syzbot

 sign-in | mailing list | source | docs
🐞 Open [964] 🐞 Fixed [3807] 🐞 Invalid [8180] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes

KASAN: out-of-bounds Write in end_buffer_read_sync
Status: upstream: reported C repro on 2022/04/25 03:07
Reported-by: syzbot+3f7f291a3d327486073c@syzkaller.appspotmail.com
First crash: 36d, last: 21h08m

Sample crash report:
==================================================================
BUG: KASAN: out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:257 [inline]
BUG: KASAN: out-of-bounds in put_bh include/linux/buffer_head.h:284 [inline]
BUG: KASAN: out-of-bounds in end_buffer_read_sync+0x24/0x30 fs/buffer.c:160
Write of size 4 at addr ffffc90002eaf9d8 by task ksoftirqd/1/23

CPU: 1 PID: 23 Comm: ksoftirqd/1 Not tainted 5.18.0-rc7-syzkaller-00119-gb015dcd62b86 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xf/0x467 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_dec include/linux/atomic/atomic-instrumented.h:257 [inline]
 put_bh include/linux/buffer_head.h:284 [inline]
 end_buffer_read_sync+0x24/0x30 fs/buffer.c:160
 end_bio_bh_io_sync+0xda/0x130 fs/buffer.c:2999
 bio_endio+0x5fe/0x780 block/bio.c:1541
 req_bio_endio block/blk-mq.c:686 [inline]
 blk_update_request+0x401/0x1310 block/blk-mq.c:815
 blk_mq_end_request+0x4b/0x80 block/blk-mq.c:941
 lo_complete_rq+0x1c2/0x280 drivers/block/loop.c:369
 blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1012
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 run_ksoftirqd kernel/softirq.c:921 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>

The buggy address belongs to the virtual mapping at
 [ffffc90002ea8000, ffffc90002eb1000) created by:
 kernel_clone+0xe7/0xab0 kernel/fork.c:2639

------------[ cut here ]------------
kernel BUG at mm/vmalloc.c:660!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 23 Comm: ksoftirqd/1 Not tainted 5.18.0-rc7-syzkaller-00119-gb015dcd62b86 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:vmalloc_to_page+0x46e/0x4f0 mm/vmalloc.c:660
Code: c1 ff 4d 31 fc 4d 21 f4 49 c1 ec 0c 4c 01 e3 49 bc 00 00 00 00 00 ea ff ff 48 c1 e3 06 49 01 dc e9 35 ff ff ff e8 d2 d5 c1 ff <0f> 0b e8 cb d5 c1 ff 0f 0b 45 31 e4 e9 1f ff ff ff e8 bc d5 c1 ff
RSP: 0018:ffffc9000071fbe8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000100
RDX: ffff888011956200 RSI: ffffffff81b69fbe RDI: 0000000000000003
RBP: ffffffff8ba8e000 R08: 00001ffffffffffe R09: 0000000000000000
R10: ffffffff81b69bd6 R11: 0000000000000000 R12: 0000370000000000
R13: 0000000000000000 R14: ffff888011956200 R15: ffff88801d70c948
FS:  0000000000000000(0000) GS:ffff88802cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc733d0f98 CR3: 00000000234c0000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 print_address_description.constprop.0.cold+0x2ce/0x467 mm/kasan/report.c:350
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_dec include/linux/atomic/atomic-instrumented.h:257 [inline]
 put_bh include/linux/buffer_head.h:284 [inline]
 end_buffer_read_sync+0x24/0x30 fs/buffer.c:160
 end_bio_bh_io_sync+0xda/0x130 fs/buffer.c:2999
 bio_endio+0x5fe/0x780 block/bio.c:1541
 req_bio_endio block/blk-mq.c:686 [inline]
 blk_update_request+0x401/0x1310 block/blk-mq.c:815
 blk_mq_end_request+0x4b/0x80 block/blk-mq.c:941
 lo_complete_rq+0x1c2/0x280 drivers/block/loop.c:369
 blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1012
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 run_ksoftirqd kernel/softirq.c:921 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vmalloc_to_page+0x46e/0x4f0 mm/vmalloc.c:660
Code: c1 ff 4d 31 fc 4d 21 f4 49 c1 ec 0c 4c 01 e3 49 bc 00 00 00 00 00 ea ff ff 48 c1 e3 06 49 01 dc e9 35 ff ff ff e8 d2 d5 c1 ff <0f> 0b e8 cb d5 c1 ff 0f 0b 45 31 e4 e9 1f ff ff ff e8 bc d5 c1 ff
RSP: 0018:ffffc9000071fbe8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000100
RDX: ffff888011956200 RSI: ffffffff81b69fbe RDI: 0000000000000003
RBP: ffffffff8ba8e000 R08: 00001ffffffffffe R09: 0000000000000000
R10: ffffffff81b69bd6 R11: 0000000000000000 R12: 0000370000000000
R13: 0000000000000000 R14: ffff888011956200 R15: ffff88801d70c948
FS:  0000000000000000(0000) GS:ffff88802cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc733d0f98 CR3: 00000000234c0000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (72):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-qemu-upstream 2022/05/20 12:22 upstream b015dcd62b86 cb1ac2e7 .config log report syz C KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/07 13:26 upstream 4b97bac0756a e60b1103 .config log report syz C KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/24 11:04 upstream 143a6252e1b8 fcfad4ff .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/23 14:39 upstream 4b0986a3613c 4c7657cb .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/23 11:15 upstream 4b0986a3613c 4c7657cb .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/22 23:15 upstream 4b0986a3613c 7268fa62 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/22 09:11 upstream eaea45fc0e7b 7268fa62 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/20 17:10 upstream 3d7285a335ed bd37ad7e .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/20 15:01 upstream 3d7285a335ed cb1ac2e7 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/19 12:13 upstream f993aed406ea cb1ac2e7 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/18 16:25 upstream ef1302160bfb 50c53f39 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/17 18:22 upstream 42226c989789 744a39e2 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/16 05:58 upstream 42226c989789 744a39e2 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/12 14:13 upstream feb9c5e19e91 9ad6612a .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/08 17:57 upstream 379c72654524 e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/08 16:45 upstream 30c8e80f7932 e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/07 08:07 upstream 4b97bac0756a e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/07 06:42 upstream 4b97bac0756a e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/07 05:29 upstream 4b97bac0756a e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/06 20:03 upstream 64267926e01b e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/06 17:49 upstream 64267926e01b e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/06 09:34 upstream fe27d189e3f4 e60b1103 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/05 09:08 upstream a7391ad35724 02ba4ad6 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/05 02:27 upstream a7391ad35724 dc9e5259 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/04 15:19 upstream 107c948d1d3e dc9e5259 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/04 03:57 upstream 107c948d1d3e dc9e5259 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/03 23:30 upstream ef8e4d3c2ab1 dc9e5259 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/01 22:24 upstream b2da7df52e16 2df221f6 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/01 17:57 upstream b2da7df52e16 2df221f6 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/04/30 07:52 upstream 8013d1d3d2e3 ad6b95d8 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/04/29 04:28 upstream 259b897e5a79 e9076525 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/04/28 17:19 upstream 8f4dd16603ce e9076525 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/04/28 12:39 upstream 8f4dd16603ce 8a1f1f07 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/27 17:22 upstream 46cf2c613f4b 8a1f1f07 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/04/27 11:33 upstream 46cf2c613f4b 1fa34c1b .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/04/27 10:16 upstream 46cf2c613f4b 1fa34c1b .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/04/26 21:49 upstream cf424ef014ac 1fa34c1b .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/26 07:07 upstream d615b5416f8a 1fa34c1b .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/04/26 04:38 upstream d615b5416f8a 152baedd .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/25 19:02 upstream af2d861d4cd2 152baedd .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/25 09:28 upstream af2d861d4cd2 c889aef9 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/24 09:06 upstream 22da5264abf4 131df97d .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/23 18:14 upstream 45ab9400e73f 131df97d .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/04/22 21:00 upstream 281b9d9a4b02 131df97d .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/21 22:47 upstream 59f0c2447e25 2738b391 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/21 03:05 upstream b253435746d9 d4befee1 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream-386 2022/05/21 05:20 upstream 3b5e1590a267 7268fa62 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream-386 2022/05/20 14:47 upstream 3d7285a335ed cb1ac2e7 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream-386 2022/05/13 11:07 upstream f3f19f939c11 7ce5a022 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream-386 2022/05/03 22:42 upstream ef8e4d3c2ab1 dc9e5259 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream-386 2022/05/01 20:12 upstream b2da7df52e16 2df221f6 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream-386 2022/04/22 13:30 upstream d569e86915b7 2738b391 .config log report info KASAN: out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/26 21:06 upstream babf0bb978e3 3037caa9 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-selinux-root 2022/05/26 14:55 upstream babf0bb978e3 3037caa9 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/05/26 03:41 upstream d7227785e384 3037caa9 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/08 23:47 upstream 379c72654524 e60b1103 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-kasan-gce-root 2022/05/05 13:21 upstream a7391ad35724 06089fcd .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream 2022/04/26 07:34 upstream d615b5416f8a 1fa34c1b .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-qemu-upstream-386 2022/05/19 07:16 upstream f993aed406ea 50c53f39 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/18 15:17 linux-next 3f7bdc402fb0 50c53f39 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/18 01:26 linux-next 3f7bdc402fb0 744a39e2 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/11 15:34 linux-next 38a288f5941e beb0b407 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/10 13:33 linux-next 38a288f5941e 8b277b8e .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/08 01:06 linux-next 38a288f5941e e60b1103 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/02 15:21 linux-next 9f9b9a2972eb 2df221f6 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/02 14:04 linux-next 9f9b9a2972eb 2df221f6 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/05/02 13:36 linux-next 9f9b9a2972eb 2df221f6 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync
ci-upstream-linux-next-kasan-gce-root 2022/04/30 17:32 linux-next 5469f0c06732 2df221f6 .config log report info KASAN: stack-out-of-bounds Write in end_buffer_read_sync