KASAN: slab-out-of-bounds Read in dbAdjTree

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	KASAN: use-after-free Read in dbAdjTree	C		error	5	806d	923d	0/1	upstream: reported C repro on 2022/10/31 14:16
upstream	UBSAN: array-index-out-of-bounds in dbAdjTree jfs	C	error	error	41	481d	958d	25/28	fixed on 2024/01/30 15:47
linux-5.15	UBSAN: array-index-out-of-bounds in dbAdjTree origin:lts-only	C		done	7	149d	188d	3/3	fixed on 2025/01/22 14:58
upstream	UBSAN: array-index-out-of-bounds in dbAdjTree (2) jfs	C	inconclusive		77	173d	358d	28/28	fixed on 2024/12/16 09:50
linux-6.1	UBSAN: array-index-out-of-bounds in dbAdjTree origin:lts-only	C		done	4	150d	153d	0/3	upstream: reported C repro on 2024/12/09 11:51

Created	Duration	User	Repo	Result
2023/02/25 13:21	51m	bisect fix	linux-4.14.y	OK (0) job log log
2023/01/25 03:24	29m	bisect fix	linux-4.14.y	OK (0) job log log
2022/11/04 12:58	22m	bisect fix	linux-4.14.y	OK (0) job log log

Created

Duration

User

Patch

Repo

Result

2023/02/25 13:21

51m

bisect fix

linux-4.14.y

OK (0) job log log

2023/01/25 03:24

29m

bisect fix

linux-4.14.y

OK (0) job log log

2022/11/04 12:58

22m

bisect fix

linux-4.14.y

OK (0) job log log

================================================================== BUG: KASAN: slab-out-of-bounds in dbAdjTree+0x20d/0x280 fs/jfs/jfs_dmap.c:2918 Read of size 1 at addr ffff8880af2dd078 by task syz-executor423/7959 CPU: 1 PID: 7959 Comm: syz-executor423 Not tainted 4.14.295-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load1_noabort+0x68/0x70 mm/kasan/report.c:427 dbAdjTree+0x20d/0x280 fs/jfs/jfs_dmap.c:2918 dbSplit+0xeb/0x130 fs/jfs/jfs_dmap.c:2690 dbAllocBits+0x10b/0x4a0 fs/jfs/jfs_dmap.c:2239 dbAllocDmap+0x5f/0x100 fs/jfs/jfs_dmap.c:2080 dbAllocNear fs/jfs/jfs_dmap.c:1309 [inline] dbAlloc+0x679/0x980 fs/jfs/jfs_dmap.c:826 diNewExt+0x5b0/0x1780 fs/jfs/jfs_imap.c:2272 diAllocExt fs/jfs/jfs_imap.c:1966 [inline] diAllocAG+0x14ee/0x2110 fs/jfs/jfs_imap.c:1683 diAlloc+0x69d/0x1230 fs/jfs/jfs_imap.c:1604 ialloc+0x7b/0x940 fs/jfs/jfs_inode.c:70 jfs_mkdir.part.0+0xfd/0x7e0 fs/jfs/namei.c:238 jfs_mkdir+0x35/0x50 fs/jfs/namei.c:223 vfs_mkdir+0x463/0x6e0 fs/namei.c:3851 SYSC_mkdirat fs/namei.c:3874 [inline] SyS_mkdirat+0x1fd/0x270 fs/namei.c:3858 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f24d3892e49 RSP: 002b:00007ffc991e54c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f24d3892e49 RDX: 00007f24d38513e3 RSI: 0000000000000000 RDI: 00000000200052c0 RBP: 00007f24d38526b0 R08: 00005555574f02c0 R09: 0000000000000000 R10: 00007ffc991e5390 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00080000000000fc R15: 0000000000000000 Allocated by task 4632: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] kernfs_fop_write+0x2fe/0x440 fs/kernfs/file.c:293 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb Freed by task 4632: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xc9/0x250 mm/slab.c:3815 kernfs_fop_write+0x161/0x440 fs/kernfs/file.c:330 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb The buggy address belongs to the object at ffff8880af2dd040 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 24 bytes to the right of 32-byte region [ffff8880af2dd040, ffff8880af2dd060) The buggy address belongs to the page: page:ffffea0002bcb740 count:1 mapcount:0 mapping:ffff8880af2dd000 index:0xffff8880af2ddfc1 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffff8880af2dd000 ffff8880af2ddfc1 0000000100000006 raw: ffffea0002ae6ce0 ffffea0002b06960 ffff88813fe741c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880af2dcf00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880af2dcf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880af2dd000: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff8880af2dd080: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8880af2dd100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ==================================================================

Crashes (3):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Assets (help?)	Manager	Title
2022/10/03 00:16	linux-4.14.y	9d5c0b3a8e1a	feb56351	.config	console log	report	syz	C	[disk image] [vmlinux]	ci2-linux-4-14	KASAN: slab-out-of-bounds Read in dbAdjTree
2023/02/26 21:56	linux-4.14.y	7878a41b6cc1	ee50e71c	.config	console log	report	syz	C	[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-linux-4-14	BUG: unable to handle kernel paging request in dbAdjTree
2022/11/10 00:46	linux-4.14.y	a901bb6c7db7	bebca8b7	.config	console log	report	syz	C	[disk image] [vmlinux] [kernel image] [mounted in repro]	ci2-linux-4-14	BUG: unable to handle kernel paging request in dbAdjTree

Crashes (3):

Assets (help?)