syzbot


KASAN: slab-out-of-bounds Read in build_segment_manager

Status: closed as invalid on 2020/03/24 18:50
Fix commit: f2fs/fscrypt: updates on 4.18-rc1
First crash: 2169d, last: 2169d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-out-of-bounds Read in build_segment_manager f2fs C 1 2169d 2169d 8/26 fixed on 2018/07/09 18:05
linux-4.14 KASAN: slab-out-of-bounds Read in build_segment_manager f2fs C error 5 412d 1270d 0/1 upstream: reported C repro on 2020/10/05 08:04

Sample crash report:
F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
==================================================================
BUG: KASAN: slab-out-of-bounds in build_sit_entries fs/f2fs/segment.c:3654 [inline]
BUG: KASAN: slab-out-of-bounds in build_segment_manager+0x962a/0x9d30 fs/f2fs/segment.c:3853
Read of size 4 at addr ffff8801c4754a00 by task syzkaller107152/3637

CPU: 1 PID: 3637 Comm: syzkaller107152 Not tainted 4.9.94-g8683408 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c471f870 ffffffff81eb0aa9 ffffea000711d400 ffff8801c4754a00
 0000000000000000 ffff8801c4754a00 ffff8801d6db3300 ffff8801c471f8a8
 ffffffff815652cb ffff8801c4754a00 0000000000000004 0000000000000000
Call Trace:
 [<ffffffff81eb0aa9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb0aa9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff815652cb>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff815656d5>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff815656d5>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff81539334>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 [<ffffffff81c90f0a>] build_sit_entries fs/f2fs/segment.c:3654 [inline]
 [<ffffffff81c90f0a>] build_segment_manager+0x962a/0x9d30 fs/f2fs/segment.c:3853
 [<ffffffff81bfe7e0>] f2fs_fill_super+0x1d10/0x5d00 fs/f2fs/super.c:2807
 [<ffffffff81579c17>] mount_bdev+0x2c7/0x390 fs/super.c:1100
 [<ffffffff81bea994>] f2fs_mount+0x34/0x40 fs/f2fs/super.c:3024
 [<ffffffff8157b99c>] mount_fs+0x28c/0x370 fs/super.c:1206
 [<ffffffff815daf41>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 [<ffffffff815e2869>] vfs_kern_mount fs/namespace.c:973 [inline]
 [<ffffffff815e2869>] do_new_mount fs/namespace.c:2512 [inline]
 [<ffffffff815e2869>] do_mount+0x3c9/0x2740 fs/namespace.c:2834
 [<ffffffff815e55be>] SYSC_mount fs/namespace.c:3050 [inline]
 [<ffffffff815e55be>] SyS_mount+0xfe/0x110 fs/namespace.c:3027
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f2313>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801c4754400
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1536 bytes inside of
 2048-byte region [ffff8801c4754400, ffff8801c4754c00)
The buggy address belongs to the page:
page:ffffea000711d400 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c4754900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c4754980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801c4754a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff8801c4754a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c4754b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/20 17:08 https://android.googlesource.com/kernel/common android-4.9 8683408f8e81 cc402841 .config console log report syz C ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.