syzbot

 sign-in | mailing list | source | docs
🐞 Open [717]
🐞 Fixed [181]
🐞 Invalid [640]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in dbJoin

Status: upstream: reported C repro on 2022/09/26 07:12
Reported-by: syzbot+38cb1c06812b2affa808@syzkaller.appspotmail.com
First crash: 855d, last: 707d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in dbJoin jfs C error 988 1d15h 841d 0/28 upstream: reported C repro on 2022/10/10 07:35
linux-4.19 KASAN: use-after-free Read in dbJoin C error 1 855d 855d 0/1 upstream: reported C repro on 2022/09/26 15:15
linux-6.1 UBSAN: array-index-out-of-bounds in dbJoin origin:upstream C error 51 30d 259d 0/3 upstream: reported C repro on 2024/05/14 08:42
linux-5.15 UBSAN: array-index-out-of-bounds in dbJoin origin:upstream C 76 2d22h 265d 0/3 upstream: reported C repro on 2024/05/08 02:35
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2023/02/21 14:19 36m bisect fix linux-4.14.y OK (0) job log log
2023/01/21 13:20 22m bisect fix linux-4.14.y OK (0) job log log
2022/11/05 02:26 19m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KASAN: use-after-free in dbJoin+0x1ee/0x200 fs/jfs/jfs_dmap.c:2849
Read of size 1 at addr ffff8881a9008a4c by task jfsCommit/1964

CPU: 1 PID: 1964 Comm: jfsCommit Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load1_noabort+0x68/0x70 mm/kasan/report.c:427
 dbJoin+0x1ee/0x200 fs/jfs/jfs_dmap.c:2849
 dbFreeBits+0xd4/0x660 fs/jfs/jfs_dmap.c:2386
 dbFreeDmap+0x61/0x180 fs/jfs/jfs_dmap.c:2135
 dbFree+0x20c/0x4b0 fs/jfs/jfs_dmap.c:392
 txFreeMap+0x691/0xa00 fs/jfs/jfs_txnmgr.c:2579
 txUpdateMap+0x2e3/0xe30 fs/jfs/jfs_txnmgr.c:2375
 txLazyCommit fs/jfs/jfs_txnmgr.c:2709 [inline]
 jfs_lazycommit+0x48b/0x8c0 fs/jfs/jfs_txnmgr.c:2777
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

The buggy address belongs to the page:
page:ffffea0006a40200 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x57ff00000000000()
raw: 057ff00000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: ffffea0006a40220 ffffea0006a40220 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881a9008900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881a9008980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881a9008a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff8881a9008a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881a9008b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/04 04:28 linux-4.14.y 9d5c0b3a8e1a feb56351 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-14 KASAN: use-after-free Read in dbJoin
2022/09/26 07:12 linux-4.14.y 4edbf74132a4 0042f2b4 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-14 KASAN: use-after-free Read in dbJoin
* Struck through repros no longer work on HEAD.