linux-kernel - Re: [PATCH] ocfs2: fix use-after-free when unmounting read-only filesystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 23 May 2023 10:43:11 +0800
From:   Joseph Qi <joseph.qi@...ux.alibaba.com>
To:     Luís Henriques <lhenriques@...e.de>,
        Heming Zhao <heming.zhao@...e.com>
Cc:     ocfs2-devel@....oracle.com, linux-kernel@...r.kernel.org,
        Mark Fasheh <mark@...heh.com>, Joel Becker <jlbec@...lplan.org>
Subject: Re: [PATCH] ocfs2: fix use-after-free when unmounting read-only
 filesystem



On 5/22/23 9:22 PM, Luís Henriques wrote:
> Heming Zhao <heming.zhao@...e.com> writes:
> 
>> On Mon, May 22, 2023 at 01:23:07PM +0100, Luís Henriques wrote:
>>> Joseph Qi <joseph.qi@...ux.alibaba.com> writes:
>>>
>>>> On 5/22/23 6:25 PM, Luís Henriques wrote:
>>>>> It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using
>>>>> fstest generic/452.  After mounting a filesystem as read-only, quotas are
>>>>
>>>> generic/452 is for testing ext4 mounted with dax and ro.
>>>> But ocfs2 doesn't support dax yet.
>>>
>>> Right, but I think it's still useful to run the 'generic' test-suite in a
>>> filesystem.  We can always find issues in the test itself or, in this
>>> case, a bug in the filesystem.
>>
>> It looks you did some special steps for 452. In my env, without changing
>> anything, I could pass this case successfully. 
> 
> No, I haven't changed anything to the test.  I just make sure there's a
> scratch device to be used.
> 
> Maybe you can try to enable KASAN to catch the UAF.  I've found the bug
> without KASAN (i.e. I saw a NULL pointer panic), but enabling it also
> detects the issue -- see below.
> 
> Cheers,

We'd better append panic dmesg to patch description as well.

Thanks,
Joseph