syzbot

 sign-in | mailing list | source | docs
🐞 Open [1507]
≡ Subsystems
🐞 Fixed [6531]
🐞 Invalid [16650]
⬇ Missing Backports [205]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: use-after-free Read in ocfs2_dir_foreach_blk

Status: upstream: reported C repro on 2024/09/27 14:22
Subsystems: ocfs2
[Documentation on labels]
Reported-by: syzbot+b20bbf680bb0f2ecedae@syzkaller.appspotmail.com
First crash: 339d, last: 10d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [ocfs2?] KASAN: use-after-free Read in ocfs2_dir_foreach_blk 0 (2) 2024/10/29 17:49
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: use-after-free Read in ocfs2_dir_foreach_blk origin:upstream 19 C 4 19d 206d 0/3 upstream: reported C repro on 2025/02/03 04:13
▶ ▼ Last patch testing requests (9)
Created Duration User Patch Repo Result
2025/07/07 04:19 15m retest repro upstream report log
2025/07/07 03:13 19m retest repro upstream OK log
2025/06/16 00:42 15m retest repro upstream report log
2025/04/26 09:09 47m retest repro upstream report log
2025/04/12 08:19 13m retest repro upstream report log
2025/04/12 08:19 13m retest repro upstream report log
2025/04/12 08:19 13m retest repro upstream report log
2025/04/12 05:25 16m retest repro upstream report log
2024/12/10 05:40 13m retest repro upstream report log

Sample crash report:
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
==================================================================
BUG: KASAN: use-after-free in ocfs2_dir_foreach_blk_id fs/ocfs2/dir.c:1787 [inline]
BUG: KASAN: use-after-free in ocfs2_dir_foreach_blk+0x132c/0x1b20 fs/ocfs2/dir.c:1925
Read of size 2 at addr ffff8880745c98c9 by task syz-executor199/5852

CPU: 0 UID: 0 PID: 5852 Comm: syz-executor199 Not tainted 6.13.0-syzkaller-09793-g69b8923f5003 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 ocfs2_dir_foreach_blk_id fs/ocfs2/dir.c:1787 [inline]
 ocfs2_dir_foreach_blk+0x132c/0x1b20 fs/ocfs2/dir.c:1925
 ocfs2_readdir+0x2a1/0x5e0 fs/ocfs2/dir.c:1969
 wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 __do_sys_getdents fs/readdir.c:322 [inline]
 __se_sys_getdents+0x1fd/0x4e0 fs/readdir.c:308
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffa5856f939
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdd8d085f8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ffa5856f939
RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000000 R08: 00007ffdd8d08630 R09: 00007ffdd8d08630
R10: 00007ffdd8d08630 R11: 0000000000000246 R12: 00007ffdd8d0861c
R13: 0000000000000004 R14: 431bde82d7b634db R15: 00007ffdd8d08650
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x90c pfn:0x745c9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001d17288 ffffea0001d17208 0000000000000000
raw: 000000000000090c 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5849, tgid 5849 (syz-executor199), ts 99408658391, free_ts 100198069162
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
 alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
 folio_alloc_mpol_noprof+0x36/0x70 mm/mempolicy.c:2289
 shmem_alloc_folio mm/shmem.c:1863 [inline]
 shmem_alloc_and_add_folio+0x4a0/0x1090 mm/shmem.c:1902
 shmem_get_folio_gfp+0x621/0x1840 mm/shmem.c:2522
 shmem_get_folio mm/shmem.c:2628 [inline]
 shmem_write_begin+0x165/0x350 mm/shmem.c:3278
 generic_perform_write+0x346/0x990 mm/filemap.c:4189
 shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3454
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xacf/0xd10 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5828 tgid 5828 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_folios+0xe2f/0x18a0 mm/page_alloc.c:2707
 folios_put_refs+0x76c/0x860 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x593/0x1820 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1352
 evict+0x4e8/0x9a0 fs/inode.c:796
 __dentry_kill+0x20d/0x630 fs/dcache.c:643
 dput+0x19f/0x2b0 fs/dcache.c:885
 __fput+0x60b/0x9f0 fs/file_table.c:458
 task_work_run+0x24f/0x310 kernel/task_work.c:227
 ptrace_notify+0x2d2/0x380 kernel/signal.c:2522
 ptrace_report_syscall include/linux/ptrace.h:415 [inline]
 ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
 syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173
 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
 syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880745c9780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880745c9800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880745c9880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff8880745c9900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880745c9980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (94):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/03 08:36 upstream 69b8923f5003 568559e4 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 07:36 upstream 69e858e0b8b2 568559e4 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 07:16 upstream 69b8923f5003 568559e4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/05/29 23:08 upstream e0797d3b91de 3d2f584d .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/08/06 21:38 linux-next b7d4e259682c 4bd24a3e .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 05:32 upstream 69b8923f5003 568559e4 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: slab-use-after-free Read in ocfs2_dir_foreach_blk
2025/08/18 03:49 upstream 8d561baae505 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/08/15 21:20 upstream ee94b00c1a64 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/08/12 08:54 upstream 53e760d89498 c06e8995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/07/28 08:26 upstream b711733e89a3 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/07/26 08:40 upstream 5f33ebd2018c fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/07/24 10:09 upstream 01a412d06bc5 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/07/16 02:40 upstream 155a3c003e55 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/06/23 02:36 upstream b67ec639010f d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/06/18 06:22 upstream 4663747812d1 e77fae15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/06/01 23:56 upstream 7d4e49a77d99 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/05/02 15:51 upstream ebd297a2affa d7f099d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/03/25 15:27 upstream 2f2d52945852 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/03/22 19:02 upstream 88d324e69ea9 c6512ef7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/03/04 04:41 upstream 99fa936e8e4f c3901742 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/19 21:57 upstream 6537cfb395f3 b257a9b7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/14 09:36 upstream 68763b29e0a6 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/12 22:44 upstream 09fbf3d50205 b27c2402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/11 12:15 upstream febbc555cf0f 43f51a00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/09 01:13 upstream 8f6629c004b1 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/05 14:51 upstream 5c8c229261f1 4dc70884 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/05 07:22 upstream d009de7d5428 5896748e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/05 04:17 upstream d009de7d5428 5896748e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 19:53 upstream d009de7d5428 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 17:03 upstream 0de63bb7d919 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 13:47 upstream 0de63bb7d919 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/07/12 19:48 upstream 379f604cc3dc 3cda49cf .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/07/09 05:24 upstream 733923397fd9 f4e5e155 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/05/29 22:10 upstream e0797d3b91de 3d2f584d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/25 13:57 upstream d082ecbc71e9 d34966d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/20 11:58 upstream 87a132e73910 50668798 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/12 02:27 upstream 09fbf3d50205 f2baddf5 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/09/22 10:03 upstream 88264981f208 6f888b75 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/16 14:28 linux-next 0ae0fa3bf0b4 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/14 16:29 linux-next 0ae0fa3bf0b4 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/13 08:19 linux-next 7b7a883c7f4d 2afad16e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/12 10:49 linux-next c674aa7c289e f2baddf5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/12 07:39 linux-next c674aa7c289e f2baddf5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/10 08:41 linux-next df5d6180169a ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/10 06:18 linux-next df5d6180169a ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/10 03:00 linux-next ed58d103e6da ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/07 06:45 linux-next ed58d103e6da 53657d1b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/06 22:01 linux-next 808eb958781e 53657d1b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 19:06 linux-next 40b8e93e17bf 4baca3d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/07/26 01:56 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 82af5ea7c611 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/03/03 15:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci e056da87c780 c3901742 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/08/13 12:00 upstream 8742b2d8935f 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2025/03/25 19:04 upstream 2df0c02dab82 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ocfs2_dir_foreach_blk
2025/03/09 23:28 upstream 1110ce6a1e34 163f510d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2025/03/06 23:32 upstream 848e07631744 831e3629 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2025/03/05 13:14 upstream 48a5eed9ad58 60f5d8d9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in ocfs2_dir_foreach_blk
2025/03/29 05:15 upstream 0c86b42439b6 cf25e2c2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in ocfs2_dir_foreach_blk
2025/03/07 07:02 upstream f315296c92fd 831e3629 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in ocfs2_dir_foreach_blk
2024/10/29 17:48 upstream e42b1a9a2557 66aeb999 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in ocfs2_dir_foreach_blk
* Struck through repros no longer work on HEAD.