux.dev
Subject: Re: WARNING in jbd2_journal_update_sb_log_tail

The bisection log shows the first cause commit is
a09decff5c32060639a685581c380f51b14e1fc2:
a09decff5c32 jbd2: clear JBD2_ABORT flag before journal_reset to update log
tail info when load journal

The full bisection log is attached. Hope this helps.

Heming Zhao <heming.zhao@...e.com> 于2025年1月14日周二 22:51写道：

> Hi Ted,
>
> On 1/14/25 21:38, Theodore Ts'o wrote:
> > On Tue, Jan 14, 2025 at 02:25:21PM +0800, Heming Zhao wrote:
> >>
> >> The root cause appears to be that the jbd2 bypass recovery logic
> >> is incorrect.
> >
> > Heming, thanks for taking a look.
> >
> > I'm not convinced the root cause is what you've stated.  When
> > jbd2_journal_wipe() calls jbd2_mark_journal_empty(), s_start gets set
> > to zero:
>
> Actually, ocfs2 calls jbd2_journal_wipe() with 'write=0' (hard coded),
> so jbd2_mark_journal_empty() isn't called during the ocfs2 mount
> phase. This means the following deduction won't apply in this case.
>
> -- Heming
>
> >
> >       sb->s_start    = cpu_to_be32(0);
> >
> > This then gets checked in jbd2_journal_recovery:
> >
> >       if (!sb->s_start) {
> >               jbd2_debug(1, "No recovery required, last transaction %d,
> head block %u\n",
> >                         be32_to_cpu(sb->s_sequence),
> be32_to_cpu(sb->s_head));
> >               journal->j_transaction_sequence =
> be32_to_cpu(sb->s_sequence) + 1;
> >               journal->j_head = be32_to_cpu(sb->s_head);
> >               return 0;
> >       }
> >
> > I suspect that there is something else wrong with jbd2's superblock,
> > since this normally works in the absence of malicious fs image
> > fuzzing, such that when jbd2_journal_load() calls reset_journal()
> > after jbd2_journal_recover() correctly bypasses recovery, the WARN_ON
> > gets triggered.
> >
> > I'd suggest that you enable jbd2 debugging so we can see all of the
> > jbd2_debug() message to understand what might be going on.
> >
> > By the way, given that this is only a WARN_ON, and it involves
> > malicious image fuzzing, this is probably a valid jbd2 bug, but it's
> > not actually a security bug.  Sure, someone silly enough to pick up a
> > maliciously corrupted USB thumb drive dropped in a parking lot and
> > insert it into their desktop, and the distribution is silly enoough to
> > allow automount, the worse that can happen is that the system to
> > reboot if the system is configured to panic on a WARNING.  So feel
> > free to prioritize your investigation appropriately.  :-)
> >
> > Cheers,
> >
> >                                               - Ted
>
>

Content of type "text/html" skipped

Download attachment "bisect.log" of type "application/octet-stream" (52190 bytes)

Download attachment "repro.cprog" of type "application/octet-stream" (84313 bytes)