syzbot


KASAN: use-after-free Read in copy_page_from_iter_atomic (2)

Status: upstream: reported C repro on 2022/06/07 13:11
Reported-by: syzbot+d2dd123304b4ae59f1bd@syzkaller.appspotmail.com
First crash: 116d, last: 17h01m

Cause bisection: introduced by (bisect log) :
commit 4cd4aed63125ccd4efc35162627827491c2a7be7
Author: Christoph Hellwig <hch@lst.de>
Date: Fri May 27 08:43:20 2022 +0000

  btrfs: fold repair_io_failure into btrfs_repair_eb_io_failure

Crash: KASAN: use-after-free Read in copy_page_from_iter_atomic (log)
Repro: C syz .config

Fix bisection: failed (bisect log)
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in copy_page_from_iter_atomic 8 265d 378d 0/24 auto-closed as invalid on 2022/05/09 13:28
Patch testing requests:
Created Duration User Patch Repo Result
2022/07/09 10:01 17m gautammenghani201@gmail.com linux-next error

Sample crash report:
BTRFS error (device loop0): bad tree block start, want 30490624 have 0
==================================================================
BUG: KASAN: use-after-free in copy_page_from_iter_atomic+0xef6/0x1b30 lib/iov_iter.c:969
Read of size 4096 at addr ffff888170801000 by task kworker/u4:0/8

CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.19.0-rc1-next-20220609-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: loop0 loop_rootcg_workfn
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 memcpy+0x20/0x60 mm/kasan/shadow.c:65
 copy_page_from_iter_atomic+0xef6/0x1b30 lib/iov_iter.c:969
 generic_perform_write+0x2b8/0x560 mm/filemap.c:3735
 __generic_file_write_iter+0x2aa/0x4d0 mm/filemap.c:3855
 generic_file_write_iter+0xd7/0x220 mm/filemap.c:3887
 call_write_iter include/linux/fs.h:2057 [inline]
 do_iter_readv_writev+0x3d1/0x640 fs/read_write.c:742
 do_iter_write+0x182/0x700 fs/read_write.c:868
 vfs_iter_write+0x70/0xa0 fs/read_write.c:909
 lo_write_bvec drivers/block/loop.c:249 [inline]
 lo_write_simple drivers/block/loop.c:271 [inline]
 do_req_filebacked drivers/block/loop.c:495 [inline]
 loop_handle_cmd drivers/block/loop.c:1859 [inline]
 loop_process_work+0xd83/0x2050 drivers/block/loop.c:1894
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0005c20040 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x170801
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea0005c20048 ffffea0005c20048 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff888170800f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888170800f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888170801000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888170801080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888170801100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (23):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-linux-next-kasan-gce-root 2022/06/10 01:24 linux-next ff539ac73ea5 0d5abf15 .config log report syz C KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2022/06/24 05:05 upstream de5c208d533a 912f5df7 .config log report syz KASAN: use-after-free Read in copy_page_from_iter_atomic
ci2-upstream-fs 2022/09/30 22:38 upstream 70575e77839f feb56351 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-selinux-root 2022/09/24 20:17 upstream a63f2e7cb110 0042f2b4 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-smack-root 2022/08/07 17:41 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-kasan-gce-root 2022/06/18 09:30 upstream 4b35035bcf80 8f633d84 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/09/04 23:10 linux-next e47eb90a0a9a 28811d0a .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/12 02:51 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/11 04:07 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:37 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:37 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 19:24 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 17:09 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 02:19 linux-next ff539ac73ea5 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/09 23:40 linux-next ff539ac73ea5 0d5abf15 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/09 03:42 linux-next 03c312cc5f47 b2706118 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 13:10 linux-next 73d0e32571a0 c8857892 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 12:42 linux-next 73d0e32571a0 c8857892 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 12:32 linux-next 73d0e32571a0 c8857892 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/07 12:13 linux-next 73d0e32571a0 c8857892 .config log report info KASAN: use-after-free Read in copy_page_from_iter_atomic
ci-upstream-linux-next-kasan-gce-root 2022/06/10 21:48 linux-next 6d0c80680317 0d5abf15 .config log report info KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic
* Struck through repros no longer work on HEAD.