linux-kernel - kernel BUG in jfs_evict

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CACkBjsYganRrN=WjgcotH1RdZ99_6mPuy=GhsFrq2CUNOUrpbA@mail.gmail.com>
Date:   Wed, 6 Oct 2021 16:44:49 +0800
From:   Hao Sun <sunhao.th@...il.com>
To:     jfs-discussion@...ts.sourceforge.net, shaggy@...nel.org
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: kernel BUG in jfs_evict_inode

Hello,

When using Healer to fuzz the latest Linux kernel, the following crash
was triggered.

HEAD commit: 0513e464f900 Merge tag 'perf-tools-fixes-for-v5.15-2021-09-27'
git tree: upstream
console output:
https://drive.google.com/file/d/1NSVdsjViaEUbSeaWVC-UYThJlWp0lvVW/view?usp=sharing
kernel config: https://drive.google.com/file/d/1Jqhc4DpCVE8X7d-XBdQnrMoQzifTG5ho/view?usp=sharing
C reproducer: https://drive.google.com/file/d/184Rm6ijCSvoPQ5yHX7LOzbjXVtx7lyvN/view?usp=sharing
Syzlang reproducer:
https://drive.google.com/file/d/12c_LoGNiQQOutVwi3b2XL83fDTG_BpdB/view?usp=sharing

If you fix this issue, please add the following tag to the commit:
Reported-by: Hao Sun <sunhao.th@...il.com>

------------[ cut here ]------------
kernel BUG at fs/jfs/inode.c:168!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 2759 Comm: syz-executor Not tainted 5.15.0-rc3+ #21
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:jfs_evict_inode+0x157/0x1a0 fs/jfs/inode.c:168
Code: 83 78 28 00 74 0d e8 48 b5 7f ff 48 89 df e8 c0 de 00 00 e8 3b
b5 7f ff 48 89 df e8 33 25 b1 ff e9 fb fe ff ff e8 29 b5 7f ff <0f> 0b
e8 22 b5 7f ff 48 89 df e8 1a 34 00 00 eb b4 e8 13 b5 7f ff
RSP: 0018:ffffc90000867d68 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888018cb41a8 RCX: 0000000000000000
RDX: ffff8880167ec500 RSI: ffffffff81b7dc37 RDI: ffff888018cb41a8
RBP: ffffffff81b7dae0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffc90000867ce8 R11: 0000000000000001 R12: ffffffff84964600
R13: ffffffff853a64cd R14: ffff88801a91d980 R15: ffff88801a91d000
FS:  00000000025cb940(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc3c3d0da4 CR3: 0000000016458000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 evict+0xfd/0x1e0 fs/inode.c:588
 dispose_list+0x61/0x90 fs/inode.c:621
 evict_inodes+0x194/0x1f0 fs/inode.c:671
 generic_shutdown_super+0x45/0x170 fs/super.c:454
 kill_block_super+0x2c/0x60 fs/super.c:1395
 deactivate_locked_super+0x43/0x80 fs/super.c:335
 deactivate_super+0x53/0x80 fs/super.c:366
 cleanup_mnt+0x138/0x1b0 fs/namespace.c:1137
 task_work_run+0x86/0xd0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x271/0x280 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x40/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x46c777
Code: ff d0 48 89 c7 b8 3c 00 00 00 0f 05 48 c7 c1 bc ff ff ff f7 d8
64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc3c3d14d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000046c777
RDX: 0000000000404e22 RSI: 0000000000000002 RDI: 00007ffc3c3d15a0
RBP: 00007ffc3c3d15a0 R08: 00000000025d5033 R09: 000000000000000b
R10: 00000000fffffffb R11: 0000000000000246 R12: 00000000004e38c6
R13: 00007ffc3c3d2650 R14: 00007ffc3c3d264c R15: 0000000000000010
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace a937ecc93c68ee05 ]---
RIP: 0010:jfs_evict_inode+0x157/0x1a0 fs/jfs/inode.c:168
Code: 83 78 28 00 74 0d e8 48 b5 7f ff 48 89 df e8 c0 de 00 00 e8 3b
b5 7f ff 48 89 df e8 33 25 b1 ff e9 fb fe ff ff e8 29 b5 7f ff <0f> 0b
e8 22 b5 7f ff 48 89 df e8 1a 34 00 00 eb b4 e8 13 b5 7f ff
RSP: 0018:ffffc90000867d68 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888018cb41a8 RCX: 0000000000000000
RDX: ffff8880167ec500 RSI: ffffffff81b7dc37 RDI: ffff888018cb41a8
RBP: ffffffff81b7dae0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffc90000867ce8 R11: 0000000000000001 R12: ffffffff84964600
R13: ffffffff853a64cd R14: ffff88801a91d980 R15: ffff88801a91d000
FS:  00000000025cb940(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc3c3d0da4 CR3: 0000000016458000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554