From: Greg Kroah-Hartman Date: Sat, 7 Oct 2023 11:06:23 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.327~78 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5e35993282fce14f752ab8f6ca8b4d9bbf0d84ab;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: ext4-fix-rec_len-verify-error.patch --- diff --git a/queue-4.14/ext4-fix-rec_len-verify-error.patch b/queue-4.14/ext4-fix-rec_len-verify-error.patch new file mode 100644 index 00000000000..5d08ac28eab --- /dev/null +++ b/queue-4.14/ext4-fix-rec_len-verify-error.patch @@ -0,0 +1,123 @@ +From 7fda67e8c3ab6069f75888f67958a6d30454a9f6 Mon Sep 17 00:00:00 2001 +From: Shida Zhang +Date: Thu, 3 Aug 2023 14:09:38 +0800 +Subject: ext4: fix rec_len verify error + +From: Shida Zhang + +commit 7fda67e8c3ab6069f75888f67958a6d30454a9f6 upstream. + +With the configuration PAGE_SIZE 64k and filesystem blocksize 64k, +a problem occurred when more than 13 million files were directly created +under a directory: + +EXT4-fs error (device xx): ext4_dx_csum_set:492: inode #xxxx: comm xxxxx: dir seems corrupt? Run e2fsck -D. +EXT4-fs error (device xx): ext4_dx_csum_verify:463: inode #xxxx: comm xxxxx: dir seems corrupt? Run e2fsck -D. +EXT4-fs error (device xx): dx_probe:856: inode #xxxx: block 8188: comm xxxxx: Directory index failed checksum + +When enough files are created, the fake_dirent->reclen will be 0xffff. +it doesn't equal to the blocksize 65536, i.e. 0x10000. + +But it is not the same condition when blocksize equals to 4k. +when enough files are created, the fake_dirent->reclen will be 0x1000. +it equals to the blocksize 4k, i.e. 0x1000. + +The problem seems to be related to the limitation of the 16-bit field +when the blocksize is set to 64k. +To address this, helpers like ext4_rec_len_{from,to}_disk has already +been introduced to complete the conversion between the encoded and the +plain form of rec_len. + +So fix this one by using the helper, and all the other in this file too. + +Cc: stable@kernel.org +Fixes: dbe89444042a ("ext4: Calculate and verify checksums for htree nodes") +Suggested-by: Andreas Dilger +Suggested-by: Darrick J. Wong +Signed-off-by: Shida Zhang +Reviewed-by: Andreas Dilger +Reviewed-by: Darrick J. Wong +Link: https://lore.kernel.org/r/20230803060938.1929759-1-zhangshida@kylinos.cn +Signed-off-by: Theodore Ts'o +Signed-off-by: Shida Zhang +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/namei.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -321,17 +321,17 @@ static struct ext4_dir_entry_tail *get_d + struct ext4_dir_entry *de) + { + struct ext4_dir_entry_tail *t; ++ int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); + + #ifdef PARANOID + struct ext4_dir_entry *d, *top; + + d = de; + top = (struct ext4_dir_entry *)(((void *)de) + +- (EXT4_BLOCK_SIZE(inode->i_sb) - +- sizeof(struct ext4_dir_entry_tail))); +- while (d < top && d->rec_len) ++ (blocksize - sizeof(struct ext4_dir_entry_tail))); ++ while (d < top && ext4_rec_len_from_disk(d->rec_len, blocksize)) + d = (struct ext4_dir_entry *)(((void *)d) + +- le16_to_cpu(d->rec_len)); ++ ext4_rec_len_from_disk(d->rec_len, blocksize)); + + if (d != top) + return NULL; +@@ -342,7 +342,8 @@ static struct ext4_dir_entry_tail *get_d + #endif + + if (t->det_reserved_zero1 || +- le16_to_cpu(t->det_rec_len) != sizeof(struct ext4_dir_entry_tail) || ++ (ext4_rec_len_from_disk(t->det_rec_len, blocksize) != ++ sizeof(struct ext4_dir_entry_tail)) || + t->det_reserved_zero2 || + t->det_reserved_ft != EXT4_FT_DIR_CSUM) + return NULL; +@@ -424,13 +425,14 @@ static struct dx_countlimit *get_dx_coun + struct ext4_dir_entry *dp; + struct dx_root_info *root; + int count_offset; ++ int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); ++ unsigned int rlen = ext4_rec_len_from_disk(dirent->rec_len, blocksize); + +- if (le16_to_cpu(dirent->rec_len) == EXT4_BLOCK_SIZE(inode->i_sb)) ++ if (rlen == blocksize) + count_offset = 8; +- else if (le16_to_cpu(dirent->rec_len) == 12) { ++ else if (rlen == 12) { + dp = (struct ext4_dir_entry *)(((void *)dirent) + 12); +- if (le16_to_cpu(dp->rec_len) != +- EXT4_BLOCK_SIZE(inode->i_sb) - 12) ++ if (ext4_rec_len_from_disk(dp->rec_len, blocksize) != blocksize - 12) + return NULL; + root = (struct dx_root_info *)(((void *)dp + 12)); + if (root->reserved_zero || +@@ -1243,6 +1245,7 @@ static int dx_make_map(struct inode *dir + unsigned int buflen = bh->b_size; + char *base = bh->b_data; + struct dx_hash_info h = *hinfo; ++ int blocksize = EXT4_BLOCK_SIZE(dir->i_sb); + + if (ext4_has_metadata_csum(dir->i_sb)) + buflen -= sizeof(struct ext4_dir_entry_tail); +@@ -1256,11 +1259,12 @@ static int dx_make_map(struct inode *dir + map_tail--; + map_tail->hash = h.hash; + map_tail->offs = ((char *) de - base)>>2; +- map_tail->size = le16_to_cpu(de->rec_len); ++ map_tail->size = ext4_rec_len_from_disk(de->rec_len, ++ blocksize); + count++; + cond_resched(); + } +- de = ext4_next_entry(de, dir->i_sb->s_blocksize); ++ de = ext4_next_entry(de, blocksize); + } + return count; + } diff --git a/queue-4.14/series b/queue-4.14/series index 9269b0f97f1..4fc3377f6b7 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -29,3 +29,4 @@ ata-libata-core-fix-port-and-device-removal.patch ata-libata-sata-increase-pmp-srst-timeout-to-10s.patch fs-binfmt_elf_efpic-fix-personality-for-elf-fdpic.patch vc_screen-reload-load-of-struct-vc_data-pointer-in-vcs_write-to-avoid-uaf.patch +ext4-fix-rec_len-verify-error.patch