syzbot

 sign-in | mailing list | source | docs
🐞 Open [552] 🐞 Fixed [32] 🐞 Invalid [297] ⬇ Missing Backports [45] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list (2)

Status: upstream: reported C repro on 2024/01/28 16:33
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+72da154e9f7c4866295f@syzkaller.appspotmail.com
First crash: 90d, last: 7d18h
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2024/01/28 upstream (ToT) 8a696a29c690 C [report] KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list origin:upstream C 2 31d 341d 0/3 upstream: reported C repro on 2023/05/22 16:15
upstream KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list reiserfs C error done 100 116d 547d 26/26 fixed on 2024/02/16 19:40
linux-5.15 KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list 3 295d 371d 0/3 auto-obsoleted due to no activity on 2023/10/16 09:07
linux-4.14 BUG: unable to handle kernel paging request in cleanup_bitmap_list C 1 433d 545d 0/1 upstream: reported C repro on 2022/10/30 13:58
linux-4.19 BUG: unable to handle kernel paging request in cleanup_bitmap_list reiserfs C error 2 465d 548d 0/1 upstream: reported C repro on 2022/10/28 06:50
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2024/04/06 22:58 1h44m bisect fix linux-5.15.y job log (0) log
2024/03/07 02:21 57m bisect fix linux-5.15.y job log (0) log

Sample crash report:
REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30
REISERFS (device loop0): checking transaction log (loop0)
REISERFS (device loop0): Using r5 hash to sort names
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in cleanup_bitmap_list+0x175/0x500 fs/reiserfs/journal.c:231
Read of size 8 at addr ffffc90000e36008 by task syz-executor290/3501

CPU: 0 PID: 3501 Comm: syz-executor290 Not tainted 5.15.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_address_description+0x63/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
 cleanup_bitmap_list+0x175/0x500 fs/reiserfs/journal.c:231
 free_list_bitmaps+0x48/0x1a0 fs/reiserfs/journal.c:249
 free_journal_ram+0xf8/0x3f0 fs/reiserfs/journal.c:1884
 do_journal_release+0x362/0x4d0 fs/reiserfs/journal.c:1957
 journal_release+0x1b/0x30 fs/reiserfs/journal.c:1968
 reiserfs_put_super+0x237/0x4b0 fs/reiserfs/super.c:616
 generic_shutdown_super+0x136/0x2c0 fs/super.c:475
 kill_block_super+0x7a/0xe0 fs/super.c:1414
 deactivate_locked_super+0xa0/0x110 fs/super.c:335
 cleanup_mnt+0x44e/0x500 fs/namespace.c:1143
 task_work_run+0x129/0x1a0 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0x6a3/0x2480 kernel/exit.c:872
 do_group_exit+0x144/0x310 kernel/exit.c:994
 __do_sys_exit_group kernel/exit.c:1005 [inline]
 __se_sys_exit_group kernel/exit.c:1003 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1003
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f305ee5a849
Code: Unable to access opcode bytes at RIP 0x7f305ee5a81f.
RSP: 002b:00007ffe232a32c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f305ee5a849
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 00007f305eed72d0 R08: ffffffffffffffb8 R09: 00007ffe232a33a0
R10: 00007ffe232a33a0 R11: 0000000000000246 R12: 00007f305eed72d0
R13: 0000000000000000 R14: 00007f305eed8040 R15: 00007f305ee28d80
 </TASK>


Memory state around the buggy address:
 ffffc90000e35f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000e35f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90000e36000: 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                      ^
 ffffc90000e36080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000e36100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/28 16:33 linux-5.15.y 6139f2a02fe0 cc4a4020 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list
2024/04/20 16:49 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list
2024/04/07 04:43 linux-5.15.y 9465fef4ae35 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Read in cleanup_bitmap_list
* Struck through repros no longer work on HEAD.