syzbot


UBSAN: shift-out-of-bounds in do_mpage_readpage
Status: upstream: reported C repro on 2021/05/10 12:19
Reported-by: syzbot+cf89d662483d6a1a0790@syzkaller.appspotmail.com
First crash: 383d, last: 217d

Cause bisection: introduced by (bisect log) :
commit dcd479e10a0510522a5d88b29b8f79ea3467d501
Author: Johannes Berg <johannes.berg@intel.com>
Date: Fri Oct 9 12:17:11 2020 +0000

  mac80211: always wind down STA state

Crash: BUG: sleeping function called from invalid context in sta_info_move_state (log)
Repro: C syz .config

Fix bisection: failed (bisect log)
Patch testing requests:
Created Duration User Patch Repo Result
2021/08/07 09:51 10m asha.16@itfac.mrt.ac.lk https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2021/06/22 14:50 17m chouhan.shreyansh630@gmail.com patch upstream OK
2021/06/14 19:34 10m chouhan.shreyansh630@gmail.com upstream report log
2021/05/15 15:32 11m h.shahbazi.git@gmail.com patch upstream report log

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in fs/mpage.c:189:40
shift exponent 4294967279 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 8457 Comm: systemd-udevd Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 do_mpage_readpage.cold+0x226/0x2bb fs/mpage.c:189
 mpage_readahead+0x3a3/0x880 fs/mpage.c:389
 read_pages+0x1df/0x8d0 mm/readahead.c:130
 page_cache_ra_unbounded+0x61f/0x920 mm/readahead.c:238
 do_page_cache_ra mm/readahead.c:267 [inline]
 force_page_cache_ra+0x3ba/0x5b0 mm/readahead.c:299
 page_cache_sync_ra+0x107/0x200 mm/readahead.c:573
 page_cache_sync_readahead include/linux/pagemap.h:864 [inline]
 filemap_get_pages+0x29f/0x1920 mm/filemap.c:2442
 filemap_read+0x2ca/0xe40 mm/filemap.c:2525
 generic_file_read_iter+0x397/0x4f0 mm/filemap.c:2676
 blkdev_read_iter+0x11b/0x180 fs/block_dev.c:1720
 call_read_iter include/linux/fs.h:2110 [inline]
 new_sync_read+0x41e/0x6e0 fs/read_write.c:415
 vfs_read+0x35c/0x570 fs/read_write.c:496
 ksys_read+0x12d/0x250 fs/read_write.c:634
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fdc7280d210
Code: 73 01 c3 48 8b 0d 98 7d 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d b9 c1 20 00 00 75 10 b8 00 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 4e fc ff ff 48 89 04 24
RSP: 002

Crashes (6):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2021/05/08 17:00 upstream d2b6f8a17919 bc5434be .config log report syz C UBSAN: shift-out-of-bounds in do_mpage_readpage
ci-upstream-kasan-gce-smack-root 2021/09/21 01:19 upstream e4e737bb5c17 af796c18 .config log report info UBSAN: shift-out-of-bounds in do_mpage_readpage
ci-upstream-kasan-gce-root 2021/08/16 04:20 upstream 7c60610d4767 2489ab88 .config log report info UBSAN: shift-out-of-bounds in do_mpage_readpage
ci-upstream-kasan-gce 2021/06/13 05:53 upstream 8ecfa36cd4db 1ba81399 .config log report info UBSAN: shift-out-of-bounds in do_mpage_readpage
ci-upstream-kasan-gce-selinux-root 2021/05/08 15:45 upstream d2b6f8a17919 bc5434be .config log report info UBSAN: shift-out-of-bounds in do_mpage_readpage
ci-upstream-linux-next-kasan-gce-root 2021/07/25 02:49 linux-next 90d856e71443 4d1b57d4 .config log report info UBSAN: shift-out-of-bounds in do_mpage_readpage