| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <27DB604A-8C3B-4703-BB8A-CBC16B9C4969@m.fudan.edu.cn> Date: Mon, 13 Jan 2025 23:54:58 +0800 From: Kun Hu <huk23@...udan.edu.cn> To: Andreas Gruenbacher <agruenba@...hat.com> Cc: Jan Kara <jack@...e.cz>, viro@...iv.linux.org.uk, brauner@...nel.org, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, "jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>, gfs2@...ts.linux.dev Subject: Re: Bug: slab-out-of-bounds Write in __bh_read > > 32generated_program.c memory maps the filesystem image, mounts it, and > then modifies it through the memory map. It's those modifications that > cause gfs2 to crash, so the test case is invalid. > > Is disabling CONFIG_BLK_DEV_WRITE_MOUNTED supposed to prevent that? If > so, then it doesn't seem to be working. > > Thanks, > Andreas > We have reproduced the crash with CONFIG_BLK_DEV_WRITE_MOUNTED disabled to obtain the same crash log. The new crash log, along with C and Syzlang reproducers are provided below: > Crash log: https://drive.google.com/file/d/1FiCgo05oPheAt4sDQzRYTQwl0-CY6rvi/view?usp=sharing > C reproducer: https://drive.google.com/file/d/1TTR9cquaJcMYER6vtYUGh3gOn_mROME4/view?usp=sharing > Syzlang reproducer: https://drive.google.com/file/d/1R9QDUP2r7MI4kYMiT_yn-tzm6NqmcEW-/view?usp=sharing Hi Andreas, As per Jan's suggestion, we’ve successfully reproduced the crash with CONFIG_BLK_DEV_WRITE_MOUNTED disabled. Should you require us to test this issue again, we are happy to do so. —— Thanks, Kun Hu
Powered by blists - more mailing lists