| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <4bbab168407600a07e1a0921a1569c96e4a1df31.camel@mediatek.com>
Date: Tue, 12 Mar 2024 01:33:40 +0000
From: Ed Tsai (蔡宗軒) <Ed.Tsai@...iatek.com>
To: "jaegeuk@...nel.org" <jaegeuk@...nel.org>, "hdanton@...a.com"
<hdanton@...a.com>
CC: Light Hsieh (謝明燈) <Light.Hsieh@...iatek.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"linux-f2fs-devel@...ts.sourceforge.net"
<linux-f2fs-devel@...ts.sourceforge.net>,
Freddy Hsin (辛恒豐) <Freddy.Hsin@...iatek.com>,
"linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
Chun-Hung Wu (巫駿宏) <Chun-hung.Wu@...iatek.com>
Subject: Re: [syzbot] [f2fs?] KASAN: slab-use-after-free Read in
f2fs_filemap_fault
On Mon, 2024-01-15 at 20:05 +0800, Hillf Danton wrote:
>
> ...
>
> --- x/fs/f2fs/file.c
> +++ y/fs/f2fs/file.c
> @@ -39,6 +39,7 @@
> static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
> {
> struct inode *inode = file_inode(vmf->vma->vm_file);
> + vm_flags_t flags = vmf->vma->vm_flags;
> vm_fault_t ret;
>
> ret = filemap_fault(vmf);
> @@ -46,7 +47,7 @@ static vm_fault_t f2fs_filemap_fault(str
> f2fs_update_iostat(F2FS_I_SB(inode), inode,
> APP_MAPPED_READ_IO,
> F2FS_BLKSIZE);
>
> - trace_f2fs_filemap_fault(inode, vmf->pgoff, vmf->vma-
> >vm_flags, ret);
> + trace_f2fs_filemap_fault(inode, vmf->pgoff, flags, ret);
>
> return ret;
> }
> --
Hi Jaegeuk,
We recently encountered this slabe-use-after-free issue in KASAN as
well. Could you please review the patch above and merge it into f2fs?
Best,
Ed
==================================================================
[29195.369964][T31720] BUG: KASAN: slab-use-after-free in
f2fs_filemap_fault+0x50/0xe0
[29195.370971][T31720] Read at addr f7ffff80454ebde0 by task AsyncTask
#11/31720
[29195.371881][T31720] Pointer tag: [f7], memory tag: [f1]
[29195.372549][T31720]
[29195.372838][T31720] CPU: 2 PID: 31720 Comm: AsyncTask #11 Tainted:
G W OE 6.6.17-android15-0-gcb5ba718a525 #1
[29195.374862][T31720] Call trace:
[29195.375268][T31720] dump_backtrace+0xec/0x138
[29195.375848][T31720] show_stack+0x18/0x24
[29195.376365][T31720] dump_stack_lvl+0x50/0x6c
[29195.376943][T31720] print_report+0x1b0/0x714
[29195.377520][T31720] kasan_report+0xc4/0x124
[29195.378076][T31720] __do_kernel_fault+0xb8/0x26c
[29195.378694][T31720] do_bad_area+0x30/0xdc
[29195.379226][T31720] do_tag_check_fault+0x20/0x34
[29195.379834][T31720] do_mem_abort+0x58/0x104
[29195.380388][T31720] el1_abort+0x3c/0x5c
[29195.380899][T31720] el1h_64_sync_handler+0x54/0x90
[29195.381529][T31720] el1h_64_sync+0x68/0x6c
[29195.382069][T31720] f2fs_filemap_fault+0x50/0xe0
[29195.382678][T31720] __do_fault+0xc8/0xfc
[29195.383209][T31720] handle_mm_fault+0xb44/0x10c4
[29195.383816][T31720] do_page_fault+0x294/0x48c
[29195.384395][T31720] do_translation_fault+0x38/0x54
[29195.385023][T31720] do_mem_abort+0x58/0x104
[29195.385577][T31720] el0_da+0x44/0x78
[29195.386057][T31720] el0t_64_sync_handler+0x98/0xbc
[29195.386688][T31720] el0t_64_sync+0x1a8/0x1ac
[29195.387249][T31720]
[29195.387534][T31720] Allocated by task 14784:
[29195.388085][T31720] kasan_save_stack+0x40/0x70
[29195.388672][T31720] save_stack_info+0x34/0x128
[29195.389259][T31720] kasan_save_alloc_info+0x14/0x20
[29195.389901][T31720] __kasan_slab_alloc+0x168/0x174
[29195.390530][T31720] slab_post_alloc_hook+0x88/0x3a4
[29195.391168][T31720] kmem_cache_alloc+0x18c/0x2c8
[29195.391771][T31720] vm_area_alloc+0x2c/0xe8
[29195.392327][T31720] mmap_region+0x440/0xa94
[29195.392888][T31720] do_mmap+0x3d0/0x524
[29195.393399][T31720] vm_mmap_pgoff+0x1a0/0x1f8
[29195.393980][T31720] ksys_mmap_pgoff+0x78/0xf4
[29195.394557][T31720] __arm64_sys_mmap+0x34/0x44
[29195.395138][T31720] invoke_syscall+0x58/0x114
[29195.395727][T31720] el0_svc_common+0x80/0xe0
[29195.396292][T31720] do_el0_svc+0x1c/0x28
[29195.396812][T31720] el0_svc+0x38/0x68
[29195.397302][T31720] el0t_64_sync_handler+0x68/0xbc
[29195.397932][T31720] el0t_64_sync+0x1a8/0x1ac
[29195.398492][T31720]
[29195.398778][T31720] Freed by task 0:
[29195.399240][T31720] kasan_save_stack+0x40/0x70
[29195.399825][T31720] save_stack_info+0x34/0x128
[29195.400412][T31720] kasan_save_free_info+0x18/0x28
[29195.401043][T31720] ____kasan_slab_free+0x254/0x25c
[29195.401682][T31720] __kasan_slab_free+0x10/0x20
[29195.402278][T31720] slab_free_freelist_hook+0x174/0x1e0
[29195.402961][T31720] kmem_cache_free+0xc4/0x348
[29195.403544][T31720] __vm_area_free+0x84/0xa4
[29195.404103][T31720] vm_area_free_rcu_cb+0x10/0x20
[29195.404719][T31720] rcu_do_batch+0x214/0x720
[29195.405284][T31720] rcu_core+0x1b0/0x408
[29195.405800][T31720] rcu_core_si+0x10/0x20
[29195.406348][T31720] __do_softirq+0x120/0x3f4
[29195.406907][T31720]
[29195.407191][T31720] The buggy address belongs to the object at
ffffff80454ebdc0
[29195.407191][T31720] which belongs to the cache vm_area_struct of
size 176
[29195.408978][T31720] The buggy address is located 32 bytes inside of
[29195.408978][T31720] 176-byte region [ffffff80454ebdc0,
ffffff80454ebe70)
[29195.410625][T31720]
[29195.410911][T31720] The buggy address belongs to the physical page:
[29195.411709][T31720] page:0000000058f0f2f1 refcount:1 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0xc54eb
[29195.412980][T31720] anon flags:
0x4000000000000800(slab|zone=1|kasantag=0x0)
[29195.413880][T31720] page_type: 0xffffffff()
[29195.414418][T31720] raw: 4000000000000800 f6ffff8002904500
fffffffe076fc8c0 dead000000000007
[29195.415488][T31720] raw: 0000000000000000 0000000000170017
00000001ffffffff 0000000000000000
Powered by blists - more mailing lists