Bug 211237

Summary: kernel squashfs trying to free a free buffer
Product: [Fedora] Fedora Reporter: Steve Grubb <sgrubb>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED CURRENTRELEASE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: phillip, phillip.lougher, security-response-team, spacewar, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 2.6.18-1.2869 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-01-23 18:30:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
problematic image
none
Patch for fsfuzz triggered crashes (against Squashfs 3.1) none

Description Steve Grubb 2006-10-18 00:05:20 UTC 
Description of problem:
Running the file system fuzzer against squashfs, I get the following backtrace
on the 2.6.18-2798 x86_64 kernel:

VFS: brelse: Trying to free free buffer
BUG: warning at fs/buffer.c:1277/__brelse() (Not tainted)

Call Trace:
 [<ffffffff8026929b>] show_trace+0x34/0x47
 [<ffffffff802692c0>] dump_stack+0x12/0x17
 [<ffffffff88576a13>] :squashfs:squashfs_read_data+0x53f/0x57c
 [<ffffffff885780f3>] :squashfs:squashfs_get_cached_block+0x1ee/0x397
 [<ffffffff88579722>] :squashfs:squashfs_iget+0x162/0x12cd
 [<ffffffff885773c2>] :squashfs:squashfs_fill_super+0x972/0xa3a
 [<ffffffff802d51db>] get_sb_bdev+0xf8/0x152
 [<ffffffff802d4cc9>] vfs_kern_mount+0x93/0x11a
 [<ffffffff802d4d92>] do_kern_mount+0x36/0x4d
 [<ffffffff802de132>] do_mount+0x692/0x702
 [<ffffffff8024ad02>] sys_mount+0x8a/0xcd
 [<ffffffff8025c181>] tracesys+0xd1/0xdc
DWARF2 unwinder stuck at tracesys+0xd1/0xdc
Leftover inexact backtrace:

VFS: brelse: Trying to free free buffer
BUG: warning at fs/buffer.c:1277/__brelse() (Not tainted)

Call Trace:
 [<ffffffff8026929b>] show_trace+0x34/0x47
 [<ffffffff802692c0>] dump_stack+0x12/0x17
 [<ffffffff88576a13>] :squashfs:squashfs_read_data+0x53f/0x57c
 [<ffffffff885780f3>] :squashfs:squashfs_get_cached_block+0x1ee/0x397
 [<ffffffff88579722>] :squashfs:squashfs_iget+0x162/0x12cd
 [<ffffffff885773c2>] :squashfs:squashfs_fill_super+0x972/0xa3a
 [<ffffffff802d51db>] get_sb_bdev+0xf8/0x152
 [<ffffffff802d4cc9>] vfs_kern_mount+0x93/0x11a
 [<ffffffff802d4d92>] do_kern_mount+0x36/0x4d
 [<ffffffff802de132>] do_mount+0x692/0x702
 [<ffffffff8024ad02>] sys_mount+0x8a/0xcd
 [<ffffffff8025c181>] tracesys+0xd1/0xdc
DWARF2 unwinder stuck at tracesys+0xd1/0xdc
Leftover inexact backtrace:

SQUASHFS error: sb_bread failed reading block 0x16
SQUASHFS error: Unable to read cache block [2a77:240]
SQUASHFS error: Unable to read inode [2a77:240]


How reproducible:
Always

Steps to Reproduce:
1. ./fsfuzz squashfs
Comment 1 Eric Sandeen 2006-10-29 14:17:33 UTC 
Created attachment 139667 [details]
problematic image

Attached problematic image.
Comment 2 Eric Sandeen 2006-10-29 14:43:39 UTC 
Hm, that may not be the image that caused this exact problem, there are a few of
these floating around w/ different problems.

The tool steve is using is at 
http://projects.info-pull.com/mokb/fsfuzzer-0.6-lmh.tgz

Point it at squashfs and you'll probably eventually hit the original signature here.
Comment 3 Phillip Lougher 2006-10-30 05:02:38 UTC 
I've fixed this bug.  I'm still tracking down another bug thrown up by fsfuzzer,
when I've fixed that I'll attach a patch.  What version of Squashfs are you using?

Phillip
Comment 4 Dave Jones 2006-11-02 23:26:21 UTC 
3.1 I think, but we've got a few tweaks in there to cope with the changes other
patches in our tree have made (we backported the inode diet stuff from .19 for eg).

btw, infamy! http://projects.info-pull.com/mokb/MOKB-02-11-2006.html
Comment 5 Phillip Lougher 2006-11-06 03:50:19 UTC 
Infamy, infamy, they've all got it in for me :-) (apologies to the non-Brits).

A listing on MOKB, and the second bug too...  Sadly not my idea of a good
advertisement.  I've submitted my current fufuzz fixes to Squashfs CVS (along
with support for NFS).  Unfortunately, I've run of time this weekend to do a
patch that I could attach here.
Comment 7 Phillip Lougher 2006-11-15 18:08:50 UTC 
Created attachment 141292 [details]
Patch for fsfuzz triggered crashes (against Squashfs 3.1)

I have attached a patch that fixes this bug, and all other bugs that fsfuzz
triggers.  With this patch applied Squashfs survived 14 consecutive runs of
fsfuzz (I stopped it after 14 runs).

Phillip
Comment 8 Steve Grubb 2006-11-17 13:07:18 UTC 
I built a kernel based off of 2849 + this patch. The kernel does not work. I
don't think it makes it to the point where you see the message about
decrompressing the kernel and immediately goes back to the BIOS.
Comment 9 Phillip Lougher 2006-11-17 14:53:23 UTC 
"I built a kernel based off of 2849 + this patch. The kernel does not work."

This isn't anything to do with my patch.  My patch touches three files, all 
within the Squashfs filesystem.  Changes in these won't cause the issues you 
describe.

Phillip
Comment 10 Steve Grubb 2007-01-23 18:30:59 UTC 
I belive this was fixed in build 2869. Closing.