linux-ext4 - [Bug 193431] New: 512 byte inodes + inline_data + journal_data == segfaults/buserrors in userspace mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <bug-193431-13602@https.bugzilla.kernel.org/>
Date:   Sat, 28 Jan 2017 12:38:26 +0000
From:   bugzilla-daemon@...zilla.kernel.org
To:     linux-ext4@...r.kernel.org
Subject: [Bug 193431] New: 512 byte inodes + inline_data + journal_data ==
 segfaults/buserrors in userspace mmap

https://bugzilla.kernel.org/show_bug.cgi?id=193431

            Bug ID: 193431
           Summary: 512 byte inodes + inline_data + journal_data ==
                    segfaults/buserrors in userspace mmap
           Product: File System
           Version: 2.5
    Kernel Version: Multiple ( tested on 3.16, 4.1 and 4.9 )
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: high
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@...nel-bugs.osdl.org
          Reporter: rabbit@...bit.us
        Regression: No

Created attachment 253361
  --> https://bugzilla.kernel.org/attachment.cgi?id=253361&action=edit
Backtrace attempt

Steps to reproduce:


root@...sver:~# dd if=/dev/zero of=zeros.img bs=128M count=1
1+0 records in
1+0 records out
134217728 bytes (134 MB) copied, 1.61473 s, 83.1 MB/s


root@...sver:~# losetup -f zeros.img


root@...sver:~# mke2fs -t ext4 -I 512 -j -O inline_data /dev/loop0
mke2fs 1.43.3 (04-Sep-2016)
journal checksum features.
Discarding device blocks: done                            
Creating filesystem with 131072 1k blocks and 32768 inodes
Filesystem UUID: 675cf4a8-fb74-4a4a-9f28-f01b462b1933
Superblock backups stored on blocks: 
    8193, 24577, 40961, 57345, 73729

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done 



root@...sver:~# mount -o data=journal /dev/loop0 /mnt


root@...sver:~# rm -f /usr/lib/locale/locale-archive


root@...sver:~# ln -s /mnt/locale-archive /usr/lib/locale/locale-archive


root@...sver:~# localedef -i en_US -c -f ISO-8859-1 en_US
Segmentation fault



I am also attaching a gdb backtrace of the error as seen using the Debian
Stretch Installer RC1. The backtraced line 773 seems to be this one:
https://sources.debian.net/src/glibc/2.24-9/locale/programs/locarchive.c/#L773

-- 
You are receiving this mail because:
You are watching the assignee of the bug.