syzbot


KASAN: wild-memory-access Read in read_block_bitmap

Status: upstream: reported C repro on 2023/10/08 02:34
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+41074320433348dd071f@syzkaller.appspotmail.com
First crash: 208d, last: 30d
Fix bisection: the issue occurs on the latest tested release (bisect log)
Crash: KASAN: wild-memory-access Read in read_block_bitmap (log)
Repro: C syz .config
  
Bug presence (3)
Date Name Commit Repro Result
2024/01/06 linux-6.1.y (ToT) 38fb82ecd144 C [report] KASAN: wild-memory-access Read in read_block_bitmap
2023/10/08 upstream (ToT) b9ddbb0cde2a C [report] KASAN: wild-memory-access Read in read_block_bitmap
2024/01/06 upstream (ToT) 95c8a35f1c01 C Didn't crash
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: wild-memory-access Read in read_block_bitmap ext4 C 33 30d 204d 0/26 upstream: reported C repro on 2023/10/12 02:25
Fix bisection attempts (3)
Created Duration User Patch Repo Result
2024/01/07 13:22 2h38m fix candidate upstream job log (0)
2023/12/24 18:26 2h33m bisect fix linux-6.1.y job log (0) log
2023/11/23 17:37 3h11m bisect fix linux-6.1.y job log (0) log

Sample crash report:
==================================================================
BUG: KASAN: wild-memory-access in generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline]
BUG: KASAN: wild-memory-access in test_bit_le include/asm-generic/bitops/le.h:21 [inline]
BUG: KASAN: wild-memory-access in ext2_valid_block_bitmap fs/ext2/balloc.c:88 [inline]
BUG: KASAN: wild-memory-access in read_block_bitmap+0x338/0x628 fs/ext2/balloc.c:155
Read of size 8 at addr 1fff0000e2ba1ff8 by task syz-executor173/4582

CPU: 1 PID: 4582 Comm: syz-executor173 Not tainted 6.1.80-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_report+0xe4/0x4c0 mm/kasan/report.c:398
 kasan_report+0xd4/0x130 mm/kasan/report.c:495
 __asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351
 generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline]
 test_bit_le include/asm-generic/bitops/le.h:21 [inline]
 ext2_valid_block_bitmap fs/ext2/balloc.c:88 [inline]
 read_block_bitmap+0x338/0x628 fs/ext2/balloc.c:155
 ext2_free_blocks+0x280/0xa28 fs/ext2/balloc.c:516
 ext2_free_data fs/ext2/inode.c:1089 [inline]
 ext2_free_branches+0x2f4/0x3c4 fs/ext2/inode.c:1146
 ext2_free_branches+0x180/0x3c4 fs/ext2/inode.c:1137
 ext2_free_branches+0x180/0x3c4 fs/ext2/inode.c:1137
 __ext2_truncate_blocks+0x9a8/0xd00 fs/ext2/inode.c:1220
 ext2_setsize fs/ext2/inode.c:1278 [inline]
 ext2_setattr+0x8e8/0xbcc fs/ext2/inode.c:1648
 notify_change+0xb58/0xe1c fs/attr.c:499
 do_truncate+0x1c0/0x28c fs/open.c:65
 handle_truncate fs/namei.c:3287 [inline]
 do_open fs/namei.c:3632 [inline]
 path_openat+0x1fa0/0x2548 fs/namei.c:3785
 do_filp_open+0x1bc/0x3cc fs/namei.c:3812
 do_sys_openat2+0x128/0x3d8 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1345
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
==================================================================
EXT2-fs (loop2): error: ext2_valid_block_bitmap: Invalid block bitmap - block_group = 0, block = 0
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks in system zones - Block = 3, count = 3
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 983269, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 589827, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2185560079, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 18346, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks in system zones - Block = 2, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 33261, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: bit already cleared for block 100
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1669132791, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1669132791, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: bit already cleared for block 64
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 65536, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 268435456, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1803188595, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1701604449, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2054779762, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1819042155, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 7565925, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1937768448, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1634433657, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1919249516, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1803188595, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1701604449, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2054779762, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1819042155, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2037609061, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1818323834, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 3133565699, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 327680, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 150994944, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2683928664, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2683928664, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2683928664, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1669132791, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2683928664, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 3925999616, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 3409668, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: bit already cleared for block 40
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1635017060, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1936876908, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1634433657, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1919249516, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1803188595, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1701604449, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2054779762, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1819042155, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2037609061, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1818323834, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1936876908, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: bit already cleared for block 9
EXT2-fs (loop2): error: ext2_free_blocks: bit already cleared for block 13
EXT2-fs (loop2): error: ext2_free_blocks: bit already cleared for block 32
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 163928, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 2683895808, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 1669132790, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks not in datazone - block = 131072, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks in system zones - Block = 5, count = 1
EXT2-fs (loop2): error: ext2_free_blocks: Freeing blocks in system zones - Block = 5, count = 1
EXT2-fs (loop2): error: ext2_free_branches: Read failure, inode=16, block=16777216

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/04 21:58 linux-6.1.y a3eb3a74aa8c 3717835d .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2024/03/01 22:36 linux-6.1.y a3eb3a74aa8c 83acf9e0 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/08 17:13 linux-6.1.y ecda77b46871 5e837c76 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2024/03/02 08:06 linux-6.1.y a3eb3a74aa8c 25905f5d .config console log report syz [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2024/04/03 07:26 linux-6.1.y e5cd595e23c1 7925100d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2024/03/28 00:20 linux-6.1.y e5cd595e23c1 120789fd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/19 23:05 linux-6.1.y 7d24402875c7 42e1d524 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/19 14:48 linux-6.1.y adc4d740ad9e 42e1d524 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/18 11:57 linux-6.1.y adc4d740ad9e 342b9c55 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/13 17:14 linux-6.1.y 082280fe94a0 f757a323 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/12 22:38 linux-6.1.y 082280fe94a0 6388bc36 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/10 05:38 linux-6.1.y ecda77b46871 c9be5398 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
2023/10/08 02:34 linux-6.1.y ecda77b46871 5e837c76 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: wild-memory-access Read in read_block_bitmap
* Struck through repros no longer work on HEAD.