ext4: 构造特殊block bitmap损坏镜像导致WANRON

【标题描述】在ext4 block bitmap末尾（超出cluster部分）注入非0数据，挂载后触发WARNON
【环境信息】
硬件信息：
NA
软件信息：
OLK-5.10
【问题复现步骤】
gcc -occ c.c -lpthread
./cc
出现概率(是否必现，概率性错误)必现
【预期结果】
内核WANRON
【实际结果】
```
[  136.958773] ------------[ cut here ]------------
[  136.959457] WARNING: CPU: 2 PID: 1568 at fs/ext4/mballoc.c:1869 mb_find_extent+0x232/0x310
[  136.960759] Modules linked in:
[  136.961239] CPU: 2 PID: 1568 Comm: cc Not tainted 6.2.0-13281-g7f8fdc0b5190 #1107
[  136.962316] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraprojec4
[  136.964210] RIP: 0010:mb_find_extent+0x232/0x310
[  136.964945] Code: 01 8b 5d 04 8b 45 0c 4d 8b 57 28 8d 14 03 48 63 d2 49 8b 8a 80 03 00 00 48 3b 51 18 0f 86 9c fe ff ff 48 837
[  136.967578] RSP: 0018:ffffc900014db450 EFLAGS: 00010202
[  136.968371] RAX: 0000000000000018 RBX: 0000000000000029 RCX: ffff888104431000
[  136.969459] RDX: 0000000000000041 RSI: 0000000000000000 RDI: ffffc900014db560
[  136.970453] RBP: ffffc900014db4b8 R08: 0000000000000000 R09: 0000000000000000
[  136.971500] R10: ffff888100b08000 R11: 0000000000000000 R12: 0000000000000000
[  136.972579] R13: 0000000000000040 R14: 0000000000000040 R15: ffffc900014db560
[  136.973626] FS:  00007f9c19436700(0000) GS:ffff88842fd00000(0000) knlGS:0000000000000000
[  136.974768] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  136.975594] CR2: 00007f9c18aa72e0 CR3: 0000000174e30000 CR4: 00000000000006e0
[  136.976653] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  136.977716] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  136.978768] Call Trace:
[  136.979119]  <TASK>
[  136.979442]  ext4_mb_complex_scan_group+0xeb/0x3f0
[  136.980180]  ext4_mb_regular_allocator+0x490/0x16b0
[  136.980869]  ext4_mb_new_blocks+0xe45/0x20f0
[  136.981495]  ? ext4_find_extent+0x5d5/0x8c0
[  136.982136]  ext4_ext_map_blocks+0xbee/0x1d50
[  136.982816]  ext4_map_blocks+0x293/0xa70
[  136.983416]  ? _raw_spin_lock_irqsave+0x39/0xb0
[  136.984116]  ? _raw_spin_unlock_irqrestore+0x4b/0x90
[  136.984879]  ? __create_object+0x2b3/0x600
[  136.985490]  ext4_getblk+0x84/0x450
[  136.986038]  ext4_bread+0x14/0x110
[  136.986572]  ext4_quota_write+0xe9/0x370
[  136.987172]  ? note_qf_name.isra.0+0x240/0x240
[  136.987831]  write_blk+0x50/0xb0
[  136.988309]  get_free_dqblk+0x5b/0x130
[  136.988875]  do_insert_tree+0x1b3/0x700
[  136.989462]  do_insert_tree+0x6f8/0x700
[  136.990062]  do_insert_tree+0x6f8/0x700
[  136.990620]  ? ext4_fh_to_dentry+0x30/0x30
[  136.991251]  do_insert_tree+0x6f8/0x700
[  136.991848]  ? qtree_write_dquot+0x46/0x250
[  136.992483]  qtree_write_dquot+0x95/0x250
[  136.993089]  v2_write_dquot+0x56/0xe0
[  136.993651]  dquot_acquire+0xd7/0x1e0
[  136.994234]  ? __ext4_journal_start_sb+0x5b/0x300
[  136.994979]  ext4_acquire_dquot+0xca/0x190
[  136.995599]  ? percpu_counter_add_batch+0x3b/0xf0
[  136.996307]  dqget+0x35c/0x700
[  136.996813]  __dquot_initialize+0x2a2/0x640
[  136.997421]  ? ext4_read_inode_bitmap+0x4ba/0xb40
[  136.998167]  dquot_initialize+0x17/0x20
[  136.998759]  ext4_process_orphan+0x27/0x1a0
[  136.999409]  ext4_orphan_cleanup+0x2b5/0x740
[  137.000045]  __ext4_fill_super+0x31c2/0x33c0
[  137.000663]  ? __ext4_fill_super+0x33c0/0x33c0
[  137.001373]  ext4_fill_super+0x13d/0x300
[  137.001964]  get_tree_bdev+0x1db/0x370
[  137.002532]  ext4_get_tree+0x19/0x30
[  137.003108]  vfs_get_tree+0x27/0x150
[  137.003663]  path_mount+0x3b6/0x1060
[  137.004228]  do_mount+0x8d/0xc0
[  137.004673]  __x64_sys_mount+0xc0/0x160
[  137.005271]  do_syscall_64+0x35/0x80
[  137.005823]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
```
【附件信息】
https://syzkaller.appspot.com/x/repro.c?x=149409ff880000

src-openEuler/kernel
关闭

内容风险标识

评论 (4)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识