syzbot

 sign-in | mailing list | source | docs
🐞 Open [981] ≡ Subsystems 🐞 Fixed [5235] 🐞 Invalid [12495] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in copy_page_from_iter_atomic (2)

Status: auto-obsoleted due to no activity on 2024/03/22 14:46
Subsystems: btrfs
[Documentation on labels]
Reported-by: syzbot+d2dd123304b4ae59f1bd@syzkaller.appspotmail.com
First crash: 686d, last: 244d
Cause bisection: introduced by (bisect log) :
commit 4cd4aed63125ccd4efc35162627827491c2a7be7
Author: Christoph Hellwig <hch@lst.de>
Date: Fri May 27 08:43:20 2022 +0000

  btrfs: fold repair_io_failure into btrfs_repair_eb_io_failure

Crash: KASAN: use-after-free Read in copy_page_from_iter_atomic (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] KASAN: use-after-free Read in copy_page_from_iter_atomic (2) 7 (10) 2022/06/16 14:57
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic origin:upstream C 7 1d22h 373d 0/3 upstream: reported C repro on 2023/04/16 06:15
linux-5.15 KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic origin:upstream C error 11 198d 400d 0/3 upstream: reported C repro on 2023/03/20 18:09
upstream KASAN: use-after-free Read in copy_page_from_iter_atomic jfs 8 835d 949d 0/26 auto-closed as invalid on 2022/05/09 13:28
▶ ▼ Last patch testing requests (13)
Created Duration User Patch Repo Result
2024/03/22 14:20 24m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci OK log
2024/01/11 11:19 23m retest repro linux-next OK log
2024/01/11 11:19 22m retest repro upstream OK log
2024/01/11 11:19 21m retest repro upstream OK log
2024/01/11 11:19 16m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2023/11/02 06:59 15m retest repro upstream report log
2023/11/02 06:59 15m retest repro upstream report log
2023/11/02 03:55 49m retest repro linux-next report log
2023/11/02 03:07 35m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2023/09/08 08:18 20m retest repro upstream OK log
2023/05/18 13:46 26m tudor.ambarus@linaro.org https://android.googlesource.com/kernel/common android-mainline OK log
2023/05/18 13:44 18m tudor.ambarus@linaro.org https://android.googlesource.com/kernel/common android14-6.1 OK log
2022/07/09 10:01 17m gautammenghani201@gmail.com linux-next error OK

Sample crash report:
BTRFS error (device loop0): bad tree block start, want 30490624 have 0
==================================================================
BUG: KASAN: use-after-free in copy_page_from_iter_atomic+0xef6/0x1b30 lib/iov_iter.c:969
Read of size 4096 at addr ffff888170801000 by task kworker/u4:0/8

CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.19.0-rc1-next-20220609-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: loop0 loop_rootcg_workfn
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 memcpy+0x20/0x60 mm/kasan/shadow.c:65
 copy_page_from_iter_atomic+0xef6/0x1b30 lib/iov_iter.c:969
 generic_perform_write+0x2b8/0x560 mm/filemap.c:3735
 __generic_file_write_iter+0x2aa/0x4d0 mm/filemap.c:3855
 generic_file_write_iter+0xd7/0x220 mm/filemap.c:3887
 call_write_iter include/linux/fs.h:2057 [inline]
 do_iter_readv_writev+0x3d1/0x640 fs/read_write.c:742
 do_iter_write+0x182/0x700 fs/read_write.c:868
 vfs_iter_write+0x70/0xa0 fs/read_write.c:909
 lo_write_bvec drivers/block/loop.c:249 [inline]
 lo_write_simple drivers/block/loop.c:271 [inline]
 do_req_filebacked drivers/block/loop.c:495 [inline]
 loop_handle_cmd drivers/block/loop.c:1859 [inline]
 loop_process_work+0xd83/0x2050 drivers/block/loop.c:1894
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0005c20040 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x170801
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea0005c20048 ffffea0005c20048 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff888170800f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888170800f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888170801000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888170801080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888170801100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (67):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/06/10 01:24 linux-next ff539ac73ea5 0d5abf15 .config strace log report syz C ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/07/14 12:15 upstream 4b810bf037e5 d624500f .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/03/20 18:46 upstream e8d018dd0257 7939252e .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/01/08 12:30 linux-next cc3c08b41a9c 1dac8c7a .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/05/02 09:14 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 62df2017 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2022/10/24 06:43 upstream d47136c28015 23bf86af .config console log report syz [disk image] [vmlinux] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/24 05:05 upstream de5c208d533a 912f5df7 .config console log report syz ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/10/27 21:49 linux-next 4d48f589d294 86777b7f .config console log report syz [disk image] [vmlinux] [mounted in repro] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/07/17 20:09 upstream fdf0eaf11452 20f8b3c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/07/13 03:07 upstream eb26cbb1a754 86081196 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/06/21 17:17 upstream e660abd551f1 79782afc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/06/18 21:29 upstream 8c1f0c38b310 f3921d4d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/06/16 07:59 upstream 62d8779610bb f3921d4d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/06/02 11:39 upstream 1874a42a7d74 a4ae4f42 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/06/01 02:50 upstream 48b1320a674e babc4389 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/05/30 21:23 upstream 8b817fded42d df37c7f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/05/28 11:28 upstream 416839029e38 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/05/26 18:45 upstream 0d85b27b0cc6 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/05/12 02:00 upstream 105131df9c3b adb9a3cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/04/27 18:24 upstream 6e98b09da931 6f3d6fa7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/04/17 19:25 upstream 6a8f57ae2eb0 c6ec7083 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/02/18 13:08 upstream dbeed98d89ea d02e9a70 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/02/11 11:06 upstream 420b2d431d18 93e26d60 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/02/06 11:32 upstream d2d11f342b17 be607b78 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/02/04 18:56 upstream 0136d86b7852 be607b78 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/02/04 05:52 upstream 0136d86b7852 1b2f701a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/01/31 17:40 upstream 22b8077d0fce 9dfcf09c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/01/22 21:10 upstream 2241ab53cbb5 559a440a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/01/02 06:04 upstream 150aae354b81 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/12/18 05:57 upstream f9ff5644bcc0 05494336 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/12/08 08:48 upstream 479174d402bc d88f3abb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/11/29 05:10 upstream b7b275e60bcd ca9683b8 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/11/20 01:54 upstream fe24a97cf254 5bb70014 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/10/30 19:28 upstream b229b6ca5abb 2a71366b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/10/24 16:35 upstream 247f34f7b803 ff2fe65d .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-selinux-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/09/30 22:38 upstream 70575e77839f feb56351 .config console log report info [disk image] [vmlinux] ci2-upstream-fs KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/09/24 20:17 upstream a63f2e7cb110 0042f2b4 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-selinux-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/08/07 17:41 upstream 200e340f2196 88e3a122 .config console log report info ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/18 09:30 upstream 4b35035bcf80 8f633d84 .config console log report info ci-upstream-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/11/22 11:13 upstream eb7081409f94 1c8e10bc .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/11/29 09:54 linux-next 9e46a7996732 ca9683b8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/09/04 23:10 linux-next e47eb90a0a9a 28811d0a .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/12 02:51 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/11 04:07 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/10 21:37 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/10 21:37 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/10 19:24 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/10 17:09 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/10 02:19 linux-next ff539ac73ea5 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/09 23:40 linux-next ff539ac73ea5 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/09 03:42 linux-next 03c312cc5f47 b2706118 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/07 13:10 linux-next 73d0e32571a0 c8857892 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/07 12:42 linux-next 73d0e32571a0 c8857892 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/07 12:32 linux-next 73d0e32571a0 c8857892 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2022/06/07 12:13 linux-next 73d0e32571a0 c8857892 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/04/23 06:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 14f8db1c0f9a 2b32bd34 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/02/23 04:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a9b06ec42c0f 9e2ebb3c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in copy_page_from_iter_atomic
2023/07/30 21:34 upstream d31e3792919e 2a0d0f29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/06/29 23:51 upstream 6f612579be9d 7b33cf8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/02/10 00:07 upstream 35674e787518 07980f9d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/01/13 12:07 upstream c757fc92a3f7 96166539 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/01/01 11:26 upstream e4cf7c25bae5 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/01/13 15:42 linux-next 0a093b2893c7 529798b0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
2023/07/28 20:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6eaae1980760 92476829 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
* Struck through repros no longer work on HEAD.