linux-kernel - Re: PROBLEM: SLAB use-after-free with ceph(fs)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 4 Jan 2022 13:20:42 +0100
From:   Bastian Blank <bastian.blank@...dativ.de>
To:     Jeff Layton <jlayton@...nel.org>
Cc:     Ilya Dryomov <idryomov@...il.com>, ceph-devel@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: PROBLEM: SLAB use-after-free with ceph(fs)

Hi

On Tue, Jan 04, 2022 at 07:00:31AM -0500, Jeff Layton wrote:
> On Tue, 2022-01-04 at 10:49 +0100, Bastian Blank wrote:
> > > [152791.777458] cache_from_obj: Wrong slab cache. jbd2_journal_handle but object is from kmalloc-256

> At first blush, this looks like the same problem as:
>     https://tracker.ceph.com/issues/52283
> ...but that should have been fixed in v5.14.

Nope, does not make sense.  This reported issue tried to free a
"ceph_cap_flush", while mine tries to free "jbd2_journal_handle", which
is far away.

> You may also want to try v5.16-rc8 if you're able to build your own
> kernels. There were some patches that went in to improve how the client
> handles inodes that become inaccessible.

I try to get them to install a 5.16-rc8 or newer, get a new crash dump
and report that to https://tracker.ceph.com/.

Thanks,
Bastian

-- 
Bastian Blank
Berater
Telefon: +49 2166 9901-194
E-Mail: bastian.blank@...dativ.de
credativ GmbH, HRB Mönchengladbach 12080, USt-ID-Nummer: DE204566209
Trompeterallee 108, 41189 Mönchengladbach
Geschäftsführung: Dr. Michael Meskes, Geoff Richardson, Peter Lilley
Unser Umgang mit personenbezogenen Daten unterliegt
folgenden Bestimmungen: https://www.credativ.de/datenschutz