[Bug 259112] A damaged ext3 inode with bad extents can cause a kernel page fault.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259112

            Bug ID: 259112
           Summary: A damaged ext3 inode with bad extents can cause a
                    kernel page fault.
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

Created attachment 228634
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=228634&action=edit
A damaged ext3 file system that causes a kernel page fault.

If a damaged ext3 inode claims to have extents with
depth greater than 5, ext4_ext_find_extent() &c can run
off the end of the paths array. ext4_ext_check_header()
should probably check eh_depth.

I've attached a demo:

# uname -a
FreeBSD stock14 14.0-CURRENT FreeBSD 14.0-CURRENT #0 main-n248636-d20e9e02db3:
Thu Aug 12 05:47:18 UTC 2021    
root@releng1.nyi.freebsd.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64
# gunzip ext310.img.gz 
# mdconfig -f ext310.img
# mount -t ext2fs -o ro /dev/md0 /mnt
# cp /mnt/a /dev/null
Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xffff80403fffc000
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff810c2d23
stack pointer           = 0x28:0xfffffe009bba7350
frame pointer           = 0x28:0xfffffe009bba7350
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 871 (cp)
trap number             = 12
panic: page fault
cpuid = 0
time = 1634064958
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe009bba6ff0
vpanic() at vpanic+0x187/frame 0xfffffe009bba7050
panic() at panic+0x43/frame 0xfffffe009bba70b0
trap_fatal() at trap_fatal+0x387/frame 0xfffffe009bba7110
trap_pfault() at trap_pfault+0x99/frame 0xfffffe009bba7170
trap() at trap+0x2a7/frame 0xfffffe009bba7280
calltrap() at calltrap+0x8/frame 0xfffffe009bba7280
--- trap 0xc, rip = 0xffffffff810c2d23, rsp = 0xfffffe009bba7350, rbp =
0xfffffe009bba7350 ---
pmap_kextract() at pmap_kextract+0x1d3/frame 0xfffffe009bba7350
free() at free+0x52/frame 0xfffffe009bba7380
ext4_ext_find_extent() at ext4_ext_find_extent+0x45f/frame 0xfffffe009bba7400
ext4_bmapext() at ext4_bmapext+0x97/frame 0xfffffe009bba7460
ext2_strategy() at ext2_strategy+0x5b/frame 0xfffffe009bba7490
bufstrategy() at bufstrategy+0x3e/frame 0xfffffe009bba74c0
breadn_flags() at breadn_flags+0x1a3/frame 0xfffffe009bba7530
ext2_blkatoff() at ext2_blkatoff+0x56/frame 0xfffffe009bba75b0
ext2_lookup_ino() at ext2_lookup_ino+0x2af/frame 0xfffffe009bba76c0
vfs_cache_lookup() at vfs_cache_lookup+0xa6/frame 0xfffffe009bba7710
lookup() at lookup+0x4a1/frame 0xfffffe009bba77b0
namei() at namei+0x358/frame 0xfffffe009bba7870
kern_statat() at kern_statat+0x12d/frame 0xfffffe009bba79c0
sys_fstatat() at sys_fstatat+0x2f/frame 0xfffffe009bba7ac0
amd64_syscall() at amd64_syscall+0x12e/frame 0xfffffe009bba7bf0
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe009bba7bf0

-- 
You are receiving this mail because:
You are the assignee for the bug.