syzbot

 sign-in | mailing list | source | docs
🐞 Open [106]
🐞 Fixed [1]
🐞 Invalid [166]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Write in __ext4_expand_extra_isize

Status: auto-closed as invalid on 2020/03/31 02:59
Reported-by: syzbot+e0bf9ba61d327da7c599@syzkaller.appspotmail.com
First crash: 2273d, last: 1816d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Write in __ext4_expand_extra_isize 11 1837d 1948d 0/1 auto-closed as invalid on 2020/03/10 14:13
upstream KASAN: use-after-free Write in __ext4_expand_extra_isize ext4 C 95 2033d 2424d 12/28 fixed on 2019/06/14 18:22
linux-4.19 KASAN: use-after-free Write in __ext4_expand_extra_isize 7 1824d 1886d 0/1 auto-closed as invalid on 2020/03/22 21:28
upstream KASAN: use-after-free Write in __ext4_expand_extra_isize (2) ext4 14 1841d 1858d 15/28 fixed on 2019/12/13 00:31

Sample crash report:
EXT4-fs (sda1): Ignoring removed nomblk_io_submit option
==================================================================
EXT4-fs (sda1): Unrecognized mount option "mask=>\ONO>	cEj57" or missing value
BUG: KASAN: use-after-free in memset include/linux/string.h:332 [inline]
BUG: KASAN: use-after-free in __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5832
Write of size 4063 at addr ffff88819589e0a0 by task syz-executor.3/20036

CPU: 0 PID: 20036 Comm: syz-executor.3 Not tainted 4.14.157-syzkaller #0
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xe5/0x154 lib/dump_stack.c:58
 print_address_description+0x60/0x226 mm/kasan/report.c:187
 __kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316
 memset+0x20/0x40 mm/kasan/common.c:113
 memset include/linux/string.h:332 [inline]
 __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5832
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5884 [inline]
 ext4_mark_inode_dirty+0x471/0x7f0 fs/ext4/inode.c:5960
 ext4_evict_inode+0x6a6/0x1560 fs/ext4/inode.c:282
 evict+0x2cb/0x5f0 fs/inode.c:554
 iput_final fs/inode.c:1516 [inline]
 iput fs/inode.c:1543 [inline]
 iput+0x385/0x7f0 fs/inode.c:1528
 dentry_unlink_inode+0x25f/0x320 fs/dcache.c:387
 d_delete+0x1c5/0x280 fs/dcache.c:2414
 vfs_rmdir2 fs/namei.c:4044 [inline]
 vfs_rmdir2+0x32c/0x410 fs/namei.c:4010
 do_rmdir+0x28a/0x340 fs/namei.c:4098
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a3e7
RSP: 002b:00007fffd39209c8 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045a3e7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fffd3921b60
RBP: 0000000000000053 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000207 R12: 00007fffd3921b60
R13: 0000000000e42980 R14: 0000000000000000 R15: 00007fffd3922bf0

The buggy address belongs to the page:
page:ffffea0006562780 count:2 mapcount:0 mapping:ffff8881d9ab8950 index:0x466
flags: 0x400000000000203a(referenced|dirty|lru|active|private)
raw: 400000000000203a ffff8881d9ab8950 0000000000000466 00000002ffffffff
raw: ffffea00064205a0 ffffea000660ffe0 ffff8881d5242540 ffff8881da81aa80
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8881da81aa80

Memory state around the buggy address:
 ffff88819589ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88819589ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88819589f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88819589f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88819589f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (65):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/02 02:58 android-4.14 13855a652bd5 f879db37 .config console log report ci-android-414-kasan-gce-root
2019/11/25 00:52 android-4.14 437a2a739c5f 598ca6c8 .config console log report ci-android-414-kasan-gce-root
2019/11/23 15:52 android-4.14 437a2a739c5f 598ca6c8 .config console log report ci-android-414-kasan-gce-root
2019/11/18 19:50 android-4.14 460dc7c31cef 1daed50a .config console log report ci-android-414-kasan-gce-root
2019/11/18 08:43 android-4.14 460dc7c31cef d5696d51 .config console log report ci-android-414-kasan-gce-root
2019/11/10 00:05 android-4.14 81144e705f48 dc438b91 .config console log report ci-android-414-kasan-gce-root
2019/11/08 15:32 android-4.14 f40abacc8ac0 1e35461e .config console log report ci-android-414-kasan-gce-root
2019/11/08 14:19 android-4.14 f40abacc8ac0 1e35461e .config console log report ci-android-414-kasan-gce-root
2019/11/07 16:10 android-4.14 6e5cc2351dea d797d201 .config console log report ci-android-414-kasan-gce-root
2019/11/07 09:12 android-4.14 6e5cc2351dea d797d201 .config console log report ci-android-414-kasan-gce-root
2019/11/07 00:17 android-4.14 f7fedd5c15c1 da505f84 .config console log report ci-android-414-kasan-gce-root
2019/11/05 09:13 android-4.14 6409e7e01d11 76630fc9 .config console log report ci-android-414-kasan-gce-root
2019/11/05 05:56 android-4.14 6409e7e01d11 76630fc9 .config console log report ci-android-414-kasan-gce-root
2019/11/03 20:24 android-4.14 6409e7e01d11 c9610487 .config console log report ci-android-414-kasan-gce-root
2019/11/01 09:46 android-4.14 6409e7e01d11 a41ca8fa .config console log report ci-android-414-kasan-gce-root
2019/10/28 14:14 android-4.14 0b383e2946f5 25bb509e .config console log report ci-android-414-kasan-gce-root
2019/10/27 13:40 android-4.14 0b383e2946f5 25bb509e .config console log report ci-android-414-kasan-gce-root
2019/10/21 02:01 android-4.14 234de92896af 8c88c9c1 .config console log report ci-android-414-kasan-gce-root
2019/10/20 04:25 android-4.14 234de92896af 8c88c9c1 .config console log report ci-android-414-kasan-gce-root
2019/10/01 15:42 android-4.14 d649ef04c3ed b7a87a83 .config console log report ci-android-414-kasan-gce-root
2019/10/01 12:08 android-4.14 d649ef04c3ed c7a4fb99 .config console log report ci-android-414-kasan-gce-root
2019/10/01 08:47 android-4.14 d649ef04c3ed c7a4fb99 .config console log report ci-android-414-kasan-gce-root
2019/09/26 01:13 android-4.14 d649ef04c3ed a3355dba .config console log report ci-android-414-kasan-gce-root
2019/09/24 10:27 android-4.14 8ae37de3fa03 c68252d2 .config console log report ci-android-414-kasan-gce-root
2019/09/09 00:07 android-4.14 4eccd8013349 a60cb4cd .config console log report ci-android-414-kasan-gce-root
2019/09/06 03:59 android-4.14 38733badc0e6 040fda58 .config console log report ci-android-414-kasan-gce-root
2019/08/18 00:39 android-4.14 5d8bfdf81cde 55bf8926 .config console log report ci-android-414-kasan-gce-root
2019/06/24 08:00 android-4.14 93c338c2e7ba 472f0082 .config console log report ci-android-414-kasan-gce-root
2019/02/22 03:25 android-4.14 01709c953f89 7ff74a98 .config console log report ci-android-414-kasan-gce-root
2019/02/10 06:11 android-4.14 57de59b3cf53 b4f792e4 .config console log report ci-android-414-kasan-gce-root
2019/02/08 02:34 android-4.14 0116eb1061b0 aa4feb03 .config console log report ci-android-414-kasan-gce-root
2019/02/06 05:49 android-4.14 ae77ce090bb4 d672172c .config console log report ci-android-414-kasan-gce-root
2019/01/21 22:47 android-4.14 5a76363f1262 badbbeee .config console log report ci-android-414-kasan-gce-root
2019/01/21 14:01 android-4.14 5a76363f1262 badbbeee .config console log report ci-android-414-kasan-gce-root
2019/01/18 15:53 android-4.14 42506d99b820 2103a236 .config console log report ci-android-414-kasan-gce-root
2019/01/17 20:13 android-4.14 42506d99b820 769e75ed .config console log report ci-android-414-kasan-gce-root
2019/01/09 11:20 android-4.14 3c207c880674 45c0c1b1 .config console log report ci-android-414-kasan-gce-root
2019/01/02 15:35 android-4.14 7d2d5fc1acda f0491811 .config console log report ci-android-414-kasan-gce-root
2018/12/31 23:18 android-4.14 7d2d5fc1acda 3d85f48c .config console log report ci-android-414-kasan-gce-root
2018/12/22 22:47 android-4.14 815e34f802d8 e3bd7ab8 .config console log report ci-android-414-kasan-gce-root
2018/12/21 05:18 android-4.14 e9c7ae0eb4cb 2b497001 .config console log report ci-android-414-kasan-gce-root
2018/12/09 09:48 android-4.14 13b8d9fdf844 c7918378 .config console log report ci-android-414-kasan-gce-root
2018/12/08 21:10 android-4.14 13b8d9fdf844 60562a1d .config console log report ci-android-414-kasan-gce-root
2018/12/08 12:59 android-4.14 049053b7aee6 60562a1d .config console log report ci-android-414-kasan-gce-root
2018/12/01 20:51 android-4.14 d11d7f1ccfb1 5a581673 .config console log report ci-android-414-kasan-gce-root
2018/11/07 23:06 android-4.14 d4e5dea08bbf e85d2a61 .config console log report ci-android-414-kasan-gce-root
2018/11/06 18:05 android-4.14 d4e5dea08bbf 8bd6bd63 .config console log report ci-android-414-kasan-gce-root
2018/11/05 23:24 android-4.14 d4e5dea08bbf 8bd6bd63 .config console log report ci-android-414-kasan-gce-root
2018/11/03 17:39 android-4.14 12064f3a794e 8bd6bd63 .config console log report ci-android-414-kasan-gce-root
2018/11/03 10:06 android-4.14 12064f3a794e 8bd6bd63 .config console log report ci-android-414-kasan-gce-root
2018/10/31 02:33 android-4.14 4ed22187defd 4ccf7bb4 .config console log report ci-android-414-kasan-gce-root
2018/10/25 20:25 android-4.14 4ed22187defd a8292de9 .config console log report ci-android-414-kasan-gce-root
2018/10/23 12:03 android-4.14 a3ac63b18873 24fa2ad8 .config console log report ci-android-414-kasan-gce-root
2018/10/23 05:58 android-4.14 a3ac63b18873 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/10/21 23:10 android-4.14 c556d1ffe528 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/10/20 23:42 android-4.14 c556d1ffe528 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/10/16 21:14 android-4.14 48091d94336e 1ba7fd7e .config console log report ci-android-414-kasan-gce-root
2018/10/13 07:51 android-4.14 b7e40c3d444a caf12900 .config console log report ci-android-414-kasan-gce-root
2018/10/12 13:55 android-4.14 b7e40c3d444a ba6ddb43 .config console log report ci-android-414-kasan-gce-root
2018/10/09 06:07 android-4.14 d33692e8014d 8b311eaf .config console log report ci-android-414-kasan-gce-root
2018/10/07 23:20 android-4.14 d33692e8014d 8b311eaf .config console log report ci-android-414-kasan-gce-root
2018/10/03 15:51 android-4.14 ff9973a5da5e 8b311eaf .config console log report ci-android-414-kasan-gce-root
2018/10/01 14:16 android-4.14 84ae3e35e1ce 48a50c6b .config console log report ci-android-414-kasan-gce-root
2018/09/08 14:40 android-4.14 b859aa7d7a0c 6b5120a4 .config console log report ci-android-414-kasan-gce-root
2018/09/01 05:52 android-4.14 47350a9f13c6 a4718693 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.