https://bugzilla.kernel.org/show_bug.cgi?id=216540 Bug ID: 216540 Summary: FUZZ: kernel BUG at kernel BUG at fs/ext4/ext4.h:2413 when mount and operate on crafted image Product: File System Version: 2.5 Kernel Version: 5.15.71, 6.0-rc7 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: ext4 Assignee: fs_ext4@xxxxxxxxxxxxxxxxxxxx Reporter: wenqingliu0120@xxxxxxxxx Regression: No Created attachment 301891 --> https://bugzilla.kernel.org/attachment.cgi?id=301891&action=edit poc and .config - Overview FUZZ: kernel BUG at fs/ext4/ext4.h:ext4_rec_len_to_disk() when mount and operate on crafted image - Reproduce Tested on kernel 5.15.71, 6.0-rc7 # mkdir test_crash # cd test_crash # unzip ext4_247.zip # mkdir mnt # ./single_test.sh ext4 247 -Kernel dump [ 800.153426] loop7: detected capacity change from 0 to 32768 [ 800.189527] EXT4-fs (loop7): barriers disabled [ 800.199319] EXT4-fs (loop7): warning: mounting fs with errors, running e2fsck is recommended [ 800.206218] EXT4-fs (loop7): mounted filesystem with journalled data mode. Quota mode: none. [ 800.207555] ext4 filesystem being mounted at /home/wq/test_crashes/mt_crashes/mt_crashes/mnt supports timestamps until 2038 (0x7fffffff) [ 800.217041] EXT4-fs error (device loop7): htree_dirblock_to_tree:1093: inode #2: block 582: comm ls: bad entry in directory: rec_len is smaller than minimal - offset=780, inode=0, rec_len=0, size=1024 fake=0 [ 800.465782] ------------[ cut here ]------------ [ 800.467047] kernel BUG at fs/ext4/ext4.h:2413! [ 800.468264] invalid opcode: 0000 [#3] PREEMPT SMP KASAN NOPTI [ 800.469448] CPU: 3 PID: 2346 Comm: tmp247 Tainted: G D 6.0.0-rc7 #1 [ 800.470639] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 800.471888] RIP: 0010:make_indexed_dir+0xd6c/0x1100 [ 800.473089] Code: c9 48 89 ef ba 0b 02 00 00 48 c7 c6 00 17 79 88 e8 79 de 06 00 e9 71 fe ff ff bb 06 00 00 00 41 be 06 00 00 00 e9 70 f7 ff ff <0f> 0b 48 b8 00 00 00 00 00 fc ff df 48 8b 54 24 18 48 c1 ea 03 80 [ 800.475608] RSP: 0018:ffffc900012376d8 EFLAGS: 00010202 [ 800.476843] RAX: ffff888193057c13 RBX: ffff88819304abe8 RCX: 0000000000000000 [ 800.478083] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff88819304a817 [ 800.479369] RBP: ffff888107934808 R08: 00000000000003ed R09: ffff8881880c6818 [ 800.480606] R10: ffff8881880c6bff R11: ffffed1031018d7f R12: ffff8881880c6800 [ 800.481849] R13: ffff88819304a813 R14: 0000000000000400 R15: ffff8881880c6810 [ 800.483081] FS: 00007fed8f338540(0000) GS:ffff888293780000(0000) knlGS:0000000000000000 [ 800.484352] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 800.485557] CR2: 00007fed8f25d720 CR3: 0000000152ea6005 CR4: 0000000000370ee0 [ 800.486770] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 800.488011] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 800.489171] Call Trace: [ 800.490302] <TASK> [ 800.491459] ? ext4_dx_add_entry+0x2d40/0x2d40 [ 800.492569] ? add_dirent_to_buf+0x4a0/0x8a0 [ 800.493670] ? ext4_insert_dentry+0x650/0x650 [ 800.494770] ? __ext4_read_dirblock+0x31d/0xc70 [ 800.495907] ext4_add_entry+0x840/0xa90 [ 800.496974] ? make_indexed_dir+0x1100/0x1100 [ 800.498017] ext4_add_nondir+0x90/0x220 [ 800.499032] ext4_create+0x2dc/0x420 [ 800.500062] ? ext4_symlink+0x840/0x840 [ 800.501033] ? from_kgid+0x84/0xc0 [ 800.501997] path_openat+0x255b/0x3aa0 [ 800.502955] ? do_sys_openat2+0x256/0x680 [ 800.503953] ? path_lookupat.isra.0+0x490/0x490 [ 800.504899] ? _raw_spin_unlock_irqrestore+0x23/0x40 [ 800.505818] ? __stack_depot_save+0x1eb/0x540 [ 800.506713] do_filp_open+0x1b9/0x290 [ 800.507623] ? do_sys_truncate.part.0+0x82/0x100 [ 800.508465] ? do_syscall_64+0x38/0x90 [ 800.509291] ? may_open_dev+0xd0/0xd0 [ 800.510107] ? filename_lookup+0x236/0x3d0 [ 800.510918] ? ___slab_alloc+0x4e7/0x9a0 [ 800.511770] ? _raw_spin_lock+0x87/0xda [ 800.512558] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 800.513321] ? __check_object_size+0x171/0x620 [ 800.514057] ? _raw_spin_unlock+0x15/0x30 [ 800.514766] ? alloc_fd+0x1bc/0x4f0 [ 800.515494] do_sys_openat2+0x336/0x680 [ 800.516160] ? file_open_root+0x220/0x220 [ 800.516824] ? security_file_permission+0x50/0x580 [ 800.517490] do_sys_open+0x8a/0xe0 [ 800.518140] ? filp_open+0x60/0x60 [ 800.518771] ? exit_to_user_mode_prepare+0x3d/0x150 [ 800.519478] do_syscall_64+0x38/0x90 [ 800.520078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 800.520665] RIP: 0033:0x7fed8f25d73d [ 800.521236] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 23 37 0d 00 f7 d8 64 89 01 48 [ 800.522454] RSP: 002b:00007ffd508c7dc8 EFLAGS: 00000286 ORIG_RAX: 0000000000000002 [ 800.523080] RAX: ffffffffffffffda RBX: 00005648bdddfc30 RCX: 00007fed8f25d73d [ 800.523761] RDX: 00000000000001b6 RSI: 0000000000000042 RDI: 00007ffd508c8bb0 [ 800.524397] RBP: 00007ffd508cf620 R08: 00007ffd508cf718 R09: 00007ffd508cf718 [ 800.525022] R10: 00007ffd508cf718 R11: 0000000000000286 R12: 00005648bdddd0a0 [ 800.525639] R13: 00007ffd508cf710 R14: 0000000000000000 R15: 0000000000000000 [ 800.526245] </TASK> [ 800.526840] Modules linked in: joydev input_leds serio_raw qemu_fw_cfg xfs autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear qxl drm_ttm_helper ttm drm_kms_helper hid_generic syscopyarea usbhid sysfillrect sysimgblt fb_sys_fops hid crct10dif_pclmul drm crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd psmouse [ 800.529689] ---[ end trace 0000000000000000 ]--- [ 800.530404] RIP: 0010:ext4_read_inode_bitmap+0x682/0x1240 [ 800.531175] Code: 80 3c 02 00 0f 85 ac 0b 00 00 49 8b 87 b8 02 00 00 8b 54 24 08 4c 8d 3c d0 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 75 0b 00 00 4d 8b 3f e8 6c fa 78 ff 48 b8 00 00 [ 800.532730] RSP: 0018:ffffc900007ff730 EFLAGS: 00010246 [ 800.533517] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff11024f21407 [ 800.534301] RDX: 0000000000000000 RSI: ffff88812ea2e0a8 RDI: ffff88812790a2b8 [ 800.535095] RBP: 0000000000000000 R08: 0000000000000002 R09: ffffed1025d45c16 [ 800.535887] R10: ffff88812ea2e0af R11: ffffed1025d45c15 R12: ffff888142dd7800 [ 800.536687] R13: ffff888125c07000 R14: ffff88812ea2e0a8 R15: 0000000000000000 [ 800.537507] FS: 00007fed8f338540(0000) GS:ffff888293780000(0000) knlGS:0000000000000000 [ 800.538328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 800.539197] CR2: 00007fed8f25d720 CR3: 0000000152ea6005 CR4: 0000000000370ee0 [ 800.540034] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 800.540881] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug.
