From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3740DC3DA7C for ; Mon, 2 Jan 2023 05:41:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231167AbjABFl1 (ORCPT ); Mon, 2 Jan 2023 00:41:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49508 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230246AbjABFlY (ORCPT ); Mon, 2 Jan 2023 00:41:24 -0500 Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 75F0925CF for ; Sun, 1 Jan 2023 21:41:22 -0800 (PST) Received: by mail-wr1-x432.google.com with SMTP id w1so13338266wrt.8 for ; Sun, 01 Jan 2023 21:41:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=jvJuMP+L/v0VaSUSwJcVqo54T4tBiI2lngCqwC2iFRY=; b=jdE+clNc/4TDQB8whIIyEl2ZSBNq5czPHTE9de0nJW2ABylXLDESIP47gOK+ETeBfV yPv9YmhZfMp4/MO/t/Pd9AQwbdpkYiy0yZQaHx9AyWss5NyTwJwp0l00YR6RZCdXyqXD 7SaBlPu7Ct7rtHLV/zsIPdbZ6xmYILCwB+BJEhh+4Z2LHT9aerKZsfXbyxImb4HdF2Cr nmNSBvEcfroDdKaWzt1qBqoHyk5fNsHXLQjxl7Trd4q+b7ga53d21CxebVeiGubzl5vF WDG3+6HoQ9TniYJqiNx994VeG57FVOK+kcayF90vvY5Lpd/DHiv/9xeCzQy0hQVdpSAc 7nCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=jvJuMP+L/v0VaSUSwJcVqo54T4tBiI2lngCqwC2iFRY=; b=pje3Y63I1YuXx+9vnKYZghJKUL6gQAguLy+MESESVPaNQ6ZOfXxOyxejIocbsQ0BEH k0O+urBelorB+pZH+zXXEulLTYKHHAAbc2sF20fvzrJPYL4LsDaGEtxMjXll/AshGMAN xmPDNMZDrxVpAXt1J6Vi+PbVa5Kix/6zbTgA/3W8UhlQnvkwpJyNomzNlO5krJgmmbLx fwkwlDlp6Rv6576pRQqA5m1xgZUGWZ/JCJazef1EKQkUynSMzWwJDBBvm61lsRW63cbm hmnyXwxArXFHuMk0T4qilYPDL3xFvHAb2iKWnVFchUHLJD9rqzcVyEkR8oyUND/7vn/S MgNw== X-Gm-Message-State: AFqh2kr/JohKpBswuJUNfjOSRAoZJL5NkU1HGQPgjBuXyJWhx/70av8W 02ekhWwafsXBTP8D+k9K2m2sEg== X-Google-Smtp-Source: AMrXdXs5EtV/UCpCmjN/PveRZ2nIvMPUeyMOlaloRrFdNtQBaE+E7PWBC6E4sF4JfGAlP/qwF7FfhA== X-Received: by 2002:a5d:5908:0:b0:279:4938:eb98 with SMTP id v8-20020a5d5908000000b002794938eb98mr18309009wrd.11.1672638080618; Sun, 01 Jan 2023 21:41:20 -0800 (PST) Received: from [192.168.0.104] ([82.77.81.242]) by smtp.gmail.com with ESMTPSA id l17-20020adfe9d1000000b0024165454262sm27106850wrn.11.2023.01.01.21.41.19 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 01 Jan 2023 21:41:20 -0800 (PST) Message-ID: Date: Mon, 2 Jan 2023 07:41:18 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.4.2 Subject: Re: [PATCH v2] ext4: Fix possible use-after-free in ext4_find_extent To: Eric Biggers Cc: tytso@mit.edu, adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, joneslee@google.com, syzbot+0827b4b52b5ebf65f219@syzkaller.appspotmail.com, stable@vger.kernel.org References: <20221230062931.2344157-1-tudor.ambarus@linaro.org> Content-Language: en-US From: Tudor Ambarus In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org On 30.12.2022 22:07, Eric Biggers wrote: > On Fri, Dec 30, 2022 at 01:42:45PM +0200, Tudor Ambarus wrote: >> >> Seems that __ext4_iget() is not called on writes. > > It is called when the inode is first accessed. Usually that's when the file is > opened. Okay, thanks. > > So the question is why didn't it validate the inode's extent header, or > alternatively how did the inode's extent header get corrupted afterwards. > >> You can find below the sequence of calls that leads to the bug. > > A stack trace is not a reproducer. Things must have happened before that point. > I will try to dig more to understand what's happening. If you like to take a look into the reproducer, here it is: https://syzkaller.appspot.com/text?tag=ReproC&x=17beb560480000 The reproducer was used for Android 5.15 and the bug is reported at [1], but as I mentioned earlier, using the same reproducer and config I hit the bug on v6.2-rc1 as well. Thanks for the help. ta [1] https://syzkaller.appspot.com/bug?id=be6e90ce70987950e6deb3bac8418344ca8b96cd