| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220316100621.c5vpouz6cvyu6l7h@riteshh-domain>
Date: Wed, 16 Mar 2022 15:36:21 +0530
From: Ritesh Harjani <riteshh@...ux.ibm.com>
To: Sachin Sant <sachinp@...ux.ibm.com>
Cc: Ext4 Developers List <linux-ext4@...r.kernel.org>,
linuxppc-dev@...ts.ozlabs.org,
open list <linux-kernel@...r.kernel.org>
Subject: Re: [powerpc]Kernel crash while running LTP (execveat03)
[next-20220315]
On 22/03/16 01:47PM, Sachin Sant wrote:
> While running LTP tests(execveat03) against 5.17.0-rc8-next-20220315
> On a POWER10 LPAR following crash is seen:
>
> [ 945.659049] dummy_del_mod: loading out-of-tree module taints kernel.
> [ 945.659951] dummy_del_mod: module verification failed: signature and/or required key missing - tainting kernel
> [ 955.520206] process 'execveat01' launched '/dev/fd/-1' with NULL argv: empty string added
> [ 955.529560] loop0: detected capacity change from 0 to 524288
> [ 955.830492] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
Ok, so it has mounted ext2 using ext4 subsystem.
This means there is no journal.
> [ 955.831047] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
> [ 955.831056] ext2 filesystem being mounted at /var/tmp/avocado_2hol2hy1/ltp-SHEyyra8b0/3CPNpu/mntpoint supports timestamps until 2038 (0x7fffffff)
> [ 955.907793] Kernel attempted to read user page (1) - exploit attempt? (uid: 0)
> [ 955.907806] BUG: Kernel NULL pointer dereference on read at 0x00000001
> [ 955.907809] Faulting instruction address: 0xc008000000be04ec
> [ 955.907811] Oops: Kernel access of bad area, sig: 11 [#1]
> [ 955.907814] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
> [ 955.907818] Modules linked in: overlay vfat fat btrfs blake2b_generic xor raid6_pq zstd_compress xfs loop sctp ip6_udp_tunnel udp_tunnel dm_mod nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables bonding libcrc32c nfnetlink sunrpc pseries_rng xts vmx_crypto sch_fq_codel ext4 mbcache jbd2 sd_mod t10_pi crc64_rocksoft crc64 sg ibmvscsi ibmveth scsi_transport_srp fuse [last unloaded: dummy_del_mod]
> [ 955.907849] CPU: 30 PID: 1947255 Comm: execveat03 Tainted: G OE 5.17.0-rc8-next-20220315 #1
> [ 955.907853] NIP: c008000000be04ec LR: c008000000ba4b00 CTR: c0000000004fd040
> [ 955.907856] REGS: c0000002474831a0 TRAP: 0300 Tainted: G OE (5.17.0-rc8-next-20220315)
> [ 955.907860] MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28028282 XER: 20040000
> [ 955.907869] CFAR: c008000000ba4afc DAR: 0000000000000001 DSISR: 40000000 IRQMASK: 0
> [ 955.907869] GPR00: c008000000ba4b00 c000000247483440 c008000000c28000 0000000000000001
> [ 955.907869] GPR04: c000000206668af8 c008000000be0068 0000000000000000 0000000000000000
> [ 955.907869] GPR08: 0000000000000002 0000000000000004 0000000000000000 c008000000be7f68
> [ 955.907869] GPR12: c0000000004fd040 c000000effbe7280 0000000000000000 0000000000000001
> [ 955.907869] GPR16: 0000000000000000 c0000000029b4048 0000000000000000 0000000000000000
> [ 955.907869] GPR20: 0000000000000000 c0000000029b4048 0000000000000004 c000000206668af8
> [ 955.907869] GPR24: c000000247483528 0000000000000001 c008000000c01208 0000000000000000
> [ 955.907869] GPR28: 0000000000000001 c000000206668af8 c0000001f0d92e80 0000000000000001
> [ 955.907904] NIP [c008000000be04ec] __ext4_fc_track_link+0x44/0xf0 [ext4]
> [ 955.907927] LR [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
> [ 955.907946] Call Trace:
> [ 955.907947] [c000000247483440] [0000000000000004] 0x4 (unreliable)
> [ 955.907950] [c0000002474834a0] [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
> [ 955.907969] [c000000247483670] [c0000000004a498c] vfs_rename+0x9cc/0xe00
> [ 955.907975] [c000000247483760] [c008000000341820] ovl_do_rename.constprop.28+0x78/0x140 [overlay]
> [ 955.907982] [c000000247483830] [c008000000341b50] ovl_make_workdir+0x268/0x7e0 [overlay]
> [ 955.907988] [c000000247483960] [c008000000343aa8] ovl_fill_super+0x1060/0x2160 [overlay]
> [ 955.907994] [c000000247483ae0] [c000000000492f68] mount_nodev+0x78/0x100
> [ 955.907998] [c000000247483b20] [c008000000340054] ovl_mount+0x2c/0x50 [overlay]
> [ 955.908004] [c000000247483b40] [c0000000004f676c] legacy_get_tree+0x4c/0xb0
> [ 955.908008] [c000000247483b70] [c00000000049063c] vfs_get_tree+0x4c/0x150
> [ 955.908012] [c000000247483bf0] [c0000000004d3768] path_mount+0x8e8/0xd50
> [ 955.908017] [c000000247483cb0] [c0000000004d3c50] do_mount+0x80/0xd0
> [ 955.908021] [c000000247483d10] [c0000000004d3e3c] sys_mount+0x19c/0x370
> [ 955.908025] [c000000247483db0] [c00000000003375c] system_call_exception+0x18c/0x390
> [ 955.908029] [c000000247483e10] [c00000000000c64c] system_call_common+0xec/0x270
> [ 955.908034] --- interrupt: c00 at 0x7fffa9b38dfc
> [ 955.908036] NIP: 00007fffa9b38dfc LR: 000000001001ba78 CTR: 0000000000000000
> [ 955.908039] REGS: c000000247483e80 TRAP: 0c00 Tainted: G OE (5.17.0-rc8-next-20220315)
> [ 955.908042] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 24002202 XER: 00000000
> [ 955.908050] IRQMASK: 0
> [ 955.908050] GPR00: 0000000000000015 00007ffff95c64c0 00007fffa9c07300 0000000010029a08
> [ 955.908050] GPR04: 0000000010027de0 0000000010029a08 0000000000000000 00000000100299c0
> [ 955.908050] GPR08: 0000000000004000 0000000000000000 0000000000000000 0000000000000000
> [ 955.908050] GPR12: 0000000000000000 00007fffa9e1a340 0000000000000000 0000000000000000
> [ 955.908050] GPR16: 0000000000000000 0000000000000000 ffffffffffffffff 0000000010027a38
> [ 955.908050] GPR20: 00000000100284d0 0000000010028238 00000000100280f8 00007ffff95c65b0
> [ 955.908050] GPR24: 0000000000000003 0000000010051098 0000000010050c60 00000000100555c8
> [ 955.908050] GPR28: 000000000000040c 0000000010027b08 0000000000000000 0000000000000001
> [ 955.908083] NIP [00007fffa9b38dfc] 0x7fffa9b38dfc
> [ 955.908086] LR [000000001001ba78] 0x1001ba78
> [ 955.908090] --- interrupt: c00
> [ 955.908092] Instruction dump:
> [ 955.908095] fba1ffe8 fbc1fff0 7cbe2b78 fbe1fff8 3ca20000 e8a5a0c8 7c7f1b78 39200004
> [ 955.908103] 38e00000 7c9d2378 f8010010 f821ffa1 <e8630000> 38c10028 e94d1100 f9410038
> [ 955.908112] ---[ end trace 0000000000000000 ]---
> [ 955.908943]
> [ 956.908946] Kernel panic - not syncing: Fatal exception
>
> Bisect points to following commit:
> commit 9d5623d7ef8765f21f629e4ac636c19ec245e254
> ext4: return early for non-eligible fast_commit track events
>
> Reverting this commit allows the test to run successfully.
Hi Sachin,
Thanks so much for the report. Yes, this was discussed today here [1].
Ted mentioned, he had to add a change to fix this crash.
Once that is in, this should be fixed.
If you like you can apply below change and continue with your testing.
[1]: https://lore.kernel.org/linux-ext4/164714672856.1260831.16671323737369796834.b4-ty@mit.edu/T/#mdeff2bbdf0d107021514a9c44478d642936c4f9c
-ritesh
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 39e223f7bf64..e37da8d5cd0c 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3891,12 +3891,19 @@ static int ext4_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
ext4_fc_mark_ineligible(old.inode->i_sb,
EXT4_FC_REASON_RENAME_DIR, handle);
} else {
+ struct super_block *sb = old.inode->i_sb;
+
if (new.inode)
ext4_fc_track_unlink(handle, new.dentry);
- __ext4_fc_track_link(handle, old.inode, new.dentry);
- __ext4_fc_track_unlink(handle, old.inode, old.dentry);
- if (whiteout)
- __ext4_fc_track_create(handle, whiteout, old.dentry);
+ if (test_opt2(sb, JOURNAL_FAST_COMMIT) &&
+ !(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
+ !(ext4_test_mount_flag(sb, EXT4_MF_FC_INELIGIBLE))) {
+ __ext4_fc_track_link(handle, old.inode, new.dentry);
+ __ext4_fc_track_unlink(handle, old.inode, old.dentry);
+ if (whiteout)
+ __ext4_fc_track_create(handle, whiteout,
+ old.dentry);
+ }
}
if (new.inode) {
Powered by blists - more mailing lists