KASAN: slab-out-of-bounds Read in dbAdjTree

Status: upstream: reported C repro on 2022/10/03 00:17
Reported-by: syzbot+2aa0d1c312850487b23f@syzkaller.appspotmail.com
First crash: 1389d, last: 1242d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in dbAdjTree 19 C error 5 1244d 1361d 0/1 upstream: reported C repro on 2022/10/31 14:16
upstream UBSAN: array-index-out-of-bounds in dbAdjTree jfs 15 C error error 41 918d 1396d 25/29 fixed on 2024/01/30 15:47
linux-5.15 UBSAN: array-index-out-of-bounds in dbAdjTree origin:lts-only 15 C done 7 587d 626d 3/3 fixed on 2025/01/22 14:58
upstream UBSAN: array-index-out-of-bounds in dbAdjTree (2) jfs 15 C inconclusive 77 610d 796d 28/29 fixed on 2024/12/16 09:50
linux-6.1 UBSAN: array-index-out-of-bounds in dbAdjTree origin:lts-only 15 C done 4 588d 591d 0/3 upstream: reported C repro on 2024/12/09 11:51
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2023/02/25 13:21 51m bisect fix linux-4.14.y OK (0) job log log
2023/01/25 03:24 29m bisect fix linux-4.14.y OK (0) job log log
2022/11/04 12:58 22m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in dbAdjTree+0x20d/0x280 fs/jfs/jfs_dmap.c:2918
Read of size 1 at addr ffff8880af2dd078 by task syz-executor423/7959

CPU: 1 PID: 7959 Comm: syz-executor423 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load1_noabort+0x68/0x70 mm/kasan/report.c:427
 dbAdjTree+0x20d/0x280 fs/jfs/jfs_dmap.c:2918
 dbSplit+0xeb/0x130 fs/jfs/jfs_dmap.c:2690
 dbAllocBits+0x10b/0x4a0 fs/jfs/jfs_dmap.c:2239
 dbAllocDmap+0x5f/0x100 fs/jfs/jfs_dmap.c:2080
 dbAllocNear fs/jfs/jfs_dmap.c:1309 [inline]
 dbAlloc+0x679/0x980 fs/jfs/jfs_dmap.c:826
 diNewExt+0x5b0/0x1780 fs/jfs/jfs_imap.c:2272
 diAllocExt fs/jfs/jfs_imap.c:1966 [inline]
 diAllocAG+0x14ee/0x2110 fs/jfs/jfs_imap.c:1683
 diAlloc+0x69d/0x1230 fs/jfs/jfs_imap.c:1604
 ialloc+0x7b/0x940 fs/jfs/jfs_inode.c:70
 jfs_mkdir.part.0+0xfd/0x7e0 fs/jfs/namei.c:238
 jfs_mkdir+0x35/0x50 fs/jfs/namei.c:223
 vfs_mkdir+0x463/0x6e0 fs/namei.c:3851
 SYSC_mkdirat fs/namei.c:3874 [inline]
 SyS_mkdirat+0x1fd/0x270 fs/namei.c:3858
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f24d3892e49
RSP: 002b:00007ffc991e54c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f24d3892e49
RDX: 00007f24d38513e3 RSI: 0000000000000000 RDI: 00000000200052c0
RBP: 00007f24d38526b0 R08: 00005555574f02c0 R09: 0000000000000000
R10: 00007ffc991e5390 R11: 0000000000000246 R12: 00000000f8008000
R13: 0000000000000000 R14: 00080000000000fc R15: 0000000000000000

Allocated by task 4632:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
 __do_kmalloc mm/slab.c:3720 [inline]
 __kmalloc+0x15a/0x400 mm/slab.c:3729
 kmalloc include/linux/slab.h:493 [inline]
 kernfs_fop_write+0x2fe/0x440 fs/kernfs/file.c:293
 __vfs_write+0xe4/0x630 fs/read_write.c:480
 vfs_write+0x17f/0x4d0 fs/read_write.c:544
 SYSC_write fs/read_write.c:590 [inline]
 SyS_write+0xf2/0x210 fs/read_write.c:582
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb

Freed by task 4632:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kfree+0xc9/0x250 mm/slab.c:3815
 kernfs_fop_write+0x161/0x440 fs/kernfs/file.c:330
 __vfs_write+0xe4/0x630 fs/read_write.c:480
 vfs_write+0x17f/0x4d0 fs/read_write.c:544
 SYSC_write fs/read_write.c:590 [inline]
 SyS_write+0xf2/0x210 fs/read_write.c:582
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb

The buggy address belongs to the object at ffff8880af2dd040
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 24 bytes to the right of
 32-byte region [ffff8880af2dd040, ffff8880af2dd060)
The buggy address belongs to the page:
page:ffffea0002bcb740 count:1 mapcount:0 mapping:ffff8880af2dd000 index:0xffff8880af2ddfc1
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffff8880af2dd000 ffff8880af2ddfc1 0000000100000006
raw: ffffea0002ae6ce0 ffffea0002b06960 ffff88813fe741c0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880af2dcf00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8880af2dcf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880af2dd000: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
                                                                ^
 ffff8880af2dd080: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8880af2dd100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/03 00:16 linux-4.14.y 9d5c0b3a8e1a feb56351 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-14 KASAN: slab-out-of-bounds Read in dbAdjTree
2023/02/26 21:56 linux-4.14.y 7878a41b6cc1 ee50e71c .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 BUG: unable to handle kernel paging request in dbAdjTree
2022/11/10 00:46 linux-4.14.y a901bb6c7db7 bebca8b7 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 BUG: unable to handle kernel paging request in dbAdjTree
* Struck through repros no longer work on HEAD.