Message-ID: <CABOYnLxhiWL10EGJadN1-kQw_2-OaooW3OcZP1=OVupXmZARjQ@mail.gmail.com>
Date: Tue, 9 Apr 2024 20:40:56 +0800
From: lee bruce <xrivendell7@...il.com>
To: syzbot+5a281fe8aadf8f11230d@...kaller.appspotmail.com
Cc: dwmw2@...radead.org, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-mtd@...ts.infradead.org, richard@....at, 
	syzkaller-bugs@...glegroups.com, samsun1006219@...il.com
Subject: Re: [syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_erase_pending_blocks

Hello, I reproduced this bug and comfired in the latest upstream.

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei lee <xrivendell7@...il.com>
Reported-by: yue sun <samsun1006219@...il.com>

I use the same kernel as syzbot instance:
https://syzkaller.appspot.com/bug?extid=5a281fe8aadf8f11230d
Kernel Commit: upstream fe46a7dd189e25604716c03576d05ac8a5209743
Kernel Config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4d90a36f0cab495a
with KASAN enabled

root@...kaller:~# ./84e
[  770.516785][ T8231] jffs2: notice: (8231)
jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of
xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
root@...kaller:~# [  770.575686][ T8255]
==================================================================
[  770.576754][ T8255] BUG: KASAN: slab-use-after-free in
__mutex_lock+0xfe/0xd70
[  770.577681][ T8255] Read of size 8 at addr ffff888019ad9130 by task
jffs2_gcd_mtd0/8255
[  770.578672][ T8255]
[  770.578989][ T8255] CPU: 0 PID: 8255 Comm: jffs2_gcd_mtd0 Not
tainted 6.8.0-08951-gfe46a7dd189e-dirty #6
[  770.580190][ T8255] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  770.581476][ T8255] Call Trace:
[  770.581915][ T8255]  <TASK>
[  770.582301][ T8255]  dump_stack_lvl+0x250/0x380
[  770.582920][ T8255]  ? __pfx_dump_stack_lvl+0x10/0x10
[  770.583599][ T8255]  ? __pfx__printk+0x10/0x10
[  770.584222][ T8255]  ? _printk+0xda/0x120
[  770.584784][ T8255]  ? __virt_addr_valid+0x19b/0x580
[  770.585429][ T8255]  ? __virt_addr_valid+0x19b/0x580
[  770.586071][ T8255]  print_report+0x169/0x550
[  770.586643][ T8255]  ? __virt_addr_valid+0x19b/0x580
[  770.587298][ T8255]  ? __virt_addr_valid+0x19b/0x580
[  770.587949][ T8255]  ? __virt_addr_valid+0x4a8/0x580
[  770.588559][ T8255]  ? __phys_addr+0xc3/0x180
[  770.589036][ T8255]  ? __mutex_lock+0xfe/0xd70
[  770.589613][ T8255]  kasan_report+0x143/0x180
[  770.590214][ T8255]  ? __mutex_lock+0xfe/0xd70
[  770.590809][ T8255]  __mutex_lock+0xfe/0xd70
[  770.591384][ T8255]  ? jffs2_garbage_collect_pass+0xb3/0x2130
[  770.592122][ T8255]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  770.592812][ T8255]  ? __pfx___mutex_lock+0x10/0x10
[  770.593467][ T8255]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  770.594273][ T8255]  ? _raw_spin_lock_irq+0xdf/0x120
[  770.594917][ T8255]  jffs2_garbage_collect_pass+0xb3/0x2130
[  770.595639][ T8255]  ? lockdep_hardirqs_on+0x99/0x150
[  770.596293][ T8255]  ? _raw_spin_unlock_irq+0x2e/0x50
[  770.596938][ T8255]  ? __set_current_blocked+0x31f/0x390
[  770.597610][ T8255]  ? __pfx___set_current_blocked+0x10/0x10
[  770.598257][ T8255]  ? schedule+0x90/0x320
[  770.598705][ T8255]  ? schedule+0x155/0x320
[  770.599239][ T8255]  ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[  770.600014][ T8255]  ? schedule_timeout+0x227/0x320
[  770.600663][ T8255]  ? sigprocmask+0x231/0x290
[  770.601178][ T8255]  ? __pfx_sigprocmask+0x10/0x10
[  770.601814][ T8255]  ? do_raw_spin_unlock+0x13c/0x8b0
[  770.602473][ T8255]  jffs2_garbage_collect_thread+0x691/0x730
[  770.603218][ T8255]  ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[  770.604008][ T8255]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[  770.604758][ T8255]  ? __kthread_parkme+0x172/0x1d0
[  770.605407][ T8255]  kthread+0x310/0x3b0
[  770.605935][ T8255]  ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[  770.606720][ T8255]  ? __pfx_kthread+0x10/0x10
[  770.607223][ T8255]  ret_from_fork+0x52/0x80
[  770.607722][ T8255]  ? __pfx_kthread+0x10/0x10
[  770.608230][ T8255]  ret_from_fork_asm+0x1a/0x30
[  770.608766][ T8255]  </TASK>
[  770.609073][ T8255]
[  770.609323][ T8255] Allocated by task 8231:
[  770.609831][ T8255]  kasan_save_track+0x3f/0x80
[  770.610374][ T8255]  __kasan_kmalloc+0x98/0xb0
[  770.610915][ T8255]  kmalloc_trace+0x1db/0x360
[  770.611495][ T8255]  jffs2_init_fs_context+0x54/0xd0
[  770.612155][ T8255]  alloc_fs_context+0x6a5/0x830
[  770.612788][ T8255]  do_new_mount+0x175/0xb90
[  770.613338][ T8255]  __se_sys_mount+0x362/0x3d0
[  770.613925][ T8255]  do_syscall_64+0xfb/0x240
[  770.614522][ T8255]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[  770.615270][ T8255]
[  770.615567][ T8255] Freed by task 8231:
[  770.616053][ T8255]  kasan_save_track+0x3f/0x80
[  770.616676][ T8255]  kasan_save_free_info+0x40/0x50
[  770.617335][ T8255]  poison_slab_object+0xa6/0xe0
[  770.617968][ T8255]  __kasan_slab_free+0x37/0x60
[  770.618518][ T8255]  kfree+0x14a/0x380
[  770.619008][ T8255]  deactivate_locked_super+0xcb/0x140
[  770.619596][ T8255]  put_fs_context+0x9b/0x7b0
[  770.620158][ T8255]  fscontext_release+0x6c/0x90
[  770.620746][ T8255]  __fput+0x442/0x8d0
[  770.621247][ T8255]  task_work_run+0x25c/0x320
[  770.621835][ T8255]  do_exit+0xa46/0x28a0
[  770.622362][ T8255]  do_group_exit+0x20b/0x2c0
[  770.622951][ T8255]  __x64_sys_exit_group+0x3f/0x40
[  770.623596][ T8255]  do_syscall_64+0xfb/0x240
[  770.624167][ T8255]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[  770.624912][ T8255]
[  770.625213][ T8255] The buggy address belongs to the object at
ffff888019ad9000
[  770.625213][ T8255]  which belongs to the cache kmalloc-4k of size 4096
[  770.626916][ T8255] The buggy address is located 304 bytes inside of
[  770.626916][ T8255]  freed 4096-byte region [ffff888019ad9000,
ffff888019ada000)

=* repro.c =*
#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#include <linux/capability.h>

#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fspick
#define __NR_fspick 433
#endif

static bool write_file(const char* file, const char* what, ...) {
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void setup_common() {
  if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
  }
}

static void setup_binderfs() {
  if (mkdir("/dev/binderfs", 0777)) {
  }
  if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
  }
  if (symlink("/dev/binderfs", "./binderfs")) {
  }
}

static void loop();

static void sandbox_common() {
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setsid();
  struct rlimit rlim;
  rlim.rlim_cur = rlim.rlim_max = (200 << 20);
  setrlimit(RLIMIT_AS, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 32 << 20;
  setrlimit(RLIMIT_MEMLOCK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 136 << 20;
  setrlimit(RLIMIT_FSIZE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
  setrlimit(RLIMIT_STACK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 128 << 20;
  setrlimit(RLIMIT_CORE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 256;
  setrlimit(RLIMIT_NOFILE, &rlim);
  if (unshare(CLONE_NEWNS)) {
  }
  if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
  }
  if (unshare(CLONE_NEWIPC)) {
  }
  if (unshare(0x02000000)) {
  }
  if (unshare(CLONE_NEWUTS)) {
  }
  if (unshare(CLONE_SYSVSEM)) {
  }
  typedef struct {
    const char* name;
    const char* value;
  } sysctl_t;
  static const sysctl_t sysctls[] = {
      {"/proc/sys/kernel/shmmax", "16777216"},
      {"/proc/sys/kernel/shmall", "536870912"},
      {"/proc/sys/kernel/shmmni", "1024"},
      {"/proc/sys/kernel/msgmax", "8192"},
      {"/proc/sys/kernel/msgmni", "1024"},
      {"/proc/sys/kernel/msgmnb", "1024"},
      {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
  };
  unsigned i;
  for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
    write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid) {
  if (pid < 0)
    exit(1);
  int status = 0;
  while (waitpid(-1, &status, __WALL) != pid) {
  }
  return WEXITSTATUS(status);
}

static void drop_caps(void) {
  struct __user_cap_header_struct cap_hdr = {};
  struct __user_cap_data_struct cap_data[2] = {};
  cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
  cap_hdr.pid = getpid();
  if (syscall(SYS_capget, &cap_hdr, &cap_data))
    exit(1);
  const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
  cap_data[0].effective &= ~drop;
  cap_data[0].permitted &= ~drop;
  cap_data[0].inheritable &= ~drop;
  if (syscall(SYS_capset, &cap_hdr, &cap_data))
    exit(1);
}

static int do_sandbox_none(void) {
  if (unshare(CLONE_NEWPID)) {
  }
  int pid = fork();
  if (pid != 0)
    return wait_for_loop(pid);
  setup_common();
  sandbox_common();
  drop_caps();
  if (unshare(CLONE_NEWNET)) {
  }
  write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
  setup_binderfs();
  loop();
  exit(1);
}

static void setup_binfmt_misc() {
  if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) {
  }
  write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:");
  write_file("/proc/sys/fs/binfmt_misc/register",
             ":syz1:M:1:\x02::./file0:POC");
}

uint64_t r[1] = {0xffffffffffffffff};

void loop(void) {
  intptr_t res = 0;
  memcpy((void*)0x200000c0, "./file0\000", 8);
  syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000c0ul, /*mode=*/0ul);
  memcpy((void*)0x20000040, "mtd", 3);
  sprintf((char*)0x20000043, "0x%016llx", (long long)0);
  memcpy((void*)0x200000c0, "./file0\000", 8);
  memcpy((void*)0x20001200, "jffs2\000", 6);
  syscall(__NR_mount, /*src=*/0x20000040ul, /*dst=*/0x200000c0ul,
          /*type=*/0x20001200ul, /*flags=*/3ul, /*data=*/0ul);
  memcpy((void*)0x20000380, "./file0/../file0\000", 17);
  res = syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x20000380ul,
                /*flags=*/0ul);
  if (res != -1)
    r[0] = res;
  syscall(__NR_fsconfig, /*fd=*/r[0], /*cmd=*/7ul, /*key=*/0ul, /*value=*/0ul,
          /*aux=*/0ul);
}
int main(void) {
  syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
          /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
  setup_binfmt_misc();
  do_sandbox_none();
  return 0;
}


=* repro.txt =*
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000040)=ANY=[@ANYBLOB='mtd', @ANYRESHEX=0x0],
&(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='jffs2\x00', 0x3,
0x0)
r0 = fspick(0xffffffffffffff9c, &(0x7f0000000380)='./file0/../file0\x00', 0x0)
fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0)

and see also in
https://gist.github.com/xrivendell7/2832a318a4c3bbad0bdeae8d268c4883

I hope it helps.
Best regards

Powered by blists - more mailing lists