syzbot


KASAN: use-after-free Read in ocfs2_dir_foreach_blk

Status: upstream: reported C repro on 2024/09/27 14:22
Subsystems: ocfs2
[Documentation on labels]
Reported-by: syzbot+b20bbf680bb0f2ecedae@syzkaller.appspotmail.com
First crash: 142d, last: 2h00m
Cause bisection: failed (error log, bisect log)
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [ocfs2?] KASAN: use-after-free Read in ocfs2_dir_foreach_blk 0 (2) 2024/10/29 17:49
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: use-after-free Read in ocfs2_dir_foreach_blk C 3 8d09h 8d10h 0/3 upstream: reported C repro on 2025/02/03 04:13
Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/12/10 05:40 13m retest repro upstream report log

Sample crash report:
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
==================================================================
BUG: KASAN: use-after-free in ocfs2_dir_foreach_blk_id fs/ocfs2/dir.c:1787 [inline]
BUG: KASAN: use-after-free in ocfs2_dir_foreach_blk+0x132c/0x1b20 fs/ocfs2/dir.c:1925
Read of size 2 at addr ffff8880745c98c9 by task syz-executor199/5852

CPU: 0 UID: 0 PID: 5852 Comm: syz-executor199 Not tainted 6.13.0-syzkaller-09793-g69b8923f5003 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 ocfs2_dir_foreach_blk_id fs/ocfs2/dir.c:1787 [inline]
 ocfs2_dir_foreach_blk+0x132c/0x1b20 fs/ocfs2/dir.c:1925
 ocfs2_readdir+0x2a1/0x5e0 fs/ocfs2/dir.c:1969
 wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 __do_sys_getdents fs/readdir.c:322 [inline]
 __se_sys_getdents+0x1fd/0x4e0 fs/readdir.c:308
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffa5856f939
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdd8d085f8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ffa5856f939
RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000000 R08: 00007ffdd8d08630 R09: 00007ffdd8d08630
R10: 00007ffdd8d08630 R11: 0000000000000246 R12: 00007ffdd8d0861c
R13: 0000000000000004 R14: 431bde82d7b634db R15: 00007ffdd8d08650
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x90c pfn:0x745c9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001d17288 ffffea0001d17208 0000000000000000
raw: 000000000000090c 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5849, tgid 5849 (syz-executor199), ts 99408658391, free_ts 100198069162
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
 alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
 folio_alloc_mpol_noprof+0x36/0x70 mm/mempolicy.c:2289
 shmem_alloc_folio mm/shmem.c:1863 [inline]
 shmem_alloc_and_add_folio+0x4a0/0x1090 mm/shmem.c:1902
 shmem_get_folio_gfp+0x621/0x1840 mm/shmem.c:2522
 shmem_get_folio mm/shmem.c:2628 [inline]
 shmem_write_begin+0x165/0x350 mm/shmem.c:3278
 generic_perform_write+0x346/0x990 mm/filemap.c:4189
 shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3454
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xacf/0xd10 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5828 tgid 5828 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_folios+0xe2f/0x18a0 mm/page_alloc.c:2707
 folios_put_refs+0x76c/0x860 mm/swap.c:994
 folio_batch_release include/linux/pagevec.h:101 [inline]
 shmem_undo_range+0x593/0x1820 mm/shmem.c:1112
 shmem_truncate_range mm/shmem.c:1224 [inline]
 shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1352
 evict+0x4e8/0x9a0 fs/inode.c:796
 __dentry_kill+0x20d/0x630 fs/dcache.c:643
 dput+0x19f/0x2b0 fs/dcache.c:885
 __fput+0x60b/0x9f0 fs/file_table.c:458
 task_work_run+0x24f/0x310 kernel/task_work.c:227
 ptrace_notify+0x2d2/0x380 kernel/signal.c:2522
 ptrace_report_syscall include/linux/ptrace.h:415 [inline]
 ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
 syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173
 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
 syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880745c9780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880745c9800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880745c9880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff8880745c9900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880745c9980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (53):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/03 08:36 upstream 69b8923f5003 568559e4 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 07:36 upstream 69e858e0b8b2 568559e4 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 07:16 upstream 69b8923f5003 568559e4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/10/29 17:48 upstream e42b1a9a2557 66aeb999 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in ocfs2_dir_foreach_blk
2025/02/03 05:32 upstream 69b8923f5003 568559e4 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: slab-use-after-free Read in ocfs2_dir_foreach_blk
2025/02/11 12:15 upstream febbc555cf0f 43f51a00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/09 01:13 upstream 8f6629c004b1 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/05 14:51 upstream 5c8c229261f1 4dc70884 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/05 07:22 upstream d009de7d5428 5896748e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/05 04:17 upstream d009de7d5428 5896748e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 19:53 upstream d009de7d5428 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 17:03 upstream 0de63bb7d919 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 13:47 upstream 0de63bb7d919 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 03:22 upstream 0de63bb7d919 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 23:47 upstream 2014c95afece a21a8419 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 11:48 upstream 2014c95afece a21a8419 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 11:48 upstream 2014c95afece a21a8419 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 08:27 upstream 69b8923f5003 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/02 22:51 upstream 69b8923f5003 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/02 22:51 upstream 69b8923f5003 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/02 22:49 upstream 69b8923f5003 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/02 16:27 upstream 69b8923f5003 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/01 09:58 upstream ccb98ccef0e5 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/01 09:55 upstream ccb98ccef0e5 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/01 09:54 upstream ccb98ccef0e5 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/12/24 17:34 upstream f07044dd0df0 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/12/22 13:40 upstream 48f506ad0b68 b4fbdbd4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/11/18 23:23 upstream 23acd177540d e7bb5d6e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/30 16:36 upstream 72deda0abee6 e961d16c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/16 07:02 upstream 619f0b6fad52 968edaf4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/10 04:48 upstream 643e2e259c2b 67d7ec0a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/11/11 23:59 upstream 2d5404caa8c7 75bb1b32 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/09/22 10:03 upstream 88264981f208 6f888b75 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/10 08:41 linux-next df5d6180169a ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/10 06:18 linux-next df5d6180169a ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/10 03:00 linux-next ed58d103e6da ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/07 06:45 linux-next ed58d103e6da 53657d1b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/06 22:01 linux-next 808eb958781e 53657d1b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/04 19:06 linux-next 40b8e93e17bf 4baca3d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/02/03 22:34 linux-next 00f3246adeea a21a8419 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/27 21:18 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1950a0af2d55 18070896 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2024/11/18 09:46 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 887407160d72 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in ocfs2_dir_foreach_blk
2025/01/16 10:38 upstream 619f0b6fad52 968edaf4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2024/11/25 07:28 upstream 9f16d5e6f220 68da6d95 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2024/11/21 18:59 upstream 43fb83c17ba2 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2024/11/07 22:10 upstream ff7afaeca1a1 c069283c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2024/11/03 13:13 upstream 3e5e6c9900c3 f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ocfs2_dir_foreach_blk
2024/12/14 22:42 upstream a446e965a188 7cbfbb3a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in ocfs2_dir_foreach_blk
2024/11/26 05:38 upstream 2c22dc1ee3a1 11dbc254 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in ocfs2_dir_foreach_blk
2024/10/29 17:04 upstream e42b1a9a2557 66aeb999 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in ocfs2_dir_foreach_blk
* Struck through repros no longer work on HEAD.