[DragonFlyBSD - Bug #3456] (Resolved) ext2fs: kernel panic when a directory is renamed into another directory

[liweitianux]

Issue #3456 has been updated by liweitianux.

Status changed from New to Resolved

Patch merged. Thank you.

----------------------------------------
Bug #3456: ext2fs: kernel panic when a directory is renamed into another directory
http://bugs.dragonflybsd.org/issues/3456#change-14913

* Author: sigttou
* Status: Resolved
* Priority: Normal
* Category: Kernel
* Target version: 6.6
* Start date: 2026-10-22
----------------------------------------
@ext2_rename()@ reads the first block of the moved directory into a buffer of one filesystem block, but passes @(caddr_t)&dirbuf@, the address of the pointer, and only 24 bytes. @vn_rdwr()@ writes the directory data over the pointer and the stack next to it, and the next dirbuf access faults:

 mkdir p1 p2 p1/x; mv p1/x p2/
Fatal trap 9: general protection fault while in kernel mode
stopped at ext2_rename+0x943

On a machine without a console it looks like a hang (the fault enters ddb). The short transfer also leaves the directory checksum untouched on metadata_csum filesystems.

The bug is in master and in the v6.0.0 and v6.4.0 releases (not in v5.8.0). -> Pass @dirbuf@ itself and @e2fs_bsize@ for both the read and the write, as FreeBSD does.


---Files--------------------------------
0001-ext2fs-pass-dirbuf-itself-and-the-whole-block-to-vn_.patch (3.16 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account