Bug 244344 - geom(4): Panic plugging in UFS USB drive: Memory modified after free 0xfffffe003a559000(65528) val=4 @ 0xfffffe003a559000 (13-CURRENT, 12.1-RELEASE r354233, 12.1-STABLE r358121)
Summary: geom(4): Panic plugging in UFS USB drive: Memory modified after free 0xfffffe...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.2-RELEASE
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-geom (Nobody)
URL:
Keywords: crash, needs-qa
Depends on:
Blocks: 244384 263979
  Show dependency tree / graph
 
Reported: 2020-02-23 19:58 UTC by Neeraj
Modified: 2022-11-18 23:29 UTC (History)
5 users (show)

See Also:
koobs: maintainer-feedback? (mckusick)
koobs: mfc-stable13?
koobs: mfc-stable12?

Attachments
Contains PoC UFS image and detailed logs includes 13-current, 12.1-release and 12.1-stable (170 bytes, text/plain)
2020-02-23 19:58 UTC, Neeraj 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Neeraj 2020-02-23 19:58:10 UTC 
Created attachment 211868 [details]
Contains PoC UFS image and detailed logs includes 13-current, 12.1-release and 12.1-stable

Hi there,

Kernel Panic is observed while attaching the usb drive which contains malicious UFS filesystem image. No user authentication and interaction is needed.

Just flash the attached UFS image to usb drive and plug the usb drive to FreeBSD 13-CURRENT, 12.1-RELEASE, or 12.1-STABLE.


[Kernel Log - FreeBSD 13-CURRENT (UAF)]

freebsd dumped core - see /var/crash/vmcore.2

Fri Feb 21 07:01:11 UTC 2020

FreeBSD freebsd 13.0-CURRENT FreeBSD 13.0-CURRENT #3: Thu Feb 20
03:35:37 UTC 2020
root@freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC  amd64

panic: Most recently used by GEOM

GNU gdb (GDB) 8.3.1 [GDB v8.3.1 for FreeBSD]
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-portbld-freebsd13.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/kernel/kernel...
Reading symbols from /usr/lib/debug//boot/kernel/kernel.debug...

Unread portion of the kernel message buffer:
Superblock check-hash failed: recorded check-hash 0x9dafc69a !=
computed check-hash 0x7ccaabd4 (Ignored)
Memory modified after free 0xfffffe003a559000(65528) val=4 @ 0xfffffe003a559000
panic: Most recently used by GEOM

cpuid = 1
time = 1582268274
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe002c779750
vpanic() at vpanic+0x185/frame 0xfffffe002c7797b0
panic() at panic+0x43/frame 0xfffffe002c779810
mtrash_ctor() at mtrash_ctor+0x7e/frame 0xfffffe002c779830
item_ctor() at item_ctor+0x2cb/frame 0xfffffe002c779890
uma_zalloc_arg() at uma_zalloc_arg+0x144/frame 0xfffffe002c7798e0
malloc() at malloc+0x99/frame 0xfffffe002c779930
g_read_data() at g_read_data+0x82/frame 0xfffffe002c779970
g_use_g_read_data() at g_use_g_read_data+0x35/frame 0xfffffe002c779990
ffs_sbget() at ffs_sbget+0x24f/frame 0xfffffe002c779a00
g_label_ufs_taste_common() at g_label_ufs_taste_common+0x79/frame
0xfffffe002c779a40
g_label_taste() at g_label_taste+0x2ac/frame 0xfffffe002c779b50
g_new_provider_event() at g_new_provider_event+0xaa/frame 0xfffffe002c779b70
g_run_events() at g_run_events+0x176/frame 0xfffffe002c779bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe002c779bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe002c779bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
Uptime: 6m11s
Dumping 264 out of 4062 MB:..7%..13%..25%..31%..43%..55%..61%..73%..85%..91%

[Attachments]
+ UFS filesystem image
+ detailed logs from FreeBSD 13-CURRENT, 12.1-RELEASE, and 12.1-STABLE.
Comment 1 Kirk McKusick freebsd_committer freebsd_triage 2022-05-16 00:27:55 UTC 
Please check to see if my proposed change in https://reviews.freebsd.org/D35219 resolves this bug.
Comment 2 Kirk McKusick freebsd_committer freebsd_triage 2022-11-18 23:29:18 UTC 
Fixed in 14 as detailed in https://reviews.freebsd.org/D35219

MFC'ed to 13 with commit b999366aab4e2d59cb8869b0e5ef0f70ab9b9bbe on Fri May 27 12:21:11 2022 -0700

Too old in 12 life to be candidate for MFC.