general protection fault in __bch2_trans_commit

From: Ubisectech Sirius <hidden>
Date: 2024-05-20 06:59:21
Also in: lkml

Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.7. Attached to the email were a PoC file of the issue.

Stack dump:
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 PID: 10008 Comm: syz-executor.3 Not tainted 6.7.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:bch2_snapshot_is_internal_node fs/bcachefs/snapshot.h:143 [inline]
RIP: 0010:btree_insert_entry_checks fs/bcachefs/btree_trans_commit.c:318 [inline]
RIP: 0010:__bch2_trans_commit+0x1630/0x6d60 fs/bcachefs/btree_trans_commit.c:1060
Code: 26 5b c7 fd 8b 85 e8 fe ff ff 85 c0 0f 85 2d 3b 00 00 e8 73 5f c7 fd 41 f7 d4 49 6b c4 38 49 8d 7c 06 14 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ea
RSP: 0018:ffffc90002437378 EFLAGS: 00010203
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: ffffc90005fa2000
RDX: 0000000000040000 RSI: ffffffff83c296dd RDI: 0000000000000014
RBP: ffffc90002437550 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff83c29668 R12: 0000000000000000
R13: ffff88804c65a558 R14: 0000000000000000 R15: ffff88804c65a560
FS:  00007ffb04b55640(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f48f35daf88 CR3: 000000005ca2c000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 bch2_trans_commit fs/bcachefs/btree_update.h:137 [inline]
 __bch2_create+0x857/0xeb0 fs/bcachefs/fs.c:280
 bch2_mknod fs/bcachefs/fs.c:379 [inline]
 bch2_create+0x41/0xc0 fs/bcachefs/fs.c:393
 lookup_open.isra.0+0xfc9/0x1370 fs/namei.c:3477
 open_last_lookups fs/namei.c:3546 [inline]
 path_openat+0xa89/0x26d0 fs/namei.c:3776
 do_filp_open+0x1c9/0x420 fs/namei.c:3809
 do_sys_openat2+0x164/0x1d0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_creat fs/open.c:1528 [inline]
 __se_sys_creat fs/open.c:1522 [inline]
 __x64_sys_creat+0xcd/0x120 fs/open.c:1522
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x43/0x120 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7ffb03e8fd6d
Code: c3 e8 97 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffb04b55028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007ffb03fcbf80 RCX: 00007ffb03e8fd6d
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000480
RBP: 00007ffb03ef14cd R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007ffb03fcbf80 R15: 00007ffb04b35000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_snapshot_is_internal_node fs/bcachefs/snapshot.h:143 [inline]
RIP: 0010:btree_insert_entry_checks fs/bcachefs/btree_trans_commit.c:318 [inline]
RIP: 0010:__bch2_trans_commit+0x1630/0x6d60 fs/bcachefs/btree_trans_commit.c:1060
Code: 26 5b c7 fd 8b 85 e8 fe ff ff 85 c0 0f 85 2d 3b 00 00 e8 73 5f c7 fd 41 f7 d4 49 6b c4 38 49 8d 7c 06 14 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ea
RSP: 0018:ffffc90002437378 EFLAGS: 00010203
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: ffffc90005fa2000
RDX: 0000000000040000 RSI: ffffffff83c296dd RDI: 0000000000000014
RBP: ffffc90002437550 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff83c29668 R12: 0000000000000000
R13: ffff88804c65a558 R14: 0000000000000000 R15: ffff88804c65a560
FS:  00007ffb04b55640(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f48f34f56c6 CR3: 000000005ca2c000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:   fd                      std
   1:   8b 85 e8 fe ff ff       mov    -0x118(%rbp),%eax
   7:   85 c0                   test   %eax,%eax
   9:   0f 85 2d 3b 00 00       jne    0x3b3c
   f:   e8 73 5f c7 fd          call   0xfdc75f87
  14:   41 f7 d4                not    %r12d
  17:   49 6b c4 38             imul   $0x38,%r12,%rax
  1b:   49 8d 7c 06 14          lea    0x14(%r14,%rax,1),%rdi
  20:   48 89 f8                mov    %rdi,%rax
  23:   48 c1 e8 03             shr    $0x3,%rax
* 27:   0f b6 14 18             movzbl (%rax,%rbx,1),%edx <-- trapping instruction
  2b:   48 89 f8                mov    %rdi,%rax
  2e:   83 e0 07                and    $0x7,%eax
  31:   83 c0 03                add    $0x3,%eax
  34:   38 d0                   cmp    %dl,%al
  36:   7c 08                   jl     0x40
  38:   84 d2                   test   %dl,%dl
  3a:   0f                      .byte 0xf
  3b:   85 ea                   test   %ebp,%edx

Thank you for taking the time to read this email and we look forward to working with you further.







Attachments

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help