linux-kernel - Re: Bug: slab-out-of-bounds Write in __bh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <eb78dcaf-5acc-4317-911d-cff3b53e424d@redhat.com>
Date: Thu, 16 Jan 2025 14:30:38 +0000
From: Andrew Price <anprice@...hat.com>
To: Kun Hu <huk23@...udan.edu.cn>, Andreas Gruenbacher <agruenba@...hat.com>
Cc: "jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>,
 viro@...iv.linux.org.uk, brauner@...nel.org, linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org, gfs2@...ts.linux.dev
Subject: Re: Bug: slab-out-of-bounds Write in __bh_read

On 16/01/2025 10:41, Kun Hu wrote:
> 
>> 2025年1月15日 02:05，Andreas Gruenbacher <agruenba@...hat.com> 写道：
>> I've posted a fix and pushed it to for-next:
>>
>> https://lore.kernel.org/gfs2/20250114175949.1196275-1-agruenba@redhat.com/
>>
>> Thanks for reporting!
>>
>> Andreas
> 
>> Syzlang reproducer: https://drive.google.com/file/d/1R9QDUP2r7MI4kYMiT_yn-tzm6NqmcEW-/view?usp=sharing
> 
> Hi Andreas,
> 
> Thank you for the patch. I tested it using the syscall reproducer and was still able to reproduce the issue.
> 
> Crash log: Link: https://github.com/pghk13/Kernel-Bug/blob/main/0103_6.13rc5_%E6%9C%AA%E6%8A%A5%E5%91%8A/%E5%AE%8C%E5%85%A8%E6%97%A0%E8%AE%B0%E5%BD%95/32-KASAN_%20slab-out-of-bounds%20Write%20in%20__bh_read/crashlog_0116_rc7%2Bpatch.txt
> 

That's not the slab-out-of-bounds failure. It's failing to mount with:

"kobject: kobject_add_internal failed for syz:syz with -EEXIST, don't 
try to register things with the same name in the same directory."

This can happen when a gfs2 fs is mounted with the same locktable twice, 
so I expect it's a problem in the test. Please make sure you're running 
the same reproducer from the original report, in the same way. The patch 
fixes both reproducers for me.

Andy