linux-kernel - A null-ptr-deref bug was triggered when continuously remont jfs image to write a log to record

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAFcO6XNGVq16N-c=9dfmTiu28jmjh097WGwsapi3tQs=cZ3MeQ@mail.gmail.com>
Date:   Mon, 7 Mar 2022 16:01:12 +0800
From:   butt3rflyh4ck <butterflyhuangxx@...il.com>
To:     shaggy@...nel.org
Cc:     jfs-discussion@...ts.sourceforge.net,
        LKML <linux-kernel@...r.kernel.org>
Subject: A null-ptr-deref bug was triggered when continuously remont jfs image
 to write a log to record

Hi, there is a null-ptr-deref bug by kernel fuzz. It was triggered
when continuously remont jfs image to write a log to record
I can reproduce it on the latest kernel.

### Crash log
[   30.752504][ T7617] BUG: kernel NULL pointer dereference, address:
00000000000005a8
[   30.753179][ T7617] #PF: supervisor read access in kernel mode
[   30.753670][ T7617] #PF: error_code(0x0000) - not-present page
[   30.754160][ T7617] PGD 106cb067 P4D 106cb067 PUD f7e7067 PMD 0
[   30.754681][ T7617] Oops: 0000 [#1] PREEMPT SMP
[   30.755073][ T7617] CPU: 1 PID: 7617 Comm: bio_associate_b Tainted:
G        W         5.17.0-rc6+ #47
[   30.755880][ T7617] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.13.0-1ubuntu1 04/01/2014
[   30.756688][ T7617] RIP: 0010:bio_associate_blkg_from_css+0x1f1/0x730
[   30.757238][ T7617] Code: c6 50 59 e4 81 48 c7 c7 c0 cc 22 85 e8 d8
8d 41 ff 49 89 5c 24 48 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3
49 8b 44 24 08 <48> 8b 80 a5
[   30.758904][ T7617] RSP: 0018:ffffc900022f3b70 EFLAGS: 00010246
[   30.759429][ T7617] RAX: 0000000000000000 RBX: 0000000000000000
RCX: 0000000000000001
[   30.760127][ T7617] RDX: 0000000000000000 RSI: ffffffff882f6080
RDI: ffff888046ee3e00
[   30.760739][ T7617] RBP: ffffffff882f6080 R08: 0000000000000000
R09: 0000000000020027
[   30.761297][ T7617] R10: 0000000000000001 R11: 0000000000000000
R12: ffff888046ee3e00
[   30.761854][ T7617] R13: ffff8880482f8400 R14: ffff8880482f85d0
R15: ffff8880482f85d0
[   30.762412][ T7617] FS:  0000000000e05880(0000)
GS:ffff88807ec00000(0000) knlGS:0000000000000000
[   30.763118][ T7617] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   30.763680][ T7617] CR2: 00007fcd480390e8 CR3: 000000000fdf7000
CR4: 00000000000006e0
[   30.764390][ T7617] Call Trace:
[   30.764673][ T7617]  <TASK>
[   30.764929][ T7617]  bio_associate_blkg+0x58/0x190
[   30.765331][ T7617]  lbmStartIO+0x7c/0xf0
[   30.765684][ T7617]  ? lockdep_hardirqs_on+0x79/0x100
[   30.766138][ T7617]  lbmWrite+0xed/0x150
[   30.766492][ T7617]  lmNextPage+0x87/0x150
[   30.766861][ T7617]  lmWriteRecord+0x35d/0x460
[   30.767270][ T7617]  lmLog+0xc2/0x290
[   30.767597][ T7617]  ? __sync_dirty_buffer+0x85/0x160
[   30.768082][ T7617]  jfs_mount_rw+0x15e/0x190
[   30.768465][ T7617]  jfs_fill_super+0x2d3/0x350
[   30.768857][ T7617]  mount_bdev+0x18b/0x1c0
[   30.769217][ T7617]  ? jfs_remount+0x1d0/0x1d0
[   30.769605][ T7617]  legacy_get_tree+0x28/0x50
[   30.769991][ T7617]  vfs_get_tree+0x1d/0xb0
[   30.770362][ T7617]  path_mount+0x42b/0xb10
[   30.770731][ T7617]  do_mount+0x70/0x90
[   30.771056][ T7617]  __x64_sys_mount+0x89/0xc0
[   30.771450][ T7617]  do_syscall_64+0x35/0xb0
[   30.771836][ T7617]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   30.772327][ T7617] RIP: 0033:0x4521de
[   30.772662][ T7617] Code: 83 c4 08 5b 5d c3 66 0f 1f 44 00 00 c3 66
2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 a5
00 00 00 0f 05 <48> 3d 01 f8
[   30.774275][ T7617] RSP: 002b:00007ffeae064a48 EFLAGS: 00000282
ORIG_RAX: 00000000000000a5
[   30.774988][ T7617] RAX: ffffffffffffffda RBX: 0000000000400530
RCX: 00000000004521de
[   30.775692][ T7617] RDX: 0000000020000000 RSI: 0000000020000100
RDI: 00007ffeae064ac0
[   30.776382][ T7617] RBP: 00007ffeae064c10 R08: 00007ffeae064b00
R09: 00007ffeae064a84
[   30.777054][ T7617] R10: 0000000000000000 R11: 0000000000000282
R12: 0000000000404050
[   30.777617][ T7617] R13: 0000000000000000 R14: 00000000004c8018
R15: 0000000000000000

the attachment is reproduce.

Regards,
 butt3rflyh4ck.








--
Active Defense Lab of Venustech

Download attachment "repro.cprog" of type "application/octet-stream" (11619 bytes)