syzbot

 sign-in | mailing list | source | docs
🐞 Open [546] 🐞 Fixed [32] 🐞 Invalid [297] ⬇ Missing Backports [45] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: user-memory-access Write in __destroy_inode

Status: upstream: reported C repro on 2023/05/28 20:49
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+8cc84e9be19865da71db@syzkaller.appspotmail.com
First crash: 334d, last: 2d05h
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2023/05/28 upstream (ToT) 7877cb91f108 C [report] KASAN: user-memory-access Write in __destroy_inode
2024/04/12 upstream (ToT) 5939d45155bb C Failed due to an error; will retry later
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: user-memory-access Write in __destroy_inode jfs C error 304 3h17m 359d 0/26 upstream: reported C repro on 2023/05/04 09:32
linux-6.1 KASAN: user-memory-access Write in __destroy_inode origin:upstream C 7 11h18m 328d 0/3 upstream: reported C repro on 2023/06/03 22:53
▶ ▼ Fix bisection attempts (8)
Created Duration User Patch Repo Result
2024/03/27 04:10 1h44m bisect fix linux-5.15.y job log (0) log
2024/02/25 18:37 55m bisect fix linux-5.15.y job log (0) log
2024/01/17 16:21 1h26m bisect fix linux-5.15.y job log (0) log
2023/12/17 19:49 2h03m bisect fix linux-5.15.y job log (0) log
2023/11/17 12:39 2h28m bisect fix linux-5.15.y job log (0) log
2023/10/17 05:09 1h43m bisect fix linux-5.15.y job log (0) log
2023/09/12 20:14 1h47m bisect fix linux-5.15.y job log (0) log
2023/06/29 00:30 1h09m bisect fix linux-5.15.y job log (0) log

Sample crash report:
ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 5
ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 6
ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 7
==================================================================
BUG: KASAN: user-memory-access in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: user-memory-access in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:167 [inline]
BUG: KASAN: user-memory-access in __refcount_sub_and_test include/linux/refcount.h:272 [inline]
BUG: KASAN: user-memory-access in __refcount_dec_and_test include/linux/refcount.h:315 [inline]
BUG: KASAN: user-memory-access in refcount_dec_and_test include/linux/refcount.h:333 [inline]
BUG: KASAN: user-memory-access in posix_acl_release include/linux/posix_acl.h:57 [inline]
BUG: KASAN: user-memory-access in __destroy_inode+0x427/0x5e0 fs/inode.c:273
Write of size 4 at addr 0000000b00000000 by task syz-executor394/3499

CPU: 0 PID: 3499 Comm: syz-executor394 Not tainted 5.15.113-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:438 [inline]
 kasan_report+0x161/0x1c0 mm/kasan/report.c:451
 kasan_check_range+0x27e/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:167 [inline]
 __refcount_sub_and_test include/linux/refcount.h:272 [inline]
 __refcount_dec_and_test include/linux/refcount.h:315 [inline]
 refcount_dec_and_test include/linux/refcount.h:333 [inline]
 posix_acl_release include/linux/posix_acl.h:57 [inline]
 __destroy_inode+0x427/0x5e0 fs/inode.c:273
 destroy_inode fs/inode.c:284 [inline]
 evict+0x51b/0x620 fs/inode.c:602
 dispose_list fs/inode.c:620 [inline]
 evict_inodes+0x601/0x6a0 fs/inode.c:670
 generic_shutdown_super+0x99/0x2c0 fs/super.c:454
 kill_block_super+0x7a/0xe0 fs/super.c:1405
 deactivate_locked_super+0xa0/0x110 fs/super.c:335
 cleanup_mnt+0x44e/0x500 fs/namespace.c:1143
 task_work_run+0x129/0x1a0 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0x6a3/0x2480 kernel/exit.c:872
 do_group_exit+0x144/0x310 kernel/exit.c:994
 __do_sys_exit_group kernel/exit.c:1005 [inline]
 __se_sys_exit_group kernel/exit.c:1003 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1003
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f0afa8dca59
Code: Unable to access opcode bytes at RIP 0x7f0afa8dca2f.
RSP: 002b:00007ffe09a32038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f0afa957330 RCX: 00007f0afa8dca59
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f0afa951e40
R10: 00007f0afa951e40 R11: 0000000000000246 R12: 00007f0afa957330
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
 </TASK>
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/28 20:49 linux-5.15.y 1fe619a7d252 cf184559 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan KASAN: user-memory-access Write in __destroy_inode
2024/04/21 06:11 linux-5.15.y c52b9710c83d af24b050 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 KASAN: user-memory-access Write in __destroy_inode
2024/04/25 07:02 linux-5.15.y c52b9710c83d 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: user-memory-access Write in __destroy_inode
2024/04/21 05:30 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: user-memory-access Write in __destroy_inode
2024/04/21 05:30 linux-5.15.y c52b9710c83d af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 KASAN: user-memory-access Write in __destroy_inode
* Struck through repros no longer work on HEAD.