KASAN: use-after-free Read in ext4_put

Kernel	Title	Repro	Fix bisect	Count	Last	Reported	Patched	Status
android-54	KASAN: use-after-free Read in ext4_put_super ext4	C		27	1d04h	1316d	0/2	upstream: reported C repro on 2021/04/17 06:50
upstream	general protection fault in ext4_put_super ext4			4	158d	167d	0/28	auto-obsoleted due to no activity on 2024/09/16 20:16
linux-4.19	KASAN: use-after-free Write in ext4_put_super ext4	C	error	17	632d	790d	0/1	upstream: reported C repro on 2022/09/25 13:27
upstream	KASAN: use-after-free Write in ext4_put_super ext4			1	1317d	1313d	0/28	auto-closed as invalid on 2021/08/14 16:30

Created	Duration	User	Patch	Repo	Result
2023/02/03 12:39	1m	bisect fix		linux-4.14.y	error job log
2022/11/11 05:23	28m	bisect fix		linux-4.14.y	OK (0) job log log

Created

Duration

User

Patch

Repo

Result

2023/02/03 12:39

bisect fix

linux-4.14.y

error job log

2022/11/11 05:23

28m

bisect fix

linux-4.14.y

OK (0) job log log

EXT4-fs (loop0): re-mounted. Opts: (null) EXT4-fs (loop2): re-mounted. Opts: (null) EXT4-fs (loop0): re-mounted. Opts: (null) EXT4-fs warning (device loop5): ext4_multi_mount_protect:325: MMP startup interrupted, failing mount ================================================================== BUG: KASAN: use-after-free in to_kthread kernel/kthread.c:71 [inline] BUG: KASAN: use-after-free in kthread_stop+0x591/0x640 kernel/kthread.c:551 Read of size 4 at addr ffff8880a05a8164 by task syz-executor.5/7998 CPU: 1 PID: 7998 Comm: syz-executor.5 Not tainted 4.14.295-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 print_req_error: I/O error, dev loop3, sector 0 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load4_noabort+0x68/0x70 mm/kasan/report.c:429 EXT4-fs (loop0): re-mounted. Opts: (null) to_kthread kernel/kthread.c:71 [inline] kthread_stop+0x591/0x640 kernel/kthread.c:551 EXT4-fs (loop1): re-mounted. Opts: (null) ext4_put_super+0x865/0xf00 fs/ext4/super.c:988 generic_shutdown_super+0x144/0x370 fs/super.c:446 kill_block_super+0x95/0xe0 fs/super.c:1161 deactivate_locked_super+0x6c/0xd0 fs/super.c:319 deactivate_super+0x7f/0xa0 fs/super.c:350 EXT4-fs (loop0): re-mounted. Opts: (null) cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183 task_work_run+0x11f/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f6d58634a17 RSP: 002b:00007fff22d29278 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6d58634a17 RDX: 00007fff22d2934a RSI: 000000000000000a RDI: 00007fff22d29340 RBP: 00007fff22d29340 R08: 00000000ffffffff R09: 00007fff22d29110 R10: 00005555571d6903 R11: 0000000000000246 R12: 00007f6d5868d5f6 R13: 00007fff22d2a400 R14: 00005555571d6810 R15: 00007fff22d2a440 Allocated by task 2: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 EXT4-fs (loop1): re-mounted. Opts: (null) kmem_cache_alloc_node+0x146/0x410 mm/slab.c:3642 alloc_task_struct_node kernel/fork.c:156 [inline] dup_task_struct kernel/fork.c:515 [inline] copy_process.part.0+0x17d3/0x71c0 kernel/fork.c:1631 copy_process kernel/fork.c:1606 [inline] _do_fork+0x184/0xc80 kernel/fork.c:2092 kernel_thread+0x2f/0x40 kernel/fork.c:2154 create_kthread kernel/kthread.c:255 [inline] kthreadd+0x51a/0x770 kernel/kthread.c:592 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Freed by task 18: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758 __put_task_struct+0x276/0x470 kernel/fork.c:420 put_task_struct include/linux/sched/task.h:98 [inline] delayed_put_task_struct+0x1fb/0x2e0 kernel/exit.c:180 __rcu_reclaim kernel/rcu/rcu.h:195 [inline] rcu_do_batch kernel/rcu/tree.c:2699 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2929 [inline] rcu_process_callbacks+0x780/0x1180 kernel/rcu/tree.c:2946 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 The buggy address belongs to the object at ffff8880a05a8140 which belongs to the cache task_struct of size 6144 The buggy address is located 36 bytes inside of 6144-byte region [ffff8880a05a8140, ffff8880a05a9940) The buggy address belongs to the page: print_req_error: I/O error, dev loop2, sector 0 page:ffffea0002816a00 count:1 mapcount:0 mapping:ffff8880a05a8140 index:0x0 compound_mapcount: 0 flags: 0xfff00000008100(slab|head) raw: 00fff00000008100 ffff8880a05a8140 0000000000000000 0000000100000001 raw: ffffea000287b6a0 ffffea00023c21a0 ffff88823f8307c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a05a8000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a05a8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc print_req_error: I/O error, dev loop4, sector 0 >ffff8880a05a8100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8880a05a8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a05a8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2022/10/12 05:23	linux-4.14.y	9d5c0b3a8e1a	02b6492e	.config	console log	report	syz			[disk image] [vmlinux] [mounted in repro]	ci2-linux-4-14	KASAN: use-after-free Read in ext4_put_super

Crashes (1):

Assets (help?)