syzbot

 sign-in | mailing list | source | docs
🐞 Open [717] 🐞 Fixed [181] 🐞 Invalid [640] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: stack-out-of-bounds Read in iov_iter_revert

Status: upstream: reported C repro on 2021/09/12 17:39
Subsystems: xfs
[Documentation on labels]
Reported-by: syzbot+c9ab5b4d6a32fbfc2f13@syzkaller.appspotmail.com
First crash: 955d, last: 452d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in iov_iter_revert fs io-uring C error 14 969d 986d 20/26 fixed on 2021/11/10 00:50
linux-4.19 KASAN: stack-out-of-bounds Read in iov_iter_revert C error 26 454d 1013d 0/1 upstream: reported C repro on 2021/07/16 11:05
android-54 KASAN: stack-out-of-bounds Read in iov_iter_revert C 37 1295d 1344d 0/2 auto-obsoleted due to no activity on 2023/04/16 21:56
android-5-10 KASAN: stack-out-of-bounds Read in iov_iter_revert C error 10 759d 912d 0/2 closed as invalid on 2022/04/06 16:19
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2022/11/11 02:30 9m retest repro linux-4.14.y report log
2022/11/11 01:30 9m retest repro linux-4.14.y report log
▶ ▼ Fix bisection attempts (7)
Created Duration User Patch Repo Result
2022/05/05 14:19 17m bisect fix linux-4.14.y error job log (0)
2022/04/05 13:58 21m bisect fix linux-4.14.y job log (0) log
2022/02/09 19:46 26m bisect fix linux-4.14.y job log (0) log
2022/01/10 19:20 25m bisect fix linux-4.14.y job log (0) log
2021/12/11 18:35 25m bisect fix linux-4.14.y job log (0) log
2021/11/11 18:07 28m bisect fix linux-4.14.y job log (0) log
2021/10/12 17:39 27m bisect fix linux-4.14.y job log (0) log

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
audit: type=1800 audit(1674890868.782:2): pid=7998 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor341" name="/" dev="fuse" ino=1 res=0
==================================================================
BUG: KASAN: stack-out-of-bounds in iov_iter_revert lib/iov_iter.c:919 [inline]
BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x800/0x900 lib/iov_iter.c:868
Read of size 8 at addr ffff88809634fd38 by task syz-executor341/7997

CPU: 0 PID: 7997 Comm: syz-executor341 Not tainted 4.14.304-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
 iov_iter_revert lib/iov_iter.c:919 [inline]
 iov_iter_revert+0x800/0x900 lib/iov_iter.c:868
 generic_file_read_iter+0x1183/0x21c0 mm/filemap.c:2257
 fuse_file_read_iter+0x1bd/0x270 fs/fuse/file.c:949
 call_read_iter include/linux/fs.h:1774 [inline]
 new_sync_read fs/read_write.c:401 [inline]
 __vfs_read+0x449/0x620 fs/read_write.c:413
 vfs_read+0x139/0x340 fs/read_write.c:447
 SYSC_read fs/read_write.c:574 [inline]
 SyS_read+0xf2/0x210 fs/read_write.c:567
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f8d37ce3169
RSP: 002b:00007f8d37c522f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f8d37d744e0 RCX: 00007f8d37ce3169
RDX: 000000007ffff000 RSI: 0000000020016400 RDI: 0000000000000005
RBP: 00007f8d37d410e4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e
R13: 00007f8d37d3d0d8 R14: 00007f8d37d3f0e0 R15: 00007f8d37d744e8

The buggy address belongs to the page:
page:ffffea000258d3c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0xfff00000000000()
raw: 00fff00000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809634fc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88809634fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88809634fd00: 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2 00 00 00 00
                                        ^
 ffff88809634fd80: 00 f2 f2 f2 f2 f2 00 00 00 00 00 f3 f3 f3 f3 f3
 ffff88809634fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/01/28 07:29 linux-4.14.y 3949d1610004 9dfcf09c .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
2022/12/24 15:15 linux-4.14.y c4215ee4771b 9da18ae8 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
2022/12/16 00:10 linux-4.14.y c4215ee4771b 6f9c033e .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
2022/05/30 04:37 linux-4.14.y 501eec4f9e13 a46af346 .config console log report syz C ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
2021/09/12 17:39 linux-4.14.y f96eb53cbd76 3ce60af8 .config console log report syz C ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
2022/12/15 23:55 linux-4.14.y c4215ee4771b 6f9c033e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
2022/07/02 13:31 linux-4.14.y f051383ef03b 1434eec0 .config console log report info ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
2022/03/06 10:09 linux-4.14.y e853993d29aa 7bdd8b2c .config console log report info ci2-linux-4-14 KASAN: stack-out-of-bounds Read in iov_iter_revert
* Struck through repros no longer work on HEAD.