linux-kernel - BUG in mm/page-writeback.c:2652

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAB+yDaaXoeQ_hVVVvQ6y+gpa+XSH2YScwp1gR-Rz-2aSQUj74g@mail.gmail.com>
Date:   Tue, 29 May 2018 10:32:35 -0700
From:   shankarapailoor <shankarapailoor@...il.com>
To:     Chris Mason <clm@...com>, jbacik@...com, dsterba@...e.com
Cc:     linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: BUG in mm/page-writeback.c:2652

Hi,

I am fuzzing linux 4.17-rc4 with BTRFS and I encountered a BUG in
mm/page-writeback.c error described below. This bug has occured 3
times in our fuzzing campaign.

Here is the full stack trace: https://pastebin.com/QcDi9xA2

Truncated Stack Trace: https://pastebin.com/GWRNmhmC

Here is a C reproducer: https://pastebin.com/xTAVB3L2

My linux configs: https://pastebin.com/6J1KMczH

It appears that there is a fault injection inside of create_io_em
during the slab allocation for the path. After that
extent_clear_unlock_delalloc gets called. I don't know if the
extent_map start and end are well defined in this case.

Regards,
Shankara Pailoor