linux-ext4 - [Bug 200109] New: BUG: KASAN: use-after-free in ext4_xattr_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <bug-200109-13602@https.bugzilla.kernel.org/>
Date:   Mon, 18 Jun 2018 03:05:12 +0000
From:   bugzilla-daemon@...zilla.kernel.org
To:     linux-ext4@...nel.org
Subject: [Bug 200109] New: BUG: KASAN: use-after-free in ext4_xattr_set_entry
 fs/ext4/xattr.c:1598

https://bugzilla.kernel.org/show_bug.cgi?id=200109

            Bug ID: 200109
           Summary: BUG: KASAN: use-after-free in ext4_xattr_set_entry
                    fs/ext4/xattr.c:1598
           Product: File System
           Version: 2.5
    Kernel Version: v4.17
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@...nel-bugs.osdl.org
          Reporter: icytxw@...il.com
        Regression: No

Created attachment 276629
  --> https://bugzilla.kernel.org/attachment.cgi?id=276629&action=edit
found this with modified syzkaller

==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x2c6c/0x2f60
fs/ext4/xattr.c:1598
Read of size 4 at addr ffff880069696a64 by task syz-executor1/11113

CPU: 0 PID: 11113 Comm: syz-executor1 Not tainted 4.17.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
Call Trace:

The buggy address belongs to the page:
page:ffffea0001a5a580 count:0 mapcount:-128 mapping:0000000000000000 index:0x1
flags: 0x100000000000000()
raw: 0100000000000000 ffffea00019e4008 ffffea000172ee08 0000000000000000
raw: 0000000000000001 0000000000000001 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff880069696900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff880069696980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff880069696a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                       ^
 ffff880069696a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff880069696b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 11113 Comm: syz-executor1 Tainted: G    B             4.17.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
Call Trace:
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

-- 
You are receiving this mail because:
You are watching the assignee of the bug.