linux-kernel - Re: Bug: slab-out-of-bounds Write in __bh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <86F5589E-BC3A-49E5-824F-0E840F75F46D@m.fudan.edu.cn>
Date: Sat, 11 Jan 2025 01:17:04 +0800
From: Kun Hu <huk23@...udan.edu.cn>
To: Andreas Gruenbacher <agruenba@...hat.com>
Cc: viro@...iv.linux.org.uk,
 brauner@...nel.org,
 linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org,
 "jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>,
 Andreas Gruenbacher <agruenba@...hat.com>,
 gfs2@...ts.linux.dev,
 Jan Kara <jack@...e.cz>
Subject: Re: Bug: slab-out-of-bounds Write in __bh_read


> 
> Thanks. Based on the crash report and the reproducer it indeed looks like
> some mixing of iomap_folio_state and buffer heads attached to a folio
> (iomap_folio_state is attached there but we end up calling
> __block_write_begin_int() which expects buffer heads there) in GFS2. GFS2
> guys, care to have a look?
> 

Thanks to Jan.

Hi Andreas,

It seems that iomap_write_begin is expected to handle I/O directly based on folio, rather than entering the buffer head path. Is it possible that GFS2 incorrectly passes data related to buffer head to iomap_write_begin?

Could you please help us to check the exact cause of the issue?

Thanks,
Kun Hu