[Bug 213357] New: chattr +e writes invalid checksum to extent block

https://bugzilla.kernel.org/show_bug.cgi?id=213357

            Bug ID: 213357
           Summary: chattr +e writes invalid checksum to extent block
           Product: File System
           Version: 2.5
    Kernel Version: 5.13.0-rc4
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@kernel-bugs.osdl.org
          Reporter: jeroen@wolffelaar.nl
        Regression: No

Created attachment 297207
  --> https://bugzilla.kernel.org/attachment.cgi?id=297207&action=edit
Reproduction script

Overview:

Converting a file previously using (ext2/3) blocklists to ext4 extents using
chattr +e makes the kernel write an invalid checksum to the extent block (if
one needs to be written because of the metadata_csum feature & there being more
than 4 extents). Because of inode caching, this won't be obvious until the
inode has has been evicted from the cache, or the filesystem is remounted. The
checksum errors are trivially correctable using e2fsck.

Reproduction:

In short:

* Create a large enough file on an ext3 filesystem to have it 5+ discontinuous
ranges of blocks
* Add 'extent' and 'metadata_csum' feature to the filesystem
* chattr +e the file
* Reload the filesystem/clear inode cache

See repro.sh for full steps.

Observe:

* Reading the file gives I/O errors (EXT4-fs error: ext4_find_extent:885: inode
#12: comm cat: pblk 17591 bad header/extent: extent tree corrupted - magic
f30a, entries 6, max 340(340), depth 0(0))
* e2fsck reports checksum mismatch (ext2fs_block_iterate3: Extent block
checksum does not match extent block)

Reproduction:

Besides the system where I originally found the bug, I reproduced it with 3
Debian versions (Stretch, Buster, Bullseye rc1), and additionally Bullseye with
vanilla 5.13.0-rc4 kernel built from kernel.org source tarball: so, kernel
versions spanning 4.9 to 5.13.

The reproduction script is destructive to the provided device.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=213357

--- Comment #1 from Jeroen van Wolffelaar (jeroen@wolffelaar.nl) ---

Created attachment 297209
  --> https://bugzilla.kernel.org/attachment.cgi?id=297209&action=edit
Execution log of reproduction script with vanilla kernel

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=213357

--- Comment #2 from Jeroen van Wolffelaar (jeroen@wolffelaar.nl) ---

Created attachment 297211
  --> https://bugzilla.kernel.org/attachment.cgi?id=297211&action=edit
Kernel log

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=213357

Luis Henriques (lhenriques@suse.de) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |lhenriques@suse.de

--- Comment #3 from Luis Henriques (lhenriques@suse.de) ---

Created attachment 299969
  --> https://bugzilla.kernel.org/attachment.cgi?id=299969&action=edit
ext4: set csum seed in tmp inode while migrating to extents

I forgot to comment on this bug regarding the fix I've proposed on the
mailing-list[1] (although there are no replies yet).  For completeness, I'm
attaching the patch here too.

[1] https://lore.kernel.org/all/20211206143733.18918-1-lhenriques@suse.de/

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.