linux-kernel - Re: KASAN: use-after-free Read in xlog_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190627135225.GA22423@infradead.org>
Date:   Thu, 27 Jun 2019 06:52:25 -0700
From:   Christoph Hellwig <hch@...radead.org>
To:     syzbot <syzbot+b75afdbe271a0d7ac4f6@...kaller.appspotmail.com>
Cc:     darrick.wong@...cle.com, linux-kernel@...r.kernel.org,
        linux-xfs@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: KASAN: use-after-free Read in xlog_alloc_log

On Thu, Jun 27, 2019 at 04:06:54AM -0700, Christoph Hellwig wrote:
> It seems like this is the xlog_alloc_log error path.  We didn't
> really change anything in the circular ioclogs queue handling, so
> maybe thish has been there before, but xfs_buf wasn't wired up to
> kasan to catch it?
> 
> Either way I suspect the right thing to do is to replace the list
> with an array based lookup.  I'll look into that, maybe a reproducer
> appears until then.

Actually, the iclog allocations are obviously too small.  A patch will
be on its way soon.