linux-kernel - Re: Bug: slab-out-of-bounds Write in __bh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <brheoinx2gsmonf6uxobqicuxnqpxnsum26c3hcuroztmccl3m@lnmielvfe4v7>
Date: Mon, 6 Jan 2025 12:29:02 +0100
From: Jan Kara <jack@...e.cz>
To: Kun Hu <huk23@...udan.edu.cn>
Cc: viro@...iv.linux.org.uk, brauner@...nel.org, jack@...e.cz, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	"jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>
Subject: Re: Bug: slab-out-of-bounds Write in __bh_read

Hello!

On Mon 06-01-25 15:23:06, Kun Hu wrote:
> When using our customized fuzzer tool to fuzz the latest Linux kernel,
> the following crash was triggered.
> 
> HEAD commit: fc033cf25e612e840e545f8d5ad2edd6ba613ed5
> git tree: upstream
> Console output: https://drive.google.com/file/d/1-YGytaKuh9M4hI6x27YjsE0vSyRFngf5/view?usp=sharing
> Kernel config: https://drive.google.com/file/d/1n2sLNg-YcIgZqhhQqyMPTDWM_N1Pqz73/view?usp=sharing
> C reproducer: /
> Syzlang reproducer: /
> 
> We found an issue in the __bh_read function at line 3086, where a
> slab-out-of-bounds error was reported. While the BUG_ON check ensures
> that bh is locked, I suspect it’s possible that bh might have been
> released prior to the call to __bh_read. This could result in accessing
> invalid memory, ultimately triggering the reported issue.

Well, most likely the bh pointer has already been corrupted. Again, nobody
is likely to be able to debug this unless we have a reliable way to
reproduce this problem.

								Honza

-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR