syzbot


KASAN: stack-out-of-bounds Read in __find_get_block

Status: closed as invalid on 2018/07/07 06:58
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+86cd05434e33bd1e6571@syzkaller.appspotmail.com
First crash: 2397d, last: 2397d

Sample crash report:
==================================================================
BUG: KASAN: stack-out-of-bounds in lookup_bh_lru fs/buffer.c:1256 [inline]
BUG: KASAN: stack-out-of-bounds in __find_get_block+0xcb9/0xe60 fs/buffer.c:1283
Read of size 8 at addr ffff88019024fb40 by task syz-executor1/4475

CPU: 0 PID: 4475 Comm: syz-executor1 Not tainted 4.18.0-rc3+ #47
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 lookup_bh_lru fs/buffer.c:1256 [inline]
 __find_get_block+0xcb9/0xe60 fs/buffer.c:1283
 __getblk_gfp+0xde/0xb10 fs/buffer.c:1309
PANIC: double fault, error_code: 0x0
CPU: 1 PID: 28939 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #47
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__lock_acquire+0x2e/0x5020 kernel/locking/lockdep.c:3294
Code: 41 
57 41 
89 cf 
41 56 
41 55 
 sb_getblk include/linux/buffer_head.h:325 [inline]
 ext4_getblk+0x1ea/0x630 fs/ext4/inode.c:973
49 89 
fd 41 
54 45 
89 cc 
 ext4_bread+0x95/0x2b0 fs/ext4/inode.c:1016
53 65 
4c 8b 
34 25 
40 ee 
01 00 
 __ext4_read_dirblock+0x36/0x980 fs/ext4/namei.c:101
48 83 
 htree_dirblock_to_tree+0x13a/0xae0 fs/ext4/namei.c:978
e4 f0 
48 81 
ec 60 
03 00 
00 48 
8b 45 
10 <89> 
94 24 
80 00 
00 00 
48 ba 
00 00 
 ext4_htree_fill_tree+0x40c/0xd60 fs/ext4/namei.c:1097
00 00 
00 fc 
ff df 
48 89 
84 24 
98 
RSP: 0018:ffff8801859ffee0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 1ffff10030b40058 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff88f92620
 ext4_dx_readdir fs/ext4/dir.c:578 [inline]
 ext4_readdir+0x1cac/0x3bd0 fs/ext4/dir.c:123
RBP: ffff880185a00268 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000000 R12: 0000000000000000
R13: ffffffff88f92620 R14: ffff8801b2188480 R15: 0000000000000002
FS:  00007f148b2fe700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801859ffed8 CR3: 000000019f75a000 CR4: 00000000001406e0
DR0: 0000000020000080 DR1: 0000000020000080 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/06 23:43 bpf-next 6fcf9b1d4d6c 9636bc93 .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.