linux-ext4 - [Linux kernel bug] general protection fault in ext4_block_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 26 Apr 2024 09:31:09 +0800
From: Sam Sun <samsun1006219@...il.com>
To: linux-kernel@...r.kernel.org, linux-ext4@...r.kernel.org, tytso@....edu, 
	adilger.kernel@...ger.ca
Cc: syzkaller-bugs@...glegroups.com, xrivendell7@...il.com
Subject: [Linux kernel bug] general protection fault in ext4_block_write_begin

Dear developers and maintainers,

We encountered a general protection fault in function
ext4_block_write_begin. It is tested against the latest upstream linux
(tag 6.9-rc5). C repro and kernel config are attached to this email.
Kernel crash log is listed below.
```
general protection fault, probably for non-canonical address
0xdffffc0040000005: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: probably user-memory-access in range
[0x0000000200000028-0x000000020000002f]
CPU: 1 PID: 8130 Comm: systemd Not tainted 6.9.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ext4_block_write_begin+0xed/0x1810 fs/ext4/inode.c:1025
Code: 3c 08 00 74 08 48 89 df e8 70 85 a2 ff 48 8b 03 48 89 44 24 28
48 8d 58 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c
08 00 74 08 48 89 df e8 45 85 a2 ff 48 8b 1b 48 83 c3 18 48
RSP: 0018:ffffc900027fec80 EFLAGS: 00010206
RAX: 0000000040000005 RBX: 0000000200000029 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000019000 RDI: ffffea000448cc80
RBP: ffffc900027fedb0 R08: ffffffff81c4bca6 R09: 1ffff1100635cac0
R10: dffffc0000000000 R11: ffffed100635cac1 R12: ffffea000448cc80
R13: 0000000000019000 R14: dffffc0000000000 R15: ffffea000448cc80
FS:  00007feecab13900(0000) GS:ffff888135c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f15eb840260 CR3: 000000001c02c000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 ext4_da_write_begin+0x581/0x8a0 fs/ext4/inode.c:2894
 generic_perform_write+0x2f2/0x610 mm/filemap.c:3974
 ext4_buffered_write_iter+0xc5/0x340 fs/ext4/file.c:299
 ext4_file_write_iter+0x1d1/0x1a10
 __kernel_write_iter+0x427/0x8c0 fs/read_write.c:523
 dump_emit_page+0x3a4/0x520 fs/coredump.c:890
 dump_user_range+0xd3/0x180 fs/coredump.c:951
 elf_core_dump+0x3b81/0x44f0 fs/binfmt_elf.c:2077
 do_coredump+0x1b53/0x2b40 fs/coredump.c:764
 get_signal+0x13e7/0x1720 kernel/signal.c:2896
 arch_do_signal_or_restart+0x87/0x820 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x8a/0x270 kernel/entry/common.c:218
 do_syscall_64+0xf1/0x240 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7feecae65087
Code: ff ff 90 48 8b 15 09 4e 19 00 f7 d8 64 89 02 b8 ff ff ff ff e9
5d ff ff ff e8 95 24 0d 00 0f 1f 44 00 00 b8 3e 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 8b 0d d9 4d 19 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd620ceeb8 EFLAGS: 00000203 ORIG_RAX: 000000000000003e
RAX: 0000000000000000 RBX: 00007ffd620cef68 RCX: 00007feecae65087
RDX: 00007feecaf17e07 RSI: 0000000000000006 RDI: 0000000000001fc2
RBP: 00007ffd620cef60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 0000000000000006
R13: 0000000000000000 R14: 00007ffd620cffa0 R15: 0000000000000000
 </TASK>
Modules linked in:
----------------
Code disassembly (best guess):
   0:    3c 08                    cmp    $0x8,%al
   2:    00 74 08 48              add    %dh,0x48(%rax,%rcx,1)
   6:    89 df                    mov    %ebx,%edi
   8:    e8 70 85 a2 ff           call   0xffa2857d
   d:    48 8b 03                 mov    (%rbx),%rax
  10:    48 89 44 24 28           mov    %rax,0x28(%rsp)
  15:    48 8d 58 28              lea    0x28(%rax),%rbx
  19:    48 89 d8                 mov    %rbx,%rax
  1c:    48 c1 e8 03              shr    $0x3,%rax
  20:    48 b9 00 00 00 00 00     movabs $0xdffffc0000000000,%rcx
  27:    fc ff df
* 2a:    80 3c 08 00              cmpb   $0x0,(%rax,%rcx,1) <--
trapping instruction
  2e:    74 08                    je     0x38
  30:    48 89 df                 mov    %rbx,%rdi
  33:    e8 45 85 a2 ff           call   0xffa2857d
  38:    48 8b 1b                 mov    (%rbx),%rbx
  3b:    48 83 c3 18              add    $0x18,%rbx
  3f:    48                       rex.W
```
If you have any questions, please contact us.

Reported by Yue Sun <samsun1006219@...il.com>
Reported by xingwei lee <xrivendell7@...il.com>

Best Regards,
Yue

Download attachment "config" of type "application/octet-stream" (247888 bytes)

View attachment "ext4_block_write_begin1.c" of type "text/x-csrc" (43203 bytes)