kern/55287: memory corruption around lfs_unmark_dirop

[Shinichi Doyashiki <clare%csel.org@localhost>]

>Number:         55287
>Category:       kern
>Synopsis:       memory corruption around lfs_unmark_dirop
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri May 22 23:50:00 +0000 2020
>Originator:     Shinichi Doyashiki
>Release:        NetBSD 9.99.63
>Organization:
	at home
>Environment:
System: NetBSD drunker.csel.org 9.99.63 NetBSD 9.99.63 (J1900PC_KASAN) #4: Fri May 22 02:18:02 JST 2020 clare%drunker.csel.org@localhost:/export/netbsd/src/sys/arch/amd64/compile/J1900PC_KASAN amd64
Architecture: x86_64
Machine: amd64
>Description:
	i got a error report from kASan while using LFS.


reboot after panic: [ 1220.1714081] panic: ASan: Unauthorized Access In 0xffffffff80e64896: Addr 0xffffb880261aa4d8 [4 bytes, read, PoolUseAfterFree] 


Reading symbols from netbsd.gdb...
(gdb) target kvm /var/crash/netbsd.3.core
0xffffffff80225f35 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:713
713                     dumpsys();
(gdb) bt
#0  0xffffffff80225f35 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:713
#1  0xffffffff80f20a6b in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:73
#2  0xffffffff80f819db in vpanic (fmt=fmt@entry=0xffffffff817433d8 "ASan: Unauthorized Access In %p: Addr %p [%zu byte%s, %s, %s]\n", 
    ap=ap@entry=0xffffc382f632bb70) at ../../../../kern/subr_prf.c:290
#3  0xffffffff80f81b2d in panic (fmt=fmt@entry=0xffffffff817433d8 "ASan: Unauthorized Access In %p: Addr %p [%zu byte%s, %s, %s]\n")
    at ../../../../kern/subr_prf.c:209
#4  0xffffffff80f4c245 in kasan_report (addr=<optimized out>, size=size@entry=4, write=write@entry=false, pc=<optimized out>, code=<optimized out>)
    at ../../../../kern/subr_asan.c:197
#5  0xffffffff80f5a48e in kasan_shadow_check (retaddr=<optimized out>, write=false, size=4, addr=<optimized out>) at ../../../../kern/subr_asan.c:424
#6  __asan_load4 (addr=<optimized out>) at ../../../../kern/subr_asan.c:1209
#7  0xffffffff80e64896 in lfs_unmark_dirop (fs=0xffffc380236aa000) at ../../../../ufs/lfs/lfs_subr.c:384
#8  lfs_segunlock (fs=0xffffc380236aa000) at ../../../../ufs/lfs/lfs_subr.c:555
#9  0xffffffff80e6196a in lfs_segwrite (mp=mp@entry=0xffffc380236a9000, flags=<optimized out>, flags@entry=5) at ../../../../ufs/lfs/lfs_segment.c:840
#10 0xffffffff80e6cb78 in lfs_sync (mp=0xffffc380236a9000, waitfor=3, cred=<optimized out>) at ../../../../ufs/lfs/lfs_vfsops.c:1531
#11 0xffffffff80ffd1d8 in VFS_SYNC (mp=0xffffc380236a9000, a=3, b=0xffffc3801f7e1040) at ../../../../kern/vfs_subr.c:1436
#12 0xffffffff80ffd34f in sched_sync (arg=<optimized out>) at ./machine/cpu.h:72
#13 0xffffffff802086f7 in lwp_trampoline ()
#14 0x0000000000000000 in ?? ()


>How-To-Repeat:
	use LFS with kASan enabled kernel.

>Fix:
	unknown yet.