Date: Mon, 23 Oct 2006 15:45:05 -0500From: Eric Sandeen <sandeen@redhat.com>Subject: [PATCH RHEL5] - handle ext3 directory corruption betterThis is for BZ 209907 <https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=209907>: kernel Soft lockup detected on corrupted ext3 filesystem.This patch is now in -mm.I've been using Steve Grubb's purely evil "fsfuzzer" tool, athttp://people.redhat.com/sgrubb/files/fsfuzzer-0.4.tar.gzBasically it makes a filesystem, splats some random bits over it, thentries to mount it and do some simple filesystem actions.At best, the filesystem catches the corruption gracefully.  At worst,things spin out of control.As you might guess, we found a couple places in ext3 where things spin outof control :)First, we had a corrupted directory that was never checked forconsistency...  it was corrupt, and pointed to another bad "entry" oflength 0.  The for() loop looped forever, since the length ofext3_next_entry(de) was 0, and we kept looking at the same pointer over andover and over and over...  I modeled this check and subsequent action onwhat is done for other directory types in ext3_readdir...(adding this check adds some computational expense; I am testing a followuppatch to reduce the number of times we check and re-check these directoryentries, in all cases.  Thanks for the idea, Andreas).Next we had a root directory inode which had a corrupted size, claimed tobe > 200M on a 4M filesystem.  There was only really 1 block in thedirectory, but because the size was so large, readdir kept coming back formore, spewing thousands of printk's along the way.Per Andreas' suggestion, if we're in this read error condition and we'retrying to read an offset which is greater than i_blocks worth of bytes,stop trying, and break out of the loop.With these two changes fsfuzz test survives quite well on ext3.Signed-off-by: Eric Sandeen <sandeen@redhat.com>Cc: <linux-ext4@vger.kernel.org>Signed-off-by: Andrew Morton <akpm@osdl.org>--- fs/ext3/dir.c   |    3 +++ fs/ext3/namei.c |    9 +++++++++ 2 files changed, 12 insertions(+)Index: linux-2.6.18-1.2732.el5/fs/ext3/dir.c===================================================================--- linux-2.6.18-1.2732.el5.orig/fs/ext3/dir.c+++ linux-2.6.18-1.2732.el5/fs/ext3/dir.c@@ -151,6 +151,9 @@ static int ext3_readdir(struct file * fi 			ext3_error (sb, "ext3_readdir", 				"directory #%lu contains a hole at offset %lu", 				inode->i_ino, (unsigned long)filp->f_pos);+			/* corrupt size?  Maybe no more blocks to read */+			if (filp->f_pos > inode->i_blocks << 9)+				break; 			filp->f_pos += sb->s_blocksize - offset; 			continue; 		}Index: linux-2.6.18-1.2732.el5/fs/ext3/namei.c===================================================================--- linux-2.6.18-1.2732.el5.orig/fs/ext3/namei.c+++ linux-2.6.18-1.2732.el5/fs/ext3/namei.c@@ -551,6 +551,15 @@ static int htree_dirblock_to_tree(struct 					   dir->i_sb->s_blocksize - 					   EXT3_DIR_REC_LEN(0)); 	for (; de < top; de = ext3_next_entry(de)) {+		if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh,+					(block<<EXT3_BLOCK_SIZE_BITS(dir->i_sb))+						+((char *)de - bh->b_data))) {+			/* On error, skip the f_pos to the next block. */+			dir_file->f_pos = (dir_file->f_pos |+					(dir->i_sb->s_blocksize - 1)) + 1;+			brelse (bh);+			return count;+		} 		ext3fs_dirhash(de->name, de->name_len, hinfo); 		if ((hinfo->hash < start_hash) || 		    ((hinfo->hash == start_hash) &&