Bug 199275

Created attachment 275091 [details]
The crafted image which causes kernel panic

- Overview
Invalid pointer dereference in ext4_get_group_info() when mounting a crafted ext4 image

- Reproduce (tested on 4.4/4.15)
# mkdir mnt
# mount -t ext4 88.img mnt

- Reason
https://elixir.bootlin.com/linux/v4.15/source/fs/ext4/ext4.h#L2766
Kernel misses sanitary check on EXT4_SB(sb)->s_group_info in ext4_get_group_info

- Kernel dump 
[   48.581147] EXT4-fs (loop0): barriers disabled
[   48.581223] JBD2: Clearing recovery information on journal
[   48.584375] EXT4-fs (loop0): corrupt root inode, run e2fsck
[   48.584455] BUG: unable to handle kernel NULL pointer dereference at           (null)
[   48.584485] IP: [<ffffffff812de12d>] ext4_free_blocks+0x1ed/0xc00
[   48.584513] PGD 80000000392b0067 PUD 39281067 PMD 0
[   48.584534] Oops: 0000 [#1] SMP
[   48.584549] Modules linked in: vmw_vsock_vmci_transport vsock ppdev vmw_balloon coretemp joydev input_leds serio_raw uvcvideo snd_ens1371 videobuf2_vmalloc snd_ac97_codec videobuf2_memops videobuf2_v4l2 gameport videobuf2_core snd_rawmidi v4l2_common snd_seq_device ac97_bus btusb btrtl videodev snd_pcm btbcm btintel bluetooth snd_timer media snd soundcore vmw_vmci i2c_piix4 shpchp nfit 8250_fintek parport_pc parport mac_hid ib_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper
[   48.584896]  cryptd vmwgfx ttm psmouse drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops mptspi mptscsih ahci libahci e1000 drm mptbase scsi_transport_spi pata_acpi fjes
[   48.584974] CPU: 0 PID: 1387 Comm: mount Not tainted 4.4.0-116-generic #140-Ubuntu
[   48.584999] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
[   48.585033] task: ffff880037b3aa00 ti: ffff8800393d4000 task.ti: ffff8800393d4000
[   48.585058] RIP: 0010:[<ffffffff812de12d>]  [<ffffffff812de12d>] ext4_free_blocks+0x1ed/0xc00
[   48.585089] RSP: 0018:ffff8800393d7988  EFLAGS: 00010246
[   48.585107] RAX: ffff88003786f800 RBX: 0000000000000001 RCX: 0000000000000000
[   48.585129] RDX: 0000000000000020 RSI: 0000000000000000 RDI: 0000000000000000
[   48.585152] RBP: ffff8800393d7a60 R08: ffff8800393d79ec R09: ffff8800393d79e8
[   48.585198] R10: ffff8800393d7880 R11: ffff8800395d7988 R12: 0000000000000001
[   48.585219] R13: ffff88003786f000 R14: 0000000000000001 R15: 000000000000002c
[   48.585240] FS:  00007f228f21b840(0000) GS:ffff88003c600000(0000) knlGS:0000000000000000
[   48.585264] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   48.585281] CR2: 0000000000000000 CR3: 0000000033684000 CR4: 0000000000160670
[   48.585337] Stack:
[   48.585345]  000000000000002c ffff8800395a74e0 ffff8800395a7548 ffffffff81f3c9c0
[   48.585372]  ffff8800395a72d8 ffff8800395a7340 ffff88003af29000 ffff88003786f000
[   48.585398]  0000000000000001 00000013812cc1d0 ffff88003786f800 ffff8800395d7a58
[   48.585425] Call Trace:
[   48.586053]  [<ffffffff8124bddd>] ? __find_get_block+0x10d/0x120
[   48.586737]  [<ffffffff812d0708>] ext4_ext_remove_space+0xa68/0x11f0
[   48.587402]  [<ffffffff812d2dfe>] ext4_ext_truncate+0x9e/0xd0
[   48.588029]  [<ffffffff812a5a04>] ext4_truncate+0x364/0x460
[   48.588624]  [<ffffffff812a6697>] ext4_evict_inode+0x3f7/0x4f0
[   48.589215]  [<ffffffff8122f9f1>] evict+0xc1/0x190
[   48.589780]  [<ffffffff8122fcd7>] iput+0x1c7/0x250
[   48.590504]  [<ffffffff812c69ff>] ext4_fill_super+0x1ecf/0x3020
[   48.591058]  [<ffffffff81217410>] mount_bdev+0x270/0x2c0
[   48.591601]  [<ffffffff812c4b30>] ? ext4_calculate_overhead+0x3c0/0x3c0
[   48.592091]  [<ffffffff812b5595>] ext4_mount+0x15/0x20
[   48.592581]  [<ffffffff81217e4d>] mount_fs+0x3d/0x170
[   48.593060]  [<ffffffff811b7575>] ? __alloc_percpu+0x15/0x20
[   48.593509]  [<ffffffff81234647>] vfs_kern_mount+0x67/0x110
[   48.593959]  [<ffffffff81236cff>] do_mount+0x25f/0xda0
[   48.594460]  [<ffffffff81215c33>] ? __fput+0x193/0x230
[   48.594904]  [<ffffffff811f5bd6>] ? __kmalloc_track_caller+0x1b6/0x250
[   48.595302]  [<ffffffff811b1d32>] ? memdup_user+0x42/0x70
[   48.595687]  [<ffffffff81237b7f>] SyS_mount+0x9f/0x100
[   48.596065]  [<ffffffff8184efc8>] entry_SYSCALL_64_fastpath+0x1c/0xbb
[   48.596435] Code: ff 49 8b 85 58 04 00 00 8b 75 8c 3b 70 40 0f 83 35 08 00 00 8b 88 a8 00 00 00 89 f2 48 8b b8 78 02 00 00 d3 ea 89 d1 48 8b 50 38 <48> 8b 0c cf 48 83 ea 01 21 f2 48 8b 14 d1 48 8b 12 83 e2 04 0f
[   48.597819] RIP  [<ffffffff812de12d>] ext4_free_blocks+0x1ed/0xc00
[   48.598225]  RSP <ffff8800393d7988>
[   48.598598] CR2: 0000000000000000
[   48.598996] ---[ end trace 6f4a81a91bc49fd0 ]---

- Credit
Reported by Wen Xu from SSLab, Gatech