linux-kernel - Re: [syzbot] [nilfs?] general protection fault in touch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_A26C497463A2045397695767E6D4B36EC305@qq.com>
Date: Thu, 31 Oct 2024 20:26:19 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+9982fb8d18eba905abe2@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [nilfs?] general protection fault in touch_buffer

debug

#syz test

diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 9c0b7cddeaae..63831711077f 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -32,12 +32,21 @@ static struct buffer_head *__nilfs_get_folio_block(struct folio *folio,
 {
 	unsigned long first_block;
 	struct buffer_head *bh = folio_buffers(folio);
+	u32 fs = folio_size(folio);
+	int fpr = folio_nr_pages(folio);
+	printk("bh: %p, folio size: %u, folio nr pages: %d, %s\n", bh, fs, fpr, __func__);
 
 	if (!bh)
 		bh = create_empty_buffers(folio, 1 << blkbits, b_state);
 
 	first_block = (unsigned long)index << (PAGE_SHIFT - blkbits);
+	printk("bh: %p, blk: %lu, first blk: %lu, blkbits: %d, idx: %lu, %s\n", bh, block, first_block, blkbits, index, __func__);
+	BUG_ON(block < first_block);
+	if (fs >> blkbits < (block - first_block))
+		printk("folio size is too small %s\n", __func__);
+
 	bh = get_nth_bh(bh, block - first_block);
+	printk("after get nth bh: %p, %s\n", bh, __func__);
 
 	touch_buffer(bh);
 	wait_on_buffer(bh);
Upstream-Status: Pending