Commit 3d1658bb authored by Theodore Ts'o's avatar Theodore Ts'o Committed by Willy Tarreau

ext4: fix hang when processing corrupted orphaned inode list

commit c9eb13a9 upstream.

If the orphaned inode list contains inode #5, ext4_iget() returns a
bad inode (since the bootloader inode should never be referenced
directly).  Because of the bad inode, we end up processing the inode
repeatedly and this hangs the machine.

This can be reproduced via:

   mke2fs -t ext4 /tmp/foo.img 100
   debugfs -w -R "ssv last_orphan 5" /tmp/foo.img
   mount -o loop /tmp/foo.img /mnt

(But don't do this if you are using an unpatched kernel if you care
about the system staying functional.  :-)

This bug was found by the port of American Fuzzy Lop into the kernel
to find file system problems[1].  (Since it *only* happens if inode #5
shows up on the orphan list --- 3, 7, 8, etc. won't do it, it's not
surprising that AFL needed two hours before it found it.)

[1] http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf

Cc: stable@vger.kernel.org
Reported by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
parent 01537846
...@@ -1027,11 +1027,13 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino) ...@@ -1027,11 +1027,13 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
goto iget_failed; goto iget_failed;
/* /*
* If the orphans has i_nlinks > 0 then it should be able to be * If the orphans has i_nlinks > 0 then it should be able to
* truncated, otherwise it won't be removed from the orphan list * be truncated, otherwise it won't be removed from the orphan
* during processing and an infinite loop will result. * list during processing and an infinite loop will result.
* Similarly, it must not be a bad inode.
*/ */
if (inode->i_nlink && !ext4_can_truncate(inode)) if ((inode->i_nlink && !ext4_can_truncate(inode)) ||
is_bad_inode(inode))
goto bad_orphan; goto bad_orphan;
if (NEXT_ORPHAN(inode) > max_ino) if (NEXT_ORPHAN(inode) > max_ino)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment