linux-kernel - Re: [syzbot] Re: [syzbot] [jfs?] KASAN: slab-use-after-free Read in lmLogInit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <000000000000033fee062040778e@google.com>
Date: Thu, 22 Aug 2024 00:18:26 -0700
From: syzbot <syzbot+d16facb00df3f446511c@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] Re: [syzbot] [jfs?] KASAN: slab-use-after-free Read in lmLogInit

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: [syzbot] [jfs?] KASAN: slab-use-after-free Read in lmLogInit
Author: lizhi.xu@...driver.com

why integrity chaneged?

#syz test: upstream df6cbc62cc9b

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 9609349e92e5..cc33178f720a 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1963,11 +1963,14 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 {
 	struct bio *bio;
 	struct lbuf *bp;
+	int no_integrity = log->no_integrity;
 
 	/*
 	 * allocate a log buffer
 	 */
+	printk("log1: %p, integrity: %d, %s\n", log, log->no_integrity, __func__);
 	*bpp = bp = lbmAllocate(log, pn);
+	printk("log2: %p, integrity: %d, %s\n", log, log->no_integrity, __func__);
 	jfs_info("lbmRead: bp:0x%p pn:0x%x", bp, pn);
 
 	bp->l_flag |= lbmREAD;
@@ -1979,8 +1982,9 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 
 	bio->bi_end_io = lbmIODone;
 	bio->bi_private = bp;
+	printk("log3: %p, integrity: %d, %s\n", log, log->no_integrity, __func__);
 	/*check if journaling to disk has been disabled*/
-	if (log->no_integrity) {
+	if (no_integrity) {
 		bio->bi_iter.bi_size = 0;
 		lbmIODone(bio);
 	} else {