Re: Bug: slab-out-of-bounds Write in __bh_read

[Jan Kara]

Hello!

On Wed 08-01-25 12:08:56, Kun Hu wrote:
> >> HEAD commit: fc033cf25e612e840e545f8d5ad2edd6ba613ed5
> >> git tree: upstream
> >> Console output: https://drive.google.com/file/d/1-YGytaKuh9M4hI6x27YjsE0vSyRFngf5/view?usp=sharing
> >> Kernel config: https://drive.google.com/file/d/1n2sLNg-YcIgZqhhQqyMPTDWM_N1Pqz73/view?usp=sharing
> >> C reproducer: /
> >> Syzlang reproducer: /
> >> 
> >> We found an issue in the __bh_read function at line 3086, where a
> >> slab-out-of-bounds error was reported. While the BUG_ON check ensures
> >> that bh is locked, I suspect it’s possible that bh might have been
> >> released prior to the call to __bh_read. This could result in accessing
> >> invalid memory, ultimately triggering the reported issue.
> > 
> > Well, most likely the bh pointer has already been corrupted. Again, nobody
> > is likely to be able to debug this unless we have a reliable way to
> > reproduce this problem.
> 
> We have obtained the reproducers of this issue for multi round testing.
> But, the crash location seems to vary. The crash log shows a possible
> deadlock occurring in “gfs2_trans_begin" in /fs/gfs2/trans.c, with
> duplicate registrations happening when attempting to register a
> "kobject."

OK. Checking the syzlang reproducer the same comment as for other
filesystem bugs applies - please run with CONFIG_BLK_DEV_WRITE_MOUNTED
disabled to rule out corruption of a filesystem while it is mounted.

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR