Gentoo Archives: gentoo-hardened

From: ingo.schmitt@×××××××××××××.net
To: gentoo-hardened@l.g.o
Subject: [gentoo-hardened] btrfs size overflow bug since 4.2.6-hardened-r6
Date: Thu, 03 Mar 2016 16:44:28
Message-Id: de5314eb382626c200beb490ef0088c3@binarysignals.net
1 I'm still facing a bug with btrfs that
2 occurs since 4.2.6-hardened-r6 till 4.4.2.
3
4 An similar bug has been patched already
5 https://patchwork.kernel.org/patch/7582351/
6
7 Is someone able to reproduce this?
8
9 Thx!
10
11 my config:
12
13 https://binarysignals.net/pub/linux-4.2.6-hardened-r5.config
14 https://binarysignals.net/pub/emerge--info_e10.txt
15
16 dmesg:
17
18 Feb 20 17:21:22 e10 kernel: PAX: size overflow detected in function
19 btrfs_extent_item_to_extent_map fs/btrfs/file-item.c:913 cicus.463_134
20 min, count: 150, decl: orig_start; num: 0; context: extent_map;
21 Feb 20 17:21:22 e10 kernel: CPU: 0 PID: 4709 Comm: evolution-addre Not
22 tainted 4.4.2-hardened #1
23 Feb 20 17:21:22 e10 kernel: Hardware name: Dell Inc. Latitude E4200
24 /0XRV1H, BIOS A24 06/04/2013
25 Feb 20 17:21:22 e10 kernel: ffff880100000002 c3eced83898a9252
26 0000000000000000 0000000000000391
27 Feb 20 17:21:22 e10 kernel: ffffc90005893630 ffffffffa26152bb
28 ffffffffa9124d70 c3eced83898a9252
29 Feb 20 17:21:22 e10 kernel: ffffffffa9124d70 ffffc90005893660
30 ffffffffa2241e6e ffff8800baa0d2f8
31 Feb 20 17:21:22 e10 kernel: Call Trace:
32 Feb 20 17:21:22 e10 kernel: [<ffffffffa26152bb>] dump_stack+0x57/0x8c
33 Feb 20 17:21:22 e10 kernel: [<ffffffffa2241e6e>]
34 report_size_overflow+0x6e/0x80
35 Feb 20 17:21:22 e10 kernel: [<ffffffffa24c2f68>]
36 btrfs_extent_item_to_extent_map+0x458/0x490
37 Feb 20 17:21:22 e10 kernel: [<ffffffffa24d4a86>]
38 btrfs_get_extent+0xbe6/0xdb0
39 Feb 20 17:21:22 e10 kernel: [<ffffffffa24f9291>] ?
40 submit_extent_page+0x101/0x250
41 Feb 20 17:21:22 e10 kernel: [<ffffffffa24fa305>]
42 __do_readpage+0x2b5/0xe50
43 Feb 20 17:21:22 e10 kernel: [<ffffffffa24fbcf0>] ?
44 btrfs_create_repair_bio+0x1a0/0x1a0
45 Feb 20 17:21:22 e10 kernel: [<ffffffffa24d3ea0>] ?
46 btrfs_direct_IO+0x530/0x530
47 Feb 20 17:21:22 e10 kernel: [<ffffffffa24fb3d0>]
48 __extent_readpages.constprop.44+0x310/0x350
49 Feb 20 17:21:22 e10 kernel: [<ffffffffa24d3ea0>] ?
50 btrfs_direct_IO+0x530/0x530
51 Feb 20 17:21:22 e10 kernel: [<ffffffffa24fd1e4>]
52 extent_readpages+0x1e4/0x1f0
53 Feb 20 17:21:22 e10 kernel: [<ffffffffa24d3ea0>] ?
54 btrfs_direct_IO+0x530/0x530
55 Feb 20 17:21:22 e10 kernel: [<ffffffffa2212cd9>] ?
56 alloc_pages_current+0x89/0x110
57 Feb 20 17:21:22 e10 kernel: [<ffffffffa24d1df2>]
58 btrfs_readpages+0x32/0x40
59 Feb 20 17:21:22 e10 kernel: [<ffffffffa21d18b1>]
60 __do_page_cache_readahead+0x1d1/0x250
61 Feb 20 17:21:22 e10 kernel: [<ffffffffa21d1a11>]
62 ondemand_readahead+0xe1/0x2e0
63 Feb 20 17:21:22 e10 kernel: [<ffffffffa21d1dc6>]
64 page_cache_sync_readahead+0x46/0x70
65 Feb 20 17:21:22 e10 kernel: [<ffffffffa21c4e43>]
66 generic_file_read_iter+0x633/0x7c0
67 Feb 20 17:21:22 e10 kernel: [<ffffffffa223926b>] __vfs_read+0x10b/0x140
68 Feb 20 17:21:22 e10 kernel: [<ffffffffa2239e83>] vfs_read+0xc3/0x240
69 Feb 20 17:21:22 e10 kernel: [<ffffffffa225e8cd>] ?
70 __fget_light+0x2d/0x70
71 Feb 20 17:21:22 e10 kernel: [<ffffffffa223b453>] SyS_pread64+0xa3/0xc0
72 Feb 20 17:21:22 e10 kernel: [<ffffffffa2d4a999>]
73 entry_SYSCALL_64_fastpath+0x12/0x83
74 Feb 20 17:21:22 e10 kernel: ------------[ cut here ]------------

Replies

Subject Author
Re: [gentoo-hardened] btrfs size overflow bug since 4.2.6-hardened-r6 "Tóth Attila" <atoth@××××××××××.hu>
Re: [gentoo-hardened] btrfs size overflow bug since 4.2.6-hardened-r6 PaX Team <pageexec@××××××××.hu>