| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202301310955.cda1e590-yujie.liu@intel.com>
Date: Tue, 31 Jan 2023 09:40:39 +0800
From: kernel test robot <yujie.liu@...el.com>
To: Vladislav Efanov <VEfanov@...ras.ru>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
<linux-fsdevel@...r.kernel.org>, Jan Kara <jack@...e.com>,
Vladislav Efanov <VEfanov@...ras.ru>,
<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>
Subject: Re: [PATCH] udf: Reserve bits for Bitmap Descriptor buffers
Greeting,
FYI, we noticed BUG:KASAN:use-after-free_in_load_block_bitmap due to commit (built with gcc-11):
commit: e8161db9511ffda382e586a9a1f87ccb2b479ca8 ("[PATCH] udf: Reserve bits for Bitmap Descriptor buffers")
url: https://github.com/intel-lab-lkp/linux/commits/Vladislav-Efanov/udf-Reserve-bits-for-Bitmap-Descriptor-buffers/20230120-172019
base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git d368967cb1039b5c4cccb62b5a4b9468c50cd143
patch link: https://lore.kernel.org/all/20230120090858.1591519-1-VEfanov@ispras.ru/
patch subject: [PATCH] udf: Reserve bits for Bitmap Descriptor buffers
in testcase: xfstests
version: xfstests-x86_64-fb6575e-1_20230116
with following parameters:
disk: 4HDD
fs: udf
test: generic-group-24
test-description: xfstests is a regression test suite for xfs and other files ystems.
test-url: git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
on test machine: 4 threads Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz (Skylake) with 32G memory
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
[ 63.221412][ T1358] run fstests generic/490 at 2023-01-24 10:29:18
[ 63.788011][ T3618] ==================================================================
[ 63.795875][ T3618] BUG: KASAN: use-after-free in load_block_bitmap+0x291/0x370 [udf]
[ 63.803652][ T3618] Write of size 8 at addr ffff8881ffdbf000 by task seek_sanity_tes/3618
[ 63.811775][ T3618]
[ 63.813958][ T3618] CPU: 1 PID: 3618 Comm: seek_sanity_tes Tainted: G I 6.2.0-rc4-00078-ge8161db9511f #1
[ 63.824758][ T3618] Hardware name: Dell Inc. OptiPlex 7040/0Y7WYT, BIOS 1.1.1 10/07/2015
[ 63.832783][ T3618] Call Trace:
[ 63.835903][ T3618] <TASK>
[ 63.838675][ T3618] dump_stack_lvl+0x38/0x48
[ 63.843021][ T3618] print_address_description+0x87/0x2a1
[ 63.849415][ T3618] print_report+0x103/0x1e9
[ 63.853747][ T3618] ? kasan_addr_to_slab+0xd/0xa0
[ 63.858514][ T3618] ? load_block_bitmap+0x291/0x370 [udf]
[ 63.863963][ T3618] kasan_report+0xb2/0xe0
[ 63.868115][ T3618] ? load_block_bitmap+0x291/0x370 [udf]
[ 63.873565][ T3618] kasan_check_range+0x39/0x1b0
[ 63.878233][ T3618] load_block_bitmap+0x291/0x370 [udf]
[ 63.883516][ T3618] udf_bitmap_new_block+0x1e9/0xe00 [udf]
[ 63.889059][ T3618] ? udf_do_extend_file+0x353/0x590 [udf]
[ 63.894604][ T3618] ? udf_next_aext+0x3a0/0x3a0 [udf]
[ 63.899729][ T3618] udf_new_block+0x185/0x250 [udf]
[ 63.904699][ T3618] inode_getblk+0xc37/0x1710 [udf]
[ 63.909653][ T3618] ? kasan_save_stack+0x35/0x40
[ 63.914323][ T3618] ? kasan_save_stack+0x22/0x40
[ 63.918993][ T3618] ? udf_update_extents+0x4d0/0x4d0 [udf]
[ 63.924528][ T3618] ? entry_SYSCALL_64_after_hwframe+0x5e/0xc8
[ 63.930404][ T3618] ? xas_create+0xd4/0x7e0
[ 63.934644][ T3618] ? mem_cgroup_handle_over_high+0x480/0x480
[ 63.940434][ T3618] ? __mod_lruvec_page_state+0x1a9/0x420
[ 63.945879][ T3618] ? _raw_spin_lock+0x85/0xe0
[ 63.950375][ T3618] ? _raw_write_lock_irq+0xe0/0xe0
[ 63.955302][ T3618] ? down_write_killable+0x160/0x160
[ 63.960402][ T3618] udf_get_block+0x162/0x580 [udf]
[ 63.965336][ T3618] ? udf_block_map+0x250/0x250 [udf]
[ 63.970443][ T3618] __block_write_begin_int+0x290/0x880
[ 63.975728][ T3618] ? udf_block_map+0x250/0x250 [udf]
[ 63.980847][ T3618] ? invalidate_bh_lrus_cpu+0x80/0x80
[ 63.986032][ T3618] ? truncate_inode_partial_folio+0x390/0x390
[ 63.991908][ T3618] ? udf_block_map+0x250/0x250 [udf]
[ 63.997011][ T3618] block_write_begin+0x77/0x2c0
[ 64.001698][ T3618] udf_write_begin+0x30/0x90 [udf]
[ 64.006644][ T3618] generic_perform_write+0x21e/0x4b0
[ 64.011757][ T3618] ? filemap_fdatawrite_wbc+0x180/0x180
[ 64.017114][ T3618] ? current_time+0x77/0x220
[ 64.021526][ T3618] ? alloc_inode+0x1e0/0x1e0
[ 64.025936][ T3618] ? __cond_resched+0x20/0x90
[ 64.030432][ T3618] __generic_file_write_iter+0x218/0x420
[ 64.035875][ T3618] ? udf_setsize+0x4df/0x6b0 [udf]
[ 64.040814][ T3618] udf_file_write_iter+0x239/0x550 [udf]
[ 64.046263][ T3618] vfs_write+0x788/0xb60
[ 64.050331][ T3618] ? kernel_write+0x430/0x430
[ 64.054828][ T3618] ? up_write+0x53/0x90
[ 64.058812][ T3618] __x64_sys_pwrite64+0x19a/0x1f0
[ 64.063654][ T3618] ? vfs_write+0xb60/0xb60
[ 64.067891][ T3618] ? do_sys_ftruncate+0x3b6/0x490
[ 64.072735][ T3618] do_syscall_64+0x39/0x80
[ 64.076973][ T3618] entry_SYSCALL_64_after_hwframe+0x5e/0xc8
[ 64.082676][ T3618] RIP: 0033:0x7fa8533b3986
[ 64.086929][ T3618] Code: 48 c7 c0 ff ff ff ff eb ba 66 2e 0f 1f 84 00 00 00 00 00 90 49 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 12 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 90 48 83 ec 28 48 89 54 24 10 48 89 74
[ 64.106239][ T3618] RSP: 002b:00007fff3cc60608 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
[ 64.114439][ T3618] RAX: ffffffffffffffda RBX: 0000000000000200 RCX: 00007fa8533b3986
[ 64.122213][ T3618] RDX: 0000000000000001 RSI: 00005587b53599ec RDI: 0000000000000004
[ 64.129993][ T3618] RBP: 0000000000000004 R08: 0000000000000001 R09: 000000000000001f
[ 64.137775][ T3618] R10: 0000000000000200 R11: 0000000000000246 R12: 00005587b53599ec
[ 64.145556][ T3618] R13: 0000000000000001 R14: 0000000000000001 R15: 000000000000000c
[ 64.153328][ T3618] </TASK>
[ 64.156184][ T3618]
[ 64.158354][ T3618] The buggy address belongs to the physical page:
[ 64.164572][ T3618] page:00000000b46d5236 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x1ffdbf
[ 64.174582][ T3618] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
[ 64.181755][ T3618] raw: 0017ffffc0000000 ffffea0008014b88 ffffea0004f41e08 0000000000000000
[ 64.190128][ T3618] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 64.198509][ T3618] page dumped because: kasan: bad access detected
[ 64.204736][ T3618]
[ 64.206916][ T3618] Memory state around the buggy address:
[ 64.212359][ T3618] ffff8881ffdbef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 64.220215][ T3618] ffff8881ffdbef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 64.228069][ T3618] >ffff8881ffdbf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.235922][ T3618] ^
[ 64.239814][ T3618] ffff8881ffdbf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.247668][ T3618] ffff8881ffdbf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.255520][ T3618] ==================================================================
[ 64.263404][ T3618] Disabling lock debugging due to kernel taint
[ 64.381695][ T253] generic/490 _check_dmesg: something found in dmesg (see /lkp/benchmarks/xfstests/results//generic/490.dmesg)
If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <yujie.liu@...el.com>
| Link: https://lore.kernel.org/oe-lkp/202301310955.cda1e590-yujie.liu@intel.com
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
sudo bin/lkp install job.yaml # job file is attached in this email
bin/lkp split-job --compatible job.yaml # generate the yaml file for lkp run
sudo bin/lkp run generated-yaml-file
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests
View attachment "config-6.2.0-rc4-00078-ge8161db9511f" of type "text/plain" (172226 bytes)
View attachment "job-script" of type "text/plain" (5830 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (44872 bytes)
View attachment "xfstests" of type "text/plain" (2585 bytes)
View attachment "job.yaml" of type "text/plain" (4709 bytes)
View attachment "reproduce" of type "text/plain" (901 bytes)
Powered by blists - more mailing lists