linux-kernel - Re: [f2fs-dev] [PATCH] f2fs: fix to do sanity check on direct node in truncate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <168816842335.31915.17270081956061195335.git-patchwork-notify@kernel.org>
Date:   Fri, 30 Jun 2023 23:40:23 +0000
From:   patchwork-bot+f2fs@...nel.org
To:     Chao Yu <chao@...nel.org>
Cc:     jaegeuk@...nel.org, linux-kernel@...r.kernel.org,
        syzbot+12cb4425b22169b52036@...kaller.appspotmail.com,
        linux-f2fs-devel@...ts.sourceforge.net
Subject: Re: [f2fs-dev] [PATCH] f2fs: fix to do sanity check on direct node in
 truncate_dnode()

Hello:

This patch was applied to jaegeuk/f2fs.git (dev)
by Jaegeuk Kim <jaegeuk@...nel.org>:

On Thu, 29 Jun 2023 19:11:44 +0800 you wrote:
> syzbot reports below bug:
> 
> BUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574
> Read of size 4 at addr ffff88802a25c000 by task syz-executor148/5000
> 
> CPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
>  print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351
>  print_report mm/kasan/report.c:462 [inline]
>  kasan_report+0x11c/0x130 mm/kasan/report.c:572
>  f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574
>  truncate_dnode+0x229/0x2e0 fs/f2fs/node.c:944
>  f2fs_truncate_inode_blocks+0x64b/0xde0 fs/f2fs/node.c:1154
>  f2fs_do_truncate_blocks+0x4ac/0xf30 fs/f2fs/file.c:721
>  f2fs_truncate_blocks+0x7b/0x300 fs/f2fs/file.c:749
>  f2fs_truncate.part.0+0x4a5/0x630 fs/f2fs/file.c:799
>  f2fs_truncate include/linux/fs.h:825 [inline]
>  f2fs_setattr+0x1738/0x2090 fs/f2fs/file.c:1006
>  notify_change+0xb2c/0x1180 fs/attr.c:483
>  do_truncate+0x143/0x200 fs/open.c:66
>  handle_truncate fs/namei.c:3295 [inline]
>  do_open fs/namei.c:3640 [inline]
>  path_openat+0x2083/0x2750 fs/namei.c:3791
>  do_filp_open+0x1ba/0x410 fs/namei.c:3818
>  do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
>  do_sys_open fs/open.c:1372 [inline]
>  __do_sys_creat fs/open.c:1448 [inline]
>  __se_sys_creat fs/open.c:1442 [inline]
>  __x64_sys_creat+0xcd/0x120 fs/open.c:1442
>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>  do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> [...]

Here is the summary with links:
  - [f2fs-dev] f2fs: fix to do sanity check on direct node in truncate_dnode()
    https://git.kernel.org/jaegeuk/f2fs/c/a6ec83786ab9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html