Re: divide error in mb_update_avg_fragment_size

Re: divide error in mb_update_avg_fragment_size

[xingwei lee]

Hello I saw you can't reproduce this bug and I reproduce it with
repro.c and repro.txt
I test the repro.c in the lastest HEAD: 5e3f5b81de80c98338bcb47c233aebefee5a4801
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6ae1a4ee971a7305
and the bug also existed.

=* repro.c =*
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms) { usleep(ms * 1000); }

static uint64_t current_time_ms(void) {
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...) {
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1) return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status) {
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid) return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent) break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test() {
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void) {
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0) exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break;
      sleep_ms(1);
      if (current_time_ms() - start < 5000) continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0xffffffffffffffff, 0xffffffffffffffff};

void execute_one(void) {
  intptr_t res = 0;
  memcpy((void*)0x20000280, "cgroup.controllers\000", 19);
  res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000280ul,
                /*flags=*/0x275aul, /*mode=*/0ul);
  if (res != -1) r[0] = res;
  memcpy((void*)0x20000180, "cgroup.controllers\000", 19);
  res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000180ul,
                /*flags=*/0x275aul, /*mode=*/0ul);
  if (res != -1) r[1] = res;
  res = syscall(__NR_dup3, /*oldfd=*/r[1], /*newfd=*/r[0], /*flags=*/0ul);
  if (res != -1) r[2] = res;
  *(uint32_t*)0x20000140 = 0x20;
  *(uint32_t*)0x20000144 = 0x8c8c;
  *(uint32_t*)0x20000148 = 0;
  *(uint32_t*)0x2000014c = 0;
  *(uint32_t*)0x20000150 = 0;
  memset((void*)0x20000154, 0, 8);
  syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x401c5820, /*arg=*/0x20000140ul);
  sprintf((char*)0x20000040, "0x%016llx", (long long)0);
  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x20000040ul, /*len=*/0xfea0ul);
  memcpy((void*)0x200001c0, "cpuset.effective_cpus\000", 22);
  res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200001c0ul,
                /*flags=*/0x275aul, /*mode=*/0ul);
  if (res != -1) r[3] = res;
  sprintf((char*)0x20000380, "0x%016llx", (long long)0);
  syscall(__NR_write, /*fd=*/r[3], /*buf=*/0x20000380ul, /*len=*/0x101bful);
  syscall(__NR_ioctl, /*fd=*/r[3], /*cmd=*/0x660c, 0);
  *(uint32_t*)0x200000c0 = 0;
  *(uint32_t*)0x200000c4 = r[3];
  *(uint64_t*)0x200000c8 = 7;
  *(uint64_t*)0x200000d0 = 0;
  *(uint64_t*)0x200000d8 = 0;
  *(uint64_t*)0x200000e0 = 0;
  syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0xc028660f, /*arg=*/0x200000c0ul);
  syscall(__NR_writev, /*fd=*/-1, /*vec=*/0ul, /*vlen=*/0ul);
  syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x40045569, /*arg=*/9ul);
  syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0ul, /*flags=*/0x275aul,
          /*mode=*/0ul);
  memcpy((void*)0x20000180, "cgroup.controllers\000", 19);
  res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000180ul,
                /*flags=*/0x275aul, /*mode=*/0ul);
  if (res != -1) r[4] = res;
  *(uint64_t*)0x200000c0 = 4;
  *(uint64_t*)0x200000c8 = 0x16000000000000;
  *(uint64_t*)0x200000d0 = 0x20;
  syscall(__NR_ioctl, /*fd=*/r[4], /*cmd=*/0xc0185879, /*arg=*/0x200000c0ul);
}
int main(void) {
  syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
          /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
  for (procid = 0; procid < 4; procid++) {
    if (fork() == 0) {
      loop();
    }
  }
  sleep(1000000);
  return 0;
}

=* repro.txt =*
r0 = openat$cgroup_ro(0xffffffffffffff9c,
&(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c,
&(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0)
r2 = dup3(r1, r0, 0x0)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000140)={0x20, 0x8c8c})
write$cgroup_int(r0, &(0x7f0000000040), 0xfea0)
r3 = openat$cgroup_ro(0xffffffffffffff9c,
&(0x7f00000001c0)='cpuset.effective_cpus\x00', 0x275a, 0x0)
write$cgroup_int(r3, &(0x7f0000000380), 0x101bf)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r3, 0x660c)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f00000000c0)={0x0, r3, 0x7})
writev(0xffffffffffffffff, 0x0, 0x0)
ioctl$UI_SET_LEDBIT(0xffffffffffffffff, 0x40045569, 0x9)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c,
&(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0)
ioctl$FITRIM(r4, 0xc0185879, &(0x7f00000000c0)={0x4, 0x16000000000000, 0x20})

and also https://gist.github.com/xrivendell7/bad992c2b716ed14310efa2c6f878b7c

Re: divide error in mb_update_avg_fragment_size

[Baokun Li]

On 2023/12/8 22:12, xingwei lee wrote:
> Hello I saw you can't reproduce this bug and I reproduce it with
> repro.c and repro.txt
> I test the repro.c in the lastest HEAD: 5e3f5b81de80c98338bcb47c233aebefee5a4801
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6ae1a4ee971a7305
> and the bug also existed.

Hello xingwei!

Thanks for the reproducer!

The problem is that the same range of physical blocks are freed in
ext4_mb_release_inode_pa() and ext4_process_freed_data() successively.
Thus in mb_free_blocks() bb_free is added twice, while bb_fragments
is added only once, the second time exiting early due to checking
for release of already freed blocks. So when fstrim marks all the
blocks in the group as already used, bb_free not being 0 and
bb_fragments being 0 triggers a divide-by-zero problem in
mb_update_avg_fragment_size().

We should avoid freeing blocks in ext4_mb_release_inode_pa() that
are about to be freed in ext4_process_freed_data().  I will send out
a patch after doing some tests.

Cheers!
-- 
With Best Regards,
Baokun Li
.

divide error in mb_update_avg_fragment_size

[Wei Chen]

Dear Linux Developers,

Recently, when using our tool to fuzz kernel, the following crash was triggered.

HEAD commit: 147307c69ba
git tree: linux-next
compiler: clang 12.0.0
console output:
https://drive.google.com/file/d/1tComytzKYQKzKfiS1PwrKBLQJwZn4usl/view?usp=share_link
kernel config: https://drive.google.com/file/d/1NAf4S43d9VOKD52xbrqw-PUP1Mbj8z-S/view?usp=share_link

Unfortunately, I didn't have a reproducer for this crash. When calling
ioctl with command FITRIM, the variable grp->bb_fragments is zero,
thus leading to divide error when executing grp->bb_free /
grp->bb_fragments. I'm wondering if a sanity check is missing when
handling malicious disk image.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: Wei Chen <harperchen1110@gmail.com>

divide error: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 8874 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014
RIP: 0010:mb_update_avg_fragment_size+0x84/0x2e0 fs/ext4/mballoc.c:835
Code: 41 5f 5d c3 49 8d 7e 14 e8 a9 38 ca ff 41 8b 5e 14 31 ff 89 de
e8 ac d3 b6 ff 85 db 74 61 49 8d 7e 18 e8 8f 38 ca ff 89 d8 99 <41> f7
7e 18 89 44 24 14 bb ff ff ff ff 0f bd 5c 24 14 8d 73 ff 45
RSP: 0018:ffffc90001bf3a60 EFLAGS: 00010246
RAX: 0000000000000456 RBX: 0000000000000456 RCX: ffffffff8170e251
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88810204e018
RBP: ffff8881030de800 R08: 000188810204e01b R09: 0000000000000000
R10: 0001ffffffffffff R11: 000188810204e020 R12: 0000000000008000
R13: ffff88810315b000 R14: ffff88810204e000 R15: ffffc90001bf3cc0
FS:  00007f4a1db97700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ebcf207bd0 CR3: 0000000131681000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 mb_mark_used+0xb5c/0xcc0 fs/ext4/mballoc.c:1958
 ext4_trim_extent+0xd4/0x340 fs/ext4/mballoc.c:6352
 ext4_try_to_trim_range+0x194/0x460 fs/ext4/mballoc.c:6382
 ext4_trim_all_free+0x26e/0x3d0 fs/ext4/mballoc.c:6444
 ext4_trim_fs+0x56b/0x6d0 fs/ext4/mballoc.c:6540
 __ext4_ioctl+0x13b6/0x2990 fs/ext4/ioctl.c:1483
 ext4_ioctl+0x1e/0x30 fs/ext4/ioctl.c:1606
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:856
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x4697f9
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4a1db96c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000077bf80 RCX: 00000000004697f9
RDX: 0000000020000040 RSI: 00000000c0185879 RDI: 0000000000000004
RBP: 00000000004d29e9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf80
R13: 0000000000000000 R14: 000000000077bf80 R15: 00007fffbabb2d30
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mb_update_avg_fragment_size+0x84/0x2e0 fs/ext4/mballoc.c:835
Code: 41 5f 5d c3 49 8d 7e 14 e8 a9 38 ca ff 41 8b 5e 14 31 ff 89 de
e8 ac d3 b6 ff 85 db 74 61 49 8d 7e 18 e8 8f 38 ca ff 89 d8 99 <41> f7
7e 18 89 44 24 14 bb ff ff ff ff 0f bd 5c 24 14 8d 73 ff 45
RSP: 0018:ffffc90001bf3a60 EFLAGS: 00010246
RAX: 0000000000000456 RBX: 0000000000000456 RCX: ffffffff8170e251
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88810204e018
RBP: ffff8881030de800 R08: 000188810204e01b R09: 0000000000000000
R10: 0001ffffffffffff R11: 000188810204e020 R12: 0000000000008000
R13: ffff88810315b000 R14: ffff88810204e000 R15: ffffc90001bf3cc0
FS:  00007f4a1db97700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ebcf207bd0 CR3: 0000000131681000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0: 41 5f                 pop    %r15
   2: 5d                   pop    %rbp
   3: c3                   retq
   4: 49 8d 7e 14           lea    0x14(%r14),%rdi
   8: e8 a9 38 ca ff       callq  0xffca38b6
   d: 41 8b 5e 14           mov    0x14(%r14),%ebx
  11: 31 ff                 xor    %edi,%edi
  13: 89 de                 mov    %ebx,%esi
  15: e8 ac d3 b6 ff       callq  0xffb6d3c6
  1a: 85 db                 test   %ebx,%ebx
  1c: 74 61                 je     0x7f
  1e: 49 8d 7e 18           lea    0x18(%r14),%rdi
  22: e8 8f 38 ca ff       callq  0xffca38b6
  27: 89 d8                 mov    %ebx,%eax
  29: 99                   cltd
* 2a: 41 f7 7e 18           idivl  0x18(%r14) <-- trapping instruction
  2e: 89 44 24 14           mov    %eax,0x14(%rsp)
  32: bb ff ff ff ff       mov    $0xffffffff,%ebx
  37: 0f bd 5c 24 14       bsr    0x14(%rsp),%ebx
  3c: 8d 73 ff             lea    -0x1(%rbx),%esi
  3f: 45                   rex.RB

Best,
Wei