Reaching user disk quota limit creates a 2**32-1 byte file

From: Nick Burrett (nick@dsvr.net)
Date: Tue Mar 28 2000 - 08:50:31 EST


Hello,

I've been experiencing a filesystem error using various Linux kernels
since 2.0.36. This bug report relates to a test I have made on kernel
2.3.99-pre3. The problem manifests itself when an attempt is made to
extend a file but the diskquota check blocks the attempt, resulting in
a 4294967295 byte file.

Here's a perl script that I used to duplicate the problem:

  #!/usr/bin/perl
  open (LOG, "+<file.ips");
  while ($line = <LOG>) {
    push (@lines, $line);
  }
  seek (LOG, 0, 0);
  foreach (@lines) {
    print LOG "$_";
  }
  print LOG "sdfoasdfunasdofnasdufnasdufnusoc sdacn sdu9cnsduicsdfc";
  print LOG "ascoisdacio ncion coisdnacoi nsdacunsdaicnasdicusdi cs";
  print LOG "asfouin si nsd mnsdaklcvn uioanf oncuio sdncuisdncsdcs";
  print LOG "sdfoasdfunasdofnasdufnasdufnusoc sdacn sdu9cnsduicsdfc\n";
  truncate (LOG, tell (LOG));
  close (LOG);

I ran the script as user `nick' and set the disk quota one block larger
than the current use:

[root@build /root]# /usr/sbin/repquota -u -a
                        Block limits File limits
User used soft hard grace used soft hard grace
nick -- 40969 40970 40970 3479 0 0

Create a zero length file:
[nick@build nick]$ touch file.ips

Then simply run the script repeatadly until you get a quota limit error:

[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ls -l file.ips
-rw-rw-r-- 1 nick nick 984 Mar 28 14:31 file.ips
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ls -l file.ips
-rw-rw-r-- 1 nick nick 1148 Mar 28 14:31 file.ips
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ./bug1.pl
[nick@build nick]$ ls -l file.ips
-rw-rw-r-- 1 nick nick 1968 Mar 28 14:31 file.ips
[nick@build nick]$ ./bug1.pl
/: write failed, user disk limit reached.
                                         [nick@build nick]$
[nick@build nick]$ ls -l file.ips
-rw-rw-r-- 1 nick nick 4294967295 Mar 28 14:31 file.ips

After the events, disk quota shows:

[root@build /root]# /usr/sbin/repquota -u -a
                        Block limits File limits
User used soft hard grace used soft hard grace
nick +- 40970 40970 40970 none 3480 0 0

The perl script I used was based on a ads script that appears on many
webservers. The ads script loads the entire file into memory and then
appends a line to the end, in much the same way as the script above.
The script uses up all memory and crashes the server.

Regards,

Nick.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Fri Mar 31 2000 - 21:00:22 EST