[Bug 199989] use-after-free() detected by KASAN in ext4_find_extent() when mounting and writing to a crafted ext4 image

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.kernel.org/show_bug.cgi?id=199989

Theodore Tso (tytso@xxxxxxx) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |tytso@xxxxxxx
         Resolution|---                         |DUPLICATE

--- Comment #1 from Theodore Tso (tytso@xxxxxxx) ---
This is a dup of #199417.   With the patch:
ext4: verify the depth of extent tree in ext4_find_extent()

... this reproducer no longer crashes:  (note the invalid extent depth
ext4_error complaint):

root@kvm-xfstests:~# /vdb/poc/do-989
[   61.103607] EXT4-fs (loop0): 1 truncate cleaned up
[   61.104790] EXT4-fs (loop0): recovery complete
[   61.107122] EXT4-fs (loop0): mounted filesystem with ordered data mode.
Opts: (null)
[   61.121704] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
poc-199989: error while reading EA inode 1528337011 err=-117
[   61.125338] EXT4-fs error (device loop0): ext4_find_extent:874: inode #14:
comm poc-199989: inode has invalid extent depth: 28535
[   61.129157] EXT4-fs (loop0): Delayed block allocation failed for inode 14 at
logical offset 0 with max blocks 33 with error 117
[   61.132337] EXT4-fs (loop0): This should not happen!! Data will be lost
[   61.132337] 
[   61.135080] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
poc-199989: error while reading EA inode 1528337011 err=-117
[   61.157028] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
kworker/u4:0: error while reading EA inode 1528337011 err=-117
[   61.160579] EXT4-fs error (device loop0): ext4_xattr_inode_iget:390: comm
kworker/u4:0: error while reading EA inode 1528337011 err=-117

*** This bug has been marked as a duplicate of bug 199417 ***

-- 
You are receiving this mail because:
You are watching the assignee of the bug.



[Index of Archives]     [Reiser Filesystem Development]     [Ceph FS]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite National Park]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]     [Linux Media]

  Powered by Linux