Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
upstream | KASAN: use-after-free Read in fuse_dev_do_read fuse | syz | 19 | 2235d | 2283d | 11/28 | fixed on 2018/11/12 21:25 |
syzbot |
sign-in | mailing list | source | docs |
Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
upstream | KASAN: use-after-free Read in fuse_dev_do_read fuse | syz | 19 | 2235d | 2283d | 11/28 | fixed on 2018/11/12 21:25 |
================================================================== BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline] BUG: KASAN: use-after-free in fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303 Read of size 8 at addr ffff8801d06e0278 by task syz-executor209/8903 CPU: 0 PID: 8903 Comm: syz-executor209 Not tainted 4.9.113-g47bbcd6 #10 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cf7e7968 ffffffff81eb32a9 ffffea000741b800 ffff8801d06e0278 0000000000000000 ffff8801d06e0278 ffff8801b84aab40 ffff8801cf7e79a0 ffffffff81567bd9 ffff8801d06e0278 0000000000000008 0000000000000000 Call Trace: [<ffffffff81eb32a9>] __dump_stack lib/dump_stack.c:15 [inline] [<ffffffff81eb32a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [<ffffffff81567bd9>] print_address_description+0x6c/0x234 mm/kasan/report.c:256 [<ffffffff81567fe3>] kasan_report_error mm/kasan/report.c:355 [inline] [<ffffffff81567fe3>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412 [<ffffffff8153bc34>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 [<ffffffff81911917>] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline] [<ffffffff81911917>] fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303 [<ffffffff81911bce>] fuse_dev_read+0x15e/0x1f0 fs/fuse/dev.c:1345 [<ffffffff815711bd>] new_sync_read fs/read_write.c:439 [inline] [<ffffffff815711bd>] __vfs_read+0x3dd/0x570 fs/read_write.c:451 [<ffffffff815726c0>] vfs_read+0x120/0x380 fs/read_write.c:472 [<ffffffff81576719>] SYSC_read fs/read_write.c:588 [inline] [<ffffffff81576719>] SyS_read+0xd9/0x1c0 fs/read_write.c:581 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 [<ffffffff839f9f93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Allocated by task 8903: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547 slab_post_alloc_hook mm/slab.h:417 [inline] slab_alloc_node mm/slub.c:2715 [inline] slab_alloc mm/slub.c:2723 [inline] kmem_cache_alloc+0xbe/0x290 mm/slub.c:2728 __fuse_request_alloc+0x27/0xe0 fs/fuse/dev.c:58 fuse_request_alloc+0x18/0x20 fs/fuse/dev.c:86 fuse_fill_super+0xcd3/0x1550 fs/fuse/inode.c:1141 mount_nodev+0x5b/0x100 fs/super.c:1146 fuse_mount+0x2c/0x40 fs/fuse/inode.c:1198 mount_fs+0x28c/0x370 fs/super.c:1206 vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991 vfs_kern_mount fs/namespace.c:973 [inline] do_new_mount fs/namespace.c:2513 [inline] do_mount+0x3c9/0x2740 fs/namespace.c:2835 SYSC_mount fs/namespace.c:3051 [inline] SyS_mount+0xfe/0x110 fs/namespace.c:3028 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Freed by task 8918: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kmem_cache_free+0xbe/0x310 mm/slub.c:2980 fuse_request_free+0x8b/0xa0 fs/fuse/dev.c:101 fuse_put_request+0x259/0x300 fs/fuse/dev.c:288 request_end+0x183/0x610 fs/fuse/dev.c:398 fuse_dev_do_write+0x1099/0x20a0 fs/fuse/dev.c:1905 fuse_dev_write+0x14b/0x1e0 fs/fuse/dev.c:1929 new_sync_write fs/read_write.c:496 [inline] __vfs_write+0x3e0/0x580 fs/read_write.c:509 vfs_write+0x187/0x530 fs/read_write.c:557 SYSC_write fs/read_write.c:604 [inline] SyS_write+0xd9/0x1c0 fs/read_write.c:596 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb The buggy address belongs to the object at ffff8801d06e0248 which belongs to the cache fuse_request of size 456 The buggy address is located 48 bytes inside of 456-byte region [ffff8801d06e0248, ffff8801d06e0410) The buggy address belongs to the page: page:ffffea000741b800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x8000000000004080(slab|head) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801d06e0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801d06e0180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc >ffff8801d06e0200: fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb ^ ffff8801d06e0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801d06e0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2018/07/21 14:49 | https://android.googlesource.com/kernel/common android-4.9 | 47bbcd6bf8f9 | 8cc079c3 | .config | console log | report | syz | C | ci-android-49-kasan-gce-root | |||
2018/10/01 03:24 | https://android.googlesource.com/kernel/common android-4.9 | 1c7637ca0b04 | 41e4b329 | .config | console log | report | syz | ci-android-49-kasan-gce-root | ||||
2018/10/12 18:47 | https://android.googlesource.com/kernel/common android-4.9 | 38f2b4a8c277 | caf12900 | .config | console log | report | ci-android-49-kasan-gce-root | |||||
2018/09/23 20:41 | https://android.googlesource.com/kernel/common android-4.9 | 1c57ba4f543b | 28d9ac76 | .config | console log | report | ci-android-49-kasan-gce-root | |||||
2018/09/09 01:03 | https://android.googlesource.com/kernel/common android-4.9 | dcae9fa1319b | 6b5120a4 | .config | console log | report | ci-android-49-kasan-gce-root | |||||
2018/09/07 06:05 | https://android.googlesource.com/kernel/common android-4.9 | dcae9fa1319b | e30d3b52 | .config | console log | report | ci-android-49-kasan-gce-root | |||||
2018/08/30 14:52 | https://android.googlesource.com/kernel/common android-4.9 | 09eb2ba5ed0c | 938220fd | .config | console log | report | ci-android-49-kasan-gce-root | |||||
2018/08/04 22:15 | https://android.googlesource.com/kernel/common android-4.9 | 8b21e85d919c | 3476a2df | .config | console log | report | ci-android-49-kasan-gce-root | |||||
2018/07/21 12:48 | https://android.googlesource.com/kernel/common android-4.9 | 47bbcd6bf8f9 | 8cc079c3 | .config | console log | report | ci-android-49-kasan-gce-root |