linux-ext4 - Re: KASAN: use-after-free in move_expired

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 4 Nov 2017 17:02:34 -0400
From:   Andrew Zhu Aday <andrew.aday@...umbia.edu>
To:     linux-ext4@...r.kernel.org
Cc:     Shankara Pailoor <sp3485@...umbia.edu>
Subject: Re: KASAN: use-after-free in move_expired_inodes

cc shankara

On Sat, Nov 4, 2017 at 4:05 PM, Andrew Zhu Aday
<andrew.aday@...umbia.edu> wrote:
> ---------- Forwarded message ----------
> From: Shankara Pailoor <sp3485@...umbia.edu>
> Date: Tue, Oct 31, 2017 at 10:05 PM
> Subject: Fwd: KASAN: use-after-free in move_expired_inodes
> To: Andrew Zhu Aday <andrew.aday@...umbia.edu>
>
>
> ---------- Forwarded message ----------
> From: Shankara Pailoor <sp3485@...umbia.edu>
> Date: Tue, Oct 31, 2017 at 10:04 PM
> Subject: Re: KASAN: use-after-free in move_expired_inodes
> To: LKML <linux-kernel@...r.kernel.org>, viro@...iv.linux.org.uk,
> linux-fsdevel@...r.kernel.org
>
>
> Hi Al, etc,
>
> I was unable to find a reproducer but I was looking at
> move_expired_inodes (fs/fs-writeback.c 1093.c) and how do you ensure
> that the inode can't be freed after retrieving it from the work queue?
> Any insights would be appreciated.
>
> Regards,
> Shankara
>
> On Tue, Oct 31, 2017 at 9:24 AM, Shankara Pailoor <sp3485@...umbia.edu> wrote:
>> Hi,
>>
>> We got the following error:
>>
>> BUG: KASAN: use-after-free in move_expired_inodes+0xce6/0xdf0
>> Write of size 8 at addr ffff8800a3a36bf8 by task kworker/u8:0/5
>>
>> while fuzzing with Syzkaller on 4.14-rc4 on x86_64. Included is the
>> trace of the crash along with the programs running around the time of
>> the crash.
>>
>> Programs can be found here: https://pastebin.com/RYGtNn3z
>>
>> Stack trace here: https://pastebin.com/SaJXWMg3
>>
>> We don't have a C reproducer but we will send one if we have it.
>>
>> Regards,
>> Shankara