Created attachment 228634 [details] A damaged ext3 file system that causes a kernel page fault. If a damaged ext3 inode claims to have extents with depth greater than 5, ext4_ext_find_extent() &c can run off the end of the paths array. ext4_ext_check_header() should probably check eh_depth. I've attached a demo: # uname -a FreeBSD stock14 14.0-CURRENT FreeBSD 14.0-CURRENT #0 main-n248636-d20e9e02db3: Thu Aug 12 05:47:18 UTC 2021 root@releng1.nyi.freebsd.org:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64 # gunzip ext310.img.gz # mdconfig -f ext310.img # mount -t ext2fs -o ro /dev/md0 /mnt # cp /mnt/a /dev/null Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0xffff80403fffc000 fault code = supervisor read data, page not present instruction pointer = 0x20:0xffffffff810c2d23 stack pointer = 0x28:0xfffffe009bba7350 frame pointer = 0x28:0xfffffe009bba7350 code segment = base rx0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 871 (cp) trap number = 12 panic: page fault cpuid = 0 time = 1634064958 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe009bba6ff0 vpanic() at vpanic+0x187/frame 0xfffffe009bba7050 panic() at panic+0x43/frame 0xfffffe009bba70b0 trap_fatal() at trap_fatal+0x387/frame 0xfffffe009bba7110 trap_pfault() at trap_pfault+0x99/frame 0xfffffe009bba7170 trap() at trap+0x2a7/frame 0xfffffe009bba7280 calltrap() at calltrap+0x8/frame 0xfffffe009bba7280 --- trap 0xc, rip = 0xffffffff810c2d23, rsp = 0xfffffe009bba7350, rbp = 0xfffffe009bba7350 --- pmap_kextract() at pmap_kextract+0x1d3/frame 0xfffffe009bba7350 free() at free+0x52/frame 0xfffffe009bba7380 ext4_ext_find_extent() at ext4_ext_find_extent+0x45f/frame 0xfffffe009bba7400 ext4_bmapext() at ext4_bmapext+0x97/frame 0xfffffe009bba7460 ext2_strategy() at ext2_strategy+0x5b/frame 0xfffffe009bba7490 bufstrategy() at bufstrategy+0x3e/frame 0xfffffe009bba74c0 breadn_flags() at breadn_flags+0x1a3/frame 0xfffffe009bba7530 ext2_blkatoff() at ext2_blkatoff+0x56/frame 0xfffffe009bba75b0 ext2_lookup_ino() at ext2_lookup_ino+0x2af/frame 0xfffffe009bba76c0 vfs_cache_lookup() at vfs_cache_lookup+0xa6/frame 0xfffffe009bba7710 lookup() at lookup+0x4a1/frame 0xfffffe009bba77b0 namei() at namei+0x358/frame 0xfffffe009bba7870 kern_statat() at kern_statat+0x12d/frame 0xfffffe009bba79c0 sys_fstatat() at sys_fstatat+0x2f/frame 0xfffffe009bba7ac0 amd64_syscall() at amd64_syscall+0x12e/frame 0xfffffe009bba7bf0 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe009bba7bf0
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=be60d8f276fa20fc11ad814e54c9c2540f79c7da commit be60d8f276fa20fc11ad814e54c9c2540f79c7da Author: Neel Chauhan <nc@FreeBSD.org> AuthorDate: 2021-11-17 00:25:04 +0000 Commit: Neel Chauhan <nc@FreeBSD.org> CommitDate: 2021-11-18 17:54:42 +0000 ext2fs: check for eh_depth in ext4_ext_check_header() PR: 259112 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: fsu MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D33030 sys/fs/ext2fs/ext2_extents.c | 4 ++++ 1 file changed, 4 insertions(+)
Committed!
A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=5c50e93e6ce43e8558e043de0745bad889c3a77f commit 5c50e93e6ce43e8558e043de0745bad889c3a77f Author: Neel Chauhan <nc@FreeBSD.org> AuthorDate: 2021-11-17 00:25:04 +0000 Commit: Neel Chauhan <nc@FreeBSD.org> CommitDate: 2021-11-29 17:56:42 +0000 ext2fs: check for eh_depth in ext4_ext_check_header() PR: 259112 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: fsu (src) Differential Revision: https://reviews.freebsd.org/D33030 (cherry picked from commit be60d8f276fa20fc11ad814e54c9c2540f79c7da) sys/fs/ext2fs/ext2_extents.c | 4 ++++ 1 file changed, 4 insertions(+)
A commit in branch stable/12 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=8facf7082d4973aedc30cdd8e90fbd33beb17d7f commit 8facf7082d4973aedc30cdd8e90fbd33beb17d7f Author: Neel Chauhan <nc@FreeBSD.org> AuthorDate: 2021-11-17 00:25:04 +0000 Commit: Neel Chauhan <nc@FreeBSD.org> CommitDate: 2021-11-29 17:57:12 +0000 ext2fs: check for eh_depth in ext4_ext_check_header() PR: 259112 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: fsu (src) Differential Revision: https://reviews.freebsd.org/D33030 (cherry picked from commit be60d8f276fa20fc11ad814e54c9c2540f79c7da) sys/fs/ext2fs/ext2_extents.c | 4 ++++ 1 file changed, 4 insertions(+)
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=f1d5e2c862ef599efd1705b04d505d5415b77f82 commit f1d5e2c862ef599efd1705b04d505d5415b77f82 Author: Fedor Uporov <fsu@FreeBSD.org> AuthorDate: 2021-12-24 14:18:15 +0000 Commit: Fedor Uporov <fsu@FreeBSD.org> CommitDate: 2021-12-30 06:14:45 +0000 Improve extents verification logic Add functionality for extents validation inside the filesystem extents block. The main logic is implemented under ext4_validate_extent_entries() function, which verifies extents or extents indexes depending of extent depth value. PR: 259112 Reported by: Robert Morris Reviewed by: pfg MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D33375 sys/fs/ext2fs/ext2_extents.c | 291 +++++++++++++++++++++++++++++++---------- sys/fs/ext2fs/ext2_inode_cnv.c | 8 +- 2 files changed, 224 insertions(+), 75 deletions(-)