lkml.org 
[lkml]   [2013]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [ 132/184] ext4: avoid hang when mounting non-journal
From
Date
On Tue, 2013-06-04 at 19:23 +0200, Willy Tarreau wrote:
> 2.6.32-longterm review patch. If anyone has any objections, please let me know.
>
> ------------------
> filesystems with orphan list
>
> From: Theodore Ts'o <tytso@mit.edu>

commit 0e9a9a1ad619e7e987815d20262d36a2f95717ca upstream.

> When trying to mount a file system which does not contain a journal,
> but which does have a orphan list containing an inode which needs to
> be truncated, the mount call with hang forever in
> ext4_orphan_cleanup() because ext4_orphan_del() will return
> immediately without removing the inode from the orphan list, leading
> to an uninterruptible loop in kernel code which will busy out one of
> the CPU's on the system.
>
> This can be trivially reproduced by trying to mount the file system
> found in tests/f_orphan_extents_inode/image.gz from the e2fsprogs
> source tree. If a malicious user were to put this on a USB stick, and
> mount it on a Linux desktop which has automatic mounts enabled, this
> could be considered a potential denial of service attack. (Not a big
> deal in practice, but professional paranoids worry about such things,
> and have even been known to allocate CVE numbers for such problems.)
>
> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
> Reviewed-by: Zheng Liu <wenqing.lz@taobao.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Willy Tarreau <w@1wt.eu>
> ---
> fs/ext4/namei.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index 230bef5..3a1af19 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -2082,7 +2082,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
> struct ext4_iloc iloc;
> int err = 0;
>
> - if (!EXT4_SB(inode->i_sb)->s_journal)
> + if ((!EXT4_SB(inode->i_sb)->s_journal) &&
> + !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
> return 0;
>
> mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);

--
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2013-06-07 08:21    [W:1.974 / U:0.732 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site