fix null-ptr-deref in '__ext4_journal_ensure_credits'

[ 1901.129556] EXT4-fs (vda): Ignoring removed bh option
[ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user
[ 1901.130901] Aborting journal on device vda-8.
[ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal
[ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal
[ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal
[ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal
[ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted
[ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal
[ 1901.136915] ==================================================================
[ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4]
[ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal
[ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal
[ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968
[ 1901.138817]
[ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal
[ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1
[ 1901.146479] Hardware name: linux,dummy-virt (DT)
[ 1901.147317] Call trace:
[ 1901.147552]  dump_backtrace+0x0/0x2d8
[ 1901.147898]  show_stack+0x28/0x38
[ 1901.148215]  dump_stack+0xec/0x15c
[ 1901.148746]  kasan_report+0x108/0x338
[ 1901.149207]  __asan_load8+0x58/0xb0
[ 1901.149753]  __ext4_journal_ensure_credits+0x74/0x140 [ext4]
[ 1901.150579]  ext4_xattr_delete_inode+0xe4/0x700 [ext4]
[ 1901.151316]  ext4_evict_inode+0x524/0xba8 [ext4]
[ 1901.151985]  evict+0x1a4/0x378
[ 1901.152353]  iput+0x310/0x428
[ 1901.152733]  do_unlinkat+0x260/0x428
[ 1901.153056]  __arm64_sys_unlinkat+0x6c/0xc0
[ 1901.153455]  el0_svc_common+0xc8/0x320
[ 1901.153799]  el0_svc_handler+0xf8/0x160
[ 1901.154265]  el0_svc+0x10/0x218
[ 1901.154682] ==================================================================
[ 1901.155322] Disabling lock debugging due to kernel taint
[ 1901.156787] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 1901.157496] Mem abort info:
[ 1901.157715]   ESR = 0x96000006
[ 1901.157949]   Exception class = DABT (current EL), IL = 32 bits
[ 1901.158385]   SET = 0, FnV = 0
[ 1901.158624]   EA = 0, S1PTW = 0
[ 1901.158882] Data abort info:
[ 1901.159111]   ISV = 0, ISS = 0x00000006
[ 1901.159396]   CM = 0, WnR = 0
[ 1901.159753] user pgtable: 4k pages, 48-bit VAs, pgdp = 000000006ed1962d
[ 1901.160323] [0000000000000000] pgd=0000000064b62003, pud=0000000064b63003, pmd=0000000000000000
[ 1901.160958] Internal error: Oops: 96000006 [#1] SMP
[ 1901.161333] Process syz-executor.17 (pid: 968, stack limit = 0x0000000025b97b1c)
[ 1901.161898] CPU: 1 PID: 968 Comm: syz-executor.17 Tainted: G    B             4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1
[ 1901.162864] Hardware name: linux,dummy-virt (DT)
[ 1901.163218] pstate: 80400005 (Nzcv daif +PAN -UAO)
[ 1901.163712] pc : __ext4_journal_ensure_credits+0x74/0x140 [ext4]
[ 1901.164332] lr : __ext4_journal_ensure_credits+0x74/0x140 [ext4]
[ 1901.164880] sp : ffffc6b2e4bef970
[ 1901.165188] x29: ffffc6b2e4bef970 x28: 0000000000000000
[ 1901.165703] x27: ffffc6b3672fb820 x26: ffffc6b2c882c478
[ 1901.166209] x25: 0000000000000000 x24: 0000000000000006
[ 1901.166718] x23: 0000000000000006 x22: 0000000000000000
[ 1901.167248] x21: 0000000000000001 x20: 0000000000000000
[ 1901.167693] x19: ffffc6b2c882c478 x18: 0000000000000000
[ 1901.168181] x17: 0000000000000000 x16: ffff2000c26ea078
[ 1901.168637] x15: 0000000000000000 x14: 3d3d3d3d3d3d3d3d
[ 1901.169088] x13: 3d3d3d3d3d3d3d3d x12: 3d3d3d3d3d3d3d3d
[ 1901.169536] x11: 1fffe40018948e43 x10: ffff040018948e43
[ 1901.170008] x9 : dfff200000000000 x8 : 6e72656b206f7420
[ 1901.170492] x7 : 65756420676e6967 x6 : dfff200000000000
[ 1901.170973] x5 : 0000000000000001 x4 : ffffc6b39b7a6468
[ 1901.171451] x3 : ffff2000c2200000 x2 : 0000000000000000
[ 1901.171933] x1 : 2341a0b0706edb00 x0 : 0000000000000000
[ 1901.172415] Call trace:
[ 1901.172691]  __ext4_journal_ensure_credits+0x74/0x140 [ext4]
[ 1901.173216]  ext4_xattr_delete_inode+0xe4/0x700 [ext4]
[ 1901.173701]  ext4_evict_inode+0x524/0xba8 [ext4]
[ 1901.174100]  evict+0x1a4/0x378
[ 1901.174396]  iput+0x310/0x428
[ 1901.174666]  do_unlinkat+0x260/0x428
[ 1901.174982]  __arm64_sys_unlinkat+0x6c/0xc0
[ 1901.175337]  el0_svc_common+0xc8/0x320
[ 1901.175655]  el0_svc_handler+0xf8/0x160
[ 1901.176026]  el0_svc+0x10/0x218
[ 1901.176318] Code: 350000b4 9402a960 aa1903e0 9402a5ba (f9400339)
[ 1901.176865] kernel fault(0x1) notification starting on CPU 1
[ 1901.177418] kernel fault(0x1) notification finished on CPU 1
[ 1901.177975] Modules linked in: ext4 mbcache jbd2 dm_multipath virtio_net net_failover virtio_blk failover virtio_rng virtio_pci virtio_mmio virtio_ring virtio sunrpc dm_mirror dm_region_hash dm_log dm_mod
[ 1901.179791] ---[ end trace 089838aa3172648f ]---
[ 1901.180255] Kernel panic - not syncing: Fatal exception
[ 1901.180777] kernel fault(0x5) notification starting on CPU 1
[ 1901.181326] kernel fault(0x5) notification finished on CPU 1
[ 1901.181883] SMP: stopping secondary CPUs
[ 1901.182335] Kernel Offset: 0x42200000 from 0xffff200080000000
[ 1901.182927] CPU features: 0x12,aaa00238
[ 1901.183347] Memory Limit: none
[ 1901.183761] kernel reboot(0x2) notification starting on CPU 1
[ 1901.184496] kernel reboot(0x2) notification finished on CPU 1
[ 1901.185346] ---[ end Kernel panic - not syncing: Fatal exception ]---

GVP openEuler/kernel
关闭

内容风险标识

评论 (2)

GVPopenEuler/kernel关闭

内容风险标识