linux-ext4 - Re: [PATCH -next] ext4: Fix null-ptr-deref in '__ext4_journal_ensure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <164058326343.3172825.16437833457845956898.b4-ty@mit.edu>
Date:   Mon, 27 Dec 2021 00:34:43 -0500
From:   "Theodore Ts'o" <tytso@....edu>
To:     adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org,
        Ye Bin <yebin10@...wei.com>
Cc:     "Theodore Ts'o" <tytso@....edu>, linux-kernel@...r.kernel.org,
        jack@...e.cz, lczerner@...hat.com
Subject: Re: [PATCH -next] ext4: Fix null-ptr-deref in '__ext4_journal_ensure_credits'

On Fri, 24 Dec 2021 18:03:41 +0800, Ye Bin wrote:
> We got issue as follows when run syzkaller test:
> [ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user
> [ 1901.130901] Aborting journal on device vda-8.
> [ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal
> [ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal
> [ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal
> [ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal
> [ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted
> [ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal
> [ 1901.136915] ==================================================================
> [ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4]
> [ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal
> [ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal
> [ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968
> [ 1901.138817]
> [ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal
> [ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1
> [ 1901.146479] Hardware name: linux,dummy-virt (DT)
> [ 1901.147317] Call trace:
> [ 1901.147552]  dump_backtrace+0x0/0x2d8
> [ 1901.147898]  show_stack+0x28/0x38
> [ 1901.148215]  dump_stack+0xec/0x15c
> [ 1901.148746]  kasan_report+0x108/0x338
> [ 1901.149207]  __asan_load8+0x58/0xb0
> [ 1901.149753]  __ext4_journal_ensure_credits+0x74/0x140 [ext4]
> [ 1901.150579]  ext4_xattr_delete_inode+0xe4/0x700 [ext4]
> [ 1901.151316]  ext4_evict_inode+0x524/0xba8 [ext4]
> [ 1901.151985]  evict+0x1a4/0x378
> [ 1901.152353]  iput+0x310/0x428
> [ 1901.152733]  do_unlinkat+0x260/0x428
> [ 1901.153056]  __arm64_sys_unlinkat+0x6c/0xc0
> [ 1901.153455]  el0_svc_common+0xc8/0x320
> [ 1901.153799]  el0_svc_handler+0xf8/0x160
> [ 1901.154265]  el0_svc+0x10/0x218
> [ 1901.154682] ==================================================================
> 
> [...]

Applied, thanks!

[1/1] ext4: Fix null-ptr-deref in '__ext4_journal_ensure_credits'
      commit: 5bceadc3d3ed3d12a1cf72d80df98cad7f66b1a9

Best regards,
-- 
Theodore Ts'o <tytso@....edu>