syzbot |
sign-in | mailing list | source | docs |
🐞 Open [720] 🐞 Fixed [181] 🐞 Invalid [637] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes | 💬 Send us feedback |
Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
linux-4.19 | KASAN: use-after-free Read in dbAdjTree | C | error | 5 | 28d | 145d | 0/1 | upstream: reported C repro on 2022/10/31 14:16 | |
upstream | UBSAN: array-index-out-of-bounds in dbAdjTree jfs | C | error | 23 | 28d | 180d | 0/24 | upstream: reported C repro on 2022/09/26 09:44 |
================================================================== BUG: KASAN: slab-out-of-bounds in dbAdjTree+0x20d/0x280 fs/jfs/jfs_dmap.c:2918 Read of size 1 at addr ffff8880af2dd078 by task syz-executor423/7959 CPU: 1 PID: 7959 Comm: syz-executor423 Not tainted 4.14.295-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load1_noabort+0x68/0x70 mm/kasan/report.c:427 dbAdjTree+0x20d/0x280 fs/jfs/jfs_dmap.c:2918 dbSplit+0xeb/0x130 fs/jfs/jfs_dmap.c:2690 dbAllocBits+0x10b/0x4a0 fs/jfs/jfs_dmap.c:2239 dbAllocDmap+0x5f/0x100 fs/jfs/jfs_dmap.c:2080 dbAllocNear fs/jfs/jfs_dmap.c:1309 [inline] dbAlloc+0x679/0x980 fs/jfs/jfs_dmap.c:826 diNewExt+0x5b0/0x1780 fs/jfs/jfs_imap.c:2272 diAllocExt fs/jfs/jfs_imap.c:1966 [inline] diAllocAG+0x14ee/0x2110 fs/jfs/jfs_imap.c:1683 diAlloc+0x69d/0x1230 fs/jfs/jfs_imap.c:1604 ialloc+0x7b/0x940 fs/jfs/jfs_inode.c:70 jfs_mkdir.part.0+0xfd/0x7e0 fs/jfs/namei.c:238 jfs_mkdir+0x35/0x50 fs/jfs/namei.c:223 vfs_mkdir+0x463/0x6e0 fs/namei.c:3851 SYSC_mkdirat fs/namei.c:3874 [inline] SyS_mkdirat+0x1fd/0x270 fs/namei.c:3858 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f24d3892e49 RSP: 002b:00007ffc991e54c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f24d3892e49 RDX: 00007f24d38513e3 RSI: 0000000000000000 RDI: 00000000200052c0 RBP: 00007f24d38526b0 R08: 00005555574f02c0 R09: 0000000000000000 R10: 00007ffc991e5390 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00080000000000fc R15: 0000000000000000 Allocated by task 4632: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] kernfs_fop_write+0x2fe/0x440 fs/kernfs/file.c:293 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb Freed by task 4632: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xc9/0x250 mm/slab.c:3815 kernfs_fop_write+0x161/0x440 fs/kernfs/file.c:330 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb The buggy address belongs to the object at ffff8880af2dd040 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 24 bytes to the right of 32-byte region [ffff8880af2dd040, ffff8880af2dd060) The buggy address belongs to the page: page:ffffea0002bcb740 count:1 mapcount:0 mapping:ffff8880af2dd000 index:0xffff8880af2ddfc1 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffff8880af2dd000 ffff8880af2ddfc1 0000000100000006 raw: ffffea0002ae6ce0 ffffea0002b06960 ffff88813fe741c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880af2dcf00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880af2dcf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880af2dd000: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff8880af2dd080: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8880af2dd100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ==================================================================
Manager | Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
ci2-linux-4-14 | 2023/02/25 14:13 | linux-4.14.y | 7878a41b6cc1 | feb56351 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2023/01/25 03:54 | linux-4.14.y | 3949d1610004 | feb56351 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2022/11/04 13:21 | linux-4.14.y | a901bb6c7db7 | feb56351 | .config | console log | report | syz | C |
Manager | Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
ci2-linux-4-14 | 2022/10/03 00:16 | linux-4.14.y | 9d5c0b3a8e1a | feb56351 | .config | console log | report | syz | C | [disk image] [vmlinux] | KASAN: slab-out-of-bounds Read in dbAdjTree | |
ci2-linux-4-14 | 2023/02/26 21:56 | linux-4.14.y | 7878a41b6cc1 | ee50e71c | .config | console log | report | syz | C | [disk image] [vmlinux] [kernel image] [mounted in repro] | BUG: unable to handle kernel paging request in dbAdjTree | |
ci2-linux-4-14 | 2022/11/10 00:46 | linux-4.14.y | a901bb6c7db7 | bebca8b7 | .config | console log | report | syz | C | [disk image] [vmlinux] [kernel image] [mounted in repro] | BUG: unable to handle kernel paging request in dbAdjTree |