Bug 200069
| Summary: | BUG() triggered in start_this_handle() (jbd2/transaction.c) when operating and umounting a crafted ext4 image | ||
|---|---|---|---|
| Product: | File System | Reporter: | Wen Xu (wen.xu) |
| Component: | ext4 | Assignee: | fs_ext4 (fs_ext4) |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | CC: | tytso, wen.xu |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 4.17 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: |
The crafted image which causes kernel panic
poc.c A simplified image |
||
|
Description
Wen Xu
2018-06-14 03:10:56 UTC
Created attachment 276541 [details]
poc.c
I paste log on 4.16 above, here is the log from latest 4.17 [ 200.967406] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended [ 201.036729] EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: (null) [ 206.253988] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 46: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=90, rec_len=0, name_len=0 [ 206.289919] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 47: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=90, rec_len=0, name_len=0 [ 206.318461] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 48: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=0, rec_len=0, name_len=0 [ 206.350065] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 50: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=0, rec_len=0, name_len=0 [ 206.380015] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 57: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=0, rec_len=3, name_len=0 [ 206.403864] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 58: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=2553887680, rec_len=0, name_len=0 [ 206.433522] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 59: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=2553887680, rec_len=0, name_len=0 [ 206.465441] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 60: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=524287, rec_len=0, name_len=0 [ 206.495732] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 61: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=10, rec_len=11, name_len=0 [ 206.525387] EXT4-fs error (device loop0): ext4_readdir:239: inode #2: block 62: comm a.out: path /home/test/mnt: bad entry in directory: rec_len is smaller than minimal - offset=0(0), inode=0, rec_len=0, name_len=0 [ 210.529765] ------------[ cut here ]------------ [ 210.529770] kernel BUG at fs/jbd2/transaction.c:319! [ 210.531101] invalid opcode: 0000 [#1] SMP PTI [ 210.531963] CPU: 0 PID: 1355 Comm: umount Not tainted 4.17.0+ #1 [ 210.533155] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 210.534996] RIP: 0010:start_this_handle+0x1ef/0x400 [ 210.535952] Code: 4c 89 e7 e8 43 8c 78 00 48 83 7b 50 00 0f 84 f0 00 00 00 c6 43 24 00 4c 89 e7 e8 7c 8c 78 00 48 8b 03 a8 01 0f 84 c7 fe ff ff <0f> 0b b8 00 fe ff ff f0 41 0f c1 04 24 e8 5f 3b 78 00 8b 4b 2c 85 [ 210.539619] RSP: 0018:ffffae23c1253bd8 EFLAGS: 00010202 [ 210.540650] RAX: 0000000000000039 RBX: ffff982eb4924000 RCX: 0000000000000000 [ 210.542031] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff982eb4924024 [ 210.543415] RBP: ffffae23c1253c58 R08: ffff982ebfc28d40 R09: ffff982eaeeee800 [ 210.544810] R10: fffffffffffffff4 R11: 0000000000000300 R12: ffff982eb4924024 [ 210.546194] R13: ffff982eaeeed060 R14: 0000000000000100 R15: 0000000000000000 [ 210.547578] FS: 00007feed2341840(0000) GS:ffff982ebfc00000(0000) knlGS:0000000000000000 [ 210.549267] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 210.550391] CR2: 00000000011c6368 CR3: 000000022e286000 CR4: 00000000000006f0 [ 210.551782] Call Trace: [ 210.552284] ? schedule+0x36/0x80 [ 210.552955] ? _cond_resched+0x1a/0x50 [ 210.553694] ? kmem_cache_alloc+0x16b/0x1e0 [ 210.554518] jbd2__journal_start+0xdb/0x1f0 [ 210.555342] ? ext4_evict_inode+0x213/0x5d0 [ 210.556165] __ext4_journal_start_sb+0x6d/0x120 [ 210.557067] ext4_evict_inode+0x213/0x5d0 [ 210.557862] evict+0xca/0x1a0 [ 210.558458] iput+0x1ba/0x210 [ 210.559053] jbd2_journal_destroy+0x1c4/0x280 [ 210.559915] ? put_pwq+0x35/0x40 [ 210.560570] ? put_pwq_unlocked+0x22/0x40 [ 210.561365] ext4_put_super+0x6b/0x3d0 [ 210.562110] generic_shutdown_super+0x72/0x120 [ 210.562986] kill_block_super+0x27/0x50 [ 210.563747] deactivate_locked_super+0x48/0x80 [ 210.564633] deactivate_super+0x5a/0x60 [ 210.565395] cleanup_mnt+0x3f/0x80 [ 210.566073] __cleanup_mnt+0x12/0x20 [ 210.566786] task_work_run+0x8a/0xb0 [ 210.567500] exit_to_usermode_loop+0xf0/0x100 [ 210.568362] do_syscall_64+0xda/0x110 [ 210.569103] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 210.570091] RIP: 0033:0x7feed1c21487 [ 210.570795] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 c9 2b 00 f7 d8 64 89 01 48 [ 210.574459] RSP: 002b:00007fff1807bab8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 210.575925] RAX: 0000000000000000 RBX: 00000000011bd030 RCX: 00007feed1c21487 [ 210.577323] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00000000011c41e0 [ 210.578712] RBP: 00000000011c41e0 R08: 0000000000000000 R09: 0000000000000014 [ 210.580101] R10: 00000000000006b2 R11: 0000000000000246 R12: 00007feed212a83c [ 210.581497] R13: 0000000000000000 R14: 00000000011bd210 R15: 00007fff1807bd40 [ 210.582884] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd soundcore i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul qxl 8139too drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops aesni_intel ttm drm aes_x86_64 crypto_simd cryptd glue_helper floppy pata_acpi 8139cp mii [ 210.592154] ---[ end trace c0f20d44c9d2c2d4 ]--- [ 210.593086] RIP: 0010:start_this_handle+0x1ef/0x400 [ 210.594069] Code: 4c 89 e7 e8 43 8c 78 00 48 83 7b 50 00 0f 84 f0 00 00 00 c6 43 24 00 4c 89 e7 e8 7c 8c 78 00 48 8b 03 a8 01 0f 84 c7 fe ff ff <0f> 0b b8 00 fe ff ff f0 41 0f c1 04 24 e8 5f 3b 78 00 8b 4b 2c 85 [ 210.597759] RSP: 0018:ffffae23c1253bd8 EFLAGS: 00010202 [ 210.598782] RAX: 0000000000000039 RBX: ffff982eb4924000 RCX: 0000000000000000 [ 210.600159] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff982eb4924024 [ 210.601553] RBP: ffffae23c1253c58 R08: ffff982ebfc28d40 R09: ffff982eaeeee800 [ 210.602957] R10: fffffffffffffff4 R11: 0000000000000300 R12: ffff982eb4924024 [ 210.604346] R13: ffff982eaeeed060 R14: 0000000000000100 R15: 0000000000000000 [ 210.605766] FS: 00007feed2341840(0000) GS:ffff982ebfc00000(0000) knlGS:0000000000000000 [ 210.607338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 210.608451] CR2: 00000000011c6368 CR3: 000000022e286000 CR4: 00000000000006f0 Created attachment 276575 [details]
A simplified image
I feel hard to simplify this corrupted image but meanwhile still keep hitting the BUG(). Right now I just upload a simplified image that leads to this error by poc.c:
[ 516.384286] EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: (null)
[ 531.719394] jbd2_journal_bmap: journal block not found at offset 7 on loop0-8
[ 531.721009] Aborting journal on device loop0-8.
[ 531.851971] EXT4-fs error (device loop0): ext4_journal_check_start:61: Detected aborted journal
[ 531.854414] EXT4-fs (loop0): Remounting filesystem read-only
OK, what's going on with this image is the following: * The s_first_ino is 3 --- it's supposed to be 11, and should never be less than that number. The kernel currently doesn't check to make sure value of s_first_ino is valid. This is a recipe for disaster, but what's really triggering the problem is.... * The directory entry for foo/bar/baz points at inode #8 -- the journal inode. So when the workload unlinks foo/bar/baz, this drops the refcount to zero, and when we unmount the file system and release the journal inode, ext4_evict_inode() tries to delete the journal inode, after we almost completely done with the unmount. This triggers the BUG_ON at fs/jbd2/transaction.c:319. This bug is addressed via:
ext4: add more inode number paranoia checks
http://patchwork.ozlabs.org/patch/930637/
This has been assigned CVE-2018-10882 Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1596842 |