[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAEkJfYNrxuWzW42Bu56NN-x2s3sbgxZkEU+W5uCZPwjVojar9A@mail.gmail.com>
Date: Fri, 26 Apr 2024 09:31:09 +0800
From: Sam Sun <samsun1006219@...il.com>
To: linux-kernel@...r.kernel.org, linux-ext4@...r.kernel.org, tytso@....edu,
adilger.kernel@...ger.ca
Cc: syzkaller-bugs@...glegroups.com, xrivendell7@...il.com
Subject: [Linux kernel bug] general protection fault in ext4_block_write_begin
Dear developers and maintainers,
We encountered a general protection fault in function
ext4_block_write_begin. It is tested against the latest upstream linux
(tag 6.9-rc5). C repro and kernel config are attached to this email.
Kernel crash log is listed below.
```
general protection fault, probably for non-canonical address
0xdffffc0040000005: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: probably user-memory-access in range
[0x0000000200000028-0x000000020000002f]
CPU: 1 PID: 8130 Comm: systemd Not tainted 6.9.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ext4_block_write_begin+0xed/0x1810 fs/ext4/inode.c:1025
Code: 3c 08 00 74 08 48 89 df e8 70 85 a2 ff 48 8b 03 48 89 44 24 28
48 8d 58 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c
08 00 74 08 48 89 df e8 45 85 a2 ff 48 8b 1b 48 83 c3 18 48
RSP: 0018:ffffc900027fec80 EFLAGS: 00010206
RAX: 0000000040000005 RBX: 0000000200000029 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000019000 RDI: ffffea000448cc80
RBP: ffffc900027fedb0 R08: ffffffff81c4bca6 R09: 1ffff1100635cac0
R10: dffffc0000000000 R11: ffffed100635cac1 R12: ffffea000448cc80
R13: 0000000000019000 R14: dffffc0000000000 R15: ffffea000448cc80
FS: 00007feecab13900(0000) GS:ffff888135c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f15eb840260 CR3: 000000001c02c000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
ext4_da_write_begin+0x581/0x8a0 fs/ext4/inode.c:2894
generic_perform_write+0x2f2/0x610 mm/filemap.c:3974
ext4_buffered_write_iter+0xc5/0x340 fs/ext4/file.c:299
ext4_file_write_iter+0x1d1/0x1a10
__kernel_write_iter+0x427/0x8c0 fs/read_write.c:523
dump_emit_page+0x3a4/0x520 fs/coredump.c:890
dump_user_range+0xd3/0x180 fs/coredump.c:951
elf_core_dump+0x3b81/0x44f0 fs/binfmt_elf.c:2077
do_coredump+0x1b53/0x2b40 fs/coredump.c:764
get_signal+0x13e7/0x1720 kernel/signal.c:2896
arch_do_signal_or_restart+0x87/0x820 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x8a/0x270 kernel/entry/common.c:218
do_syscall_64+0xf1/0x240 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7feecae65087
Code: ff ff 90 48 8b 15 09 4e 19 00 f7 d8 64 89 02 b8 ff ff ff ff e9
5d ff ff ff e8 95 24 0d 00 0f 1f 44 00 00 b8 3e 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 8b 0d d9 4d 19 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd620ceeb8 EFLAGS: 00000203 ORIG_RAX: 000000000000003e
RAX: 0000000000000000 RBX: 00007ffd620cef68 RCX: 00007feecae65087
RDX: 00007feecaf17e07 RSI: 0000000000000006 RDI: 0000000000001fc2
RBP: 00007ffd620cef60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 0000000000000006
R13: 0000000000000000 R14: 00007ffd620cffa0 R15: 0000000000000000
</TASK>
Modules linked in:
----------------
Code disassembly (best guess):
0: 3c 08 cmp $0x8,%al
2: 00 74 08 48 add %dh,0x48(%rax,%rcx,1)
6: 89 df mov %ebx,%edi
8: e8 70 85 a2 ff call 0xffa2857d
d: 48 8b 03 mov (%rbx),%rax
10: 48 89 44 24 28 mov %rax,0x28(%rsp)
15: 48 8d 58 28 lea 0x28(%rax),%rbx
19: 48 89 d8 mov %rbx,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <--
trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 45 85 a2 ff call 0xffa2857d
38: 48 8b 1b mov (%rbx),%rbx
3b: 48 83 c3 18 add $0x18,%rbx
3f: 48 rex.W
```
If you have any questions, please contact us.
Reported by Yue Sun <samsun1006219@...il.com>
Reported by xingwei lee <xrivendell7@...il.com>
Best Regards,
Yue
Download attachment "config" of type "application/octet-stream" (247888 bytes)
View attachment "ext4_block_write_begin1.c" of type "text/x-csrc" (43203 bytes)
Powered by blists - more mailing lists