From: Chandan Rajendra Subject: [PATCH] ext4: Fix crash when working on a fuzzed ext2 fs image Date: Thu, 7 Dec 2017 11:08:18 +0530 Message-ID: <20171207053818.23799-1-chandan@linux.vnet.ibm.com> Cc: Chandan Rajendra , tytso@mit.edu, abdhalee@linux.vnet.ibm.com To: linux-ext4@vger.kernel.org Return-path: Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:45602 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750936AbdLGFhV (ORCPT ); Thu, 7 Dec 2017 00:37:21 -0500 Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id vB75aGHM082003 for ; Thu, 7 Dec 2017 00:37:21 -0500 Received: from e38.co.us.ibm.com (e38.co.us.ibm.com [32.97.110.159]) by mx0a-001b2d01.pphosted.com with ESMTP id 2epyher8yh-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 07 Dec 2017 00:37:21 -0500 Received: from localhost by e38.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 6 Dec 2017 22:37:20 -0700 Sender: linux-ext4-owner@vger.kernel.org List-ID: On a ppc64 machine, when mounting a fuzzed ext2 image (generated by fsfuzzer) the following call trace is seen, VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 6913 at /root/repos/linux/fs/buffer.c:1165 .__brelse.part.6+0x24/0x40 .__brelse.part.6+0x20/0x40 (unreliable) .ext4_find_entry+0x384/0x4f0 .ext4_lookup+0x84/0x250 .lookup_slow+0xdc/0x230 .walk_component+0x268/0x400 .path_lookupat+0xec/0x2d0 .filename_lookup+0x9c/0x1d0 .vfs_statx+0x98/0x140 .SyS_newfstatat+0x48/0x80 system_call+0x58/0x6c This happens because the directory that ext4_find_entry() looks up has inode->i_size that is less than the block size of the filesystem. This causes 'nblocks' to have a value of zero. ext4_bread_batch() ends up not reading any of the directory file's blocks. This renders the entries in bh_use[] array to continue to have garbage data. buffer_uptodate() on bh_use[0] can then return a zero value upon which brelse() function is invoked. This commit fixes the bug by returning -ENOENT when the directory file has no associated blocks. Reported-by: Abdul Haleem Signed-off-by: Chandan Rajendra --- fs/ext4/namei.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 798b3ac..42e2729 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -1398,7 +1398,13 @@ static struct buffer_head * ext4_find_entry (struct inode *dir, dxtrace(printk(KERN_DEBUG "ext4_find_entry: dx failed, " "falling back\n")); } + nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb); + if (!nblocks) { + ret = -ENOENT; + goto cleanup_and_exit; + } + start = EXT4_I(dir)->i_dir_start_lookup; if (start >= nblocks) start = 0; -- 2.9.5