syzbot


WARNING in udf_new_block

Status: upstream: reported C repro on 2024/04/19 09:03
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+8cded13d88d44440ebdb@syzkaller.appspotmail.com
First crash: 57d, last: 3d21h
Bug presence (1)
Date Name Commit Repro Result
2024/05/12 upstream (ToT) cf87f46fd34d C [report] KASAN: use-after-free Read in udf_sync_fs
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in udf_new_block udf C inconclusive done 31 172d 456d 26/27 fixed on 2024/01/31 10:34
linux-6.1 WARNING in udf_new_block 1 431d 431d 0/3 auto-obsoleted due to no activity on 2023/08/09 08:15
linux-6.1 WARNING in udf_new_block (2) 2 55d 58d 0/3 upstream: reported on 2024/04/19 02:50
Fix bisection attempts (1)
Created Duration User Patch Repo Result
2024/06/12 05:14 2h09m bisect fix linux-5.15.y job log (0) log

Sample crash report:
loop0: detected capacity change from 0 to 128
UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256
UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3501 at fs/udf/udfdecl.h:116 udf_add_free_space fs/udf/balloc.c:125 [inline]
WARNING: CPU: 1 PID: 3501 at fs/udf/udfdecl.h:116 udf_table_new_block fs/udf/balloc.c:667 [inline]
WARNING: CPU: 1 PID: 3501 at fs/udf/udfdecl.h:116 udf_new_block+0x1e2b/0x21a0 fs/udf/balloc.c:733
Modules linked in:
CPU: 0 PID: 3501 Comm: syz-executor315 Not tainted 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:udf_updated_lvid fs/udf/udfdecl.h:114 [inline]
RIP: 0010:udf_add_free_space fs/udf/balloc.c:125 [inline]
RIP: 0010:udf_table_new_block fs/udf/balloc.c:667 [inline]
RIP: 0010:udf_new_block+0x1e2b/0x21a0 fs/udf/balloc.c:733
Code: fd ff ff e8 e7 99 a7 fe 48 8b bc 24 80 00 00 00 e8 3a 76 4d 07 45 31 ff 48 8b 9c 24 98 00 00 00 e9 7d fd ff ff e8 c5 99 a7 fe <0f> 0b 43 80 7c 25 00 00 0f 85 5e fc ff ff e9 61 fc ff ff 89 d9 80
RSP: 0000:ffffc90002d26f80 EFLAGS: 00010293
RAX: ffffffff82d8c2fb RBX: 000000009f433eba RCX: ffff8880793e8000
RDX: 0000000000000000 RSI: 000000009f433eba RDI: 0000000000000000
RBP: ffffc90002d271d0 R08: ffffffff82d8bf52 R09: fffffbfff1bc8c56
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff11002b724cf R14: ffff88801184661c R15: ffff888015b92678
FS:  0000555555fc0380(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f505e306095 CR3: 000000006f4bc000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 udf_new_inode+0x3a3/0xf10 fs/udf/ialloc.c:86
 udf_create+0x1f/0x140 fs/udf/namei.c:612
 lookup_open fs/namei.c:3462 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0x130a/0x2f20 fs/namei.c:3739
 do_filp_open+0x21c/0x460 fs/namei.c:3769
 file_open_name fs/open.c:1198 [inline]
 filp_open+0x25d/0x2c0 fs/open.c:1218
 do_coredump+0x2549/0x31e0 fs/coredump.c:767
 get_signal+0xc06/0x14e0 kernel/signal.c:2875
 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:320
 exc_page_fault+0x342/0x740 arch/x86/mm/fault.c:1535
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7fd975a8e00a
Code: 00 01 00 00 00 74 9a 83 f9 c0 0f 87 8c fe ff ff c5 fe 6f 4e 20 48 29 fe 48 83 c7 3f 49 8d 0c 10 48 83 e7 c0 48 01 fe 48 29 f9 <f3> a4 c4 c1 7e 7f 00 c4 c1 7e 7f 48 20 e9 0b fd ff ff 0f 1f 40 00
RSP: 002b:00007ffeaa383eb8 EFLAGS: 00010206
RAX: 00000000200005c0 RBX: 00007fd975af4097 RCX: 000000000000fa3e
RDX: 000000000001f47e RSI: 00007fd975b040b8 RDI: 0000000020010000
RBP: 00007fd975b44600 R08: 00000000200005c0 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000031
R13: 0000000000000003 R14: 000000000000000c R15: 00007ffeaa383f0a
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/12 12:22 linux-5.15.y 284087d4f7d5 9026e142 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-linux-5-15-kasan WARNING in udf_new_block
2024/05/12 10:04 linux-5.15.y 284087d4f7d5 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in udf_new_block
2024/04/19 09:02 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in udf_new_block
* Struck through repros no longer work on HEAD.