Skip to content

Commit 8a36397

Browse files
tytsotytso
committed
ext4: avoid declaring fs inconsistent due to invalid file handles
If we receive a file handle, either from NFS or open_by_handle_at(2), and it points at an inode which has not been initialized, and the file system has metadata checksums enabled, we shouldn't try to get the inode, discover the checksum is invalid, and then declare the file system as being inconsistent. This can be reproduced by creating a test file system via "mke2fs -t ext4 -O metadata_csum /tmp/foo.img 8M", mounting it, cd'ing into that directory, and then running the following program. #define _GNU_SOURCE #include <fcntl.h> struct handle { struct file_handle fh; unsigned char fid[MAX_HANDLE_SZ]; }; int main(int argc, char **argv) { struct handle h = {{8, 1 }, { 12, }}; open_by_handle_at(AT_FDCWD, &h.fh, O_RDONLY); return 0; } Google-Bug-Id: 120690101 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org
1 parent a805622 commit 8a36397

File tree

8 files changed

+65
-41
lines changed

8 files changed

+65
-41
lines changed

‎fs/ext4/ext4.h

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2454,8 +2454,19 @@ int do_journal_get_write_access(handle_t *handle,
24542454
#define FALL_BACK_TO_NONDELALLOC 1
24552455
#define CONVERT_INLINE_DATA 2
24562456

2457-
extern struct inode *ext4_iget(struct super_block *, unsigned long);
2458-
extern struct inode *ext4_iget_normal(struct super_block *, unsigned long);
2457+
typedef enum {
2458+
EXT4_IGET_NORMAL = 0,
2459+
EXT4_IGET_SPECIAL = 0x0001, /* OK to iget a system inode */
2460+
EXT4_IGET_HANDLE = 0x0002 /* Inode # is from a handle */
2461+
} ext4_iget_flags;
2462+
2463+
extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
2464+
ext4_iget_flags flags, const char *function,
2465+
unsigned int line);
2466+
2467+
#define ext4_iget(sb, ino, flags) \
2468+
__ext4_iget((sb), (ino), (flags), __func__, __LINE__)
2469+
24592470
extern int ext4_write_inode(struct inode *, struct writeback_control *);
24602471
extern int ext4_setattr(struct dentry *, struct iattr *);
24612472
extern int ext4_getattr(const struct path *, struct kstat *, u32, unsigned int);

‎fs/ext4/ialloc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1225,7 +1225,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
12251225
if (!ext4_test_bit(bit, bitmap_bh->b_data))
12261226
goto bad_orphan;
12271227

1228-
inode = ext4_iget(sb, ino);
1228+
inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
12291229
if (IS_ERR(inode)) {
12301230
err = PTR_ERR(inode);
12311231
ext4_error(sb, "couldn't read orphan inode %lu (err %d)",

‎fs/ext4/inode.c

Lines changed: 37 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4817,7 +4817,9 @@ static inline u64 ext4_inode_peek_iversion(const struct inode *inode)
48174817
return inode_peek_iversion(inode);
48184818
}
48194819

4820-
struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
4820+
struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
4821+
ext4_iget_flags flags, const char *function,
4822+
unsigned int line)
48214823
{
48224824
struct ext4_iloc iloc;
48234825
struct ext4_inode *raw_inode;
@@ -4831,6 +4833,18 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
48314833
gid_t i_gid;
48324834
projid_t i_projid;
48334835

4836+
if (((flags & EXT4_IGET_NORMAL) &&
4837+
(ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) ||
4838+
(ino < EXT4_ROOT_INO) ||
4839+
(ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) {
4840+
if (flags & EXT4_IGET_HANDLE)
4841+
return ERR_PTR(-ESTALE);
4842+
__ext4_error(sb, function, line,
4843+
"inode #%lu: comm %s: iget: illegal inode #",
4844+
ino, current->comm);
4845+
return ERR_PTR(-EFSCORRUPTED);
4846+
}
4847+
48344848
inode = iget_locked(sb, ino);
48354849
if (!inode)
48364850
return ERR_PTR(-ENOMEM);
@@ -4846,18 +4860,26 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
48464860
raw_inode = ext4_raw_inode(&iloc);
48474861

48484862
if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
4849-
EXT4_ERROR_INODE(inode, "root inode unallocated");
4863+
ext4_error_inode(inode, function, line, 0,
4864+
"iget: root inode unallocated");
48504865
ret = -EFSCORRUPTED;
48514866
goto bad_inode;
48524867
}
48534868

4869+
if ((flags & EXT4_IGET_HANDLE) &&
4870+
(raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
4871+
ret = -ESTALE;
4872+
goto bad_inode;
4873+
}
4874+
48544875
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
48554876
ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize);
48564877
if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize >
48574878
EXT4_INODE_SIZE(inode->i_sb) ||
48584879
(ei->i_extra_isize & 3)) {
4859-
EXT4_ERROR_INODE(inode,
4860-
"bad extra_isize %u (inode size %u)",
4880+
ext4_error_inode(inode, function, line, 0,
4881+
"iget: bad extra_isize %u "
4882+
"(inode size %u)",
48614883
ei->i_extra_isize,
48624884
EXT4_INODE_SIZE(inode->i_sb));
48634885
ret = -EFSCORRUPTED;
@@ -4879,7 +4901,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
48794901
}
48804902

48814903
if (!ext4_inode_csum_verify(inode, raw_inode, ei)) {
4882-
EXT4_ERROR_INODE(inode, "checksum invalid");
4904+
ext4_error_inode(inode, function, line, 0,
4905+
"iget: checksum invalid");
48834906
ret = -EFSBADCRC;
48844907
goto bad_inode;
48854908
}
@@ -4936,7 +4959,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
49364959
((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
49374960
inode->i_size = ext4_isize(sb, raw_inode);
49384961
if ((size = i_size_read(inode)) < 0) {
4939-
EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size);
4962+
ext4_error_inode(inode, function, line, 0,
4963+
"iget: bad i_size value: %lld", size);
49404964
ret = -EFSCORRUPTED;
49414965
goto bad_inode;
49424966
}
@@ -5012,7 +5036,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
50125036
ret = 0;
50135037
if (ei->i_file_acl &&
50145038
!ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
5015-
EXT4_ERROR_INODE(inode, "bad extended attribute block %llu",
5039+
ext4_error_inode(inode, function, line, 0,
5040+
"iget: bad extended attribute block %llu",
50165041
ei->i_file_acl);
50175042
ret = -EFSCORRUPTED;
50185043
goto bad_inode;
@@ -5040,8 +5065,9 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
50405065
} else if (S_ISLNK(inode->i_mode)) {
50415066
/* VFS does not allow setting these so must be corruption */
50425067
if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) {
5043-
EXT4_ERROR_INODE(inode,
5044-
"immutable or append flags not allowed on symlinks");
5068+
ext4_error_inode(inode, function, line, 0,
5069+
"iget: immutable or append flags "
5070+
"not allowed on symlinks");
50455071
ret = -EFSCORRUPTED;
50465072
goto bad_inode;
50475073
}
@@ -5071,7 +5097,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
50715097
make_bad_inode(inode);
50725098
} else {
50735099
ret = -EFSCORRUPTED;
5074-
EXT4_ERROR_INODE(inode, "bogus i_mode (%o)", inode->i_mode);
5100+
ext4_error_inode(inode, function, line, 0,
5101+
"iget: bogus i_mode (%o)", inode->i_mode);
50755102
goto bad_inode;
50765103
}
50775104
brelse(iloc.bh);
@@ -5085,13 +5112,6 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
50855112
return ERR_PTR(ret);
50865113
}
50875114

5088-
struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino)
5089-
{
5090-
if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
5091-
return ERR_PTR(-EFSCORRUPTED);
5092-
return ext4_iget(sb, ino);
5093-
}
5094-
50955115
static int ext4_inode_blocks_set(handle_t *handle,
50965116
struct ext4_inode *raw_inode,
50975117
struct ext4_inode_info *ei)

‎fs/ext4/ioctl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
125125
!inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
126126
return -EPERM;
127127

128-
inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO);
128+
inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL);
129129
if (IS_ERR(inode_bl))
130130
return PTR_ERR(inode_bl);
131131
ei_bl = EXT4_I(inode_bl);

‎fs/ext4/namei.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1571,7 +1571,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
15711571
dentry);
15721572
return ERR_PTR(-EFSCORRUPTED);
15731573
}
1574-
inode = ext4_iget_normal(dir->i_sb, ino);
1574+
inode = ext4_iget(dir->i_sb, ino, EXT4_IGET_NORMAL);
15751575
if (inode == ERR_PTR(-ESTALE)) {
15761576
EXT4_ERROR_INODE(dir,
15771577
"deleted inode referenced: %u",
@@ -1613,7 +1613,7 @@ struct dentry *ext4_get_parent(struct dentry *child)
16131613
return ERR_PTR(-EFSCORRUPTED);
16141614
}
16151615

1616-
return d_obtain_alias(ext4_iget_normal(child->d_sb, ino));
1616+
return d_obtain_alias(ext4_iget(child->d_sb, ino, EXT4_IGET_NORMAL));
16171617
}
16181618

16191619
/*

‎fs/ext4/resize.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1637,7 +1637,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
16371637
"No reserved GDT blocks, can't resize");
16381638
return -EPERM;
16391639
}
1640-
inode = ext4_iget(sb, EXT4_RESIZE_INO);
1640+
inode = ext4_iget(sb, EXT4_RESIZE_INO, EXT4_IGET_SPECIAL);
16411641
if (IS_ERR(inode)) {
16421642
ext4_warning(sb, "Error opening resize inode");
16431643
return PTR_ERR(inode);
@@ -1965,7 +1965,8 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
19651965
}
19661966

19671967
if (!resize_inode)
1968-
resize_inode = ext4_iget(sb, EXT4_RESIZE_INO);
1968+
resize_inode = ext4_iget(sb, EXT4_RESIZE_INO,
1969+
EXT4_IGET_SPECIAL);
19691970
if (IS_ERR(resize_inode)) {
19701971
ext4_warning(sb, "Error opening resize inode");
19711972
return PTR_ERR(resize_inode);

‎fs/ext4/super.c

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1173,20 +1173,11 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb,
11731173
{
11741174
struct inode *inode;
11751175

1176-
if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
1177-
return ERR_PTR(-ESTALE);
1178-
if (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))
1179-
return ERR_PTR(-ESTALE);
1180-
1181-
/* iget isn't really right if the inode is currently unallocated!!
1182-
*
1183-
* ext4_read_inode will return a bad_inode if the inode had been
1184-
* deleted, so we should be safe.
1185-
*
1176+
/*
11861177
* Currently we don't know the generation for parent directory, so
11871178
* a generation of 0 means "accept any"
11881179
*/
1189-
inode = ext4_iget_normal(sb, ino);
1180+
inode = ext4_iget(sb, ino, EXT4_IGET_HANDLE);
11901181
if (IS_ERR(inode))
11911182
return ERR_CAST(inode);
11921183
if (generation && inode->i_generation != generation) {
@@ -4350,7 +4341,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
43504341
* so we can safely mount the rest of the filesystem now.
43514342
*/
43524343

4353-
root = ext4_iget(sb, EXT4_ROOT_INO);
4344+
root = ext4_iget(sb, EXT4_ROOT_INO, EXT4_IGET_SPECIAL);
43544345
if (IS_ERR(root)) {
43554346
ext4_msg(sb, KERN_ERR, "get root inode failed");
43564347
ret = PTR_ERR(root);
@@ -4618,7 +4609,7 @@ static struct inode *ext4_get_journal_inode(struct super_block *sb,
46184609
* happen if we iget() an unused inode, as the subsequent iput()
46194610
* will try to delete it.
46204611
*/
4621-
journal_inode = ext4_iget(sb, journal_inum);
4612+
journal_inode = ext4_iget(sb, journal_inum, EXT4_IGET_SPECIAL);
46224613
if (IS_ERR(journal_inode)) {
46234614
ext4_msg(sb, KERN_ERR, "no journal found");
46244615
return NULL;
@@ -5700,7 +5691,7 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
57005691
if (!qf_inums[type])
57015692
return -EPERM;
57025693

5703-
qf_inode = ext4_iget(sb, qf_inums[type]);
5694+
qf_inode = ext4_iget(sb, qf_inums[type], EXT4_IGET_SPECIAL);
57045695
if (IS_ERR(qf_inode)) {
57055696
ext4_error(sb, "Bad quota inode # %lu", qf_inums[type]);
57065697
return PTR_ERR(qf_inode);

‎fs/ext4/xattr.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
384384
struct inode *inode;
385385
int err;
386386

387-
inode = ext4_iget(parent->i_sb, ea_ino);
387+
inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL);
388388
if (IS_ERR(inode)) {
389389
err = PTR_ERR(inode);
390390
ext4_error(parent->i_sb,
@@ -1482,7 +1482,8 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
14821482
}
14831483

14841484
while (ce) {
1485-
ea_inode = ext4_iget(inode->i_sb, ce->e_value);
1485+
ea_inode = ext4_iget(inode->i_sb, ce->e_value,
1486+
EXT4_IGET_NORMAL);
14861487
if (!IS_ERR(ea_inode) &&
14871488
!is_bad_inode(ea_inode) &&
14881489
(EXT4_I(ea_inode)->i_flags & EXT4_EA_INODE_FL) &&

0 commit comments

Comments
 (0)