linux-ext4 - [Bug 199989] use-after-free() detected by KASAN in ext4_find_extent() when mounting and writing to a crafted ext4 image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <bug-199989-13602-GmMU21EH9d@https.bugzilla.kernel.org/>
Date:   Thu, 14 Jun 2018 21:09:16 +0000
From:   bugzilla-daemon@...zilla.kernel.org
To:     linux-ext4@...nel.org
Subject: [Bug 199989] use-after-free() detected by KASAN in
 ext4_find_extent() when mounting and writing to a crafted ext4 image

https://bugzilla.kernel.org/show_bug.cgi?id=199989

Theodore Tso (tytso@....edu) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |tytso@....edu
         Resolution|---                         |DUPLICATE

--- Comment #1 from Theodore Tso (tytso@....edu) ---
This is a dup of #199417.   With the patch:
ext4: verify the depth of extent tree in ext4_find_extent()

... this reproducer no longer crashes:  (note the invalid extent depth
ext4_error complaint):

root@...-xfstests:~# /vdb/poc/do-989
[   61.103607] EXT4-fs (loop0): 1 truncate cleaned up
[   61.104790] EXT4-fs (loop0): recovery complete
[   61.107122] EXT4-fs (loop0): mounted filesystem with ordered data mode.
Opts: (null)
[   61.121704] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
poc-199989: error while reading EA inode 1528337011 err=-117
[   61.125338] EXT4-fs error (device loop0): ext4_find_extent:874: inode #14:
comm poc-199989: inode has invalid extent depth: 28535
[   61.129157] EXT4-fs (loop0): Delayed block allocation failed for inode 14 at
logical offset 0 with max blocks 33 with error 117
[   61.132337] EXT4-fs (loop0): This should not happen!! Data will be lost
[   61.132337] 
[   61.135080] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
poc-199989: error while reading EA inode 1528337011 err=-117
[   61.157028] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
kworker/u4:0: error while reading EA inode 1528337011 err=-117
[   61.160579] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
kworker/u4:0: error while reading EA inode 1528337011 err=-117

*** This bug has been marked as a duplicate of bug 199417 ***

-- 
You are receiving this mail because:
You are watching the assignee of the bug.