• Theodore Ts'o's avatar
    ext4: fix hang when processing corrupted orphaned inode list · c9eb13a9
    Theodore Ts'o authored
    If the orphaned inode list contains inode #5, ext4_iget() returns a
    bad inode (since the bootloader inode should never be referenced
    directly).  Because of the bad inode, we end up processing the inode
    repeatedly and this hangs the machine.
    
    This can be reproduced via:
    
       mke2fs -t ext4 /tmp/foo.img 100
       debugfs -w -R "ssv last_orphan 5" /tmp/foo.img
       mount -o loop /tmp/foo.img /mnt
    
    (But don't do this if you are using an unpatched kernel if you care
    about the system staying functional.  :-)
    
    This bug was found by the port of American Fuzzy Lop into the kernel
    to find file system problems[1].  (Since it *only* happens if inode #5
    shows up on the orphan list --- 3, 7, 8, etc. won't do it, it's not
    surprising that AFL needed two hours before it found it.)
    
    [1] http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf
    
    Cc: stable@vger.kernel.org
    Reported by: Vegard Nossum <vegard.nossum@oracle.com>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    c9eb13a9
ialloc.c 38.4 KB