linux-ext4 - Re: linux-next ext4 inode size 128 corrupted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 18 Jul 2023 06:32:54 -0400
From:   Jeff Layton <jlayton@...nel.org>
To:     Hugh Dickins <hughd@...gle.com>
Cc:     Theodore Ts'o <tytso@....edu>,
        Christian Brauner <brauner@...nel.org>,
        Jan Kara <jack@...e.cz>,
        Andreas Dilger <adilger.kernel@...ger.ca>,
        linux-fsdevel@...r.kernel.org, linux-ext4@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: linux-next ext4 inode size 128 corrupted

On Mon, 2023-07-17 at 20:43 -0700, Hugh Dickins wrote:
> Hi Jeff,
> 
> I've been unable to run my kernel builds on ext4 on loop0 on tmpfs
> swapping load on linux-next recently, on one machine: various kinds
> of havoc, most common symptoms being ext4_find_dest_de:2107 errors,
> systemd-journald errors, segfaults.  But no problem observed running
> on a more recent installation.
> 
> Bisected yesterday to 979492850abd ("ext4: convert to ctime accessor
> functions").
> 
> I've mostly averted my eyes from the EXT4_INODE macro changes there,
> but I think that's where the problem lies.  Reading the comment in
> fs/ext4/ext4.h above EXT4_FITS_IN_INODE() led me to try "tune2fs -l"
> and look at /etc/mke2fs.conf.  It's an old installation, its own
> inodes are 256, but that old mke2fs.conf does default to 128 for small
> FSes, and what I use for the load test is small.  Passing -I 256 to the
> mkfs makes the problems go away.
> 

Sounds like something is storing timestamp values in the extended part
of the inode when it shouldn't be. The macros look sane to me, but I'll
go over them again.

> (What's most alarming about the corruption is that it appears to extend
> beyond just the throwaway test filesystem: segfaults on bash and libc.so
> from the root filesystem.  But no permanent damage done there.)
> 
> One oddity I noticed in scrutinizing that commit, didn't help with
> the issues above, but there's a hunk in ext4_rename() which changes
> -	old.dir->i_ctime = old.dir->i_mtime = current_time(old.dir);
> +	old.dir->i_mtime = inode_set_ctime_current(old.inode);
> 

That actually looks fine. We're just setting the in-memory inode
timestamp there. The problem you're having sounds more like something is
going wrong when storing the values to disk. I'll take a closer look.

Thanks!
-- 
Jeff Layton <jlayton@...nel.org>