syzbot

 sign-in | mailing list | source | docs
🐞 Open [106] 🐞 Fixed [1] 🐞 Invalid [166] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in disk_unblock_events

Status: public: reported C repro on 2019/04/11 00:00
Reported-by: syzbot+ca99fa5675d32478afa4@syzkaller.appspotmail.com
First crash: 2072d, last: 1617d
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 KASAN: use-after-free Read in disk_unblock_events C 367 1612d 1848d 0/2 public: reported C repro on 2019/04/12 00:00
android-49 KASAN: use-after-free Read in disk_unblock_events C 665 1945d 2385d 0/3 closed as invalid on 2019/01/08 21:30
android-49 KASAN: use-after-free Read in disk_unblock_events (2) C 200 1615d 1849d 0/3 public: reported C repro on 2019/04/11 08:44
upstream KASAN: use-after-free Read in disk_unblock_events block C 65 2271d 2377d 5/26 fixed on 2018/04/09 09:36
linux-4.14 KASAN: use-after-free Read in disk_unblock_events C error 129 602d 1841d 0/1 upstream: reported C repro on 2019/04/19 06:17

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in disk_unblock_events+0x4b/0x50 block/genhd.c:1644
Read of size 8 at addr ffff8881d2619668 by task blkid/5376

CPU: 0 PID: 5376 Comm: blkid Not tainted 4.14.152+ #0
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xca/0x134 lib/dump_stack.c:53
 print_address_description+0x60/0x226 mm/kasan/report.c:187
 __kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316
 disk_unblock_events+0x4b/0x50 block/genhd.c:1644
 __blkdev_get+0x68f/0xf90 fs/block_dev.c:1556
 blkdev_get+0x97/0x8b0 fs/block_dev.c:1612
 blkdev_open+0x1cc/0x250 fs/block_dev.c:1770
 do_dentry_open+0x44e/0xe20 fs/open.c:789
 vfs_open+0x105/0x230 fs/open.c:903
 do_last fs/namei.c:3539 [inline]
 path_openat+0xb6c/0x2be0 fs/namei.c:3681
 do_filp_open+0x1a1/0x280 fs/namei.c:3715
 do_sys_open+0x2ca/0x590 fs/open.c:1096
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7fcefacfa120
RSP: 002b:00007ffc549f5328 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcefacfa120
RDX: 00007ffc549f5f45 RSI: 0000000000000000 RDI: 00007ffc549f5f45
RBP: 0000000000000000 R08: 0000000000000078 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000025ff030
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005

Allocated by task 5359:
 save_stack mm/kasan/common.c:76 [inline]
 set_track mm/kasan/common.c:85 [inline]
 __kasan_kmalloc.part.0+0x53/0xc0 mm/kasan/common.c:501
 kmem_cache_alloc_node_trace include/linux/slab.h:378 [inline]
 kmalloc_node include/linux/slab.h:526 [inline]
 kzalloc_node include/linux/slab.h:672 [inline]
 alloc_disk_node+0x5b/0x3d0 block/genhd.c:1387
 loop_add+0x3ee/0x870 drivers/block/loop.c:1859
 loop_probe+0x153/0x180 drivers/block/loop.c:1966
 kobj_lookup+0x226/0x410 drivers/base/map.c:124
 get_gendisk+0x36/0x240 block/genhd.c:785
 bd_start_claiming fs/block_dev.c:1124 [inline]
 blkdev_get+0x131/0x8b0 fs/block_dev.c:1605
 blkdev_open+0x1cc/0x250 fs/block_dev.c:1770
 do_dentry_open+0x44e/0xe20 fs/open.c:789
 vfs_open+0x105/0x230 fs/open.c:903
 do_last fs/namei.c:3539 [inline]
 path_openat+0xb6c/0x2be0 fs/namei.c:3681
 do_filp_open+0x1a1/0x280 fs/namei.c:3715
 do_sys_open+0x2ca/0x590 fs/open.c:1096
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
 0xffffffffffffffff

Freed by task 5376:
 save_stack mm/kasan/common.c:76 [inline]
 set_track mm/kasan/common.c:85 [inline]
 __kasan_slab_free+0x164/0x210 mm/kasan/common.c:463
 slab_free_hook mm/slub.c:1407 [inline]
 slab_free_freelist_hook mm/slub.c:1458 [inline]
 slab_free mm/slub.c:3039 [inline]
 kfree+0x108/0x3a0 mm/slub.c:3976
 device_release+0xf4/0x1a0 drivers/base/core.c:823
 kobject_cleanup lib/kobject.c:646 [inline]
 kobject_release lib/kobject.c:675 [inline]
 kref_put include/linux/kref.h:70 [inline]
 kobject_put+0x142/0x200 lib/kobject.c:692
 put_disk+0x1f/0x30 block/genhd.c:1452
 __blkdev_get+0x5fa/0xf90 fs/block_dev.c:1549
 blkdev_get+0x97/0x8b0 fs/block_dev.c:1612
 blkdev_open+0x1cc/0x250 fs/block_dev.c:1770
 do_dentry_open+0x44e/0xe20 fs/open.c:789
 vfs_open+0x105/0x230 fs/open.c:903
 do_last fs/namei.c:3539 [inline]
 path_openat+0xb6c/0x2be0 fs/namei.c:3681
 do_filp_open+0x1a1/0x280 fs/namei.c:3715
 do_sys_open+0x2ca/0x590 fs/open.c:1096
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
 0xffffffffffffffff

The buggy address belongs to the object at ffff8881d2619100
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1384 bytes inside of
 2048-byte region [ffff8881d2619100, ffff8881d2619900)
The buggy address belongs to the page:
page:ffffea0007498600 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 0000000000000000 0000000000000000 00000001000f000f
raw: ffffea0007075800 0000000200000002 ffff8881d6402800 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881d2619500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881d2619580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881d2619600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff8881d2619680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881d2619700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (114):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/08 18:49 android-4.14 f40abacc8ac0 1e35461e .config console log report syz C ci-android-414-kasan-gce-root
2019/08/25 02:51 android-4.14 a48da8903efa d21c5d9d .config console log report syz C ci-android-414-kasan-gce-root
2019/07/25 10:33 android-4.14 85282d7e792d 32329ceb .config console log report syz C ci-android-414-kasan-gce-root
2019/06/08 11:40 android-4.14 76896566d7b9 cf9c3a50 .config console log report syz C ci-android-414-kasan-gce-root
2019/03/14 19:39 android-4.14 8ed9bc6e6401 d72db19b .config console log report syz C ci-android-414-kasan-gce-root
2019/02/27 18:52 android-4.14 0cc8f104f45a 083cfd0e .config console log report syz C ci-android-414-kasan-gce-root
2019/02/09 23:04 android-4.14 57de59b3cf53 d75f7686 .config console log report syz C ci-android-414-kasan-gce-root
2019/02/03 18:30 android-4.14 80d7b06534fa c198d5dd .config console log report syz C ci-android-414-kasan-gce-root
2019/02/02 06:11 android-4.14 80d7b06534fa 564f9a4f .config console log report syz C ci-android-414-kasan-gce-root
2019/01/28 14:36 android-4.14 70014b13c28c 629c2a27 .config console log report syz C ci-android-414-kasan-gce-root
2018/12/03 20:52 android-4.14 d11d7f1ccfb1 819002b0 .config console log report syz C ci-android-414-kasan-gce-root
2018/12/02 15:36 android-4.14 d11d7f1ccfb1 e0d8c853 .config console log report syz C ci-android-414-kasan-gce-root
2018/12/02 04:36 android-4.14 d11d7f1ccfb1 5a581673 .config console log report syz C ci-android-414-kasan-gce-root
2018/11/01 07:46 android-4.14 4ed22187defd 1f38e9ae .config console log report syz C ci-android-414-kasan-gce-root
2018/10/28 00:50 android-4.14 4ed22187defd 8efba39a .config console log report syz C ci-android-414-kasan-gce-root
2018/10/18 06:08 android-4.14 6d46bcc5a747 b2695b95 .config console log report syz C ci-android-414-kasan-gce-root
2018/09/23 21:50 android-4.14 666c420fa3ea 28d9ac76 .config console log report syz C ci-android-414-kasan-gce-root
2018/09/21 00:04 android-4.14 666c420fa3ea 6cee973c .config console log report syz C ci-android-414-kasan-gce-root
2018/09/14 01:38 android-4.14 fc59235394b2 19e9088b .config console log report syz C ci-android-414-kasan-gce-root
2018/09/12 10:21 android-4.14 fc59235394b2 3c88136c .config console log report syz C ci-android-414-kasan-gce-root
2018/09/11 19:58 android-4.14 fc59235394b2 4ae17b1f .config console log report syz C ci-android-414-kasan-gce-root
2018/09/06 14:45 android-4.14 b859aa7d7a0c 0bb7a7eb .config console log report syz C ci-android-414-kasan-gce-root
2018/09/03 03:18 android-4.14 47350a9f13c6 a4718693 .config console log report syz C ci-android-414-kasan-gce-root
2018/08/31 11:04 android-4.14 47350a9f13c6 a4718693 .config console log report syz C ci-android-414-kasan-gce-root
2019/04/08 10:51 android-4.14 171fc237b3cb c34fde03 .config console log report syz ci-android-414-kasan-gce-root
2019/03/19 07:16 android-4.14 ea583d160621 46264c32 .config console log report syz ci-android-414-kasan-gce-root
2019/01/23 03:06 android-4.14 a4580ffc17d3 b1ff06b2 .config console log report syz ci-android-414-kasan-gce-root
2018/10/03 07:10 android-4.14 ff9973a5da5e 0f3e0261 .config console log report syz ci-android-414-kasan-gce-root
2018/09/03 06:47 android-4.14 47350a9f13c6 a4718693 .config console log report syz ci-android-414-kasan-gce-root
2019/11/29 12:50 android-4.14 714ada7cabc7 d29b9e84 .config console log report ci-android-414-kasan-gce-root
2019/11/28 18:40 android-4.14 714ada7cabc7 46869e3e .config console log report ci-android-414-kasan-gce-root
2019/11/24 19:10 android-4.14 437a2a739c5f 598ca6c8 .config console log report ci-android-414-kasan-gce-root
2019/11/18 16:14 android-4.14 460dc7c31cef 1daed50a .config console log report ci-android-414-kasan-gce-root
2019/11/16 04:00 android-4.14 460dc7c31cef cdac920b .config console log report ci-android-414-kasan-gce-root
2019/11/16 00:42 android-4.14 460dc7c31cef cdac920b .config console log report ci-android-414-kasan-gce-root
2019/11/14 13:35 android-4.14 babe48d2e987 5d15a967 .config console log report ci-android-414-kasan-gce-root
2019/11/10 14:39 android-4.14 81144e705f48 dc438b91 .config console log report ci-android-414-kasan-gce-root
2019/11/10 09:46 android-4.14 81144e705f48 dc438b91 .config console log report ci-android-414-kasan-gce-root
2019/11/09 22:20 android-4.14 81144e705f48 dc438b91 .config console log report ci-android-414-kasan-gce-root
2019/11/08 06:04 android-4.14 f40abacc8ac0 f39aff9e .config console log report ci-android-414-kasan-gce-root
2019/11/06 08:50 android-4.14 2b2bb0cce0a5 bc2c6e45 .config console log report ci-android-414-kasan-gce-root
2019/11/03 18:04 android-4.14 6409e7e01d11 c9610487 .config console log report ci-android-414-kasan-gce-root
2019/10/21 16:44 android-4.14 234de92896af b24d2b8a .config console log report ci-android-414-kasan-gce-root
2019/10/21 13:42 android-4.14 234de92896af b24d2b8a .config console log report ci-android-414-kasan-gce-root
2019/10/20 17:35 android-4.14 234de92896af 8c88c9c1 .config console log report ci-android-414-kasan-gce-root
2019/10/14 18:01 android-4.14 1d75f58e4e19 05ad7292 .config console log report ci-android-414-kasan-gce-root
2019/10/14 13:24 android-4.14 1d75f58e4e19 a6aef847 .config console log report ci-android-414-kasan-gce-root
2019/10/13 14:12 android-4.14 1d75f58e4e19 2f661ec4 .config console log report ci-android-414-kasan-gce-root
2019/09/27 21:17 android-4.14 d649ef04c3ed d8074e0b .config console log report ci-android-414-kasan-gce-root
2019/09/23 15:57 android-4.14 8ae37de3fa03 1e9788a0 .config console log report ci-android-414-kasan-gce-root
2019/09/20 18:02 android-4.14 61a760424681 d96e88f3 .config console log report ci-android-414-kasan-gce-root
2019/09/17 01:37 android-4.14 5d41eafc92c2 51ca0454 .config console log report ci-android-414-kasan-gce-root
2019/09/13 09:17 android-4.14 f02af7b02c26 40fa42bc .config console log report ci-android-414-kasan-gce-root
2019/09/09 08:42 android-4.14 4eccd8013349 a60cb4cd .config console log report ci-android-414-kasan-gce-root
2019/09/04 04:09 android-4.14 38733badc0e6 526709ff .config console log report ci-android-414-kasan-gce-root
2019/09/03 23:14 android-4.14 38733badc0e6 48448e71 .config console log report ci-android-414-kasan-gce-root
2019/08/10 19:10 android-4.14 57ac921eaff1 acb51638 .config console log report ci-android-414-kasan-gce-root
2019/08/04 17:08 android-4.14 20c71e6d5a16 6affd8e8 .config console log report ci-android-414-kasan-gce-root
2019/07/25 21:00 android-4.14 4be998761675 732bc5a0 .config console log report ci-android-414-kasan-gce-root
2019/06/25 00:36 android-4.14 93c338c2e7ba 82c13b6b .config console log report ci-android-414-kasan-gce-root
2019/06/06 06:18 android-4.14 50f99a65439b a547defc .config console log report ci-android-414-kasan-gce-root
2019/04/20 09:15 android-4.14 4353393c9d4a b0e8efcb .config console log report ci-android-414-kasan-gce-root
2019/04/12 03:30 android-4.14 f289d4cdf0cc 13030ef8 .config console log report ci-android-414-kasan-gce-root
2019/04/09 00:47 android-4.14 d8414567db62 0dfb0452 .config console log report ci-android-414-kasan-gce-root
2019/04/08 15:57 android-4.14 171fc237b3cb 0dfb0452 .config console log report ci-android-414-kasan-gce-root
2019/03/19 02:18 android-4.14 ea583d160621 46264c32 .config console log report ci-android-414-kasan-gce-root
2019/03/14 00:42 android-4.14 8ed9bc6e6401 2881fc25 .config console log report ci-android-414-kasan-gce-root
2019/03/10 16:01 android-4.14 b11964adfe4c 12365b99 .config console log report ci-android-414-kasan-gce-root
2019/03/09 10:54 android-4.14 b11964adfe4c 12365b99 .config console log report ci-android-414-kasan-gce-root
2019/03/06 22:28 android-4.14 168dcc6231fe 18215b8d .config console log report ci-android-414-kasan-gce-root
2019/02/06 19:28 android-4.14 ae77ce090bb4 d25487bc .config console log report ci-android-414-kasan-gce-root
2019/02/04 07:14 android-4.14 80d7b06534fa c198d5dd .config console log report ci-android-414-kasan-gce-root
2019/02/02 08:41 android-4.14 80d7b06534fa c198d5dd .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.