Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] [ext4?] KASAN: use-after-free Read in ext4_search_dir | 1 (3) | 2023/05/22 12:57 |
syzbot |
sign-in | mailing list | source | docs |
🐞 Open [1012] ≡ Subsystems 🐞 Fixed [4882] 🐞 Invalid [11686] ⬇ Missing Backports [77] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes | 💬 Send us feedback |
Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] [ext4?] KASAN: use-after-free Read in ext4_search_dir | 1 (3) | 2023/05/22 12:57 |
Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
linux-5.15 | KASAN: use-after-free Read in ext4_search_dir origin:upstream | C | 1 | 9d13h | 177d | 0/3 | upstream: reported C repro on 2023/06/16 15:52 | ||
android-6-1 | KASAN: use-after-free Read in ext4_search_dir origin:upstream | C | error | 2 | 9d20h | 49d | 0/2 | upstream: reported C repro on 2023/10/22 16:55 | |
linux-6.1 | KASAN: use-after-free Read in ext4_search_dir origin:upstream | C | 1 | 9d04h | 175d | 0/3 | upstream: reported C repro on 2023/06/18 19:29 | ||
android-5-15 | KASAN: slab-out-of-bounds Read in ext4_search_dir origin:upstream | C | 1 | 9d20h | 23d | 0/2 | upstream: reported C repro on 2023/11/17 09:38 | ||
android-5-10 | KASAN: slab-out-of-bounds Read in ext4_search_dir | C | 1 | 9d20h | 23d | 0/2 | upstream: reported C repro on 2023/11/17 09:38 |
Created | Duration | User | Patch | Repo | Result |
---|---|---|---|---|---|
2023/12/06 17:45 | 15m | retest repro | upstream | report log | |
2023/12/06 17:56 | 13m | retest repro | upstream | report log | |
2023/12/06 17:45 | 10m | retest repro | upstream | report log | |
2023/10/26 03:25 | 16m | retest repro | linux-next | report log | |
2023/09/12 05:35 | 14m | retest repro | upstream | report log |
================================================================== BUG: KASAN: use-after-free in ext4_search_dir+0xf2/0x1b0 fs/ext4/namei.c:1543 Read of size 1 at addr ffff88806bcc4d23 by task syz-executor342/5059 CPU: 1 PID: 5059 Comm: syz-executor342 Not tainted 6.7.0-rc1-syzkaller-00125-g7475e51b8796 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x163/0x540 mm/kasan/report.c:475 kasan_report+0x142/0x170 mm/kasan/report.c:588 ext4_search_dir+0xf2/0x1b0 fs/ext4/namei.c:1543 ext4_find_inline_entry+0x4ba/0x5e0 fs/ext4/inline.c:1694 __ext4_find_entry+0x2b4/0x1b30 fs/ext4/namei.c:1616 ext4_lookup_entry fs/ext4/namei.c:1771 [inline] ext4_lookup+0x17a/0x750 fs/ext4/namei.c:1839 lookup_one_qstr_excl+0x11b/0x250 fs/namei.c:1609 filename_create+0x297/0x530 fs/namei.c:3876 do_mkdirat+0xbd/0x3a0 fs/namei.c:4121 __do_sys_mkdirat fs/namei.c:4144 [inline] __se_sys_mkdirat fs/namei.c:4142 [inline] __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4142 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8c74d293a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffec3db0d18 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f8c74d6d1d7 RCX: 00007f8c74d293a9 RDX: 0000000000000000 RSI: 0000000020000040 RDI: 00000000ffffff9c RBP: 0030656c69662f2e R08: 00000000000014ef R09: 0000000020001580 R10: 00000000000014f3 R11: 0000000000000246 R12: 0000000000000031 R13: 0000000000000003 R14: 00007f8c74da06c0 R15: 00007ffec3db0dfa </TASK> The buggy address belongs to the physical page: page:ffffea0001af3100 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6bcc4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 14724262823, free_ts 16180710530 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1e6/0x210 mm/page_alloc.c:1537 split_map_pages+0x24a/0x510 mm/compaction.c:97 isolate_freepages_range+0x476/0x4d0 mm/compaction.c:774 alloc_contig_range+0x62e/0x9a0 mm/page_alloc.c:6411 __alloc_contig_pages mm/page_alloc.c:6434 [inline] alloc_contig_pages+0x3f4/0x4f0 mm/page_alloc.c:6514 debug_vm_pgtable_alloc_huge_page+0xb9/0x110 mm/debug_vm_pgtable.c:1095 init_args+0x837/0xb10 mm/debug_vm_pgtable.c:1277 debug_vm_pgtable+0xe0/0x540 mm/debug_vm_pgtable.c:1315 do_one_initcall+0x234/0x810 init/main.c:1236 do_initcall_level+0x157/0x210 init/main.c:1298 do_initcalls+0x3f/0x80 init/main.c:1314 kernel_init_freeable+0x429/0x5c0 init/main.c:1551 kernel_init+0x1d/0x2a0 init/main.c:1441 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1137 [inline] free_unref_page_prepare+0x931/0xa60 mm/page_alloc.c:2347 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487 free_contig_range+0x9e/0x160 mm/page_alloc.c:6536 destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1028 debug_vm_pgtable+0x4ba/0x540 mm/debug_vm_pgtable.c:1408 do_one_initcall+0x234/0x810 init/main.c:1236 do_initcall_level+0x157/0x210 init/main.c:1298 do_initcalls+0x3f/0x80 init/main.c:1314 kernel_init_freeable+0x429/0x5c0 init/main.c:1551 kernel_init+0x1d/0x2a0 init/main.c:1441 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Memory state around the buggy address: ffff88806bcc4c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88806bcc4c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88806bcc4d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88806bcc4d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88806bcc4e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2023/11/17 08:55 | upstream | 7475e51b8796 | cb976f63 | .config | strace log | report | syz | C | [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | |
2023/05/17 08:12 | upstream | f1fcbaa18b28 | 11c89444 | .config | console log | report | syz | C | [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | |
2023/08/03 00:18 | linux-next | 626c67169f99 | 39a91c18 | .config | strace log | report | syz | C | [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] | ci-upstream-linux-next-kasan-gce-root | KASAN: use-after-free Read in ext4_search_dir | |
2023/06/23 12:45 | upstream | 8a28a0b6f1a1 | 09ffe269 | .config | console log | report | syz | C | [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] | ci-upstream-kasan-gce-root | KASAN: slab-out-of-bounds Read in ext4_search_dir | |
2023/05/17 07:29 | upstream | f1fcbaa18b28 | 11c89444 | .config | console log | report | syz | C | [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] | ci-upstream-kasan-gce-smack-root | KASAN: slab-out-of-bounds Read in ext4_search_dir | |
2023/11/17 08:25 | upstream | 7475e51b8796 | cb976f63 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | ||
2023/11/03 13:56 | upstream | 8f6f76a6a29f | c4ac074c | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | ||
2023/10/11 19:40 | upstream | 1c8b86a3799f | 83165b57 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-root | KASAN: use-after-free Read in ext4_search_dir | ||
2023/09/28 09:24 | upstream | 633b47cb009d | c2ab1e5d | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | ||
2023/08/29 05:06 | upstream | 727dbda16b83 | 7ba13a15 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | ||
2023/08/19 17:53 | upstream | aa9ea98cca3a | d216d8a0 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | ||
2023/05/17 07:02 | upstream | f1fcbaa18b28 | 11c89444 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-smack-root | KASAN: use-after-free Read in ext4_search_dir | ||
2023/05/07 07:18 | upstream | fc4354c6e5c2 | 90c93c40 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: use-after-free Read in ext4_search_dir | ||
2023/09/16 23:31 | linux-next | dfa449a58323 | 0b6a67ac | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-linux-next-kasan-gce-root | KASAN: use-after-free Read in ext4_search_dir | ||
2023/11/22 17:40 | upstream | c2d5304e6c64 | 03e12510 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: slab-out-of-bounds Read in ext4_search_dir | ||
2023/10/12 02:06 | upstream | 8182d7a3f1b8 | 83165b57 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: slab-out-of-bounds Read in ext4_search_dir | ||
2023/09/20 03:40 | upstream | 2cf0f7156238 | 0b6a67ac | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-fs | KASAN: slab-out-of-bounds Read in ext4_search_dir |