syzbot


KASAN: use-after-free Read in ext4_xattr_set_entry (2)
Status: fixed on 2020/02/14 01:19
Reported-by: syzbot+4a39a025912b265cacef@syzkaller.appspotmail.com
Fix commit: 9803387c55f7 ext4: validate the debug_want_extra_isize mount option at parse time
First crash: 1150d, last: 715d

Cause bisection: introduced by (bisect log) :
commit 8835cae5f2abd7f7a3143afe357f416aff5517a4
Author: Chris Lapa <chris@lapa.com.au>
Date: Wed Jan 11 01:44:47 2017 +0000

  power: supply: bq27xxx: adds specific support for bq27520-g4 revision.

Crash: WARNING in batadv_mcast_mla_update (log)
Repro: C syz .config
similar bugs (11):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in ext4_xattr_set_entry (3) C 1 3d13h 398d 0/1 upstream: reported C repro on 2020/10/28 15:08
android-414 KASAN: use-after-free Read in ext4_xattr_set_entry (2) 6 761d 817d 0/1 auto-closed as invalid on 2020/02/28 13:35
linux-4.14 KASAN: use-after-free Read in ext4_xattr_set_entry (2) 1 618d 618d 0/1 auto-closed as invalid on 2020/07/21 03:20
linux-4.19 KASAN: use-after-free Read in ext4_xattr_set_entry (2) C done 7 79d 537d 1/1 fixed on 2021/10/13 07:23
upstream KASAN: use-after-free Read in ext4_xattr_set_entry 1 1222d 1222d 0/22 closed as invalid on 2018/07/29 11:55
android-414 KASAN: use-after-free Read in ext4_xattr_set_entry 4 1069d 962d 0/1 auto-closed as invalid on 2019/06/26 01:15
upstream KASAN: use-after-free Read in ext4_xattr_set_entry (3) 4 513d 631d 0/22 auto-closed as invalid on 2020/11/02 08:32
linux-4.19 KASAN: use-after-free Read in ext4_xattr_set_entry syz done 10 641d 889d 1/1 fixed on 2020/03/30 09:03
upstream KASAN: use-after-free Read in ext4_xattr_set_entry (4) C error 7 20d 304d 0/22 upstream: reported C repro on 2021/01/30 11:05
android-54 KASAN: use-after-free Read in ext4_xattr_set_entry 6 481d 662d 0/1 auto-closed as invalid on 2020/12/04 21:44
linux-4.14 KASAN: use-after-free Read in ext4_xattr_set_entry C done 9 669d 761d 1/1 fixed on 2020/03/01 21:06
Patch testing requests:
Created Duration User Patch Repo Result
2019/12/15 06:30 18m tytso@mit.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git master OK

Sample crash report:

Crashes (19):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2019/12/16 14:14 upstream 07c4b9e9f71a eef6e580 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2019/12/13 18:20 upstream ae4b064e2a61 08003f64 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2019/12/04 02:31 upstream 76bb8b05960c ae13a849 .config log report
ci-upstream-kasan-gce-smack-root 2019/11/17 14:57 upstream fe30021c36fb d5696d51 .config log report
ci-upstream-kasan-gce-smack-root 2019/11/05 05:54 upstream a99d8080aaf3 76630fc9 .config log report
ci-upstream-kasan-gce-selinux-root 2019/09/29 18:43 upstream 02dc96ef6c25 c1ad5441 .config log report
ci-upstream-kasan-gce-root 2019/08/30 20:52 upstream 6525771f58cb fd37b39e .config log report
ci-upstream-kasan-gce-selinux-root 2019/08/09 16:51 upstream b678c568c561 ede31a9b .config log report
ci-upstream-kasan-gce-smack-root 2019/06/30 18:31 upstream 6fbc7275c7a9 7509bf36 .config log report
ci-upstream-kasan-gce-root 2019/04/28 13:18 upstream 037904a22bf8 b617407b .config log report
ci-upstream-kasan-gce-selinux-root 2019/04/17 10:55 upstream 444fe9913539 b0e8efcb .config log report
ci-upstream-kasan-gce-smack-root 2019/03/04 23:58 upstream 736706bee329 7c693b52 .config log report
ci-upstream-kasan-gce-root 2019/01/05 20:03 upstream 3fed6ae4b027 53be0a37 .config log report
ci-upstream-kasan-gce-selinux-root 2019/01/05 15:07 upstream 3fed6ae4b027 53be0a37 .config log report
ci-upstream-kasan-gce-smack-root 2019/01/04 08:59 upstream 645ff1e8e704 7da23925 .config log report
ci-upstream-kasan-gce-root 2018/11/16 00:41 upstream da5322e65940 3a41052e .config log report
ci-upstream-kasan-gce-selinux-root 2018/11/01 09:35 upstream 59fc453b21f7 1f38e9ae .config log report
ci-upstream-kasan-gce-selinux-root 2018/10/07 22:54 upstream fb1c592cf4c9 8b311eaf .config log report
ci-upstream-linux-next-kasan-gce-root 2019/04/28 19:52 linux-next 3ddfa8af5dc9 b617407b .config log report