syzbot


KASAN: use-after-free Read in copy_page_from_iter_atomic (2)

Status: upstream: reported C repro on 2022/06/07 13:11
Reported-by: syzbot+d2dd123304b4ae59f1bd@syzkaller.appspotmail.com
First crash: 243d, last: 1d03h

Cause bisection: introduced by (bisect log) :
commit 4cd4aed63125ccd4efc35162627827491c2a7be7
Author: Christoph Hellwig <hch@lst.de>
Date: Fri May 27 08:43:20 2022 +0000

  btrfs: fold repair_io_failure into btrfs_repair_eb_io_failure

Crash: KASAN: use-after-free Read in copy_page_from_iter_atomic (log)
Repro: C syz .config

Fix bisection: failed (bisect log)
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in copy_page_from_iter_atomic 8 392d 506d 0/24 auto-closed as invalid on 2022/05/09 13:28
Last patch testing requests:
Created Duration User Patch Repo Result
2022/07/09 10:01 17m gautammenghani201@gmail.com linux-next error

Sample crash report:
BTRFS error (device loop0): bad tree block start, want 30490624 have 0
==================================================================
BUG: KASAN: use-after-free in copy_page_from_iter_atomic+0xef6/0x1b30 lib/iov_iter.c:969
Read of size 4096 at addr ffff888170801000 by task kworker/u4:0/8

CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.19.0-rc1-next-20220609-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: loop0 loop_rootcg_workfn
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 memcpy+0x20/0x60 mm/kasan/shadow.c:65
 copy_page_from_iter_atomic+0xef6/0x1b30 lib/iov_iter.c:969
 generic_perform_write+0x2b8/0x560 mm/filemap.c:3735
 __generic_file_write_iter+0x2aa/0x4d0 mm/filemap.c:3855
 generic_file_write_iter+0xd7/0x220 mm/filemap.c:3887
 call_write_iter include/linux/fs.h:2057 [inline]
 do_iter_readv_writev+0x3d1/0x640 fs/read_write.c:742
 do_iter_write+0x182/0x700 fs/read_write.c:868
 vfs_iter_write+0x70/0xa0 fs/read_write.c:909
 lo_write_bvec drivers/block/loop.c:249 [inline]
 lo_write_simple drivers/block/loop.c:271 [inline]
 do_req_filebacked drivers/block/loop.c:495 [inline]
 loop_handle_cmd drivers/block/loop.c:1859 [inline]
 loop_process_work+0xd83/0x2050 drivers/block/loop.c:1894
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0005c20040 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x170801
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea0005c20048 ffffea0005c20048 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff888170800f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888170800f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888170801000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888170801080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888170801100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (42):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-linux-next-kasan-gce-root 2022/06/10 01:24 linux-next ff539ac73ea5 0d5abf15 .config strace log report syz C KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2023/01/08 12:30 linux-next cc3c08b41a9c 1dac8c7a .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
ci2-upstream-fs 2022/10/24 06:43 upstream d47136c28015 23bf86af .config console log report syz [disk image] [vmlinux] [mounted in repro] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2022/06/24 05:05 upstream de5c208d533a 912f5df7 .config console log report syz KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/10/27 21:49 linux-next 4d48f589d294 86777b7f .config console log report syz [disk image] [vmlinux] [mounted in repro] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2023/02/04 18:56 upstream 0136d86b7852 be607b78 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci2-upstream-fs 2023/02/04 05:52 upstream 0136d86b7852 1b2f701a .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2023/01/31 17:40 upstream 22b8077d0fce 9dfcf09c .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2023/01/22 21:10 upstream 2241ab53cbb5 559a440a .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-selinux-root 2023/01/02 06:04 upstream 150aae354b81 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci2-upstream-fs 2022/12/18 05:57 upstream f9ff5644bcc0 05494336 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2022/12/08 08:48 upstream 479174d402bc d88f3abb .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-qemu-upstream 2022/11/29 05:10 upstream b7b275e60bcd ca9683b8 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-selinux-root 2022/11/20 01:54 upstream fe24a97cf254 5bb70014 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-selinux-root 2022/10/30 19:28 upstream b229b6ca5abb 2a71366b .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-selinux-root 2022/10/24 16:35 upstream 247f34f7b803 ff2fe65d .config console log report info [disk image] [vmlinux] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci2-upstream-fs 2022/09/30 22:38 upstream 70575e77839f feb56351 .config console log report info [disk image] [vmlinux] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-selinux-root 2022/09/24 20:17 upstream a63f2e7cb110 0042f2b4 .config console log report info [disk image] [vmlinux] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-smack-root 2022/08/07 17:41 upstream 200e340f2196 88e3a122 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2022/06/18 09:30 upstream 4b35035bcf80 8f633d84 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-qemu-upstream-386 2022/11/22 11:13 upstream eb7081409f94 1c8e10bc .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/11/29 09:54 linux-next 9e46a7996732 ca9683b8 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/09/04 23:10 linux-next e47eb90a0a9a 28811d0a .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/12 02:51 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/11 04:07 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:37 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:37 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 19:24 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 17:09 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 02:19 linux-next ff539ac73ea5 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/09 23:40 linux-next ff539ac73ea5 0d5abf15 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/09 03:42 linux-next 03c312cc5f47 b2706118 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 13:10 linux-next 73d0e32571a0 c8857892 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 12:42 linux-next 73d0e32571a0 c8857892 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 12:32 linux-next 73d0e32571a0 c8857892 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 12:13 linux-next 73d0e32571a0 c8857892 .config console log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-smack-root 2023/01/13 12:07 upstream c757fc92a3f7 96166539 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-selinux-root 2023/01/01 11:26 upstream e4cf7c25bae5 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2023/01/13 15:42 linux-next 0a093b2893c7 529798b0 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config console log report info KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
* Struck through repros no longer work on HEAD.