Received-SPF: pass (google.com: domain of linux-ext4+bounces-1670-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Fri, 15 Mar 2024 22:00:21 -0400
From: "Theodore Ts'o" <tytso@mit.edu>
To: cheung wall <zzqq0103.hey@gmail.com>
Cc: Andreas Dilger <adilger.kernel@dilger.ca>, linux-ext4@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: KASAN: slab-use-after-free Read in ext4_find_extent
Message-ID: <20240316020021.GD143836@mit.edu>
References: <CAKHoSAu2+dDCR9Dgd4PGYJg2qBqKO+kNThaoFdfVi-AheS3S7w@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAKHoSAu2+dDCR9Dgd4PGYJg2qBqKO+kNThaoFdfVi-AheS3S7w@mail.gmail.com>

On Thu, Mar 14, 2024 at 02:58:04PM +0800, cheung wall wrote:
> Hello,
> 
> when using Healer to fuzz the latest Linux Kernel, the following crash
> 
> was triggered on:
> 

> HEAD commit: e8f897f4afef0031fe618a8e94127a0934896aba  (tag: v6.8)
> 
> git tree: upstream
> 
> console output: https://pastebin.com/raw/YBKrQHxW
> 
> kernel config: https://pastebin.com/raw/SJFReJfc
> 
> C reproducer: https://pastebin.com/raw/GUVzwEmx
> 
> Syzlang reproducer: https://pastebin.com/raw/9KqQRP2e
> 
> If you fix this issue, please add the following tag to the commit:
> 
> Reported-by: Qiang Zhang <zzqq0103.hey@gmail.com>

This is not reproducible using the above-specified kernel version,
kernel config, and C reproducer using kvm-xfstests.

In any case, looking at the C reproducer, it looks like the reproducer
involves forcibly deactivating the loop device, which requires root
privileges, and so this is not a terribly intereseting bug report.

	    	   	       - Ted