From nobody Mon Oct 18 16:03:29 2021 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id E56C71815FC2 for ; Mon, 18 Oct 2021 16:03:29 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HY1rK3wNwz4XMT for ; Mon, 18 Oct 2021 16:03:29 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 67E6723793 for ; Mon, 18 Oct 2021 16:03:29 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 19IG3T6b004391 for ; Mon, 18 Oct 2021 16:03:29 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 19IG3T47004390 for bugs@FreeBSD.org; Mon, 18 Oct 2021 16:03:29 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 259024] ext2_search_dirblock() loops forever if e2d_reclen is zero Date: Mon, 18 Oct 2021 16:03:29 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: fsu@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D259024 --- Comment #1 from Fedor Uporov --- Hi, Robert. Thanks a lot for reports and images for reproduction. I successfully reproduced current issue on amd64 with crash instead of infi= nity loop: #14 0xffffffff810f1927 in trap (frame=3D0xfffffe00af5eb7b0) at /usr/src/sys/amd64/amd64/trap.c:443 #15 #16 ext2_search_dirblock (ip=3D, ip@entry=3D0xfffff80004d739= 00, data=3D, foundp=3Dfoundp@entry=3D0xfffffe00af5eb990, name=3D0xfffff80004c87805 "= a", namelen=3D1, entryoffsetinblockp=3D, entryoffsetinblockp@entry=3D0xfffffe00af5eb9dc, offp=3D0xfffffe00af5eb9= e4, prevoffp=3D0xfffffe00af5eb9ac, endusefulp=3D0xfffffe00af5eb9d4, ssp=3D0xfffffe00af5eb978) at /usr/src/sys/fs/ext2fs/ext2_lookup.c:743 #17 0xffffffff82746852 in ext2_lookup_ino (vdp=3D, vpp=3D0xfffffe00af5ebc28, cnp=3D0xfffffe00af5ebc50, dd_ino=3D0x0) at /usr/src/sys/fs/ext2fs/ext2_lookup.c:455 #18 0xffffffff80cf9f16 in VOP_CACHEDLOOKUP (dvp=3D0xfffff800b50d3700, vpp=3D0xfffffe00af5ebc28, cnp=3D0xfffffe00af5ebc50) at ./vnode_if.h:103 #19 vfs_cache_lookup (ap=3D) at /usr/src/sys/kern/vfs_cache.= c:3068 #20 0xffffffff80d0b1e1 in VOP_LOOKUP (dvp=3D0xfffff800b50d3700, vpp=3D0xfffffe00af5ebc28, cnp=3D0xfffffe00af5ebc50) at ./vnode_if.h:69 #21 lookup (ndp=3Dndp@entry=3D0xfffffe00af5ebbd0) at /usr/src/sys/kern/vfs_lookup.c:1128 --Type for more, q to quit, c to continue without paging-- #22 0xffffffff80d0a0de in namei (ndp=3Dndp@entry=3D0xfffffe00af5ebbd0) at /usr/src/sys/kern/vfs_lookup.c:658 #23 0xffffffff80d29ba2 in kern_statat (td=3D0xfffffe0094b47e40, flag=3D, fd=3D-100, path=3D0x8018182f8 , pathseg=3Dpathseg@entry=3DUIO_USERSPACE, sbp=3Dsbp@entry=3D0xfffffe00af5ebd18, hook=3D0x0) at /usr/src/sys/kern/vfs_syscalls.c:2441 Issues 259105, 259107, 259112 were successfully reproduced too. The problem with these sort of issues, I mean malicious images with bad/corrupted metadata, that it is too difficult to make crosscheck of metadata values read from disk. The only way to avoid it, is = to format drive with ext4 metadata_csum (RO_COMPAT_METADATA_CSUM) feature turn= ed on. Need to find a way, how the metadata values, which cause a crashes, could be verified. --=20 You are receiving this mail because: You are the assignee for the bug.=