* [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info
@ 2023-01-07 3:21 Baokun Li
2023-01-07 3:21 ` [PATCH v2 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Baokun Li @ 2023-01-07 3:21 UTC (permalink / raw)
To: linux-ext4
Cc: tytso, adilger.kernel, jack, ritesh.list, linux-kernel, yi.zhang,
yukuai3, libaokun1
V1->V2:
In PATCH 1/2, -EFSCORRUPTED instead of -ESTALE is returned for
special inode errors, and extra parentheses are removed.
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: update s_journal_inum if it changes after journal replay
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/super.c | 7 +++++--
2 files changed, 13 insertions(+), 12 deletions(-)
--
2.31.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2 1/2] ext4: fail ext4_iget if special inode unallocated
2023-01-07 3:21 [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Baokun Li
@ 2023-01-07 3:21 ` Baokun Li
2023-01-09 11:01 ` Jan Kara
2023-01-07 3:21 ` [PATCH v2 2/2] ext4: update s_journal_inum if it changes after journal replay Baokun Li
2023-02-19 5:40 ` [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Theodore Ts'o
2 siblings, 1 reply; 5+ messages in thread
From: Baokun Li @ 2023-01-07 3:21 UTC (permalink / raw)
To: linux-ext4
Cc: tytso, adilger.kernel, jack, ritesh.list, linux-kernel, yi.zhang,
yukuai3, libaokun1, Luís Henriques
In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after
ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is
called to get an inode whose i_nlink is 0 when the flag exists, no error
is returned. If the inode is a special inode, a null pointer dereference
may occur. If the value of i_nlink is 0 for any inodes (except boot loader
inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system
is corrupted. Therefore, make the ext4_iget() function return an error if
it gets such an abnormal special inode.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539
Reported-by: Luís Henriques <lhenriques@suse.de>
Suggested-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
---
V1->V2:
-EFSCORRUPTED is returned instead of -ESTALE for special inode
errors, and the extra parentheses are removed.
fs/ext4/inode.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 9d9f414f99fe..ed7598127e7c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4872,13 +4872,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
goto bad_inode;
raw_inode = ext4_raw_inode(&iloc);
- if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
- ext4_error_inode(inode, function, line, 0,
- "iget: root inode unallocated");
- ret = -EFSCORRUPTED;
- goto bad_inode;
- }
-
if ((flags & EXT4_IGET_HANDLE) &&
(raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
ret = -ESTALE;
@@ -4951,11 +4944,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
* NeilBrown 1999oct15
*/
if (inode->i_nlink == 0) {
- if ((inode->i_mode == 0 ||
+ if ((inode->i_mode == 0 || flags & EXT4_IGET_SPECIAL ||
!(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) &&
ino != EXT4_BOOT_LOADER_INO) {
- /* this inode is deleted */
- ret = -ESTALE;
+ /* this inode is deleted or unallocated */
+ if (flags & EXT4_IGET_SPECIAL) {
+ ext4_error_inode(inode, function, line, 0,
+ "iget: special inode unallocated");
+ ret = -EFSCORRUPTED;
+ } else
+ ret = -ESTALE;
goto bad_inode;
}
/* The only unlinked inodes we let through here have
--
2.31.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v2 2/2] ext4: update s_journal_inum if it changes after journal replay
2023-01-07 3:21 [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Baokun Li
2023-01-07 3:21 ` [PATCH v2 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
@ 2023-01-07 3:21 ` Baokun Li
2023-02-19 5:40 ` [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Theodore Ts'o
2 siblings, 0 replies; 5+ messages in thread
From: Baokun Li @ 2023-01-07 3:21 UTC (permalink / raw)
To: linux-ext4
Cc: tytso, adilger.kernel, jack, ritesh.list, linux-kernel, yi.zhang,
yukuai3, libaokun1, Luís Henriques
When mounting a crafted ext4 image, s_journal_inum may change after journal
replay, which is obviously unreasonable because we have successfully loaded
and replayed the journal through the old s_journal_inum. And the new
s_journal_inum bypasses some of the checks in ext4_get_journal(), which
may trigger a null pointer dereference problem. So if s_journal_inum
changes after the journal replay, we ignore the change, and rewrite the
current journal_inum to the superblock.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
Reported-by: Luís Henriques <lhenriques@suse.de>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
---
fs/ext4/super.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 260c1b3e3ef2..3fe9dc19ff9c 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5953,8 +5953,11 @@ static int ext4_load_journal(struct super_block *sb,
if (!really_read_only && journal_devnum &&
journal_devnum != le32_to_cpu(es->s_journal_dev)) {
es->s_journal_dev = cpu_to_le32(journal_devnum);
-
- /* Make sure we flush the recovery flag to disk. */
+ ext4_commit_super(sb);
+ }
+ if (!really_read_only && journal_inum &&
+ journal_inum != le32_to_cpu(es->s_journal_inum)) {
+ es->s_journal_inum = cpu_to_le32(journal_inum);
ext4_commit_super(sb);
}
--
2.31.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2 1/2] ext4: fail ext4_iget if special inode unallocated
2023-01-07 3:21 ` [PATCH v2 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
@ 2023-01-09 11:01 ` Jan Kara
0 siblings, 0 replies; 5+ messages in thread
From: Jan Kara @ 2023-01-09 11:01 UTC (permalink / raw)
To: Baokun Li
Cc: linux-ext4, tytso, adilger.kernel, jack, ritesh.list,
linux-kernel, yi.zhang, yukuai3, Luís Henriques
On Sat 07-01-23 11:21:25, Baokun Li wrote:
> In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after
> ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is
> called to get an inode whose i_nlink is 0 when the flag exists, no error
> is returned. If the inode is a special inode, a null pointer dereference
> may occur. If the value of i_nlink is 0 for any inodes (except boot loader
> inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system
> is corrupted. Therefore, make the ext4_iget() function return an error if
> it gets such an abnormal special inode.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539
> Reported-by: Luís Henriques <lhenriques@suse.de>
> Suggested-by: Theodore Ts'o <tytso@mit.edu>
> Signed-off-by: Baokun Li <libaokun1@huawei.com>
Looks good. Feel free to add:
Reviewed-by: Jan Kara <jack@suse.cz>
Honza
> ---
> V1->V2:
> -EFSCORRUPTED is returned instead of -ESTALE for special inode
> errors, and the extra parentheses are removed.
>
> fs/ext4/inode.c | 18 ++++++++----------
> 1 file changed, 8 insertions(+), 10 deletions(-)
>
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index 9d9f414f99fe..ed7598127e7c 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -4872,13 +4872,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
> goto bad_inode;
> raw_inode = ext4_raw_inode(&iloc);
>
> - if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
> - ext4_error_inode(inode, function, line, 0,
> - "iget: root inode unallocated");
> - ret = -EFSCORRUPTED;
> - goto bad_inode;
> - }
> -
> if ((flags & EXT4_IGET_HANDLE) &&
> (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
> ret = -ESTALE;
> @@ -4951,11 +4944,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
> * NeilBrown 1999oct15
> */
> if (inode->i_nlink == 0) {
> - if ((inode->i_mode == 0 ||
> + if ((inode->i_mode == 0 || flags & EXT4_IGET_SPECIAL ||
> !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) &&
> ino != EXT4_BOOT_LOADER_INO) {
> - /* this inode is deleted */
> - ret = -ESTALE;
> + /* this inode is deleted or unallocated */
> + if (flags & EXT4_IGET_SPECIAL) {
> + ext4_error_inode(inode, function, line, 0,
> + "iget: special inode unallocated");
> + ret = -EFSCORRUPTED;
> + } else
> + ret = -ESTALE;
> goto bad_inode;
> }
> /* The only unlinked inodes we let through here have
> --
> 2.31.1
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info
2023-01-07 3:21 [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Baokun Li
2023-01-07 3:21 ` [PATCH v2 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
2023-01-07 3:21 ` [PATCH v2 2/2] ext4: update s_journal_inum if it changes after journal replay Baokun Li
@ 2023-02-19 5:40 ` Theodore Ts'o
2 siblings, 0 replies; 5+ messages in thread
From: Theodore Ts'o @ 2023-02-19 5:40 UTC (permalink / raw)
To: linux-ext4, Baokun Li
Cc: Theodore Ts'o, yukuai3, jack, ritesh.list, adilger.kernel,
yi.zhang, linux-kernel
On Sat, 7 Jan 2023 11:21:24 +0800, Baokun Li wrote:
> V1->V2:
> In PATCH 1/2, -EFSCORRUPTED instead of -ESTALE is returned for
> special inode errors, and extra parentheses are removed.
>
> Baokun Li (2):
> ext4: fail ext4_iget if special inode unallocated
> ext4: update s_journal_inum if it changes after journal replay
>
> [...]
Applied, thanks!
[1/2] ext4: fail ext4_iget if special inode unallocated
commit: 5cd740287ae5e3f9d1c46f5bfe8778972fd6d3fe
[2/2] ext4: update s_journal_inum if it changes after journal replay
commit: 3039d8b8692408438a618fac2776b629852663c3
Best regards,
--
Theodore Ts'o <tytso@mit.edu>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-02-19 5:41 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-07 3:21 [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Baokun Li
2023-01-07 3:21 ` [PATCH v2 1/2] ext4: fail ext4_iget if special inode unallocated Baokun Li
2023-01-09 11:01 ` Jan Kara
2023-01-07 3:21 ` [PATCH v2 2/2] ext4: update s_journal_inum if it changes after journal replay Baokun Li
2023-02-19 5:40 ` [PATCH v2 0/2] ext4: fix possible null pointer dereference in ext4_get_group_info Theodore Ts'o
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).