【OLK 同步】【syzkaller】KASAN: slab-out-of-bounds in crc16

```
[ 2482.041035][T20484] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[ 2482.043306][T20484] ext4 filesystem being mounted at /syzkaller-testdir409982340/syzkaller.cMHHkz/3474/bus supports timestamps until 2038 (0x7fffffff)
[ 2482.050248][T20484] VFS: Open an exclusive opened block device for write loop0. current [20484 syz-executor.0]. parent [1094 syz-executor.0]
[ 2482.055798][T20484] ==================================================================
[ 2482.058483][T20484] BUG: KASAN: slab-out-of-bounds in crc16+0xae/0xc0
[ 2482.060295][T20484] Read of size 1 at addr ffff888057bdd080 by task syz-executor.0/20484
[ 2482.062617][T20484]
[ 2482.063366][T20484] CPU: 2 PID: 20484 Comm: syz-executor.0 Not tainted 5.10.0 #1
[ 2482.065824][T20484] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[ 2482.067942][T20484] Call Trace:
[ 2482.069062][T20484]  dump_stack+0x9c/0xd3
[ 2482.071308][T20484]  print_address_description.constprop.0+0x1e/0x280
[ 2482.073557][T20484]  ? _raw_spin_lock_irqsave+0x80/0xe0
[ 2482.076187][T20484]  ? _raw_write_unlock_irqrestore+0x60/0x60
[ 2482.077846][T20484]  ? vprintk_func+0xb2/0x1d0
[ 2482.079187][T20484]  ? crc16+0xae/0xc0
[ 2482.080308][T20484]  __kasan_report.cold+0x6c/0x84
[ 2482.081781][T20484]  ? crc16+0xae/0xc0
[ 2482.083013][T20484]  kasan_report+0x3a/0x50
[ 2482.084426][T20484]  crc16+0xae/0xc0
[ 2482.085499][T20484]  ext4_group_desc_csum.isra.0+0x609/0x810
[ 2482.087263][T20484]  ? ext4_journalled_writepage_callback+0x1d0/0x1d0
[ 2482.089190][T20484]  ? ext4_read_block_bitmap_nowait+0x1da/0x1360
[ 2482.091038][T20484]  ? ext4_block_bitmap_csum_set+0x29b/0x380
[ 2482.092859][T20484]  ? ext4_block_bitmap_csum_verify+0x3e0/0x3e0
[ 2482.094691][T20484]  ext4_group_desc_csum_set+0xf5/0x180
[ 2482.096445][T20484]  ext4_mb_mark_diskspace_used+0x7b6/0x13c0
[ 2482.098046][T20484]  ? ext4_trim_all_free+0xb00/0xb00
[ 2482.099209][T20484]  ? ext4_mb_new_blocks+0x17d4/0x21f0
[ 2482.100394][T20484]  ? kmem_cache_free+0x91/0x550
[ 2482.101486][T20484]  ext4_mb_new_blocks+0x9f9/0x21f0
[ 2482.102976][T20484]  ? stack_trace_save+0x91/0xd0
[ 2482.104102][T20484]  ? ext4_mb_release_context+0x21d0/0x21d0
[ 2482.105800][T20484]  ? iput+0x1b/0x610
[ 2482.106927][T20484]  ? ext4_xattr_set_entry+0x45e/0x1dd0
[ 2482.108669][T20484]  ext4_new_meta_blocks+0x2d3/0x330
[ 2482.110144][T20484]  ? ext4_should_retry_alloc+0x220/0x220
[ 2482.111918][T20484]  ? __entry_find+0x2c1/0x3b0
[ 2482.113271][T20484]  ? dquot_initialize_needed+0x173/0x260
[ 2482.114874][T20484]  ? __kasan_kmalloc.constprop.0+0xb5/0xe0
[ 2482.116313][T20484]  ext4_xattr_block_set+0xfde/0x2bc0
[ 2482.117549][T20484]  ? ext4_fill_raw_inode+0x1d90/0x1d90
[ 2482.119286][T20484]  ? ext4_xattr_ibody_set+0x370/0x370
[ 2482.121347][T20484]  ? ext4_get_inode_loc+0xbf/0x150
[ 2482.122996][T20484]  ? ext4_get_inode_loc+0xcc/0x150
[ 2482.124210][T20484]  ? errseq_check+0x42/0x80
[ 2482.125718][T20484]  ? ext4_xattr_block_find.isra.0+0x5a/0x660
[ 2482.127675][T20484]  ? ext4_xattr_ibody_find+0xfc/0x4e0
[ 2482.127875][T20508] VFS: Open an write opened block device exclusively loop5. current [20508 syz-executor.5]. parent [28999 syz-executor.5]
[ 2482.128912][T20484]  ? ext4_xattr_ibody_set+0x264/0x370
[ 2482.128939][T20484]  ext4_xattr_set_handle+0xbf3/0x1320
[ 2482.133005][T20508] gfs2: fsid=mounts: Trying to join cluster "lock_nolock", "mounts"
[ 2482.133416][T20484]  ? ext4_xattr_ibody_inline_set+0x370/0x370
[ 2482.133438][T20484]  ? unwind_next_frame+0x1000/0x17c0
[ 2482.134517][T20508] gfs2: fsid=mounts: Now mounting FS...
[ 2482.136464][T20484]  ? __dquot_initialize+0x431/0xbe0
[ 2482.136485][T20484]  ? dquot_quota_disable+0x230/0x230
[ 2482.139751][T20508] gfs2: fsid=mounts.0: journal 0 mapped with 5 extents in 0ms
[ 2482.141588][T20484]  ? ext4_journal_check_start+0x165/0x260
[ 2482.141607][T20484]  ? __ext4_journal_start_sb+0x16b/0x2e0
[ 2482.143092][T21622] gfs2: fsid=mounts.0: jid=0, already locked for use
[ 2482.143700][T20484]  ext4_xattr_set+0x1dc/0x3a0
[ 2482.143718][T20484]  ? ext4_xattr_set_credits+0x120/0x120
[ 2482.145118][T21622] gfs2: fsid=mounts.0: jid=0: Looking at journal...
[ 2482.146456][T20484]  ? inode_has_perm.isra.0+0x13d/0x1a0
[ 2482.146476][T20484]  ? ext4_xattr_user_list+0xa0/0xa0
[ 2482.156989][T20484]  ext4_xattr_user_set+0xae/0xf0
[ 2482.158722][T20484]  __vfs_setxattr+0xfb/0x160
[ 2482.160250][T20484]  ? xattr_resolve_name+0x380/0x380
[ 2482.162265][T20484]  __vfs_setxattr_noperm+0x102/0x430
[ 2482.163750][T20484]  __vfs_setxattr_locked+0x159/0x250
[ 2482.165550][T21622] gfs2: fsid=mounts.0: jid=0: Journal head lookup took 20ms
[ 2482.165611][T20484]  vfs_setxattr+0xed/0x270
[ 2482.167825][T21622] gfs2: fsid=mounts.0: jid=0: Done
[ 2482.169019][T20484]  ? __vfs_setxattr_locked+0x250/0x250
[ 2482.169042][T20484]  ? is_vmalloc_addr+0x76/0xa0
[ 2482.170404][T20508] gfs2: fsid=mounts.0: first mount done, others may mount
[ 2482.173217][T20484]  setxattr+0x219/0x450
[ 2482.173229][T20484]  ? vfs_setxattr+0x270/0x270
[ 2482.173252][T20484]  ? set_next_entity+0x235/0x2190
[ 2482.179936][T20484]  ? __check_object_size+0x13d/0x530
[ 2482.181324][T20484]  ? getname_flags+0x233/0x550
[ 2482.182525][T20484]  ? __schedule+0x91d/0x1c00
[ 2482.183670][T20484]  ? __mnt_want_write+0x168/0x230
[ 2482.184958][T20484]  path_setxattr+0x141/0x160
[ 2482.186587][T20484]  ? __ia32_sys_fsetxattr+0x150/0x150
[ 2482.188217][T20484]  __x64_sys_setxattr+0xc5/0x160
[ 2482.189224][T20484]  do_syscall_64+0x33/0x40
[ 2482.190206][T20484]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[ 2482.191774][T20484] RIP: 0033:0x7f955a0f56cd
[ 2482.192914][T20484] Code: c3 e8 17 32 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 2482.198377][T20484] RSP: 002b:00007f9558662bf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
[ 2482.200551][T20484] RAX: ffffffffffffffda RBX: 00007f955a230f80 RCX: 00007f955a0f56cd
[ 2482.202364][T20484] RDX: 00000000200004c0 RSI: 0000000020000200 RDI: 0000000020000180
[ 2482.204412][T20484] RBP: 00007f955a162d75 R08: 0000000000000000 R09: 0000000000000000
[ 2482.206748][T20484] R10: 00000000000000c0 R11: 0000000000000246 R12: 0000000000000000
[ 2482.208637][T20484] R13: 00007fff3e98256f R14: 00007fff3e982710 R15: 00007f9558662d80
[ 2482.210707][T20484]
[ 2482.211539][T20484] Allocated by task 19066:
[ 2482.212709][T20484]  kasan_save_stack+0x1b/0x40
[ 2482.213936][T20484]  __kasan_kmalloc.constprop.0+0xb5/0xe0
[ 2482.215311][T20484]  kmem_cache_alloc+0x132/0x450
[ 2482.216726][T20484]  __kernfs_new_node+0xd9/0x620
[ 2482.217167][T20497] VFS: Open an write opened block device exclusively loop6. current [20497 syz-executor.6]. parent [1113 syz-executor.6]
[ 2482.217808][T20484]  kernfs_new_node+0x98/0x120
[ 2482.217814][T20484]  __kernfs_create_file+0x54/0x2c0
[ 2482.217820][T20484]  sysfs_add_file_mode_ns+0x1e2/0x460
[ 2482.217828][T20484]  internal_create_group+0x2f9/0xb30
[ 2482.217838][T20484]  internal_create_groups.part.0+0x91/0x130
[ 2482.217846][T20484]  sysfs_create_groups+0x2a/0x50
[ 2482.217858][T20484]  kobject_add_internal+0x55a/0xa40
[ 2482.217864][T20484]  kobject_init_and_add+0xf6/0x160
[ 2482.217872][T20484]  net_rx_queue_update_kobjects+0x1a8/0x410
[ 2482.217878][T20484]  netdev_register_kobject+0x273/0x3a0
[ 2482.217885][T20484]  register_netdevice+0x900/0xf90
[ 2482.217893][T20484]  veth_newlink+0x3bf/0x950
[ 2482.217908][T20484]  __rtnl_newlink+0xe35/0x13d0
[ 2482.238679][T20484]  rtnl_newlink+0x69/0xa0
[ 2482.240038][T20484]  rtnetlink_rcv_msg+0x3b3/0x9d0
[ 2482.241542][T20484]  netlink_rcv_skb+0x139/0x3d0
[ 2482.243260][T20484]  netlink_unicast+0x4d7/0x740
[ 2482.244378][T20484]  netlink_sendmsg+0x6c0/0xcd0
[ 2482.245484][T20484]  sock_sendmsg+0x14e/0x190
[ 2482.246584][T20484]  ____sys_sendmsg+0x6e2/0x950
[ 2482.247570][T20484]  ___sys_sendmsg+0xfd/0x170
[ 2482.248811][T20484]  __sys_sendmsg+0xd8/0x1a0
[ 2482.250216][T20484]  do_syscall_64+0x33/0x40
[ 2482.252128][T20484]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[ 2482.254009][T20484]
[ 2482.254781][T20484] The buggy address belongs to the object at ffff888057bdd000
[ 2482.254781][T20484]  which belongs to the cache kernfs_node_cache of size 128
[ 2482.259147][T20484] The buggy address is located 0 bytes to the right of
[ 2482.259147][T20484]  128-byte region [ffff888057bdd000, ffff888057bdd080)
[ 2482.263539][T20484] The buggy address belongs to the page:
[ 2482.265250][T20484] page:ffffea00015ef740 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57bdd
[ 2482.268114][T20484] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff)
[ 2482.270532][T20484] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888017241200
[ 2482.272870][T20484] raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000
[ 2482.275463][T20484] page dumped because: kasan: bad access detected
[ 2482.277516][T20484]
[ 2482.278301][T20484] Memory state around the buggy address:
[ 2482.279911][T20484]  ffff888057bdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 2482.282422][T20484]  ffff888057bdd000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 2482.284804][T20484] >ffff888057bdd080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 2482.287479][T20484]                    ^
[ 2482.288400][T20484]  ffff888057bdd100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 2482.290812][T20484]  ffff888057bdd180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 2482.293246][T20484] ==================================================================
[ 2482.295862][T20484] Disabling lock debugging due to kernel taint
[ 2482.299166][T20484] Kernel panic - not syncing: panic_on_warn set ...
```

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识