From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:42434 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752661AbcFEU5t (ORCPT ); Sun, 5 Jun 2016 16:57:49 -0400 Subject: Patch "ext4: fix hang when processing corrupted orphaned inode list" has been added to the 4.6-stable tree To: tytso@mit.edu, gregkh@linuxfoundation.org, vegard.nossum@oracle.com Cc: , From: Date: Sun, 05 Jun 2016 13:57:48 -0700 Message-ID: <14651602681241@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ext4: fix hang when processing corrupted orphaned inode list to the 4.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ext4-fix-hang-when-processing-corrupted-orphaned-inode-list.patch and it can be found in the queue-4.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From c9eb13a9105e2e418f72e46a2b6da3f49e696902 Mon Sep 17 00:00:00 2001 From: Theodore Ts'o Date: Sat, 30 Apr 2016 00:48:54 -0400 Subject: ext4: fix hang when processing corrupted orphaned inode list From: Theodore Ts'o commit c9eb13a9105e2e418f72e46a2b6da3f49e696902 upstream. If the orphaned inode list contains inode #5, ext4_iget() returns a bad inode (since the bootloader inode should never be referenced directly). Because of the bad inode, we end up processing the inode repeatedly and this hangs the machine. This can be reproduced via: mke2fs -t ext4 /tmp/foo.img 100 debugfs -w -R "ssv last_orphan 5" /tmp/foo.img mount -o loop /tmp/foo.img /mnt (But don't do this if you are using an unpatched kernel if you care about the system staying functional. :-) This bug was found by the port of American Fuzzy Lop into the kernel to find file system problems[1]. (Since it *only* happens if inode #5 shows up on the orphan list --- 3, 7, 8, etc. won't do it, it's not surprising that AFL needed two hours before it found it.) [1] http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf Reported by: Vegard Nossum Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- fs/ext4/ialloc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -1183,11 +1183,13 @@ struct inode *ext4_orphan_get(struct sup goto iget_failed; /* - * If the orphans has i_nlinks > 0 then it should be able to be - * truncated, otherwise it won't be removed from the orphan list - * during processing and an infinite loop will result. + * If the orphans has i_nlinks > 0 then it should be able to + * be truncated, otherwise it won't be removed from the orphan + * list during processing and an infinite loop will result. + * Similarly, it must not be a bad inode. */ - if (inode->i_nlink && !ext4_can_truncate(inode)) + if ((inode->i_nlink && !ext4_can_truncate(inode)) || + is_bad_inode(inode)) goto bad_orphan; if (NEXT_ORPHAN(inode) > max_ino) Patches currently in stable-queue which might be from tytso@mit.edu are queue-4.6/ext4-fix-check-of-dqget-return-value-in-ext4_ioctl_setproject.patch queue-4.6/ext4-fix-data-exposure-after-a-crash.patch queue-4.6/ext4-address-ubsan-warning-in-mb_find_order_for_block.patch queue-4.6/ext4-fix-oops-on-corrupted-filesystem.patch queue-4.6/ext4-fix-hang-when-processing-corrupted-orphaned-inode-list.patch queue-4.6/ext4-silence-ubsan-in-ext4_mb_init.patch queue-4.6/ext4-clean-up-error-handling-when-orphan-list-is-corrupted.patch