linux-kernel - Re: [syzbot] [reiserfs?] KASAN: use-after-free Read in reiserfs_get_unused

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240129094811.injplexrobjjcu6l@quack3>
Date: Mon, 29 Jan 2024 10:48:11 +0100
From: Jan Kara <jack@...e.cz>
To: syzbot <syzbot+04e8b36eaa27ecf7f840@...kaller.appspotmail.com>
Cc: axboe@...nel.dk, brauner@...nel.org, jack@...e.cz,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	reiserfs-devel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [reiserfs?] KASAN: use-after-free Read in
 reiserfs_get_unused_objectid

On Sun 28-01-24 00:33:04, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
> 
> commit 6f861765464f43a71462d52026fbddfc858239a5
> Author: Jan Kara <jack@...e.cz>
> Date:   Wed Nov 1 17:43:10 2023 +0000
> 
>     fs: Block writes to mounted block devices
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=116501efe80000
> start commit:   1e760fa3596e Merge tag 'gfs2-v6.3-rc3-fix' of git://git.ke..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=acdb62bf488a8fe5
> dashboard link: https://syzkaller.appspot.com/bug?extid=04e8b36eaa27ecf7f840
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16d5c261c80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=155eba51c80000
> 
> If the result looks correct, please mark the issue as fixed by replying with:

So this somewhat surprises me because all the reproducer does is that it
just mounts the created image. I'm not sure how blocking of writers to
a mounted device could change the behavior of this reproducer.

But given the reproducer no longer works and this is reiserfs where nobody
is likely to look into the bug, even more so without a reproducer I guess:

#syz fix: fs: Block writes to mounted block devices

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR