From: 이상호 <kudo3228@gmail.com>
To: Bob Copeland <me@bobcopeland.com>
Cc: linux-karma-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, 이상호 <kudo3228@gmail.com>
Subject: [PATCH 0/2] omfs: detect metadata chain cycles
Date: Thu, 2 Jul 2026 07:02:09 +0900 [thread overview]
Message-ID: <20260701220211.822033-1-kudo3228@gmail.com> (raw)
OMFS stores directory sibling chains and file extent continuation chains
on disk. Both chains are terminated by ~0, but the next block values are
image-controlled.
A crafted filesystem can create a cycle in either chain. Lookup of a
missing directory entry or read of a file with a cyclic extent
continuation then loops in the kernel.
This series detects cycles in both metadata chains. I verified the fixes
with crafted OMFS images:
- directory sibling self-cycle:
unpatched kernel timed out after "statting /mnt/missing";
patched kernel returned ELOOP.
- file extent continuation self-cycle:
unpatched kernel timed out after "reading /mnt/loopfile";
patched kernel returned from read with EIO.
Valid directory and file images continued to behave normally.
이상호 (2):
omfs: detect directory sibling chain cycles
omfs: detect file extent chain cycles
fs/omfs/dir.c | 64 +++++++++++++++++++++++++++++++++++++++-
fs/omfs/file.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 141 insertions(+), 2 deletions(-)
--
2.43.0
next reply other threads:[~2026-07-01 22:02 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-01 22:02 이상호 [this message]
2026-07-01 22:02 ` [PATCH 1/2] omfs: detect directory sibling chain cycles 이상호
2026-07-01 22:02 ` [PATCH 2/2] omfs: detect file extent " 이상호
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260701220211.822033-1-kudo3228@gmail.com \
--to=kudo3228@gmail.com \
--cc=linux-karma-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=me@bobcopeland.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox