syzbot

 sign-in | mailing list | source | docs
🐞 Open [969] ≡ Subsystems 🐞 Fixed [4558] 🐞 Invalid [10510] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: stack-out-of-bounds Read in xfs_buf_lock

Status: upstream: reported C repro on 2022/12/12 05:50
Labels: xfs (incorrect?)
Reported-by: syzbot+0bc698a422b5e4ac988c@syzkaller.appspotmail.com
First crash: 183d, last: 3h59m

Cause bisection: introduced by (bisect log) :
commit 679a99495b8fda800037b25af8cd990eb7dd72c9
Author: Christoph Hellwig <hch@lst.de>
Date: Mon Nov 29 10:21:41 2021 +0000

  xfs: factor out a xfs_setup_dax_always helper

Crash: INFO: task hung in unregister_shrinker (log)
Repro: C syz .config
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[syzbot] Monthly xfs report (May 2023) 1 (2) 2023/05/05 13:59
[syzbot] Monthly xfs report 3 (4) 2023/04/12 21:54
Re: [syzbot] [xfs?] KASAN: stack-out-of-bounds Read in xfs_buf_lock 2 (2) 2023/01/27 09:29
[syzbot] KASAN: stack-out-of-bounds Read in xfs_buf_lock 0 (3) 2023/01/21 20:19
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2023/01/23 08:21 23m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 7dd4b804e080 error

Sample crash report:
syz-executor415 (7514): drop_caches: 2
==================================================================
BUG: KASAN: stack-out-of-bounds in __lock_acquire+0x77/0x2000 kernel/locking/lockdep.c:4942
Read of size 8 at addr ffffc90003eff8f8 by task syz-executor415/7514

CPU: 1 PID: 7514 Comm: syz-executor415 Not tainted 6.4.0-rc2-syzkaller-00330-g0dd2a6fb1e34 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:351 [inline]
 print_report+0x163/0x540 mm/kasan/report.c:462
 kasan_report+0x176/0x1b0 mm/kasan/report.c:572
 __lock_acquire+0x77/0x2000 kernel/locking/lockdep.c:4942
 lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5691
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
 down+0x39/0xc0 kernel/locking/semaphore.c:59
 xfs_buf_lock+0x154/0x4b0 fs/xfs/xfs_buf.c:1119
 xfs_buf_delwri_submit_buffers+0x14d/0x8e0 fs/xfs/xfs_buf.c:2164
 xfs_buf_delwri_submit+0xba/0x260 fs/xfs/xfs_buf.c:2242
 xfs_qm_shrink_scan+0x1ce/0x3e0 fs/xfs/xfs_qm.c:522
 do_shrink_slab+0x563/0xdd0 mm/vmscan.c:912
 shrink_slab+0x253/0xac0 mm/vmscan.c:1075
 drop_slab_node mm/vmscan.c:1098 [inline]
 drop_slab+0x148/0x280 mm/vmscan.c:1116
 drop_caches_sysctl_handler+0xb7/0x160 fs/drop_caches.c:66
 proc_sys_call_handler+0x545/0x8a0 fs/proc/proc_sysctl.c:604
 do_iter_write+0x7b1/0xcb0 fs/read_write.c:860
 iter_file_splice_write+0x843/0xfe0 fs/splice.c:795
 do_splice_from fs/splice.c:873 [inline]
 direct_splice_actor+0xe7/0x1c0 fs/splice.c:1039
 splice_direct_to_actor+0x4c4/0xbd0 fs/splice.c:994
 do_splice_direct+0x283/0x3d0 fs/splice.c:1082
 do_sendfile+0x620/0xff0 fs/read_write.c:1254
 __do_sys_sendfile64 fs/read_write.c:1316 [inline]
 __se_sys_sendfile64+0x100/0x1e0 fs/read_write.c:1308
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc3ce524af9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe58eb6178 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00000000000c591c RCX: 00007fc3ce524af9
RDX: 0000000020002080 RSI: 0000000000000004 RDI: 0000000000000005
RBP: 0000000000000000 R08: 00007ffe58eb61a0 R09: 00007ffe58eb61a0
R10: 0000000000000870 R11: 0000000000000246 R12: 00007ffe58eb619c
R13: 00007ffe58eb61d0 R14: 00007ffe58eb61b0 R15: 000000000000002b
 </TASK>

The buggy address belongs to the virtual mapping at
 [ffffc90003ef8000, ffffc90003f01000) created by:
 copy_process+0x5c8/0x42f0 kernel/fork.c:2333

The buggy address belongs to the physical page:
page:ffffea0000b14a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c52a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 2, tgid 2 (kthreadd), ts 810996269686, free_ts 801067142749
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1e6/0x210 mm/page_alloc.c:1731
 prep_new_page mm/page_alloc.c:1738 [inline]
 get_page_from_freelist+0x321c/0x33a0 mm/page_alloc.c:3502
 __alloc_pages+0x255/0x670 mm/page_alloc.c:4768
 vm_area_alloc_pages mm/vmalloc.c:3009 [inline]
 __vmalloc_area_node mm/vmalloc.c:3085 [inline]
 __vmalloc_node_range+0x9ab/0x14e0 mm/vmalloc.c:3257
 alloc_thread_stack_node kernel/fork.c:313 [inline]
 dup_task_struct+0x3e5/0x7d0 kernel/fork.c:1116
 copy_process+0x5c8/0x42f0 kernel/fork.c:2333
 kernel_clone+0x222/0x800 kernel/fork.c:2918
 kernel_thread+0x1bc/0x230 kernel/fork.c:2980
 create_kthread kernel/kthread.c:402 [inline]
 kthreadd+0x600/0x820 kernel/kthread.c:737
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1302 [inline]
 free_unref_page_prepare+0x903/0xa30 mm/page_alloc.c:2564
 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2659
 kasan_depopulate_vmalloc_pte+0x6a/0x80 mm/kasan/shadow.c:427
 apply_to_pte_range mm/memory.c:2584 [inline]
 apply_to_pmd_range mm/memory.c:2628 [inline]
 apply_to_pud_range mm/memory.c:2664 [inline]
 apply_to_p4d_range mm/memory.c:2700 [inline]
 __apply_to_page_range+0x9c5/0xcc0 mm/memory.c:2734
 kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:544
 __purge_vmap_area_lazy+0xc0f/0x19c0 mm/vmalloc.c:1771
 drain_vmap_area_work+0x40/0xd0 mm/vmalloc.c:1804
 process_one_work+0x8a0/0x10e0 kernel/workqueue.c:2405
 worker_thread+0xa63/0x1210 kernel/workqueue.c:2552
 kthread+0x2b8/0x350 kernel/kthread.c:379
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

Memory state around the buggy address:
 ffffc90003eff780: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
 ffffc90003eff800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90003eff880: 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3
                                                                ^
 ffffc90003eff900: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90003eff980: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3
==================================================================

Crashes (182):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2023/05/21 17:25 upstream 0dd2a6fb1e34 4bce1a3e .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-smack-root KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/01/11 15:08 upstream 7dd4b804e080 1dac8c7a .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/24 18:06 upstream 9d646009f65d 4bce1a3e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/22 23:57 upstream 421ca22e3138 4bce1a3e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/22 11:04 upstream 44c026a73be8 4bce1a3e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/22 03:40 upstream e2065b8c1b01 4bce1a3e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/21 14:51 upstream 0dd2a6fb1e34 4bce1a3e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/20 15:44 upstream d635f6cc934b 4bce1a3e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/20 04:26 upstream 5565ec4ef4f0 96689200 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/19 16:19 upstream 2d1bcbc6cd70 e0257275 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/19 11:27 upstream 2d1bcbc6cd70 3bb7af1d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/19 02:30 upstream 2d1bcbc6cd70 3bb7af1d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/18 08:34 upstream 1b66c114d161 3bb7af1d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/18 05:37 upstream 1b66c114d161 3bb7af1d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/17 18:52 upstream 1b66c114d161 258520f6 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/16 23:30 upstream f1fcbaa18b28 11c89444 .config console log report info ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/16 13:58 upstream f1fcbaa18b28 60d220b5 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/16 06:09 upstream f1fcbaa18b28 71b00cfb .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/15 15:32 upstream f1fcbaa18b28 b8bae4ab .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/14 08:06 upstream bb7c241fae62 2b9ba477 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/14 00:47 upstream d4d58949a6ea 2b9ba477 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/12 06:18 upstream 105131df9c3b adb9a3cd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/12 05:12 upstream 105131df9c3b adb9a3cd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/11 23:31 upstream 105131df9c3b adb9a3cd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/11 11:17 upstream 80e62bc8487b 0fbd49f4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/09 23:14 upstream 1dc3731daf1f 1964022b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/09 10:38 upstream ba0ad6ed89fd f4168103 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/09 09:48 upstream ba0ad6ed89fd f4168103 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/07 10:19 upstream fc4354c6e5c2 90c93c40 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/07 09:13 upstream fc4354c6e5c2 90c93c40 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/06 02:12 upstream 418d5c98319f 90c93c40 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2022/12/23 19:27 upstream 8395ae05cb5a 9da18ae8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: stack-out-of-bounds Read in xfs_buf_lock
2022/12/12 05:50 upstream 830b3c68c1fb 67be1ae7 .config console log report info ci-qemu-upstream KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/06/02 10:15 upstream 1874a42a7d74 a4ae4f42 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/27 05:43 upstream a92c9ab69f66 cf184559 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/25 16:50 upstream 933174ae28ba 54259e6c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/22 09:33 upstream 44c026a73be8 4bce1a3e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/18 02:08 upstream 1b66c114d161 3bb7af1d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/16 19:13 upstream f1fcbaa18b28 11c89444 .config console log report info ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/15 11:01 upstream f1fcbaa18b28 b8bae4ab .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/14 22:35 upstream 31f4104e392a 2b9ba477 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/10 11:46 upstream 16a8829130ca 14b12a99 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/10 10:15 upstream 16a8829130ca 14b12a99 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/09 21:52 upstream 1dc3731daf1f 1964022b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/08 20:18 upstream ba0ad6ed89fd 33db58a6 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/08 12:22 upstream ac9a78681b92 90c93c40 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/07 21:19 upstream 17784de648be 90c93c40 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/07 07:39 upstream fc4354c6e5c2 90c93c40 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/05/06 17:51 upstream 2e1e1337881b 90c93c40 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2022/12/01 05:06 upstream 04aa64375f48 4c2a66e8 .config console log report info ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in xfs_buf_lock
2023/04/24 22:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a fdc18293 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: stack-out-of-bounds Read in xfs_buf_lock
* Struck through repros no longer work on HEAD.