lkml.org 
[lkml]   [2003]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Reiserfs kernel-crashing bug in 2.4.20 (and UML)
dan@merillat.org wrote:
>
> Let's get this out of the way first: I KNOW IT'S A HARDWARE BUG. My
> system wrote corrupted data to the drive. I've already recovered the
> partition but I have a dd'd copy around to figure this out.
>
> With that out of the way:
>
> I can reliably insta-reboot my kernel or cause user-mode-linux to crash
> out when doing a directory lookup in one corrupted directory.
>
> The catch is, (and there's always a catch) neither oopses. real kernel on
> real hardware just flashes the screen and reboots, user-mode-linux just
> drops back to the host's shell prompt.
>
> Here's what I've found using UML on it:
>
> The directory is one block, but we're reading data 100+k into it. Perhaps
> a sanity check that we're actually within the buffer we want to be?

You're absolutely right. Filesystem drivers should try hard to not crash
the box when fed random crap.

> + if (d_reclen < 0)
> + return -EIO;

It needs to be checked for some upper bound as well.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:48    [W:0.032 / U:3.624 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site