From: Jaegeuk Kim <jaegeuk.kim@samsung.com> To: Alexey Khoroshilov <khoroshilov@ispras.ru> Cc: Andrey Tsyvarev <tsyvarev@ispras.ru>, linux-f2fs-devel@lists.sourceforge.net, linux-kernel <linux-kernel@vger.kernel.org> Subject: Re: f2fs: BUG_ON() is triggered when mount valid f2fs filesystem Date: Fri, 18 Apr 2014 15:35:04 +0900 [thread overview] Message-ID: <1397802904.4283.1.camel@kjgkr> (raw) In-Reply-To: <5350C06A.4090807@ispras.ru> Thank you for the explanation. The following patch will resolve the issue. Thanks, >From 2048e7458c982f4297da9d3366ab29224ae2e8b0 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim <jaegeuk.kim@samsung.com> Date: Fri, 18 Apr 2014 15:21:04 +0900 Subject: [PATCH] f2fs: avoid BUG_ON when mouting corrupted image having garbage blocks If the disk has some garbage blocks, F2FS is able to face with BUG_ON when recovering direct node blocks. This patch detects the error case and avoids that prior to reaching BUG_ON. Alexey Khoroshilov addressed the potential security issues as follows. "An ability to trigger a BUG_ON assert by mounting a crafted image is usually considered as a local denial of service [1-3]. As far as I understand, the reason is that some kernel data may become inconsistent that can lead to further problems. [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3353 [2] http://www.openwall.com/lists/oss-security/2011/06/24/4 [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2928 etc." Reported-by: Andrey Tsyvarev <tsyvarev@ispras.ru> Cc: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com> --- fs/f2fs/node.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 6ebdba1..64755f4 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -1609,6 +1609,11 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page) struct node_info old_ni, new_ni; struct page *ipage; + get_node_info(sbi, ino, &old_ni); + + if (unlikely(old_ni.blk_addr != NULL_ADDR)) + return -EINVAL; + ipage = grab_cache_page(NODE_MAPPING(sbi), ino); if (!ipage) return -ENOMEM; @@ -1616,7 +1621,6 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page) /* Should not use this inode from free nid list */ remove_free_nid(NM_I(sbi), ino); - get_node_info(sbi, ino, &old_ni); SetPageUptodate(ipage); fill_node_footer(ipage, ino, ino, 0, true); -- 1.8.4.474.g128a96c -- Jaegeuk Kim Samsung
WARNING: multiple messages have this Message-ID (diff)
From: Jaegeuk Kim <jaegeuk.kim@samsung.com> To: Alexey Khoroshilov <khoroshilov@ispras.ru> Cc: Andrey Tsyvarev <tsyvarev@ispras.ru>, linux-kernel <linux-kernel@vger.kernel.org>, linux-f2fs-devel@lists.sourceforge.net Subject: Re: f2fs: BUG_ON() is triggered when mount valid f2fs filesystem Date: Fri, 18 Apr 2014 15:35:04 +0900 [thread overview] Message-ID: <1397802904.4283.1.camel@kjgkr> (raw) In-Reply-To: <5350C06A.4090807@ispras.ru> Thank you for the explanation. The following patch will resolve the issue. Thanks, >From 2048e7458c982f4297da9d3366ab29224ae2e8b0 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim <jaegeuk.kim@samsung.com> Date: Fri, 18 Apr 2014 15:21:04 +0900 Subject: [PATCH] f2fs: avoid BUG_ON when mouting corrupted image having garbage blocks If the disk has some garbage blocks, F2FS is able to face with BUG_ON when recovering direct node blocks. This patch detects the error case and avoids that prior to reaching BUG_ON. Alexey Khoroshilov addressed the potential security issues as follows. "An ability to trigger a BUG_ON assert by mounting a crafted image is usually considered as a local denial of service [1-3]. As far as I understand, the reason is that some kernel data may become inconsistent that can lead to further problems. [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3353 [2] http://www.openwall.com/lists/oss-security/2011/06/24/4 [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2928 etc." Reported-by: Andrey Tsyvarev <tsyvarev@ispras.ru> Cc: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com> --- fs/f2fs/node.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 6ebdba1..64755f4 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -1609,6 +1609,11 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page) struct node_info old_ni, new_ni; struct page *ipage; + get_node_info(sbi, ino, &old_ni); + + if (unlikely(old_ni.blk_addr != NULL_ADDR)) + return -EINVAL; + ipage = grab_cache_page(NODE_MAPPING(sbi), ino); if (!ipage) return -ENOMEM; @@ -1616,7 +1621,6 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page) /* Should not use this inode from free nid list */ remove_free_nid(NM_I(sbi), ino); - get_node_info(sbi, ino, &old_ni); SetPageUptodate(ipage); fill_node_footer(ipage, ino, ino, 0, true); -- 1.8.4.474.g128a96c -- Jaegeuk Kim Samsung ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/NeoTech
next prev parent reply other threads:[~2014-04-18 6:38 UTC|newest] Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-02-06 5:43 f2fs: f2fs unmount hangs if f2fs_init_acl() fails during mkdir syscall Andrey Tsyvarev 2014-02-06 5:43 ` Andrey Tsyvarev 2014-02-06 6:02 ` Jaegeuk Kim 2014-02-06 6:02 ` Jaegeuk Kim 2014-02-06 12:17 ` Andrey Tsyvarev 2014-02-06 12:17 ` Andrey Tsyvarev 2014-02-07 0:49 ` Jaegeuk Kim 2014-02-07 5:12 ` [f2fs-dev] " Jaegeuk Kim 2014-02-07 5:12 ` Jaegeuk Kim 2014-02-11 8:29 ` [f2fs-dev] " Andrey Tsyvarev 2014-02-11 8:29 ` Andrey Tsyvarev 2014-02-13 8:32 ` [f2fs-dev] " Gu Zheng 2014-02-13 8:32 ` Gu Zheng 2014-02-13 9:40 ` [f2fs-dev] " Andrey Tsyvarev 2014-02-13 9:40 ` Andrey Tsyvarev 2014-02-13 9:48 ` [f2fs-dev] " Gu Zheng 2014-02-13 9:48 ` Gu Zheng 2014-02-14 2:00 ` [f2fs-dev] " Jaegeuk Kim 2014-02-14 1:58 ` Jaegeuk Kim 2014-02-14 1:58 ` Jaegeuk Kim 2014-04-14 11:12 ` f2fs: BUG_ON() is triggered when mount valid f2fs filesystem Andrey Tsyvarev 2014-04-15 11:04 ` Jaegeuk Kim 2014-04-15 11:04 ` Jaegeuk Kim 2014-04-16 9:11 ` Andrey Tsyvarev 2014-04-16 9:11 ` Andrey Tsyvarev 2014-04-16 23:35 ` Jaegeuk Kim 2014-04-16 23:35 ` Jaegeuk Kim 2014-04-17 1:11 ` Alexey Khoroshilov 2014-04-17 1:11 ` Alexey Khoroshilov 2014-04-17 7:45 ` Jaegeuk Kim 2014-04-17 7:45 ` Jaegeuk Kim 2014-04-18 6:04 ` Alexey Khoroshilov 2014-04-18 6:04 ` Alexey Khoroshilov 2014-04-18 6:35 ` Jaegeuk Kim [this message] 2014-04-18 6:35 ` Jaegeuk Kim 2014-04-18 6:40 ` Gu Zheng 2014-04-18 6:40 ` Gu Zheng 2014-07-21 10:56 ` f2fs: Possible use-after-free when umount filesystem Andrey Tsyvarev 2014-07-21 11:09 ` Fwd: " Andrey Tsyvarev 2014-07-22 2:17 ` Gu Zheng 2014-07-22 2:17 ` Gu Zheng 2014-07-22 10:04 ` Andrey Tsyvarev 2014-07-22 10:04 ` Andrey Tsyvarev 2014-07-23 2:12 ` [f2fs-dev] " Chao Yu 2014-07-23 2:12 ` Chao Yu 2014-07-23 3:39 ` [f2fs-dev] " Gu Zheng 2014-07-23 3:39 ` Gu Zheng 2014-07-24 10:14 ` Andrey Tsyvarev 2014-07-24 10:14 ` Andrey Tsyvarev 2014-07-25 3:22 ` [f2fs-dev] " Chao Yu 2014-07-25 3:22 ` Chao Yu 2014-07-25 5:49 ` [f2fs-dev] " Gu Zheng 2014-07-25 5:49 ` Gu Zheng 2014-07-25 15:37 ` [f2fs-dev] " Jaegeuk Kim 2014-07-25 15:37 ` Jaegeuk Kim
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1397802904.4283.1.camel@kjgkr \ --to=jaegeuk.kim@samsung.com \ --cc=khoroshilov@ispras.ru \ --cc=linux-f2fs-devel@lists.sourceforge.net \ --cc=linux-kernel@vger.kernel.org \ --cc=tsyvarev@ispras.ru \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.