KASAN: invalid-free in dbUnmount

Status: upstream: reported C repro on 2022/11/28 18:08
Subsystems: jfs fat
[Documentation on labels]
Reported-by: syzbot+ea731a6641531af62f80@syzkaller.appspotmail.com
First crash: 1334d, last: 1309d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[PATCH] jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount 6 (6) 2023/07/18 19:46
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: invalid-free in dbUnmount 24 2 1172d 1188d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:06
upstream KASAN: invalid-free in dbUnmount jfs 24 syz error 119 1033d 1292d 23/29 fixed on 2023/10/12 12:48

Sample crash report:
RBP: 0000000000000000 R08: 00007ffea3a43290 R09: 0000000000000002
R10: 00000000018084a0 R11: 0000000000000286 R12: 00000000ffffffff
R13: 0000000000000000 R14: 00007ffea3a43290 R15: 0000000020000080
==================================================================
BUG: KASAN: double-free or invalid-free in dbUnmount+0xff/0x140 fs/jfs/jfs_dmap.c:255

CPU: 0 PID: 8113 Comm: syz-executor385 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_invalid_free+0x61/0xa0 mm/kasan/report.c:336
 __kasan_slab_free+0x1d0/0x1f0 mm/kasan/kasan.c:501
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcc/0x210 mm/slab.c:3822
 dbUnmount+0xff/0x140 fs/jfs/jfs_dmap.c:255
 jfs_umount+0x1cc/0x310 fs/jfs/jfs_umount.c:102
 jfs_put_super+0x61/0x140 fs/jfs/super.c:223
 generic_shutdown_super+0x144/0x370 fs/super.c:456
 kill_block_super+0x97/0xf0 fs/super.c:1185
 deactivate_locked_super+0x94/0x160 fs/super.c:329
 deactivate_super+0x174/0x1a0 fs/super.c:360
 cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f48e3f96807
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffea3a42308 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f48e3f96807
RDX: 00007ffea3a423ca RSI: 000000000000000a RDI: 00007ffea3a423c0
RBP: 00007ffea3a423c0 R08: 00000000ffffffff R09: 00007ffea3a421a0
R10: 0000555555ded743 R11: 0000000000000202 R12: 00007ffea3a43430
R13: 0000555555ded6b0 R14: 00007ffea3a42330 R15: 0000000000000012

Allocated by task 8262:
 kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
 kmalloc include/linux/slab.h:515 [inline]
 dbMount+0x4d/0x880 fs/jfs/jfs_dmap.c:176
 jfs_mount+0x124/0x3d0 fs/jfs/jfs_mount.c:133
 jfs_fill_super+0x55c/0xb50 fs/jfs/super.c:589
 mount_bdev+0x2fc/0x3b0 fs/super.c:1158
 mount_fs+0xa3/0x310 fs/super.c:1261
 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2492 [inline]
 do_mount+0x115c/0x2f50 fs/namespace.c:2822
 ksys_mount+0xcf/0x130 fs/namespace.c:3038
 __do_sys_mount fs/namespace.c:3052 [inline]
 __se_sys_mount fs/namespace.c:3049 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3049
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 8262:
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcc/0x210 mm/slab.c:3822
 dbUnmount+0xff/0x140 fs/jfs/jfs_dmap.c:255
 jfs_mount_rw+0x244/0x4b0 fs/jfs/jfs_mount.c:262
 jfs_remount+0x51c/0x640 fs/jfs/super.c:488
 do_remount_sb+0x1a0/0x6a0 fs/super.c:888
 do_remount fs/namespace.c:2313 [inline]
 do_mount+0x1a62/0x2f50 fs/namespace.c:2813
 ksys_mount+0xcf/0x130 fs/namespace.c:3038
 __do_sys_mount fs/namespace.c:3052 [inline]
 __se_sys_mount fs/namespace.c:3049 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3049
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88809f4b04c0
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 0 bytes inside of
 2048-byte region [ffff88809f4b04c0, ffff88809f4b0cc0)
The buggy address belongs to the page:
page:ffffea00027d2c00 count:1 mapcount:0 mapping:ffff88813bff0c40 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffffea0002568288 ffffea0002771c88 ffff88813bff0c40
raw: 0000000000000000 ffff88809f4b04c0 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809f4b0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88809f4b0400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88809f4b0480: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                           ^
 ffff88809f4b0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88809f4b0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/12/23 22:34 linux-4.19.y 3f8a27f9e27b 9da18ae8 .config console log report syz C [disk image] [vmlinux] [mounted in repro] ci2-linux-4-19 KASAN: invalid-free in dbUnmount
2022/11/28 18:07 linux-4.19.y 3f8a27f9e27b 247de55b .config console log report syz C [disk image] [vmlinux] [mounted in repro] ci2-linux-4-19 KASAN: invalid-free in dbUnmount
* Struck through repros no longer work on HEAD.