linux-kernel - Re: Fw:Re: [PATCH] fs: nilfs2: fix memory leak in nilfs sysfs create device group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 12 Mar 2022 17:20:28 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     Dongliang Mu <mudongliangabcd@...il.com>,
        Ryusuke Konishi <konishi.ryusuke@...il.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        linux-nilfs <linux-nilfs@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Nanyong Sun <sunnanyong@...wei.com>,
        慕冬亮 <dzm91@...t.edu.cn>
Subject: Re: Fw:Re: [PATCH] fs: nilfs2: fix memory leak in nilfs sysfs create
 device group

Hi Dongliang,

On 3/9/22 11:30, Dongliang Mu wrote:
>> Now I am checking the log and trying to find error injection in the
>> log file, as said by Pavel.
> 
> Attached is the report and log file.
> 
> @Pavel Skripkin I don't find any useful error injection in the log file.
> 
> In case I made some mistakes, I will clean up my local crash reports,
> update to the latest upstream kernel and restart the syzkaller. Let's
> see if the crash still occurs.

The execution path is clear from the logs. Quick grep for nilfs shows 
these lines

[  886.701044][T25972] NILFS (loop2): broken superblock, retrying with 
spare superblock (blocksize = 1024)
[  886.703251][T25972] NILFS (loop2): broken superblock, retrying with 
spare superblock (blocksize = 4096)
[  886.706454][T25972] NILFS (loop2): error -4 creating segctord thread

So here is calltrace:

nilfs_fill_super
   nilfs_attach_log_writer
     nilfs_segctor_start_thread <- failed


In case of nilfs_attach_log_writer() error code jumps to 
failed_checkpoint label and calls destroy_nilfs() which should call 
nilfs_sysfs_delete_device_group().


So I can really see how this leak is possible on top of current Linus' HEAD.


Also in the log there are onlyh 4 syz_mount_image$nilfs2 programs, so 
only one of them may be a reproducer. If you have spare time you can try 
to execute them using syz-execprog and see if it works :))



With regards,
Pavel Skripkin