KASAN: null-ptr-deref Write in f2fs_stop_gc_thread

Status: fixed on 2024/10/22 11:56
Subsystems: f2fs
[Documentation on labels]
Reported-by: syzbot+1a8e2b31f2ac9bd3d148@syzkaller.appspotmail.com
Fix commit: c7f114d864ac f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
First crash: 746d, last: 695d
Cause bisection: introduced by (bisect log) :
commit 3bdb7f161697e2d5123b89fe1778ef17a44858e7
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date: Wed Apr 3 23:07:53 2024 +0000

  f2fs: don't set RO when shutting down f2fs

Crash: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread (log)
Repro: C syz .config
  
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[syzbot] Monthly f2fs report (Sep 2024) 0 (1) 2024/09/16 12:35
[PATCH v2] f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() 2 (2) 2024/08/30 20:52
[syzbot] Monthly f2fs report (Aug 2024) 0 (1) 2024/08/16 19:58
[PATCH] f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() 4 (4) 2024/07/29 01:11
[PATCH] f2fs: Add mutex to prevent gc task from being accessed before initialization 1 (1) 2024/07/27 05:56
[syzbot] [f2fs?] KASAN: null-ptr-deref Write in f2fs_stop_gc_thread 4 (17) 2024/07/27 05:13
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 KASAN: null-ptr-deref Write in f2fs_stop_gc_thread origin:lts 12 syz, C error 6 20d 386d 0/2 upstream: reported C repro on 2025/07/15 15:45
android-5-15 KASAN: null-ptr-deref Write in f2fs_stop_gc_thread origin:lts 12 syz, C error 6 43d 386d 0/2 upstream: reported C repro on 2025/07/15 08:24
android-5-10 KASAN: null-ptr-deref Write in f2fs_stop_gc_thread 19 syz, C 7 25d 490d 0/2 upstream: reported C repro on 2025/04/02 05:33
linux-6.1 KASAN: null-ptr-deref Write in f2fs_stop_gc_thread origin:lts-only 12 syz, C inconclusive 13 86d 584d 0/3 upstream: reported C repro on 2024/12/29 01:22
▶ ▼ Last patch testing requests (15)
Created Duration User Patch Repo Result
2024/08/04 17:41 18m retest repro upstream report log
2024/08/04 17:41 18m retest repro upstream report log
2024/08/04 17:41 16m retest repro upstream report log
2024/07/27 04:08 44m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/27 03:39 21m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e OK log
2024/07/27 02:08 25m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/26 11:08 1h35m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/25 13:53 21m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/25 13:19 22m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e OK log
2024/07/25 12:49 15m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/25 08:08 2h28m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/25 07:27 35m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/25 05:08 27m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/25 02:21 1h07m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
2024/07/25 01:32 20m lizhi.xu@windriver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c9b3512402e report log
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2024/09/09 03:20 3h10m bisect fix upstream OK (0) job log log

Sample crash report:
F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5
F2FS-fs (loop4): Stopped filesystem due to reason: 0
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
BUG: KASAN: null-ptr-deref in __refcount_add include/linux/refcount.h:184 [inline]
BUG: KASAN: null-ptr-deref in __refcount_inc include/linux/refcount.h:241 [inline]
BUG: KASAN: null-ptr-deref in refcount_inc include/linux/refcount.h:258 [inline]
BUG: KASAN: null-ptr-deref in get_task_struct include/linux/sched/task.h:118 [inline]
BUG: KASAN: null-ptr-deref in kthread_stop+0xca/0x630 kernel/kthread.c:704
Write of size 4 at addr 0000000000000028 by task syz-executor169/7772

CPU: 1 PID: 7772 Comm: syz-executor169 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_report+0xe8/0x550 mm/kasan/report.c:491
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
 __refcount_add include/linux/refcount.h:184 [inline]
 __refcount_inc include/linux/refcount.h:241 [inline]
 refcount_inc include/linux/refcount.h:258 [inline]
 get_task_struct include/linux/sched/task.h:118 [inline]
 kthread_stop+0xca/0x630 kernel/kthread.c:704
 f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210
 f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283
 f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]
 __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fac5a221249
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fac5a1ce218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fac5a2a8708 RCX: 00007fac5a221249
RDX: 0000000020000140 RSI: 000000008004587d RDI: 0000000000000005
RBP: 00007fac5a2a8700 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fac5a274b1c
R13: 00007fac5a274040 R14: 00007fac5a26e057 R15: 8c02ea27aa268e19
 </TASK>
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/21 12:26 upstream 2c9b3512402e b88348e9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] [mounted in repro #3] ci2-upstream-fs KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
2024/07/21 08:27 upstream 2c9b3512402e b88348e9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] [mounted in repro #3] [mounted in repro #4] [mounted in repro #5] [mounted in repro #6] ci2-upstream-fs KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
2024/07/21 15:55 upstream 2c9b3512402e b88348e9 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] [mounted in repro #3] [mounted in repro #4] [mounted in repro #5] [mounted in repro #6] ci2-upstream-fs KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
2024/07/20 19:11 upstream 3c3ff7be9729 b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
2024/09/09 20:10 upstream da3ea35007d0 073f8be2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Write in f2fs_stop_gc_thread
* Struck through repros no longer work on HEAD.