syzbot


KASAN: use-after-free Read in __isofs_iget

Status: upstream: reported C repro on 2021/07/18 17:43
Reported-by: syzbot+4bcdacd12d4f4f7c38dc@syzkaller.appspotmail.com
First crash: 1062d, last: 731d
Fix bisection the fix commit could be any of (bisect log):
  4e68c9b0763f Linux 4.14.239
  424a46ea058e Linux 4.14.288
  
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in __isofs_iget C error 2 822d 1094d 0/1 upstream: reported C repro on 2021/06/17 11:39
upstream KASAN: use-after-free Read in __isofs_iget isofs C inconclusive 2 977d 973d 20/27 fixed on 2022/03/08 16:11
Last patch testing requests (2)
Created Duration User Patch Repo Result
2023/03/01 16:32 12m retest repro linux-4.14.y report log
2022/11/10 03:30 14m retest repro linux-4.14.y report log
Fix bisection attempts (12)
Created Duration User Patch Repo Result
2022/07/14 17:44 22m bisect fix linux-4.14.y job log (2)
2022/06/14 17:19 25m bisect fix linux-4.14.y job log (0) log
2022/05/15 16:54 24m bisect fix linux-4.14.y job log (0) log
2022/04/15 16:27 27m bisect fix linux-4.14.y job log (0) log
2022/03/16 04:46 30m bisect fix linux-4.14.y job log (0) log
2022/02/13 20:28 26m bisect fix linux-4.14.y job log (0) log
2022/01/14 20:00 27m bisect fix linux-4.14.y job log (0) log
2021/12/15 19:34 25m bisect fix linux-4.14.y job log (0) log
2021/11/15 19:04 29m bisect fix linux-4.14.y job log (0) log
2021/10/16 18:37 26m bisect fix linux-4.14.y job log (0) log
2021/09/16 18:05 22m bisect fix linux-4.14.y job log (0) log
2021/08/17 17:43 21m bisect fix linux-4.14.y job log (0) log

Sample crash report:
isofs: isofs_export_get_parent(): child directory not normalized!
isofs: isofs_export_get_parent(): child directory not normalized!
==================================================================
BUG: KASAN: use-after-free in isofs_read_inode fs/isofs/inode.c:1355 [inline]
BUG: KASAN: use-after-free in __isofs_iget+0x19dd/0x1de0 fs/isofs/inode.c:1555
Read of size 1 at addr ffff88808bd6a015 by task syz-executor181/8027

CPU: 0 PID: 8027 Comm: syz-executor181 Not tainted 4.14.239-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load1_noabort+0x68/0x70 mm/kasan/report.c:427
 isofs_read_inode fs/isofs/inode.c:1355 [inline]
 __isofs_iget+0x19dd/0x1de0 fs/isofs/inode.c:1555
 isofs_iget fs/isofs/isofs.h:134 [inline]
 isofs_export_iget fs/isofs/export.c:29 [inline]
 isofs_export_iget fs/isofs/export.c:20 [inline]
 isofs_fh_to_dentry fs/isofs/export.c:170 [inline]
 isofs_fh_to_dentry+0xf7/0x1b0 fs/isofs/export.c:162
 exportfs_decode_fh+0x113/0x6c0 fs/exportfs/expfs.c:433
 do_handle_to_path fs/fhandle.c:153 [inline]
 handle_to_path fs/fhandle.c:208 [inline]
 do_handle_open+0x248/0x570 fs/fhandle.c:224
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x444e19
RSP: 002b:00007fff54600378 EFLAGS: 00000246 ORIG_RAX: 0000000000000130
RAX: ffffffffffffffda RBX: 0000000000006ea4 RCX: 0000000000444e19
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fff546003a0
R10: 00007fff54600240 R11: 0000000000000246 R12: 00007fff5460039c
R13: 00007fff546003d0 R14: 00007fff546003b0 R15: 000000000000000b

The buggy address belongs to the page:
page:ffffea00022f5a80 count:0 mapcount:0 mapping:          (null) index:0x1
flags: 0xfff00000000000()
raw: 00fff00000000000 0000000000000000 0000000000000001 00000000ffffffff
raw: ffffea00022f5ae0 ffffea00022f78e0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88808bd69f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88808bd69f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88808bd6a000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                         ^
 ffff88808bd6a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88808bd6a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/18 17:43 linux-4.14.y 4e68c9b0763f f115ae98 .config console log report syz C ci2-linux-4-14 KASAN: use-after-free Read in __isofs_iget
* Struck through repros no longer work on HEAD.