syzbot


KASAN: use-after-free Read in dbJoin

Status: upstream: reported C repro on 2022/09/26 15:15
Reported-by: syzbot+f3743df63ec0391008ff@syzkaller.appspotmail.com
First crash: 797d, last: 797d
Fix bisection: failed (error log, bisect log)
  
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in dbJoin jfs C error 898 3d03h 784d 0/28 upstream: reported C repro on 2022/10/10 07:35
linux-4.14 KASAN: use-after-free Read in dbJoin C 2 649d 798d 0/1 upstream: reported C repro on 2022/09/26 07:12
linux-6.1 UBSAN: array-index-out-of-bounds in dbJoin origin:upstream C error 49 95d 201d 0/3 upstream: reported C repro on 2024/05/14 08:42
linux-5.15 UBSAN: array-index-out-of-bounds in dbJoin origin:upstream C 76 7d15h 208d 0/3 upstream: reported C repro on 2024/05/08 02:35

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KASAN: use-after-free in dbJoin+0x21b/0x220 fs/jfs/jfs_dmap.c:2841
Read of size 1 at addr ffff88819c47fa4c by task jfsCommit/1986

CPU: 0 PID: 1986 Comm: jfsCommit Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load1_noabort+0x88/0x90 mm/kasan/report.c:430
 dbJoin+0x21b/0x220 fs/jfs/jfs_dmap.c:2841
 dbFreeBits+0xf0/0x710 fs/jfs/jfs_dmap.c:2378
 dbFreeDmap+0x61/0x1a0 fs/jfs/jfs_dmap.c:2127
 dbFree+0x252/0x500 fs/jfs/jfs_dmap.c:385
 txFreeMap+0x7a4/0xb20 fs/jfs/jfs_txnmgr.c:2579
 txUpdateMap+0x369/0x1000 fs/jfs/jfs_txnmgr.c:2375
 txLazyCommit fs/jfs/jfs_txnmgr.c:2709 [inline]
 jfs_lazycommit+0x525/0x9d0 fs/jfs/jfs_txnmgr.c:2777
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

The buggy address belongs to the page:
page:ffffea0006711fc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x57ff00000000000()
raw: 057ff00000000000 ffffea0006711fc8 ffffea0006711fc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88819c47f900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88819c47f980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88819c47fa00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff88819c47fa80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88819c47fb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/09/26 15:15 linux-4.19.y 3f8a27f9e27b d59ba983 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in dbJoin
* Struck through repros no longer work on HEAD.