linux-kernel - Re: KASAN: slab-use-after-free Read in bch2_btree_node_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAG_fn=VT5=PcD5-bFY5LQ7SHhGg+epUAM5HGLBEFEaM55UVi2A@mail.gmail.com>
Date: Wed, 21 May 2025 14:14:14 +0200
From: Alexander Potapenko <glider@...gle.com>
To: "huk23@...udan.edu.cn" <huk23@...udan.edu.cn>
Cc: Kent Overstreet <kent.overstreet@...ux.dev>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, 
	"syzkaller@...glegroups.com" <syzkaller@...glegroups.com>, 白烁冉 <baishuoran@...eu.edu.cn>, 
	"jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>
Subject: Re: KASAN: slab-use-after-free Read in bch2_btree_node_read_done

On Wed, May 21, 2025 at 1:50 PM 'huk23@...udan.edu.cn' via syzkaller
<syzkaller@...glegroups.com> wrote:
>
> Dear Maintainers,
>
>
>
> When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (104th)was triggered.
>
>
> HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
> git tree: upstream
> Output:https:https:https://github.com/pghk13/Kernel-Bug/blob/main/0520_6.15-rc6/104_KASAN%3A%20slab-use-after-free%20Read%20in%20bch2_btree_node_read_done/104report.txt
> Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0520_6.15-rc6/config.txt
> C reproducer:https:https://github.com/pghk13/Kernel-Bug/blob/main/0520_6.15-rc6/104_KASAN%3A%20slab-use-after-free%20Read%20in%20bch2_btree_node_read_done/104repro.c
> Syzlang reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0520_6.15-rc6/104_KASAN%3A%20slab-use-after-free%20Read%20in%20bch2_btree_node_read_done/104repro.txt
>
>
>
> The bug is a use-after-free error in the btree handling code of the bcachefs filesystem. It most likely occurs in the bch_btree_node_read_done function (defined around line 193), when processing a btree node and validating its contents, the code attempts to a radix tree node that has already been released by the RCU mechanism. The root cause of the error could be a memory management or reference counting issue, especially in the complex of operations during the filesystem recovery. It could also be in the btree_io.c file, around lines 300-350, which handles btree validation and reading.Especially in the call or implementation of validate_bset, validate_bset_keys or bch2_drop_whiteouts

This is a known bug reported by syzkaller at
https://groups.google.com/g/syzkaller-bugs/c/Q4Vjvpe9ab8/m/e8jpti-MAQAJ
(dashboard: https://syzkaller.appspot.com/bug?extid=92e65e9b7a42d379f92e)
If the goal of your research is to provide AI-generated explanations
of kernel bugs, you can probably take the existing bugs instead of
duplicating syzbot's work.