[PATCH][BUG] ext4: do not execute ext4_std_error with EFBIG at ext4_setattr

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Toshiyuki Okajima <toshi.okajima@xxxxxxxxxxxxxx>

You know, do_truncate() can call ext4_setattr() (via notify_change()).
And, ext4_setattr() can return with -EFBIG if the argument(length) of 
do_truncate() is more than sbi->s_bitmap_maxbytes. At that time, 
it also calls ext4_std_error() with -EFBIG.

Besides, a panic happens when ext4_setattr() returns with -EFBIG
after we mount an ext4 filesystem with errors=panic.

The following steps can make this problem easily.
(1)
# /bin/dd if=/dev/zero of=/tmp/img bs=1k seek=1000k count=1
# /sbin/mkfs.ext3 -Fq /tmp/img
# /bin/mount -o loop -t ext4 /tmp/img /mnt
# /bin/dd if=/dev/zero of=/mnt/file bs=1k seek=2143281137 count=1
# /bin/dmesg
...
EXT4-fs error (device loop0) in ext4_setattr: error 27

(2)
# /bin/dd if=/dev/zero of=/tmp/img bs=1k seek=1000k count=1
# /sbin/mkfs.ext3 -Fq /tmp/img
# /bin/mount -o loop,errors=panic -t ext4 /tmp/img /mnt
# /bin/dd if=/dev/zero of=/mnt/file bs=1k seek=2143281137 count=1
(PANIC!)

This problem is in:
5482         if (attr->ia_valid & ATTR_SIZE) {
5483                 if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
5484                         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
5485 
5486                         if (attr->ia_size > sbi->s_bitmap_maxbytes) {
5487                                 error = -EFBIG;
5488                                 goto err_out;
5489                         }
5490                 }
5491         }

5543 err_out:
5544         ext4_std_error(inode->i_sb, error);
5545         if (!error)
5546                 error = rc;
5547         return error;
(because ext4_setattr() calls ext4_std_error() when error == -EFBIG)

So, we change those into:
5482         if (attr->ia_valid & ATTR_SIZE) {
5483                 if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
5484                         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
5485 
5486                         if (attr->ia_size > sbi->s_bitmap_maxbytes) {
5487                                 error = -EFBIG;
* 5488                                 goto err_out2;
5489                         }
5490                 }
5491         }

5543 err_out:
5544         ext4_std_error(inode->i_sb, error);
5545         if (!error)
5546                 error = rc;
* 5547 err_out2:
5548         return error;
This changes prevent this problem from happening.

Signed-off-by: Toshiyuki Okajima <toshi.okajima@xxxxxxxxxxxxxx>
---
 fs/ext4/inode.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 42272d6..e87bb45 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5485,7 +5485,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
 
 			if (attr->ia_size > sbi->s_bitmap_maxbytes) {
 				error = -EFBIG;
-				goto err_out;
+				goto err_out2;
 			}
 		}
 	}
@@ -5544,6 +5544,7 @@ err_out:
 	ext4_std_error(inode->i_sb, error);
 	if (!error)
 		error = rc;
+err_out2:
 	return error;
 }
 
-- 
1.5.5.6
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Reiser Filesystem Development]     [Ceph FS]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite National Park]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]     [Linux Media]

  Powered by Linux