UPSTREAM: ext4: avoid hang when mounting non-journal filesystems with orphan list
authorTheodore Ts'o <tytso@mit.edu>
Thu, 27 Dec 2012 06:42:50 +0000 (01:42 -0500)
committerChromeBot <chrome-bot@google.com>
Thu, 10 Jan 2013 21:56:29 +0000 (13:56 -0800)
commitd9bb491d6924b78800af1b8514f6346fe7077058
tree55d2124327cd94458cab24cfbaf0e922af6b5ede
parent56de6fae4110bbfd310d5f2b3bb7675abdbd2da1
UPSTREAM: ext4: avoid hang when mounting non-journal filesystems with orphan list

When trying to mount a file system which does not contain a journal,
but which does have a orphan list containing an inode which needs to
be truncated, the mount call with hang forever in
ext4_orphan_cleanup() because ext4_orphan_del() will return
immediately without removing the inode from the orphan list, leading
to an uninterruptible loop in kernel code which will busy out one of
the CPU's on the system.

This can be trivially reproduced by trying to mount the file system
found in tests/f_orphan_extents_inode/image.gz from the e2fsprogs
source tree.  If a malicious user were to put this on a USB stick, and
mount it on a Linux desktop which has automatic mounts enabled, this
could be considered a potential denial of service attack.  (Not a big
deal in practice, but professional paranoids worry about such things,
and have even been known to allocate CVE numbers for such problems.)

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Zheng Liu <wenqing.lz@taobao.com>
Cc: stable@vger.kernel.org
BUG=chromium-os:37768
TEST=link build, manual test with corrupted filesystem image

(cherry picked from commit 0e9a9a1ad619e7e987815d20262d36a2f95717ca)
Change-Id: I5e985a85e94f3b38f0dd5d8c1517c0bccc93eb04
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41038
Reviewed-by: Olof Johansson <olofj@chromium.org>
fs/ext4/namei.c