lkml.org 
[lkml]   [2022]   [Mar]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectA null-ptr-deref bug was triggered when continuously remont jfs image to write a log to record
Hi, there is a null-ptr-deref bug by kernel fuzz. It was triggered
when continuously remont jfs image to write a log to record
I can reproduce it on the latest kernel.

### Crash log
[ 30.752504][ T7617] BUG: kernel NULL pointer dereference, address:
00000000000005a8
[ 30.753179][ T7617] #PF: supervisor read access in kernel mode
[ 30.753670][ T7617] #PF: error_code(0x0000) - not-present page
[ 30.754160][ T7617] PGD 106cb067 P4D 106cb067 PUD f7e7067 PMD 0
[ 30.754681][ T7617] Oops: 0000 [#1] PREEMPT SMP
[ 30.755073][ T7617] CPU: 1 PID: 7617 Comm: bio_associate_b Tainted:
G W 5.17.0-rc6+ #47
[ 30.755880][ T7617] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.13.0-1ubuntu1 04/01/2014
[ 30.756688][ T7617] RIP: 0010:bio_associate_blkg_from_css+0x1f1/0x730
[ 30.757238][ T7617] Code: c6 50 59 e4 81 48 c7 c7 c0 cc 22 85 e8 d8
8d 41 ff 49 89 5c 24 48 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3
49 8b 44 24 08 <48> 8b 80 a5
[ 30.758904][ T7617] RSP: 0018:ffffc900022f3b70 EFLAGS: 00010246
[ 30.759429][ T7617] RAX: 0000000000000000 RBX: 0000000000000000
RCX: 0000000000000001
[ 30.760127][ T7617] RDX: 0000000000000000 RSI: ffffffff882f6080
RDI: ffff888046ee3e00
[ 30.760739][ T7617] RBP: ffffffff882f6080 R08: 0000000000000000
R09: 0000000000020027
[ 30.761297][ T7617] R10: 0000000000000001 R11: 0000000000000000
R12: ffff888046ee3e00
[ 30.761854][ T7617] R13: ffff8880482f8400 R14: ffff8880482f85d0
R15: ffff8880482f85d0
[ 30.762412][ T7617] FS: 0000000000e05880(0000)
GS:ffff88807ec00000(0000) knlGS:0000000000000000
[ 30.763118][ T7617] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 30.763680][ T7617] CR2: 00007fcd480390e8 CR3: 000000000fdf7000
CR4: 00000000000006e0
[ 30.764390][ T7617] Call Trace:
[ 30.764673][ T7617] <TASK>
[ 30.764929][ T7617] bio_associate_blkg+0x58/0x190
[ 30.765331][ T7617] lbmStartIO+0x7c/0xf0
[ 30.765684][ T7617] ? lockdep_hardirqs_on+0x79/0x100
[ 30.766138][ T7617] lbmWrite+0xed/0x150
[ 30.766492][ T7617] lmNextPage+0x87/0x150
[ 30.766861][ T7617] lmWriteRecord+0x35d/0x460
[ 30.767270][ T7617] lmLog+0xc2/0x290
[ 30.767597][ T7617] ? __sync_dirty_buffer+0x85/0x160
[ 30.768082][ T7617] jfs_mount_rw+0x15e/0x190
[ 30.768465][ T7617] jfs_fill_super+0x2d3/0x350
[ 30.768857][ T7617] mount_bdev+0x18b/0x1c0
[ 30.769217][ T7617] ? jfs_remount+0x1d0/0x1d0
[ 30.769605][ T7617] legacy_get_tree+0x28/0x50
[ 30.769991][ T7617] vfs_get_tree+0x1d/0xb0
[ 30.770362][ T7617] path_mount+0x42b/0xb10
[ 30.770731][ T7617] do_mount+0x70/0x90
[ 30.771056][ T7617] __x64_sys_mount+0x89/0xc0
[ 30.771450][ T7617] do_syscall_64+0x35/0xb0
[ 30.771836][ T7617] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 30.772327][ T7617] RIP: 0033:0x4521de
[ 30.772662][ T7617] Code: 83 c4 08 5b 5d c3 66 0f 1f 44 00 00 c3 66
2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 a5
00 00 00 0f 05 <48> 3d 01 f8
[ 30.774275][ T7617] RSP: 002b:00007ffeae064a48 EFLAGS: 00000282
ORIG_RAX: 00000000000000a5
[ 30.774988][ T7617] RAX: ffffffffffffffda RBX: 0000000000400530
RCX: 00000000004521de
[ 30.775692][ T7617] RDX: 0000000020000000 RSI: 0000000020000100
RDI: 00007ffeae064ac0
[ 30.776382][ T7617] RBP: 00007ffeae064c10 R08: 00007ffeae064b00
R09: 00007ffeae064a84
[ 30.777054][ T7617] R10: 0000000000000000 R11: 0000000000000282
R12: 0000000000404050
[ 30.777617][ T7617] R13: 0000000000000000 R14: 00000000004c8018
R15: 0000000000000000

the attachment is reproduce.

Regards,
butt3rflyh4ck.








--
Active Defense Lab of Venustech
[unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2022-03-07 09:01    [W:0.060 / U:0.984 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site