Re: [ 132/184] ext4: avoid hang when mounting non-journal

[Ben Hutchings]

On Tue, 2013-06-04 at 19:23 +0200, Willy Tarreau wrote:
> 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> 
> ------------------
>  filesystems with orphan list
> 
> From: Theodore Ts'o <tytso@xxxxxxx>

commit 0e9a9a1ad619e7e987815d20262d36a2f95717ca upstream.

> When trying to mount a file system which does not contain a journal,
> but which does have a orphan list containing an inode which needs to
> be truncated, the mount call with hang forever in
> ext4_orphan_cleanup() because ext4_orphan_del() will return
> immediately without removing the inode from the orphan list, leading
> to an uninterruptible loop in kernel code which will busy out one of
> the CPU's on the system.
> 
> This can be trivially reproduced by trying to mount the file system
> found in tests/f_orphan_extents_inode/image.gz from the e2fsprogs
> source tree.  If a malicious user were to put this on a USB stick, and
> mount it on a Linux desktop which has automatic mounts enabled, this
> could be considered a potential denial of service attack.  (Not a big
> deal in practice, but professional paranoids worry about such things,
> and have even been known to allocate CVE numbers for such problems.)
> 
> Signed-off-by: "Theodore Ts'o" <tytso@xxxxxxx>
> Reviewed-by: Zheng Liu <wenqing.lz@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Willy Tarreau <w@xxxxxx>
> ---
>  fs/ext4/namei.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index 230bef5..3a1af19 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -2082,7 +2082,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
>  	struct ext4_iloc iloc;
>  	int err = 0;
>  
> -	if (!EXT4_SB(inode->i_sb)->s_journal)
> +	if ((!EXT4_SB(inode->i_sb)->s_journal) &&
> +	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
>  		return 0;
>  
>  	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);

-- 
Ben Hutchings
Theory and practice are closer in theory than in practice.
                                - John Levine, moderator of comp.compilers

Attachment: signature.asc
Description: This is a digitally signed message part