linux-kernel - Re: Bug: slab-out-of-bounds Write in __bh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6yd5s7fxnr7wtmluqa667lok54sphgtg4eppubntulelwidvca@ffyohkeovnyn>
Date: Wed, 8 Jan 2025 15:59:27 +0100
From: Jan Kara <jack@...e.cz>
To: Kun Hu <huk23@...udan.edu.cn>
Cc: Jan Kara <jack@...e.cz>, viro@...iv.linux.org.uk, brauner@...nel.org, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	"jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>
Subject: Re: Bug: slab-out-of-bounds Write in __bh_read

Hello!

On Wed 08-01-25 12:08:56, Kun Hu wrote:
> >> HEAD commit: fc033cf25e612e840e545f8d5ad2edd6ba613ed5
> >> git tree: upstream
> >> Console output: https://drive.google.com/file/d/1-YGytaKuh9M4hI6x27YjsE0vSyRFngf5/view?usp=sharing
> >> Kernel config: https://drive.google.com/file/d/1n2sLNg-YcIgZqhhQqyMPTDWM_N1Pqz73/view?usp=sharing
> >> C reproducer: /
> >> Syzlang reproducer: /
> >> 
> >> We found an issue in the __bh_read function at line 3086, where a
> >> slab-out-of-bounds error was reported. While the BUG_ON check ensures
> >> that bh is locked, I suspect it’s possible that bh might have been
> >> released prior to the call to __bh_read. This could result in accessing
> >> invalid memory, ultimately triggering the reported issue.
> > 
> > Well, most likely the bh pointer has already been corrupted. Again, nobody
> > is likely to be able to debug this unless we have a reliable way to
> > reproduce this problem.
> 
> We have obtained the reproducers of this issue for multi round testing.
> But, the crash location seems to vary. The crash log shows a possible
> deadlock occurring in “gfs2_trans_begin" in /fs/gfs2/trans.c, with
> duplicate registrations happening when attempting to register a
> "kobject."

OK. Checking the syzlang reproducer the same comment as for other
filesystem bugs applies - please run with CONFIG_BLK_DEV_WRITE_MOUNTED
disabled to rule out corruption of a filesystem while it is mounted.

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR