Re: [PATCH v2] ext4: Fix possible use-after-free in ext4_find_extent

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 30.12.2022 22:07, Eric Biggers wrote:
On Fri, Dec 30, 2022 at 01:42:45PM +0200, Tudor Ambarus wrote:

Seems that __ext4_iget() is not called on writes.

It is called when the inode is first accessed.  Usually that's when the file is
opened.

Okay, thanks.


So the question is why didn't it validate the inode's extent header, or
alternatively how did the inode's extent header get corrupted afterwards.

You can find below the sequence of calls that leads to the bug.

A stack trace is not a reproducer.  Things must have happened before that point.


I will try to dig more to understand what's happening. If you like to
take a look into the reproducer, here it is:
https://syzkaller.appspot.com/text?tag=ReproC&x=17beb560480000

The reproducer was used for Android 5.15 and the bug is reported at [1],
but as I mentioned earlier, using the same reproducer and config I hit
the bug on v6.2-rc1 as well.

Thanks for the help.
ta

[1] https://syzkaller.appspot.com/bug?id=be6e90ce70987950e6deb3bac8418344ca8b96cd



[Index of Archives]     [Reiser Filesystem Development]     [Ceph FS]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite National Park]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]     [Linux Media]

  Powered by Linux