KASAN: use-after-free Read in __isofs

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	KASAN: use-after-free Read in __isofs_iget	C		error	2	1016d	1287d	0/1	upstream: reported C repro on 2021/06/17 11:39
upstream	KASAN: use-after-free Read in __isofs_iget isofs	C	inconclusive		2	1171d	1167d	20/28	fixed on 2022/03/08 16:11

linux-4.19

KASAN: use-after-free Read in __isofs_iget

error

1016d

1287d

0/1

upstream: reported C repro on 2021/06/17 11:39

upstream

KASAN: use-after-free Read in __isofs_iget isofs

inconclusive

1171d

1167d

20/28

fixed on 2022/03/08 16:11

Created	Duration	User	Patch	Repo	Result
2023/03/01 16:32	12m	retest repro		linux-4.14.y	report log
2022/11/10 03:30	14m	retest repro		linux-4.14.y	report log

Created

Duration

User

Patch

Repo

Result

2023/03/01 16:32

12m

retest repro

linux-4.14.y

report log

2022/11/10 03:30

14m

retest repro

linux-4.14.y

report log


Created	Duration	User	Repo	Result
2022/07/14 17:44	22m	bisect fix	linux-4.14.y	OK (2) job log
2022/06/14 17:19	25m	bisect fix	linux-4.14.y	OK (0) job log log
2022/05/15 16:54	24m	bisect fix	linux-4.14.y	OK (0) job log log
2022/04/15 16:27	27m	bisect fix	linux-4.14.y	OK (0) job log log
2022/03/16 04:46	30m	bisect fix	linux-4.14.y	OK (0) job log log
2022/02/13 20:28	26m	bisect fix	linux-4.14.y	OK (0) job log log
2022/01/14 20:00	27m	bisect fix	linux-4.14.y	OK (0) job log log
2021/12/15 19:34	25m	bisect fix	linux-4.14.y	OK (0) job log log
2021/11/15 19:04	29m	bisect fix	linux-4.14.y	OK (0) job log log
2021/10/16 18:37	26m	bisect fix	linux-4.14.y	OK (0) job log log
2021/09/16 18:05	22m	bisect fix	linux-4.14.y	OK (0) job log log
2021/08/17 17:43	21m	bisect fix	linux-4.14.y	OK (0) job log log

isofs: isofs_export_get_parent(): child directory not normalized! isofs: isofs_export_get_parent(): child directory not normalized! ================================================================== BUG: KASAN: use-after-free in isofs_read_inode fs/isofs/inode.c:1355 [inline] BUG: KASAN: use-after-free in __isofs_iget+0x19dd/0x1de0 fs/isofs/inode.c:1555 Read of size 1 at addr ffff88808bd6a015 by task syz-executor181/8027 CPU: 0 PID: 8027 Comm: syz-executor181 Not tainted 4.14.239-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load1_noabort+0x68/0x70 mm/kasan/report.c:427 isofs_read_inode fs/isofs/inode.c:1355 [inline] __isofs_iget+0x19dd/0x1de0 fs/isofs/inode.c:1555 isofs_iget fs/isofs/isofs.h:134 [inline] isofs_export_iget fs/isofs/export.c:29 [inline] isofs_export_iget fs/isofs/export.c:20 [inline] isofs_fh_to_dentry fs/isofs/export.c:170 [inline] isofs_fh_to_dentry+0xf7/0x1b0 fs/isofs/export.c:162 exportfs_decode_fh+0x113/0x6c0 fs/exportfs/expfs.c:433 do_handle_to_path fs/fhandle.c:153 [inline] handle_to_path fs/fhandle.c:208 [inline] do_handle_open+0x248/0x570 fs/fhandle.c:224 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x444e19 RSP: 002b:00007fff54600378 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 RAX: ffffffffffffffda RBX: 0000000000006ea4 RCX: 0000000000444e19 RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fff546003a0 R10: 00007fff54600240 R11: 0000000000000246 R12: 00007fff5460039c R13: 00007fff546003d0 R14: 00007fff546003b0 R15: 000000000000000b The buggy address belongs to the page: page:ffffea00022f5a80 count:0 mapcount:0 mapping: (null) index:0x1 flags: 0xfff00000000000() raw: 00fff00000000000 0000000000000000 0000000000000001 00000000ffffffff raw: ffffea00022f5ae0 ffffea00022f78e0 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808bd69f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88808bd69f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88808bd6a000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88808bd6a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88808bd6a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================