linux-kernel - KFENCE: invalid write in leaf_paste

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAO4mrfctrzpCgpPAp-xt1bm3wtkGBMisOe8xCw3PRARPJLyUpQ@mail.gmail.com>
Date:   Sun, 30 Oct 2022 18:28:54 +0800
From:   Wei Chen <harperchen1110@...il.com>
To:     reiserfs-devel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: KFENCE: invalid write in leaf_paste_entries

Dear Linux Developer,

Recently when using our tool to fuzz kernel, the following crash was triggered:

HEAD commit: 64570fbc14f8 Linux 5.15-rc5
git tree: upstream
compiler: gcc 8.0.1
console output:
https://drive.google.com/file/d/1Cq7j7bFaFe65Xo9xiOwMHvi0CpnFxEBU/view?usp=share_link
kernel config: https://drive.google.com/file/d/1uDOeEYgJDcLiSOrx9W8v2bqZ6uOA_55t/view?usp=share_link

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: Wei Chen <harperchen1110@...il.com>

REISERFS (device loop0): journal params: device loop0, size 512,
journal first block 18, max trans len 256, max batch 225, max commit
age 0, max trans age 30
REISERFS (device loop0): checking transaction log (loop0)
REISERFS (device loop0): Using rupasov hash to sort names
==================================================================
BUG: KFENCE: invalid write in __memmove+0x24/0x1a0

Invalid write at 0xffff88813da00000:
 __memmove+0x24/0x1a0
 leaf_paste_entries+0x1b8/0x2c0
 balance_leaf+0x46b3/0x4cd0
 do_balance+0xc6/0x350
 reiserfs_paste_into_item+0x2d6/0x320
 reiserfs_add_entry+0x3dd/0x570
 reiserfs_mkdir+0x2b6/0x3c0
 reiserfs_xattr_init+0x1be/0x330
 reiserfs_fill_super+0x110e/0x1620
 mount_bdev+0x23d/0x280
 legacy_get_tree+0x2e/0x90
 vfs_get_tree+0x29/0x100
 path_mount+0x58e/0x10a0
 do_mount+0x9b/0xb0
 __x64_sys_mount+0x13a/0x150
 do_syscall_64+0x34/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 0 PID: 5293 Comm: syz-executor.0 Not tainted 5.15.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014
RIP: 0010:__memmove+0x24/0x1a0
Code: ff cc cc cc cc cc 48 89 f8 48 39 fe 7d 0f 49 89 f0 49 01 d0 49
39 f8 0f 8f a9 00 00 00 48 83 fa 20 0f 82 f5 00 00 00 48 89 d1 <f3> a4
c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 3b 48 83 ea 20 48
RSP: 0018:ffffc90002493578 EFLAGS: 00010286
RAX: ffff888129298fb4 RBX: 0000000000000002 RCX: ffffffffeb898f94
RDX: ffffffffffffffe0 RSI: ffff88813d9ffff0 RDI: ffff88813da00000
RBP: ffff888129298fa4 R08: ffff888129298f84 R09: 0000000100000001
R10: 0004004800000002 R11: 0000000100000001 R12: 0000000000000000
R13: ffff888129298f84 R14: 0000000000000010 R15: 0000000000000001
FS:  00007f2f77e09700(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88813da00000 CR3: 000000010b047000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 leaf_paste_entries+0x1b8/0x2c0
 balance_leaf+0x46b3/0x4cd0
 do_balance+0xc6/0x350
 reiserfs_paste_into_item+0x2d6/0x320
 reiserfs_add_entry+0x3dd/0x570
 reiserfs_mkdir+0x2b6/0x3c0
 reiserfs_xattr_init+0x1be/0x330
 reiserfs_fill_super+0x110e/0x1620
 mount_bdev+0x23d/0x280
 legacy_get_tree+0x2e/0x90
 vfs_get_tree+0x29/0x100
 path_mount+0x58e/0x10a0
 do_mount+0x9b/0xb0
 __x64_sys_mount+0x13a/0x150
 do_syscall_64+0x34/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x46abda
Code: 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2f77e08a48 EFLAGS: 00000206
 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f2f77e08af0 RCX: 000000000046abda
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f2f77e08ab0
RBP: 0000000020000000 R08: 00007f2f77e08af0 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000100
R13: 00007f2f77e08ab0 R14: 0000000000000001 R15: 0000000020011500
==================================================================
----------------
Code disassembly (best guess):
   0: ff cc                dec    %esp
   2: cc                    int3
   3: cc                    int3
   4: cc                    int3
   5: cc                    int3
   6: 48 89 f8              mov    %rdi,%rax
   9: 48 39 fe              cmp    %rdi,%rsi
   c: 7d 0f                jge    0x1d
   e: 49 89 f0              mov    %rsi,%r8
  11: 49 01 d0              add    %rdx,%r8
  14: 49 39 f8              cmp    %rdi,%r8
  17: 0f 8f a9 00 00 00    jg     0xc6
  1d: 48 83 fa 20          cmp    $0x20,%rdx
  21: 0f 82 f5 00 00 00    jb     0x11c
  27: 48 89 d1              mov    %rdx,%rcx
* 2a: f3 a4                rep movsb %ds:(%rsi),%es:(%rdi) <--
trapping instruction
  2c: c3                    retq
  2d: 48 81 fa a8 02 00 00 cmp    $0x2a8,%rdx
  34: 72 05                jb     0x3b
  36: 40 38 fe              cmp    %dil,%sil
  39: 74 3b                je     0x76
  3b: 48 83 ea 20          sub    $0x20,%rdx
  3f: 48                    rex.W

Best,
Wei