syzbot

 sign-in | mailing list | source | docs
🐞 Open [708]
🐞 Fixed [107]
🐞 Invalid [633]
⬇ Missing Backports [60]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: slab-out-of-bounds Read in __ext4_iget (2)

Status: upstream: reported on 2025/02/01 20:39
Reported-by: syzbot+fb7f7c3d4430262421a7@syzkaller.appspotmail.com
First crash: 3d11h, last: 3d11h
▶ ▼ Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: use-after-free Read in __ext4_iget 17 7d07h 371d 0/3 upstream: reported on 2024/01/31 03:06
upstream KASAN: slab-use-after-free Read in __ext4_iget fs reiserfs 278 371d 609d 0/28 auto-obsoleted due to no activity on 2024/04/09 13:42
android-5-15 KASAN: use-after-free Read in __ext4_iget origin:lts syz 188 10h53m 587d 0/2 premoderation: reported syz repro on 2023/06/28 10:27
linux-5.15 KASAN: slab-out-of-bounds Read in __ext4_iget 6 476d 519d 0/3 auto-obsoleted due to no activity on 2024/01/25 22:09
android-54 KASAN: use-after-free Read in __ext4_iget 13 348d 555d 0/2 auto-obsoleted due to no activity on 2024/05/22 19:07
android-5-10 KASAN: use-after-free Read in __ext4_iget syz 161 3d02h 587d 0/2 premoderation: reported syz repro on 2023/06/28 15:01
linux-6.1 KASAN: slab-out-of-bounds Read in __ext4_iget 14 310d 566d 0/3 auto-obsoleted due to no activity on 2024/07/09 19:10
linux-6.1 KASAN: use-after-free Read in __ext4_iget 2 146d 188d 0/3 auto-obsoleted due to no activity on 2024/12/21 07:26
android-54 KASAN: use-after-free Read in __ext4_iget (2) 4 230d 249d 0/2 auto-obsoleted due to no activity on 2024/09/17 10:19

Sample crash report:
loop1: detected capacity change from 0 to 1024
==================================================================
BUG: KASAN: slab-out-of-bounds in __ext4_iget+0x2ee/0x3ee0 fs/ext4/inode.c:4835
Read of size 8 at addr ffff888056a4ff30 by task syz.1.836/6190

CPU: 0 PID: 6190 Comm: syz.1.836 Not tainted 6.1.128-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0x15f/0x4f0 mm/kasan/report.c:427
 kasan_report+0x136/0x160 mm/kasan/report.c:531
 __ext4_iget+0x2ee/0x3ee0 fs/ext4/inode.c:4835
 __ext4_fill_super fs/ext4/super.c:5390 [inline]
 ext4_fill_super+0x6ccf/0x8b50 fs/ext4/super.c:5654
 get_tree_bdev+0x3fe/0x620 fs/super.c:1366
 vfs_get_tree+0x88/0x270 fs/super.c:1573
 do_new_mount+0x2ba/0xb40 fs/namespace.c:3056
 do_mount fs/namespace.c:3399 [inline]
 __do_sys_mount fs/namespace.c:3607 [inline]
 __se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3584
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7830f8e54a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7830dfee68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f7830dfeef0 RCX: 00007f7830f8e54a
RDX: 0000000020000140 RSI: 00000000200005c0 RDI: 00007f7830dfeeb0
RBP: 0000000020000140 R08: 00007f7830dfeef0 R09: 0000000000018000
R10: 0000000000018000 R11: 0000000000000246 R12: 00000000200005c0
R13: 00007f7830dfeeb0 R14: 000000000000063d R15: 0000000020000000
 </TASK>

Allocated by task 3622:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 __kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x52/0x3a0 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc_lru+0x10c/0x2d0 mm/slub.c:3429
 __d_alloc+0x31/0x710 fs/dcache.c:1774
 d_alloc fs/dcache.c:1854 [inline]
 d_alloc_parallel+0xdd/0x1590 fs/dcache.c:2645
 __lookup_slow+0x113/0x3d0 fs/namei.c:1675
 lookup_slow+0x53/0x70 fs/namei.c:1707
 walk_component fs/namei.c:1998 [inline]
 link_path_walk+0x9d6/0xee0 fs/namei.c:2325
 path_openat+0x23d/0x2e60 fs/namei.c:3779
 do_filp_open+0x230/0x480 fs/namei.c:3810
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 0:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0x292/0x510 mm/slub.c:3683
 rcu_do_batch kernel/rcu/tree.c:2297 [inline]
 rcu_core+0xade/0x1820 kernel/rcu/tree.c:2557
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:661
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691

Last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
 call_rcu+0x163/0xa10 kernel/rcu/tree.c:2845
 __dentry_kill+0x4f4/0x650 fs/dcache.c:625
 dentry_kill+0xbb/0x290
 dput+0xfb/0x1d0 fs/dcache.c:918
 lookup_fast+0x39e/0x490 fs/namei.c:1656
 walk_component fs/namei.c:1994 [inline]
 link_path_walk+0x604/0xee0 fs/namei.c:2325
 path_openat+0x23d/0x2e60 fs/namei.c:3779
 do_filp_open+0x230/0x480 fs/namei.c:3810
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Second to last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
 call_rcu+0x163/0xa10 kernel/rcu/tree.c:2845
 __dentry_kill+0x4f4/0x650 fs/dcache.c:625
 dentry_kill+0xbb/0x290
 dput+0xfb/0x1d0 fs/dcache.c:918
 handle_mounts fs/namei.c:1551 [inline]
 step_into+0x44b/0x1070 fs/namei.c:1836
 open_last_lookups fs/namei.c:3573 [inline]
 path_openat+0x1764/0x2e60 fs/namei.c:3780
 do_filp_open+0x230/0x480 fs/namei.c:3810
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888056a4fd60
 which belongs to the cache dentry of size 312
The buggy address is located 152 bytes to the right of
 312-byte region [ffff888056a4fd60, ffff888056a4fe98)

The buggy address belongs to the physical page:
page:ffffea00015a9380 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56a4e
head:ffffea00015a9380 order:1 compound_mapcount:0 compound_pincount:0
memcg:ffff888030bc8601
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea0001d24800 dead000000000004 ffff888140009780
raw: 0000000000000000 0000000000150015 00000001ffffffff ffff888030bc8601
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 3622, tgid 3622 (udevd), ts 91350801404, free_ts 14576418346
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x3731/0x38d0 mm/page_alloc.c:4328
 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5605
 alloc_slab_page+0x6a/0x150 mm/slub.c:1794
 allocate_slab mm/slub.c:1939 [inline]
 new_slab+0x84/0x2d0 mm/slub.c:1992
 ___slab_alloc+0xc20/0x1270 mm/slub.c:3180
 __slab_alloc mm/slub.c:3279 [inline]
 slab_alloc_node mm/slub.c:3364 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc_lru+0x1a5/0x2d0 mm/slub.c:3429
 __d_alloc+0x31/0x710 fs/dcache.c:1774
 d_alloc fs/dcache.c:1854 [inline]
 d_alloc_parallel+0xdd/0x1590 fs/dcache.c:2645
 lookup_open fs/namei.c:3407 [inline]
 open_last_lookups fs/namei.c:3550 [inline]
 path_openat+0x90a/0x2e60 fs/namei.c:3780
 do_filp_open+0x230/0x480 fs/namei.c:3810
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x12a6/0x15b0 mm/page_alloc.c:3384
 free_unref_page+0x33/0x3e0 mm/page_alloc.c:3479
 free_contig_range+0x9a/0x150 mm/page_alloc.c:9565
 destroy_args+0xfe/0x997 mm/debug_vm_pgtable.c:1031
 debug_vm_pgtable+0x416/0x46b mm/debug_vm_pgtable.c:1354
 do_one_initcall+0x265/0x8f0 init/main.c:1298
 do_initcall_level+0x157/0x207 init/main.c:1371
 do_initcalls+0x49/0x86 init/main.c:1387
 kernel_init_freeable+0x45c/0x60f init/main.c:1626
 kernel_init+0x19/0x290 init/main.c:1514
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Memory state around the buggy address:
 ffff888056a4fe00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888056a4fe80: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888056a4ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                     ^
 ffff888056a4ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888056a50000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/01 20:38 linux-6.1.y 0cbb5f65e52f 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in __ext4_iget
* Struck through repros no longer work on HEAD.