linux-kernel - Re: Bug: slab-out-of-bounds Write in __bh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <A184824F-B892-46D3-B086-556E9ACF4EA0@m.fudan.edu.cn>
Date: Thu, 16 Jan 2025 18:41:26 +0800
From: Kun Hu <huk23@...udan.edu.cn>
To: Andreas Gruenbacher <agruenba@...hat.com>
Cc: "jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>,
 Andrew Price <anprice@...hat.com>,
 viro@...iv.linux.org.uk,
 brauner@...nel.org,
 linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org,
 gfs2@...ts.linux.dev
Subject: Re: Bug: slab-out-of-bounds Write in __bh_read



> 2025年1月15日 02:05，Andreas Gruenbacher <agruenba@...hat.com> 写道：
> 
> On Mon, Jan 13, 2025 at 5:12 PM Andrew Price <anprice@...hat.com> wrote:
>> On 13/01/2025 15:54, Kun Hu wrote:
>>> 
>>>> 
>>>> 32generated_program.c memory maps the filesystem image, mounts it, and
>>>> then modifies it through the memory map. It's those modifications that
>>>> cause gfs2 to crash, so the test case is invalid.
>>>> 
>>>> Is disabling CONFIG_BLK_DEV_WRITE_MOUNTED supposed to prevent that? If
>>>> so, then it doesn't seem to be working.
>>>> 
>>>> Thanks,
>>>> Andreas
>>> 
>>> 
>>>>  We have reproduced the crash with CONFIG_BLK_DEV_WRITE_MOUNTED disabled to obtain the same crash log. The new crash log, along with C and Syzlang reproducers are provided below:
>>> 
>>>> Crash log: https://drive.google.com/file/d/1FiCgo05oPheAt4sDQzRYTQwl0-CY6rvi/view?usp=sharing
>>>> C reproducer: https://drive.google.com/file/d/1TTR9cquaJcMYER6vtYUGh3gOn_mROME4/view?usp=sharing
>>>> Syzlang reproducer: https://drive.google.com/file/d/1R9QDUP2r7MI4kYMiT_yn-tzm6NqmcEW-/view?usp=sharing
>>> 
>>> Hi Andreas,
>>> 
>>> As per Jan's suggestion, we’ve successfully reproduced the crash with CONFIG_BLK_DEV_WRITE_MOUNTED disabled. Should you require us to test this issue again, we are happy to do so.
>>> 
>> FWIW the reproducer boils down to
>> 
>>   #include <fcntl.h>
>>   #include <unistd.h>
>>   #include <sys/ioctl.h>
>>   #include <linux/fs.h>
>> 
>>   /*
>>      mkfs.gfs2 -b 2048 -p lock_nolock $DEV
>>      mount $DEV $MNT
>>      cd $MNT
>>      /path/to/this_test
>>    */
>>   int main(void)
>>   {
>>           unsigned flag = FS_JOURNAL_DATA_FL;
>>           char buf[4102] = {0};
>>           int fd;
>> 
>>           /* Error checking omitted for clarity */
>>           fd = open("f", O_CREAT|O_RDWR);
>>           write(fd, buf, sizeof(buf));
>>           ioctl(fd, FS_IOC_SETFLAGS, &flag);
>>           write(fd, buf, sizeof(buf)); /* boom */
>>           close(fd);
>>           return 0;
>>   }
>> 
>> So it's switching the file to journaled data mode between two writes.
>> 
>> The size of the writes seems to be relevant and the fs needs to be
>> created with a 2K block size (I'm guessing it could reproduce with other
>> combinations).

Hi Andy,

Thanks for the reporting. I was unable to run the C reproducer you provided. I still reproduced the issue using syscall reproducer provided by syzkaller.

Thanks,

> 
> I've posted a fix and pushed it to for-next:
> 
> https://lore.kernel.org/gfs2/20250114175949.1196275-1-agruenba@redhat.com/
> 
> Thanks for reporting!
> 
> Andreas

> Syzlang reproducer: https://drive.google.com/file/d/1R9QDUP2r7MI4kYMiT_yn-tzm6NqmcEW-/view?usp=sharing

Hi Andreas,

Thank you for the patch. I tested it using the syscall reproducer and was still able to reproduce the issue.

Crash log: Link: https://github.com/pghk13/Kernel-Bug/blob/main/0103_6.13rc5_%E6%9C%AA%E6%8A%A5%E5%91%8A/%E5%AE%8C%E5%85%A8%E6%97%A0%E8%AE%B0%E5%BD%95/32-KASAN_%20slab-out-of-bounds%20Write%20in%20__bh_read/crashlog_0116_rc7%2Bpatch.txt

Could you confirm if the patch is intended to fully resolve this issue, or if additional changes might be required?

———
Thanks,
Kun Hu