| Message ID | 20211224100341.3299128-1-yebin10@huawei.com |
|---|---|
| State | Awaiting Upstream |
| Headers | show |
| Series | [-next] ext4: Fix null-ptr-deref in '__ext4_journal_ensure_credits' | expand |
On Fri, 24 Dec 2021 18:03:41 +0800, Ye Bin wrote: > We got issue as follows when run syzkaller test: > [ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user > [ 1901.130901] Aborting journal on device vda-8. > [ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal > [ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal > [ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal > [ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal > [ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted > [ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal > [ 1901.136915] ================================================================== > [ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4] > [ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal > [ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal > [ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968 > [ 1901.138817] > [ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal > [ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1 > [ 1901.146479] Hardware name: linux,dummy-virt (DT) > [ 1901.147317] Call trace: > [ 1901.147552] dump_backtrace+0x0/0x2d8 > [ 1901.147898] show_stack+0x28/0x38 > [ 1901.148215] dump_stack+0xec/0x15c > [ 1901.148746] kasan_report+0x108/0x338 > [ 1901.149207] __asan_load8+0x58/0xb0 > [ 1901.149753] __ext4_journal_ensure_credits+0x74/0x140 [ext4] > [ 1901.150579] ext4_xattr_delete_inode+0xe4/0x700 [ext4] > [ 1901.151316] ext4_evict_inode+0x524/0xba8 [ext4] > [ 1901.151985] evict+0x1a4/0x378 > [ 1901.152353] iput+0x310/0x428 > [ 1901.152733] do_unlinkat+0x260/0x428 > [ 1901.153056] __arm64_sys_unlinkat+0x6c/0xc0 > [ 1901.153455] el0_svc_common+0xc8/0x320 > [ 1901.153799] el0_svc_handler+0xf8/0x160 > [ 1901.154265] el0_svc+0x10/0x218 > [ 1901.154682] ================================================================== > > [...] Applied, thanks! [1/1] ext4: Fix null-ptr-deref in '__ext4_journal_ensure_credits' commit: 5bceadc3d3ed3d12a1cf72d80df98cad7f66b1a9 Best regards,
On Fri 24-12-21 18:03:41, Ye Bin wrote: > We got issue as follows when run syzkaller test: > [ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user > [ 1901.130901] Aborting journal on device vda-8. > [ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal > [ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal > [ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal > [ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal > [ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted > [ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal > [ 1901.136915] ================================================================== > [ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4] > [ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal > [ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal > [ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968 > [ 1901.138817] > [ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal > [ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1 > [ 1901.146479] Hardware name: linux,dummy-virt (DT) > [ 1901.147317] Call trace: > [ 1901.147552] dump_backtrace+0x0/0x2d8 > [ 1901.147898] show_stack+0x28/0x38 > [ 1901.148215] dump_stack+0xec/0x15c > [ 1901.148746] kasan_report+0x108/0x338 > [ 1901.149207] __asan_load8+0x58/0xb0 > [ 1901.149753] __ext4_journal_ensure_credits+0x74/0x140 [ext4] > [ 1901.150579] ext4_xattr_delete_inode+0xe4/0x700 [ext4] > [ 1901.151316] ext4_evict_inode+0x524/0xba8 [ext4] > [ 1901.151985] evict+0x1a4/0x378 > [ 1901.152353] iput+0x310/0x428 > [ 1901.152733] do_unlinkat+0x260/0x428 > [ 1901.153056] __arm64_sys_unlinkat+0x6c/0xc0 > [ 1901.153455] el0_svc_common+0xc8/0x320 > [ 1901.153799] el0_svc_handler+0xf8/0x160 > [ 1901.154265] el0_svc+0x10/0x218 > [ 1901.154682] ================================================================== > > This issue may happens like this: > Process1 Process2 > ext4_evict_inode > ext4_journal_start > ext4_truncate > ext4_ind_truncate > ext4_free_branches > ext4_ind_truncate_ensure_credits > ext4_journal_ensure_credits_fn > ext4_journal_restart > handle->h_transaction = NULL; > mount -o remount,abort /mnt > -> trigger JBD abort > start_this_handle -> will return failed > ext4_xattr_delete_inode > ext4_journal_ensure_credits > ext4_journal_ensure_credits_fn > __ext4_journal_ensure_credits > jbd2_handle_buffer_credits > journal = handle->h_transaction->t_journal; ->null-ptr-deref > > Now, indirect truncate process didn't handle error. To solve this issue > maybe simply add check handle is abort in '__ext4_journal_ensure_credits' > is enough, and i also think this is necessary. > > Signed-off-by: Ye Bin <yebin10@huawei.com> Thanks for the report and the analysis! The fix looks good. Feel free to add: Reviewed-by: Jan Kara <jack@suse.cz> Honza > diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c > index 6def7339056d..3477a16d08ae 100644 > --- a/fs/ext4/ext4_jbd2.c > +++ b/fs/ext4/ext4_jbd2.c > @@ -162,6 +162,8 @@ int __ext4_journal_ensure_credits(handle_t *handle, int check_cred, > { > if (!ext4_handle_valid(handle)) > return 0; > + if (is_handle_aborted(handle)) > + return -EROFS; > if (jbd2_handle_buffer_credits(handle) >= check_cred && > handle->h_revoke_credits >= revoke_cred) > return 0;
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c index 6def7339056d..3477a16d08ae 100644 --- a/fs/ext4/ext4_jbd2.c +++ b/fs/ext4/ext4_jbd2.c @@ -162,6 +162,8 @@ int __ext4_journal_ensure_credits(handle_t *handle, int check_cred, { if (!ext4_handle_valid(handle)) return 0; + if (is_handle_aborted(handle)) + return -EROFS; if (jbd2_handle_buffer_credits(handle) >= check_cred && handle->h_revoke_credits >= revoke_cred) return 0;
We got issue as follows when run syzkaller test: [ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user [ 1901.130901] Aborting journal on device vda-8. [ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal [ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal [ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal [ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal [ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted [ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal [ 1901.136915] ================================================================== [ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4] [ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal [ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal [ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968 [ 1901.138817] [ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal [ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1 [ 1901.146479] Hardware name: linux,dummy-virt (DT) [ 1901.147317] Call trace: [ 1901.147552] dump_backtrace+0x0/0x2d8 [ 1901.147898] show_stack+0x28/0x38 [ 1901.148215] dump_stack+0xec/0x15c [ 1901.148746] kasan_report+0x108/0x338 [ 1901.149207] __asan_load8+0x58/0xb0 [ 1901.149753] __ext4_journal_ensure_credits+0x74/0x140 [ext4] [ 1901.150579] ext4_xattr_delete_inode+0xe4/0x700 [ext4] [ 1901.151316] ext4_evict_inode+0x524/0xba8 [ext4] [ 1901.151985] evict+0x1a4/0x378 [ 1901.152353] iput+0x310/0x428 [ 1901.152733] do_unlinkat+0x260/0x428 [ 1901.153056] __arm64_sys_unlinkat+0x6c/0xc0 [ 1901.153455] el0_svc_common+0xc8/0x320 [ 1901.153799] el0_svc_handler+0xf8/0x160 [ 1901.154265] el0_svc+0x10/0x218 [ 1901.154682] ================================================================== This issue may happens like this: Process1 Process2 ext4_evict_inode ext4_journal_start ext4_truncate ext4_ind_truncate ext4_free_branches ext4_ind_truncate_ensure_credits ext4_journal_ensure_credits_fn ext4_journal_restart handle->h_transaction = NULL; mount -o remount,abort /mnt -> trigger JBD abort start_this_handle -> will return failed ext4_xattr_delete_inode ext4_journal_ensure_credits ext4_journal_ensure_credits_fn __ext4_journal_ensure_credits jbd2_handle_buffer_credits journal = handle->h_transaction->t_journal; ->null-ptr-deref Now, indirect truncate process didn't handle error. To solve this issue maybe simply add check handle is abort in '__ext4_journal_ensure_credits' is enough, and i also think this is necessary. Signed-off-by: Ye Bin <yebin10@huawei.com> --- fs/ext4/ext4_jbd2.c | 2 ++ 1 file changed, 2 insertions(+)