Linux Kernel: isofs endless loop

Linux Kernel: isofs endless loop

This problem is very similar to the CVE-2014-5472, but the root cause is different, is the kernel in the processing of the Rock type file expansion of the endless loop problem.

This problem is caused by the isofs module parse_rock_ridge_inode_internal function in the kernel, processing of Entry of the "CE" type does not take into account the endless loop (the CVE-2014-5472 is not considered when processing Entry of the "CL" type ).

If you make special changes to an ISO file that contains the Rock Ridge extension and direct the extension location in the CE Entry to itself, the kernel enters an endless loop during processing.

In Ubuntu 14.10, we first tested the two test iso files (deadlock. iso and recurse. iso), the results are no problem, indicating that this version has included the fix to the CVE-2014-5472 bug.

Then we tested the self-created test. iso. After the mount command is executed, we can view it through top, and the mount always occupies 100% of the CPU.

:
 

By viewing the corresponding task call stack, it is always in the parse_rock_ridge_inode_internal function, as shown below:

 

root@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<c11cf928>] __getblk+0x38/0x350[<ffffffff>] 0xffffffffroot@ubuntu-kylin:/home/ubuntu-kylin#root@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<c11cf928>] __getblk+0x38/0x350[<c11cfca7>] __bread+0x17/0xe0[<f951aac4>] rock_continue+0x84/0x130 [isofs][<f951b208>] parse_rock_ridge_inode_internal.part.7+0x108/0x660 [isofs][<f951b9db>] parse_rock_ridge_inode+0x3b/0x70 [isofs][<f95188dd>] isofs_read_inode+0x2ad/0x6f0 [isofs][<f95190b6>] __isofs_iget+0x66/0x90 [isofs][<f9519d9c>] isofs_fill_super+0x91c/0xdb0 [isofs][<c11a2c23>] mount_bdev+0x183/0x1b0[<f9518e83>] isofs_mount+0x33/0x40 [isofs][<c11a33d1>] mount_fs+0x31/0x190[<c11bc878>] vfs_kern_mount+0x48/0xf0[<c11becc9>] do_mount+0x1f9/0x9c0[<c11bf774>] SyS_mount+0xa4/0x110[<c16c329f>] sysenter_after_call+0x0/0x16[<ffffffff>] 0xffffffffroot@ubuntu-kylin:/home/ubuntu-kylin#root@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<c11cf928>] __getblk+0x38/0x350[<ffffffff>] 0xffffffffroot@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<ffffffff>] 0xffffffffroot@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<ffffffff>] 0xffffffffroot@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<ffffffff>] 0xffffffffroot@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<c10cc589>] tick_program_event+0x29/0x30[<c10833df>] hrtimer_interrupt+0x15f/0x2d0[<c11cf928>] __getblk+0x38/0x350[<c11cfca7>] __bread+0x17/0xe0[<f951aa9e>] rock_continue+0x5e/0x130 [isofs][<f951b208>] parse_rock_ridge_inode_internal.part.7+0x108/0x660 [isofs][<f951b9db>] parse_rock_ridge_inode+0x3b/0x70 [isofs][<f95188dd>] isofs_read_inode+0x2ad/0x6f0 [isofs][<f95190b6>] __isofs_iget+0x66/0x90 [isofs][<f9519d9c>] isofs_fill_super+0x91c/0xdb0 [isofs][<c11a2c23>] mount_bdev+0x183/0x1b0[<f9518e83>] isofs_mount+0x33/0x40 [isofs][<c11a33d1>] mount_fs+0x31/0x190[<c11bc878>] vfs_kern_mount+0x48/0xf0[<c11becc9>] do_mount+0x1f9/0x9c0[<c11bf774>] SyS_mount+0xa4/0x110[<c16c329f>] sysenter_after_call+0x0/0x16[<ffffffff>] 0xffffffffroot@ubuntu-kylin:/home/ubuntu-kylin# cat /proc/5807/stack[<ffffffff>] 0xffffffff

Solution:

Special CE Entry processing added to the kernel