Re: KASAN: use-after-free Write in jbd2_journal_wait_updates

[Jan Kara]

On Mon 12-09-22 22:33:48, Haichi Wang wrote:
> Dear Linux maintainers and reviewers:
> We would like to report a linux kernel bug, found by a modified version of syzkaller.
> May affected file: fs/jbd2/transaction.c
> Kernel Version: 7e57714cd0ad2d5bb90e50b5096a0e671dec1ef3 (v5.17-rc6)
> Kernel Config: see attach, linux.config
> Syzkaller Version: 3666edfeb55080ebe138d77417fa96fe2555d6bb
> reproducing program: see attach, reproducing.txt.
>  
> To use the reproducing program, please follow
> https://github.com/google/syzkaller/blob/master/docs/reproducing_crashes.md
> for more details.
> 
> Feel free to  email us if any other infomations are needed. Hope the
> provided materials will help finding and fixing the bug.
> 
> The full log crash log are as follows:(also in the attach, crash.report)
> ---------
> warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow
> ==================================================================
> BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
> BUG: KASAN: use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
> BUG: KASAN: use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
> BUG: KASAN: use-after-free in do_raw_spin_lock include/linux/spinlock.h:185 [inline]
> BUG: KASAN: use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
> BUG: KASAN: use-after-free in _raw_spin_lock+0x73/0xd0 kernel/locking/spinlock.c:154
> Write of size 4 at addr ffff88803359c1a0 by task syz-executor.1/3650
> 
> CPU: 1 PID: 3650 Comm: syz-executor.1 Tainted: G S                5.17.0-rc6 #7
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0x4d/0x66 lib/dump_stack.c:106
>  print_address_description.constprop.0+0x21/0x150 mm/kasan/report.c:255
>  __kasan_report mm/kasan/report.c:442 [inline]
>  kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
>  check_region_inline mm/kasan/generic.c:183 [inline]
>  kasan_check_range+0x14d/0x1d0 mm/kasan/generic.c:189
>  instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
>  atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
>  queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
>  do_raw_spin_lock include/linux/spinlock.h:185 [inline]
>  __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
>  _raw_spin_lock+0x73/0xd0 kernel/locking/spinlock.c:154
>  spin_lock include/linux/spinlock.h:349 [inline]
>  jbd2_journal_wait_updates+0x1f1/0x280 fs/jbd2/transaction.c:861

Ah, this one. Should be fixed by commit f7f497cb7024 ("jbd2: kill
t_handle_lock transaction spinlock") which got merged to 5.18-rc1.

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR