Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stack overflow in btrfs-util in TEST-83-BTRFS #32936

Closed
bluca opened this issue May 20, 2024 · 1 comment · Fixed by #32939
Closed

Stack overflow in btrfs-util in TEST-83-BTRFS #32936

bluca opened this issue May 20, 2024 · 1 comment · Fixed by #32939
Labels
btrfs bug 🐛 Programming errors, that need preferential fixing tests

Comments

@bluca
Copy link
Member

bluca commented May 20, 2024 

[   17.613647] TEST-83-BTRFS.sh[553]: + set -o pipefail
[   17.615768] TEST-83-BTRFS.sh[555]: ++ stat --file-system --format %T /
[   17.626059] TEST-83-BTRFS.sh[553]: + FSTYPE=btrfs
[   17.627444] TEST-83-BTRFS.sh[553]: + [[ btrfs != \b\t\r\f\s ]]
[   17.629372] TEST-83-BTRFS.sh[553]: + TEST_BTRFS_OFFSET=/usr/lib/systemd/tests/unit-tests/manual/test-btrfs-physical-offset
[   17.632673] TEST-83-BTRFS.sh[553]: + SWAPFILE=/var/tmp/swapfile
[   17.635052] TEST-83-BTRFS.sh[553]: + btrfs filesystem mkswapfile -s 10m /var/tmp/swapfile
[   17.644898] TEST-83-BTRFS.sh[556]: create swapfile /var/tmp/swapfile size 10.00MiB (10485760)
[   17.647441] TEST-83-BTRFS.sh[553]: + sync -f /var/tmp/swapfile
[   17.665170] TEST-83-BTRFS.sh[558]: ++ btrfs inspect-internal map-swapfile -r /var/tmp/swapfile
[   17.679179] TEST-83-BTRFS.sh[553]: + offset_btrfs_progs=1219840
[   17.680528] TEST-83-BTRFS.sh[553]: + echo 'btrfs-progs: 1219840'
[   17.681875] TEST-83-BTRFS.sh[553]: btrfs-progs: 1219840
[   17.683663] TEST-83-BTRFS.sh[559]: ++ /usr/lib/systemd/tests/unit-tests/manual/test-btrfs-physical-offset /var/tmp/swapfile
[   17.705387] TEST-83-BTRFS.sh[559]: =================================================================
[   17.708308] TEST-83-BTRFS.sh[559]: ==559==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x75e8b470e0a0 at pc 0x75e8b8cfa47c bp 0x7ffe742c8a40 sp 0x7ffe742c81e8
[   17.712919] TEST-83-BTRFS.sh[559]: READ of size 32 at 0x75e8b470e0a0 thread T0
[   17.814640] TEST-83-BTRFS.sh[559]:     #0 0x75e8b8cfa47b in memcpy /usr/src/debug/gcc/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
[   17.818566] TEST-83-BTRFS.sh[559]:     #1 0x75e8b76cd086 in btrfs_read_chunk_tree_fd ../src/src/shared/btrfs-util.c:1961
[   17.821562] TEST-83-BTRFS.sh[559]:     #2 0x75e8b76dc4eb in btrfs_get_file_physical_offset_fd ../src/src/shared/btrfs-util.c:2099
[   17.824669] TEST-83-BTRFS.sh[559]:     #3 0x6468a59da5f3 in main ../src/src/test/test-btrfs-physical-offset.c:29
[   17.827677] TEST-83-BTRFS.sh[559]:     #4 0x75e8b6c39c87  (/usr/lib/libc.so.6+0x25c87) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
[   17.831169] TEST-83-BTRFS.sh[559]:     #5 0x75e8b6c39d4b in __libc_start_main (/usr/lib/libc.so.6+0x25d4b) (BuildId: 32a656aa5562eece8c59a585f5eacd6cf5e2307b)
[   17.835016] TEST-83-BTRFS.sh[559]:     #6 0x6468a59da044 in _start (/usr/lib/systemd/tests/unit-tests/manual/test-btrfs-physical-offset+0x1044) (BuildId: 4726851d0da62baafb365c8a70c8d43e69953e30)
[   17.839687] TEST-83-BTRFS.sh[559]: Address 0x75e8b470e0a0 is located in stack of thread T0 at offset 4256 in frame
[   17.842507] TEST-83-BTRFS.sh[559]:     #0 0x75e8b76ccb5c in btrfs_read_chunk_tree_fd ../src/src/shared/btrfs-util.c:1926
[   17.846094] TEST-83-BTRFS.sh[559]:   This frame has 4 object(s):
[   17.850334] TEST-83-BTRFS.sh[559]:     [32, 40) 'chunk' (line 1962)
[   17.855483] TEST-83-BTRFS.sh[559]:     [64, 80) 'tree' (line 1944)
[   17.858972] TEST-83-BTRFS.sh[559]:     [96, 128) 'sh' (line 1950)
[   17.861118] TEST-83-BTRFS.sh[559]:     [160, 4256) 'search_args' (line 1928) <== Memory access at offset 4256 overflows this variable
[   17.872038] TEST-83-BTRFS.sh[559]: HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
[   17.885354] TEST-83-BTRFS.sh[559]:       (longjmp and C++ exceptions *are* supported)
[   17.893761] TEST-83-BTRFS.sh[559]: SUMMARY: AddressSanitizer: stack-buffer-overflow /usr/src/debug/gcc/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
[   17.901520] TEST-83-BTRFS.sh[559]: Shadow bytes around the buggy address:
[   17.903532] TEST-83-BTRFS.sh[559]:   0x75e8b470de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.905383] TEST-83-BTRFS.sh[559]:   0x75e8b470de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.907334] TEST-83-BTRFS.sh[559]:   0x75e8b470df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.910189] TEST-83-BTRFS.sh[559]:   0x75e8b470df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.912101] TEST-83-BTRFS.sh[559]:   0x75e8b470e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.913965] TEST-83-BTRFS.sh[559]: =>0x75e8b470e080: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
[   17.916946] TEST-83-BTRFS.sh[559]:   0x75e8b470e100: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
[   17.918828] TEST-83-BTRFS.sh[559]:   0x75e8b470e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.920737] TEST-83-BTRFS.sh[559]:   0x75e8b470e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.923529] TEST-83-BTRFS.sh[559]:   0x75e8b470e280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.926866] TEST-83-BTRFS.sh[559]:   0x75e8b470e300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.928709] TEST-83-BTRFS.sh[559]: Shadow byte legend (one shadow byte represents 8 application bytes):
[   17.933619] TEST-83-BTRFS.sh[559]:   Addressable:           00
[   17.935284] TEST-83-BTRFS.sh[559]:   Partially addressable: 01 02 03 04 05 06 07
[   17.937653] TEST-83-BTRFS.sh[559]:   Heap left redzone:       fa
[   17.940134] TEST-83-BTRFS.sh[559]:   Freed heap region:       fd
[   17.942724] TEST-83-BTRFS.sh[559]:   Stack left redzone:      f1
[   17.945826] TEST-83-BTRFS.sh[559]:   Stack mid redzone:       f2
[   17.947828] TEST-83-BTRFS.sh[559]:   Stack right redzone:     f3
[   17.949773] TEST-83-BTRFS.sh[559]:   Stack after return:      f5
[   17.952017] TEST-83-BTRFS.sh[559]:   Stack use after scope:   f8
[   17.953468] TEST-83-BTRFS.sh[559]:   Global redzone:          f9
[   17.955168] TEST-83-BTRFS.sh[559]:   Global init order:       f6
[   17.956555] TEST-83-BTRFS.sh[559]:   Poisoned by user:        f7
[   17.957951] TEST-83-BTRFS.sh[559]:   Container overflow:      fc
[   17.959274] TEST-83-BTRFS.sh[559]:   Array cookie:            ac
[   17.960832] TEST-83-BTRFS.sh[559]:   Intra object redzone:    bb
[   17.962227] TEST-83-BTRFS.sh[559]:   ASan internal:           fe
[   17.964999] TEST-83-BTRFS.sh[559]:   Left alloca redzone:     ca
[   17.966388] TEST-83-BTRFS.sh[559]:   Right alloca redzone:    cb
[   17.967836] TEST-83-BTRFS.sh[559]: ==559==ABORTING

https://github.com/systemd/systemd/actions/runs/9133421410/job/25116849501?pr=32866
@bluca bluca added the btrfs label May 20, 2024
@bluca
Copy link
Member Author

bluca commented May 20, 2024

Cannot reproduce it with the legacy test runners on Debian stable

@yuwata yuwata added bug 🐛 Programming errors, that need preferential fixing tests labels May 20, 2024
yuwata added a commit to yuwata/systemd that referenced this issue May 20, 2024
@yuwata
btrfs-util: check current offset before read
a9df132 
Fixes systemd#32936.
@yuwata yuwata mentioned this issue May 20, 2024
Merged
bluca pushed a commit that referenced this issue May 20, 2024
@yuwata @bluca
btrfs-util: check current offset before read
125cca1 
Fixes #32936.
mwilck pushed a commit to mwilck/systemd that referenced this issue May 28, 2024
@yuwata @keszybz
btrfs-util: check current offset before read
c496b01 
Fixes systemd#32936.

(cherry picked from commit 125cca1)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
btrfs bug 🐛 Programming errors, that need preferential fixing tests
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

btrfs-util: check current offset before read yuwata/systemd
2 participants
@bluca @yuwata