linux-kernel - KASAN: null-ptr-deref Write in f2fs_stop_discard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAGyP=7cYsboh5JSczkZR31_+dPh=XRq4TBF63u8jQcX3h3biLw@mail.gmail.com>
Date:   Mon, 20 Feb 2023 10:03:46 -0800
From:   Palash Oswal <oswalpalash@...il.com>
To:     chao@...nel.org, jaegeuk@...nel.org,
        linux-f2fs-devel@...ts.sourceforge.net,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: KASAN: null-ptr-deref Write in f2fs_stop_discard_thread

Hello,
I found the following issue using syzkaller on:
HEAD commit : e60276b8c11ab4a8be23807bc67b04
8cfb937dfa (v6.0.8)
git tree: stable

C Reproducer : https://gist.github.com/oswalpalash/eb758955c10d951eae2b5995ffe11d8c
Kernel .config :
https://gist.github.com/oswalpalash/0962c70d774e5ec736a047bba917cecb

Console log :

==================================================================
BUG: KASAN: null-ptr-deref in kthread_stop+0x8b/0x710
Write of size 4 at addr 000000000000001c by task syz-executor.0/6491

CPU: 1 PID: 6491 Comm: syz-executor.0 Not tainted 6.0.8-pasta #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xcd/0x134
 print_report.cold+0x36/0x63a
 kasan_report+0x8a/0x1b0
 kasan_check_range+0x13b/0x190
 kthread_stop+0x8b/0x710
 f2fs_stop_discard_thread+0x91/0xb0
 kill_f2fs_super+0xde/0x3e0
 deactivate_locked_super+0x8c/0xf0
 deactivate_super+0xad/0xd0
 cleanup_mnt+0x347/0x4b0
 task_work_run+0xe0/0x1a0
 exit_to_user_mode_prepare+0x25d/0x270
 syscall_exit_to_user_mode+0x19/0x50
 do_syscall_64+0x42/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb3a5c9143b
Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 90 f3 0f 1e fa 31 f6
e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe801d8e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fb3a5c9143b
RDX: 00007fb3a5c28a90 RSI: 000000000000000a RDI: 00007ffe801d8f30
RBP: 00007ffe801d8f30 R08: 00007fb3a5cfba1f R09: 00007ffe801d8cf0
R10: 00000000fffffffb R11: 0000000000000246 R12: 00007fb3a5cfb9f8
R13: 00007ffe801d9fd0 R14: 0000555557244d90 R15: 0000000000000032
 </TASK>
==================================================================