syzbot

 sign-in | mailing list | source | docs
🐞 Open [712]
🐞 Fixed [297]
🐞 Invalid [838]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in ext4_data_block_valid

Status: auto-closed as invalid on 2020/01/24 00:27
Reported-by: syzbot+96d41e743547b0d15ccb@syzkaller.appspotmail.com
First crash: 2212d, last: 2149d
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in ext4_data_block_valid 19 5 1903d 2191d 0/1 auto-closed as invalid on 2020/09/26 20:10
android-414 KASAN: use-after-free Read in ext4_data_block_valid (2) 19 6 2092d 2153d 0/1 auto-closed as invalid on 2020/03/21 21:05
upstream KASAN: use-after-free Read in ext4_data_block_valid ext4 19 108 2213d 2660d 13/29 fixed on 2019/10/15 23:40
android-414 KASAN: use-after-free Read in ext4_data_block_valid 19 12 2344d 2315d 0/1 auto-closed as invalid on 2019/09/11 10:38
android-49 KASAN: use-after-free Read in ext4_data_block_valid 19 21 2418d 2314d 0/3 auto-closed as invalid on 2019/06/29 18:27
android-49 KASAN: use-after-free Read in ext4_data_block_valid (2) 19 1 2089d 2089d 0/3 auto-closed as invalid on 2020/03/24 07:08

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in ext4_data_block_valid+0x2ef/0x350 fs/ext4/block_validity.c:260
Read of size 8 at addr ffff88809ac61d38 by task syz-executor.1/7397

CPU: 0 PID: 7397 Comm: syz-executor.1 Not tainted 4.19.75 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 ext4_data_block_valid+0x2ef/0x350 fs/ext4/block_validity.c:260
 ext4_mb_mark_diskspace_used+0x4a9/0x10d0 fs/ext4/mballoc.c:2966
 ext4_mb_new_blocks+0xaa4/0x3c10 fs/ext4/mballoc.c:4555
 ext4_ext_map_blocks+0x2b26/0x55c0 fs/ext4/extents.c:4484
 ext4_map_blocks+0x990/0x1b20 fs/ext4/inode.c:640
 ext4_getblk+0xc4/0x510 fs/ext4/inode.c:976
 ext4_bread+0x8f/0x230 fs/ext4/inode.c:1026
 ext4_append+0x155/0x370 fs/ext4/namei.c:66
 ext4_init_new_dir fs/ext4/namei.c:2611 [inline]
 ext4_mkdir+0x61b/0xdf0 fs/ext4/namei.c:2658
 vfs_mkdir+0x42e/0x690 fs/namei.c:3816
 do_mkdirat+0x234/0x2a0 fs/namei.c:3839
 __do_sys_mkdir fs/namei.c:3855 [inline]
 __se_sys_mkdir fs/namei.c:3853 [inline]
 __x64_sys_mkdir+0x5c/0x80 fs/namei.c:3853
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458e47
Code: 1f 40 00 b8 5a 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd c3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ad c3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe93dbefc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 000000000004f27f RCX: 0000000000458e47
RDX: 00007ffe93dbf014 RSI: 00000000000001ff RDI: 00007ffe93dbf010
RBP: 000000000000014e R08: 0000000000000000 R09: 0000000000000004
R10: 0000000000000064 R11: 0000000000000202 R12: 000000000000000c
R13: 00007ffe93dbf000 R14: 000000000004f23e R15: 00007ffe93dbf010

Allocated by task 1:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc mm/kasan/kasan.c:553 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
 kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559
 add_system_zone+0x302/0x650 fs/ext4/block_validity.c:85
 ext4_setup_system_zone+0x419/0xac0 fs/ext4/block_validity.c:212
 ext4_fill_super+0x7154/0xc830 fs/ext4/super.c:4425
 mount_bdev+0x304/0x3c0 fs/super.c:1158
 ext4_mount+0x35/0x40 fs/ext4/super.c:5936
 mount_fs+0xa8/0x31f fs/super.c:1261
 vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2469 [inline]
 do_mount+0x53e/0x2bc0 fs/namespace.c:2799
 ksys_mount+0xdb/0x150 fs/namespace.c:3015
 do_mount_root+0x35/0x1d3 init/do_mounts.c:356
 mount_block_root+0x353/0x61d init/do_mounts.c:385
 mount_root+0x283/0x2cd init/do_mounts.c:530
 prepare_namespace+0x26f/0x2ae init/do_mounts.c:589
 kernel_init_freeable+0x5aa/0x5c8 init/main.c:1164
 kernel_init+0x12/0x1c5 init/main.c:1062
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Freed by task 10895:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3503 [inline]
 kmem_cache_free+0x86/0x260 mm/slab.c:3765
 ext4_release_system_zone+0x6f/0xf0 fs/ext4/block_validity.c:236
 ext4_setup_system_zone+0x7f2/0xac0 fs/ext4/block_validity.c:194
 ext4_remount+0x112e/0x22d0 fs/ext4/super.c:5381
 do_remount_sb+0x1c4/0x710 fs/super.c:888
 do_remount fs/namespace.c:2290 [inline]
 do_mount+0x170a/0x2bc0 fs/namespace.c:2790
 ksys_mount+0xdb/0x150 fs/namespace.c:3015
 __do_sys_mount fs/namespace.c:3029 [inline]
 __se_sys_mount fs/namespace.c:3026 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3026
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88809ac61d20
 which belongs to the cache ext4_system_zone of size 40
The buggy address is located 24 bytes inside of
 40-byte region [ffff88809ac61d20, ffff88809ac61d48)
The buggy address belongs to the page:
page:ffffea00026b1840 count:1 mapcount:0 mapping:ffff888219c633c0 index:0xffff88809ac61fb9
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffff8880a672ae38 ffff8880a672ae38 ffff888219c633c0
raw: ffff88809ac61fb9 ffff88809ac61000 0000000100000004 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809ac61c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88809ac61c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88809ac61d00: fc fc fc fc fb fb fb fb fb fc fc fb fb fb fb fb
                                        ^
 ffff88809ac61d80: fc fc fb fb fb fb fb fc fc fb fb fb fb fb fc fc
 ffff88809ac61e00: fb fb fb fb fb fc fc fb fb fb fb fb fc fc fb fb
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/26 00:27 linux-4.19.y d573e8a79f70 a3355dba .config console log report ci2-linux-4-19
2019/07/25 06:11 linux-4.19.y be9b6782a9eb 32329ceb .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.