syzbot

 sign-in | mailing list | source | docs
🐞 Open [699]
🐞 Fixed [110]
🐞 Invalid [655]
⬇ Missing Backports [67]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in sysv_new_block

Status: upstream: reported C repro on 2024/10/28 12:55
Reported-by: syzbot+9aec3b4fc9b5eac66815@syzkaller.appspotmail.com
First crash: 117d, last: 11h45m
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2025/02/15 upstream (ToT) 78a632a2086c C Failed due to an error; will retry later
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in sysv_new_block sysv C error 4 785d 815d 0/1 upstream: reported C repro on 2022/11/30 03:11
upstream KASAN: use-after-free Read in sysv_new_block fs C error done 759 48m 814d 0/28 upstream: reported C repro on 2022/12/01 12:49
linux-5.15 KASAN: use-after-free Read in sysv_new_block origin:upstream C 48 16h56m 125d 0/3 upstream: reported C repro on 2024/10/20 05:31
linux-4.14 KASAN: use-after-free Read in sysv_new_block C 1 723d 807d 0/1 upstream: reported C repro on 2022/12/08 01:50

Sample crash report:
syz-executor239: attempt to access beyond end of device
loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
Buffer I/O error on dev loop0, logical block 3245768, async page read
unable to read i-node block
==================================================================
BUG: KASAN: use-after-free in sysv_new_block+0x788/0x960 fs/sysv/balloc.c:113
Read of size 4 at addr ffff88806f0d40c8 by task syz-executor239/4260

CPU: 0 PID: 4260 Comm: syz-executor239 Not tainted 6.1.127-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0x15f/0x4f0 mm/kasan/report.c:427
 kasan_report+0x136/0x160 mm/kasan/report.c:531
 sysv_new_block+0x788/0x960 fs/sysv/balloc.c:113
 alloc_branch fs/sysv/itree.c:134 [inline]
 get_block+0x2e7/0x1790 fs/sysv/itree.c:253
 __block_write_begin_int+0x544/0x1a30 fs/buffer.c:1991
 __block_write_begin fs/buffer.c:2041 [inline]
 block_write_begin+0x98/0x1f0 fs/buffer.c:2102
 sysv_write_begin+0x2d/0x60 fs/sysv/itree.c:487
 page_symlink+0x2c1/0x4e0 fs/namei.c:5218
 sysv_symlink+0xcb/0x180 fs/sysv/namei.c:86
 vfs_symlink+0x247/0x3d0 fs/namei.c:4471
 do_symlinkat+0x21e/0x390 fs/namei.c:4500
 __do_sys_symlink fs/namei.c:4522 [inline]
 __se_sys_symlink fs/namei.c:4520 [inline]
 __x64_sys_symlink+0x7a/0x90 fs/namei.c:4520
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f25f0c1e0e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe97f5e688 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f25f0c1e0e9
RDX: 0000000000000000 RSI: 000000002000acc0 RDI: 000000002000ad80
RBP: 0000000000000004 R08: 0000000000009e80 R09: 0000000000000000
R10: 00007ffe97f5e710 R11: 0000000000000246 R12: 00007ffe97f5e6d0
R13: 00007ffe97f5e710 R14: 0000000000010000 R15: 0000000000000003
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0001bc3500 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6f0d4
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001bc3548 ffffea0001bc34c8 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 20233614458, free_ts 21685061719
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2532
 split_map_pages+0x246/0x510 mm/compaction.c:97
 isolate_freepages_range+0x47c/0x4e0 mm/compaction.c:735
 alloc_contig_range+0x62a/0x990 mm/page_alloc.c:9440
 __alloc_contig_pages mm/page_alloc.c:9463 [inline]
 alloc_contig_pages+0x3f0/0x4e0 mm/page_alloc.c:9543
 debug_vm_pgtable_alloc_huge_page+0xb9/0x108 mm/debug_vm_pgtable.c:1098
 init_args+0xc92/0x1022 mm/debug_vm_pgtable.c:1221
 debug_vm_pgtable+0xaa/0x46b mm/debug_vm_pgtable.c:1259
 do_one_initcall+0x265/0x8f0 init/main.c:1298
 do_initcall_level+0x157/0x207 init/main.c:1371
 do_initcalls+0x49/0x86 init/main.c:1387
 kernel_init_freeable+0x45c/0x60f init/main.c:1626
 kernel_init+0x19/0x290 init/main.c:1514
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x12a6/0x15b0 mm/page_alloc.c:3384
 free_unref_page+0x33/0x3e0 mm/page_alloc.c:3479
 free_contig_range+0x9a/0x150 mm/page_alloc.c:9565
 destroy_args+0xfe/0x997 mm/debug_vm_pgtable.c:1031
 debug_vm_pgtable+0x416/0x46b mm/debug_vm_pgtable.c:1354
 do_one_initcall+0x265/0x8f0 init/main.c:1298
 do_initcall_level+0x157/0x207 init/main.c:1371
 do_initcalls+0x49/0x86 init/main.c:1387
 kernel_init_freeable+0x45c/0x60f init/main.c:1626
 kernel_init+0x19/0x290 init/main.c:1514
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Memory state around the buggy address:
 ffff88806f0d3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806f0d4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88806f0d4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff88806f0d4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806f0d4180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (35):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/31 08:18 linux-6.1.y 75cefdf153f5 4c6ac32f .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/22 06:12 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/22 06:07 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/22 06:06 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/22 06:05 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/22 05:55 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/22 05:13 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/22 04:58 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/17 04:59 linux-6.1.y 0cbb5f65e52f 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/17 04:44 linux-6.1.y 0cbb5f65e52f 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/13 05:32 linux-6.1.y 0cbb5f65e52f b27c2402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/09 15:16 linux-6.1.y 0cbb5f65e52f ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/31 07:43 linux-6.1.y 75cefdf153f5 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/23 02:13 linux-6.1.y f4f677285b38 a44b0418 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/23 02:11 linux-6.1.y f4f677285b38 a44b0418 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/21 17:40 linux-6.1.y f4f677285b38 da72ac06 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/21 17:39 linux-6.1.y f4f677285b38 da72ac06 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/20 10:44 linux-6.1.y f4f677285b38 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/19 23:17 linux-6.1.y f4f677285b38 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/01/05 23:06 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/12/11 18:47 linux-6.1.y e4d90d63d385 ff949d25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/12/11 18:44 linux-6.1.y e4d90d63d385 ff949d25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/12/02 03:04 linux-6.1.y e4d90d63d385 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/11/30 01:36 linux-6.1.y e4d90d63d385 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/11/30 01:35 linux-6.1.y e4d90d63d385 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/11/25 01:10 linux-6.1.y e4d90d63d385 68da6d95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/11/19 06:31 linux-6.1.y b67dc5c9ade9 571351cb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2024/10/28 12:54 linux-6.1.y 7ec6f9fa3d97 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in sysv_new_block
2025/02/15 05:42 linux-6.1.y 0cbb5f65e52f 1022af74 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in sysv_new_block
2025/02/14 02:45 linux-6.1.y 0cbb5f65e52f d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in sysv_new_block
2025/02/13 03:22 linux-6.1.y 0cbb5f65e52f b27c2402 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in sysv_new_block
2025/02/08 16:05 linux-6.1.y 0cbb5f65e52f ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in sysv_new_block
2025/01/25 19:38 linux-6.1.y 75cefdf153f5 9fbd772e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in sysv_new_block
2025/01/20 16:45 linux-6.1.y f4f677285b38 6e87cfa2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in sysv_new_block
2025/02/09 15:44 linux-6.1.y 0cbb5f65e52f ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in sysv_new_block
* Struck through repros no longer work on HEAD.