syzbot

 sign-in | mailing list | source | docs
🐞 Open [717]
🐞 Fixed [181]
🐞 Invalid [640]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in xfs_trans_committed_bulk

Status: upstream: reported C repro on 2023/01/02 11:47
Subsystems: xfs
[Documentation on labels]
Reported-by: syzbot+b2b98cffeb6f569a0bda@syzkaller.appspotmail.com
First crash: 1042d, last: 980d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in xfs_trans_committed_bulk xfs 19 C 8 984d 1026d 0/1 upstream: reported C repro on 2023/01/18 09:53
linux-5.15 KASAN: use-after-free Write in xfs_trans_committed_bulk origin:lts-only 24 C done 43 151d 973d 0/3 upstream: reported C repro on 2023/03/12 11:46
linux-6.1 KASAN: use-after-free Read in xfs_trans_committed_bulk origin:lts-only 24 C done 836 551d 976d 0/3 upstream: reported C repro on 2023/03/09 08:20
upstream BUG: unable to handle kernel paging request in xfs_trans_committed_bulk xfs 8 1 1039d 1035d 0/29 auto-obsoleted due to no activity on 2023/04/04 21:10
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2023/02/11 17:42 23m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
loop0: rw=399361, want=65599, limit=65536
XFS (loop0): metadata I/O error: block 0xffff ("xlog_iodone") error 5 numblks 64
XFS (loop0): xfs_do_force_shutdown(0x2) called from line 1244 of file fs/xfs/xfs_log.c.  Return address = 0xffffffff825f6b0b
XFS (loop0): Quotacheck: Unsuccessful (Error -5): Disabling quotas.
==================================================================
BUG: KASAN: use-after-free in xfs_trans_committed_bulk+0x531/0x630 fs/xfs/xfs_trans.c:839
Read of size 8 at addr ffff8880a92d6050 by task kworker/1:1H/2796

CPU: 1 PID: 2796 Comm: kworker/1:1H Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: xfs-log/loop0 xfs_buf_ioend_work
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
 xfs_trans_committed_bulk+0x531/0x630 fs/xfs/xfs_trans.c:839
 xlog_cil_committed+0x153/0xf50 fs/xfs/xfs_log_cil.c:600
 xlog_state_do_callback+0x3dc/0x790 fs/xfs/xfs_log.c:2815
 xfs_log_force_umount+0x2b9/0x430 fs/xfs/xfs_log.c:4055
 xfs_do_force_shutdown+0x78/0x200 fs/xfs/xfs_fsops.c:968
 xlog_iodone+0x15b/0x1e0 fs/xfs/xfs_log.c:1244
 xfs_buf_ioend+0x248/0x640 fs/xfs/xfs_buf.c:1191
 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117
 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406

Allocated by task 7991:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
 kmem_cache_alloc+0x124/0x3c0 mm/slab.c:3552
 kmem_zone_alloc+0x7f/0x180 fs/xfs/kmem.c:106
 kmem_zone_zalloc fs/xfs/kmem.h:131 [inline]
 xfs_buf_item_init+0xa1/0x560 fs/xfs/xfs_buf_item.c:752
 _xfs_trans_bjoin+0x3f/0x120 fs/xfs/xfs_trans_buf.c:89
 xfs_trans_get_buf_map+0x298/0x710 fs/xfs/xfs_trans_buf.c:177
 xfs_trans_get_buf fs/xfs/xfs_trans.h:179 [inline]
 xfs_qm_dqalloc+0x5e6/0xa20 fs/xfs/xfs_dquot.c:354
 xfs_qm_dqtobp+0x926/0xcf0 fs/xfs/xfs_dquot.c:518
 xfs_qm_dqread+0x3a3/0xe50 fs/xfs/xfs_dquot.c:629
 xfs_qm_dqget+0x4f4/0x19a0 fs/xfs/xfs_dquot.c:837
 xfs_qm_quotacheck_dqadjust+0x96/0x5c0 fs/xfs/xfs_qm.c:1077
 xfs_qm_dqusage_adjust+0x321/0xc20 fs/xfs/xfs_qm.c:1206
 xfs_bulkstat_ag_ichunk fs/xfs/xfs_itable.c:313 [inline]
 xfs_bulkstat+0x72a/0xf60 fs/xfs/xfs_itable.c:498
 xfs_qm_quotacheck+0x223/0x790 fs/xfs/xfs_qm.c:1338
 xfs_qm_mount_quotas+0xe9/0x570 fs/xfs/xfs_qm.c:1457
 xfs_mountfs+0x18be/0x1f40 fs/xfs/xfs_mount.c:979
 xfs_fs_fill_super+0xb7a/0x1380 fs/xfs/xfs_super.c:1688
 mount_bdev+0x2b3/0x360 fs/super.c:1134
 mount_fs+0x92/0x2a0 fs/super.c:1237
 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
 vfs_kern_mount fs/namespace.c:1036 [inline]
 do_new_mount fs/namespace.c:2572 [inline]
 do_mount+0xe65/0x2a30 fs/namespace.c:2905
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3

Freed by task 7991:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758
 xfs_buf_do_callbacks+0x97/0xe0 fs/xfs/xfs_buf_item.c:1039
 xfs_buf_iodone_callbacks+0xff/0xea0 fs/xfs/xfs_buf_item.c:1185
 xfs_buf_ioend+0x248/0x640 fs/xfs/xfs_buf.c:1191
 xfs_buf_submit+0x58a/0x7c0 fs/xfs/xfs_buf.c:1470
 xfs_buf_delwri_submit_buffers+0x328/0x9c0 fs/xfs/xfs_buf.c:2036
 xfs_buf_delwri_submit+0x76/0x240 fs/xfs/xfs_buf.c:2075
 xfs_qm_quotacheck+0x2a7/0x790 fs/xfs/xfs_qm.c:1367
 xfs_qm_mount_quotas+0xe9/0x570 fs/xfs/xfs_qm.c:1457
 xfs_mountfs+0x18be/0x1f40 fs/xfs/xfs_mount.c:979
 xfs_fs_fill_super+0xb7a/0x1380 fs/xfs/xfs_super.c:1688
 mount_bdev+0x2b3/0x360 fs/super.c:1134
 mount_fs+0x92/0x2a0 fs/super.c:1237
 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
 vfs_kern_mount fs/namespace.c:1036 [inline]
 do_new_mount fs/namespace.c:2572 [inline]
 do_mount+0xe65/0x2a30 fs/namespace.c:2905
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3

The buggy address belongs to the object at ffff8880a92d6000
 which belongs to the cache xfs_buf_item of size 248
The buggy address is located 80 bytes inside of
 248-byte region [ffff8880a92d6000, ffff8880a92d60f8)
The buggy address belongs to the page:
page:ffffea0002a4b580 count:1 mapcount:0 mapping:ffff8880a92d6000 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffff8880a92d6000 0000000000000000 000000010000000d
raw: ffff8880b0811248 ffff8880b0811248 ffff8880b17a6200 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a92d5f00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880a92d5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880a92d6000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8880a92d6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
 ffff8880a92d6100: fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/01/02 11:47 linux-4.14.y c4215ee4771b ab32d508 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 KASAN: use-after-free Read in xfs_trans_committed_bulk
2023/01/12 17:39 linux-4.14.y c4215ee4771b 96166539 .config console log report syz [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 KASAN: use-after-free Read in xfs_trans_committed_bulk
2023/03/05 11:28 linux-4.14.y 7878a41b6cc1 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 KASAN: use-after-free Read in xfs_trans_committed_bulk
2023/02/25 07:35 linux-4.14.y 1e61bd26fa2c ee50e71c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 KASAN: use-after-free Read in xfs_trans_committed_bulk
* Struck through repros no longer work on HEAD.