* [PATCH 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info
@ 2023-01-06 10:47 Baokun Li
2023-01-06 10:47 ` [PATCH 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
2023-01-06 10:47 ` [PATCH 2/2] ext4: update s_journal_inum if it changes after journal replay Baokun Li
0 siblings, 2 replies; 6+ messages in thread
From: Baokun Li @ 2023-01-06 10:47 UTC (permalink / raw)
To: linux-ext4
Cc: tytso, adilger.kernel, jack, ritesh.list, linux-kernel, yi.zhang,
yukuai3, libaokun1
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: update s_journal_inum if it changes after journal replay
fs/ext4/inode.c | 12 ++++--------
fs/ext4/super.c | 7 +++++--
2 files changed, 9 insertions(+), 10 deletions(-)
--
2.31.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] ext4: fail ext4_iget if special inode unallocated
2023-01-06 10:47 [PATCH 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Baokun Li
@ 2023-01-06 10:47 ` Baokun Li
2023-01-06 14:28 ` Jan Kara
2023-01-06 10:47 ` [PATCH 2/2] ext4: update s_journal_inum if it changes after journal replay Baokun Li
1 sibling, 1 reply; 6+ messages in thread
From: Baokun Li @ 2023-01-06 10:47 UTC (permalink / raw)
To: linux-ext4
Cc: tytso, adilger.kernel, jack, ritesh.list, linux-kernel, yi.zhang,
yukuai3, libaokun1, Luís Henriques
In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after
ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is
called to get an inode whose i_nlink is 0 when the flag exists, no error
is returned. If the inode is a special inode, a null pointer dereference
may occur. If the value of i_nlink is 0 for any inodes (except boot loader
inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system
is corrupted. Therefore, make the ext4_iget() function return an error if
it gets such an abnormal special inode.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539
Reported-by: Luís Henriques <lhenriques@suse.de>
Suggested-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
---
fs/ext4/inode.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 9d9f414f99fe..3f7cfa91ba89 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4872,13 +4872,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
goto bad_inode;
raw_inode = ext4_raw_inode(&iloc);
- if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
- ext4_error_inode(inode, function, line, 0,
- "iget: root inode unallocated");
- ret = -EFSCORRUPTED;
- goto bad_inode;
- }
-
if ((flags & EXT4_IGET_HANDLE) &&
(raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
ret = -ESTALE;
@@ -4951,10 +4944,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
* NeilBrown 1999oct15
*/
if (inode->i_nlink == 0) {
- if ((inode->i_mode == 0 ||
+ if ((inode->i_mode == 0 || (flags & EXT4_IGET_SPECIAL) ||
!(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) &&
ino != EXT4_BOOT_LOADER_INO) {
/* this inode is deleted */
+ if (flags & EXT4_IGET_SPECIAL)
+ ext4_error_inode(inode, function, line, 0,
+ "iget: special inode unallocated");
ret = -ESTALE;
goto bad_inode;
}
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] ext4: update s_journal_inum if it changes after journal replay
2023-01-06 10:47 [PATCH 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Baokun Li
2023-01-06 10:47 ` [PATCH 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
@ 2023-01-06 10:47 ` Baokun Li
2023-01-06 14:36 ` Jan Kara
1 sibling, 1 reply; 6+ messages in thread
From: Baokun Li @ 2023-01-06 10:47 UTC (permalink / raw)
To: linux-ext4
Cc: tytso, adilger.kernel, jack, ritesh.list, linux-kernel, yi.zhang,
yukuai3, libaokun1, Luís Henriques
When mounting a crafted ext4 image, s_journal_inum may change after journal
replay, which is obviously unreasonable because we have successfully loaded
and replayed the journal through the old s_journal_inum. And the new
s_journal_inum bypasses some of the checks in ext4_get_journal(), which
may trigger a null pointer dereference problem. So if s_journal_inum
changes after the journal replay, we ignore the change, and rewrite the
current journal_inum to the superblock.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
Reported-by: Luís Henriques <lhenriques@suse.de>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
---
fs/ext4/super.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 260c1b3e3ef2..3fe9dc19ff9c 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5953,8 +5953,11 @@ static int ext4_load_journal(struct super_block *sb,
if (!really_read_only && journal_devnum &&
journal_devnum != le32_to_cpu(es->s_journal_dev)) {
es->s_journal_dev = cpu_to_le32(journal_devnum);
-
- /* Make sure we flush the recovery flag to disk. */
+ ext4_commit_super(sb);
+ }
+ if (!really_read_only && journal_inum &&
+ journal_inum != le32_to_cpu(es->s_journal_inum)) {
+ es->s_journal_inum = cpu_to_le32(journal_inum);
ext4_commit_super(sb);
}
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] ext4: fail ext4_iget if special inode unallocated
2023-01-06 10:47 ` [PATCH 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
@ 2023-01-06 14:28 ` Jan Kara
2023-01-07 1:37 ` Baokun Li
0 siblings, 1 reply; 6+ messages in thread
From: Jan Kara @ 2023-01-06 14:28 UTC (permalink / raw)
To: Baokun Li
Cc: linux-ext4, tytso, adilger.kernel, jack, ritesh.list,
linux-kernel, yi.zhang, yukuai3, Luís Henriques
On Fri 06-01-23 18:47:05, Baokun Li wrote:
> In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after
> ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is
> called to get an inode whose i_nlink is 0 when the flag exists, no error
> is returned. If the inode is a special inode, a null pointer dereference
> may occur. If the value of i_nlink is 0 for any inodes (except boot loader
> inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system
> is corrupted. Therefore, make the ext4_iget() function return an error if
> it gets such an abnormal special inode.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539
> Reported-by: Luís Henriques <lhenriques@suse.de>
> Suggested-by: Theodore Ts'o <tytso@mit.edu>
> Signed-off-by: Baokun Li <libaokun1@huawei.com>
Thanks for the patch! A few comments below.
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index 9d9f414f99fe..3f7cfa91ba89 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -4872,13 +4872,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
> goto bad_inode;
> raw_inode = ext4_raw_inode(&iloc);
>
> - if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
> - ext4_error_inode(inode, function, line, 0,
> - "iget: root inode unallocated");
> - ret = -EFSCORRUPTED;
> - goto bad_inode;
> - }
> -
> if ((flags & EXT4_IGET_HANDLE) &&
> (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
> ret = -ESTALE;
> @@ -4951,10 +4944,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
> * NeilBrown 1999oct15
> */
> if (inode->i_nlink == 0) {
> - if ((inode->i_mode == 0 ||
> + if ((inode->i_mode == 0 || (flags & EXT4_IGET_SPECIAL) ||
^ extra parenthesis here ^
> !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) &&
> ino != EXT4_BOOT_LOADER_INO) {
> /* this inode is deleted */
> + if (flags & EXT4_IGET_SPECIAL)
> + ext4_error_inode(inode, function, line, 0,
> + "iget: special inode unallocated");
I think it would be better to return -EFSCORRUPTED and not -ESTALE in this
case.
> ret = -ESTALE;
> goto bad_inode;
> }
Otherwise the patch looks good to me.
Honza
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] ext4: update s_journal_inum if it changes after journal replay
2023-01-06 10:47 ` [PATCH 2/2] ext4: update s_journal_inum if it changes after journal replay Baokun Li
@ 2023-01-06 14:36 ` Jan Kara
0 siblings, 0 replies; 6+ messages in thread
From: Jan Kara @ 2023-01-06 14:36 UTC (permalink / raw)
To: Baokun Li
Cc: linux-ext4, tytso, adilger.kernel, jack, ritesh.list,
linux-kernel, yi.zhang, yukuai3, Luís Henriques
On Fri 06-01-23 18:47:06, Baokun Li wrote:
> When mounting a crafted ext4 image, s_journal_inum may change after journal
> replay, which is obviously unreasonable because we have successfully loaded
> and replayed the journal through the old s_journal_inum. And the new
> s_journal_inum bypasses some of the checks in ext4_get_journal(), which
> may trigger a null pointer dereference problem. So if s_journal_inum
> changes after the journal replay, we ignore the change, and rewrite the
> current journal_inum to the superblock.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
> Reported-by: Luís Henriques <lhenriques@suse.de>
> Signed-off-by: Baokun Li <libaokun1@huawei.com>
> ---
> fs/ext4/super.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
Looks good. Feel free to add:
Reviewed-by: Jan Kara <jack@suse.cz>
Honza
>
> diff --git a/fs/ext4/super.c b/fs/ext4/super.c
> index 260c1b3e3ef2..3fe9dc19ff9c 100644
> --- a/fs/ext4/super.c
> +++ b/fs/ext4/super.c
> @@ -5953,8 +5953,11 @@ static int ext4_load_journal(struct super_block *sb,
> if (!really_read_only && journal_devnum &&
> journal_devnum != le32_to_cpu(es->s_journal_dev)) {
> es->s_journal_dev = cpu_to_le32(journal_devnum);
> -
> - /* Make sure we flush the recovery flag to disk. */
> + ext4_commit_super(sb);
> + }
> + if (!really_read_only && journal_inum &&
> + journal_inum != le32_to_cpu(es->s_journal_inum)) {
> + es->s_journal_inum = cpu_to_le32(journal_inum);
> ext4_commit_super(sb);
> }
>
> --
> 2.31.1
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] ext4: fail ext4_iget if special inode unallocated
2023-01-06 14:28 ` Jan Kara
@ 2023-01-07 1:37 ` Baokun Li
0 siblings, 0 replies; 6+ messages in thread
From: Baokun Li @ 2023-01-07 1:37 UTC (permalink / raw)
To: Jan Kara
Cc: linux-ext4, tytso, adilger.kernel, ritesh.list, linux-kernel,
yi.zhang, yukuai3, Luís Henriques
On 2023/1/6 22:28, Jan Kara wrote:
> On Fri 06-01-23 18:47:05, Baokun Li wrote:
>> In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after
>> ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is
>> called to get an inode whose i_nlink is 0 when the flag exists, no error
>> is returned. If the inode is a special inode, a null pointer dereference
>> may occur. If the value of i_nlink is 0 for any inodes (except boot loader
>> inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system
>> is corrupted. Therefore, make the ext4_iget() function return an error if
>> it gets such an abnormal special inode.
>>
>> Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179
>> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
>> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539
>> Reported-by: Luís Henriques <lhenriques@suse.de>
>> Suggested-by: Theodore Ts'o <tytso@mit.edu>
>> Signed-off-by: Baokun Li <libaokun1@huawei.com>
> Thanks for the patch! A few comments below.
>
>> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
>> index 9d9f414f99fe..3f7cfa91ba89 100644
>> --- a/fs/ext4/inode.c
>> +++ b/fs/ext4/inode.c
>> @@ -4872,13 +4872,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
>> goto bad_inode;
>> raw_inode = ext4_raw_inode(&iloc);
>>
>> - if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
>> - ext4_error_inode(inode, function, line, 0,
>> - "iget: root inode unallocated");
>> - ret = -EFSCORRUPTED;
>> - goto bad_inode;
>> - }
>> -
>> if ((flags & EXT4_IGET_HANDLE) &&
>> (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
>> ret = -ESTALE;
>> @@ -4951,10 +4944,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
>> * NeilBrown 1999oct15
>> */
>> if (inode->i_nlink == 0) {
>> - if ((inode->i_mode == 0 ||
>> + if ((inode->i_mode == 0 || (flags & EXT4_IGET_SPECIAL) ||
> ^ extra parenthesis here ^
Indeed, I'll remove the extra parenthesis.
>> !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) &&
>> ino != EXT4_BOOT_LOADER_INO) {
>> /* this inode is deleted */
>> + if (flags & EXT4_IGET_SPECIAL)
>> + ext4_error_inode(inode, function, line, 0,
>> + "iget: special inode unallocated");
> I think it would be better to return -EFSCORRUPTED and not -ESTALE in this
> case.
Totally agree! For special inode, -EFSCORRUPTED is more reasonable.
>> ret = -ESTALE;
>> goto bad_inode;
>> }
> Otherwise the patch looks good to me.
>
> Honza
>
Thank you very much for your review!
I will send a patch V2 with the changes suggested by you.
--
With Best Regards,
Baokun Li
.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-01-07 1:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-06 10:47 [PATCH 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Baokun Li
2023-01-06 10:47 ` [PATCH 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
2023-01-06 14:28 ` Jan Kara
2023-01-07 1:37 ` Baokun Li
2023-01-06 10:47 ` [PATCH 2/2] ext4: update s_journal_inum if it changes after journal replay Baokun Li
2023-01-06 14:36 ` Jan Kara
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.