Re: Use-After-Free Write in jbd2_journal_wait_updates in mainline Linux kernel 5.17

Re: Use-After-Free Write in jbd2_journal_wait_updates in mainline Linux kernel 5.17

[Jan Kara]

On Thu 31-03-22 16:51:59, chill wrote:
> Hello, I found a similar vulnerability in the kernel like this:
> https://groups.google.com/g/syzkaller-bugs/c/AHp-BfwUM50/m/Jas1oKfmAAAJ in
> the kernel: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.17.tar.xz
> REPORT:
> ==================================================================
> BUG: KASAN: use-after-free in instrument_atomic_read_write
> include/linux/instrumented.h:101 [inline]
> BUG: KASAN: use-after-free in atomic_try_cmpxchg_acquire
> include/linux/atomic/atomic-instrumented.h:541 [inline]
> BUG: KASAN: use-after-free in queued_spin_lock
> include/asm-generic/qspinlock.h:82 [inline]
> BUG: KASAN: use-after-free in do_raw_spin_lock include/linux/spinlock.h:185
> [inline]
> BUG: KASAN: use-after-free in __raw_spin_lock
> include/linux/spinlock_api_smp.h:134 [inline]
> BUG: KASAN: use-after-free in _raw_spin_lock+0x73/0xd0
> kernel/locking/spinlock.c:154
> Write of size 4 at addr ffff8880236f11a0 by task syz-executor.2/9557
> 
> CPU: 0 PID: 9557 Comm: syz-executor.2 Not tainted 5.17.0-rc6 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2
> 04/01/2014
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0x4d/0x66 lib/dump_stack.c:106
>  print_address_description.constprop.0+0x1f/0x150 mm/kasan/report.c:255
>  __kasan_report mm/kasan/report.c:442 [inline]
>  kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
>  check_region_inline mm/kasan/generic.c:183 [inline]
>  kasan_check_range+0xf9/0x1e0 mm/kasan/generic.c:189
>  instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
>  atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541
> [inline]
>  queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
>  do_raw_spin_lock include/linux/spinlock.h:185 [inline]
>  __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
>  _raw_spin_lock+0x73/0xd0 kernel/locking/spinlock.c:154
>  spin_lock include/linux/spinlock.h:349 [inline]
>  jbd2_journal_wait_updates+0x1f1/0x280 fs/jbd2/transaction.c:861
>  jbd2_journal_lock_updates+0x13a/0x2e0 fs/jbd2/transaction.c:896
>  ext4_ioctl_checkpoint fs/ext4/ioctl.c:1085 [inline]
>  __ext4_ioctl+0xb5b/0x44f0 fs/ext4/ioctl.c:1562
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:874 [inline]
>  __se_sys_ioctl fs/ioctl.c:860 [inline]
>  __x64_sys_ioctl+0x170/0x1d0 fs/ioctl.c:860
>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>  do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
>  entry_SYSCALL_64_after_hwframe+0x44/0xae

Thanks for report. This should be fixed by commit f7f497cb702 ("jbd2: kill
t_handle_lock transaction spinlock") which got just merged into 5.18-rc1.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: Use-After-Free Write in jbd2_journal_wait_updates in mainline Linux kernel 5.17

[Ritesh Harjani]

On 22/04/01 11:19AM, Jan Kara wrote:
> On Thu 31-03-22 16:51:59, chill wrote:
> > Hello, I found a similar vulnerability in the kernel like this:
> > https://groups.google.com/g/syzkaller-bugs/c/AHp-BfwUM50/m/Jas1oKfmAAAJ in
> > the kernel: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.17.tar.xz
> > REPORT:
> > ==================================================================
> > BUG: KASAN: use-after-free in instrument_atomic_read_write
> > include/linux/instrumented.h:101 [inline]
> > BUG: KASAN: use-after-free in atomic_try_cmpxchg_acquire
> > include/linux/atomic/atomic-instrumented.h:541 [inline]
> > BUG: KASAN: use-after-free in queued_spin_lock
> > include/asm-generic/qspinlock.h:82 [inline]
> > BUG: KASAN: use-after-free in do_raw_spin_lock include/linux/spinlock.h:185
> > [inline]
> > BUG: KASAN: use-after-free in __raw_spin_lock
> > include/linux/spinlock_api_smp.h:134 [inline]
> > BUG: KASAN: use-after-free in _raw_spin_lock+0x73/0xd0
> > kernel/locking/spinlock.c:154
> > Write of size 4 at addr ffff8880236f11a0 by task syz-executor.2/9557
> >
> > CPU: 0 PID: 9557 Comm: syz-executor.2 Not tainted 5.17.0-rc6 #1
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2
> > 04/01/2014
> > Call Trace:
> >  <TASK>
> >  __dump_stack lib/dump_stack.c:88 [inline]
> >  dump_stack_lvl+0x4d/0x66 lib/dump_stack.c:106
> >  print_address_description.constprop.0+0x1f/0x150 mm/kasan/report.c:255
> >  __kasan_report mm/kasan/report.c:442 [inline]
> >  kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
> >  check_region_inline mm/kasan/generic.c:183 [inline]
> >  kasan_check_range+0xf9/0x1e0 mm/kasan/generic.c:189
> >  instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
> >  atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541
> > [inline]
> >  queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
> >  do_raw_spin_lock include/linux/spinlock.h:185 [inline]
> >  __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
> >  _raw_spin_lock+0x73/0xd0 kernel/locking/spinlock.c:154
> >  spin_lock include/linux/spinlock.h:349 [inline]
> >  jbd2_journal_wait_updates+0x1f1/0x280 fs/jbd2/transaction.c:861
> >  jbd2_journal_lock_updates+0x13a/0x2e0 fs/jbd2/transaction.c:896
> >  ext4_ioctl_checkpoint fs/ext4/ioctl.c:1085 [inline]
> >  __ext4_ioctl+0xb5b/0x44f0 fs/ext4/ioctl.c:1562
> >  vfs_ioctl fs/ioctl.c:51 [inline]
> >  __do_sys_ioctl fs/ioctl.c:874 [inline]
> >  __se_sys_ioctl fs/ioctl.c:860 [inline]
> >  __x64_sys_ioctl+0x170/0x1d0 fs/ioctl.c:860
> >  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> >  do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
> >  entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> Thanks for report. This should be fixed by commit f7f497cb702 ("jbd2: kill
> t_handle_lock transaction spinlock") which got just merged into 5.18-rc1.

Thanks Jan,
This I think is now picked by Greg too for 5.17 stable [1].

[1]: https://lore.kernel.org/all/20220325150421.134448886@linuxfoundation.org/

-ritesh