syzbot


KASAN: slab-out-of-bounds Read in hfsplus_bnode_read

Status: upstream: reported C repro on 2022/11/26 08:07
Subsystems: hfs
[Documentation on labels]
Reported-by: syzbot+e76bf3d19b85350571ac@syzkaller.appspotmail.com
First crash: 479d, last: 10h40m
Cause bisection: failed (error log, bisect log)
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] KASAN: slab-out-of-bounds Read in hfsplus_bnode_read 0 (1) 2022/11/26 08:07
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: slab-out-of-bounds Read in hfsplus_bnode_read origin:upstream C 4 9h20m 272d 0/3 upstream: reported C repro on 2023/06/20 20:03
linux-4.19 KASAN: slab-out-of-bounds Read in hfsplus_bnode_read C error 2 477d 478d 0/1 upstream: reported C repro on 2022/11/26 10:26
linux-4.14 KASAN: slab-out-of-bounds Read in hfsplus_bnode_read hfsplus C 3 380d 471d 0/1 upstream: reported C repro on 2022/12/03 05:45
Last patch testing requests (10)
Created Duration User Patch Repo Result
2024/02/29 22:15 23m retest repro upstream OK log
2024/02/18 00:25 20m retest repro upstream OK log
2024/02/17 11:46 16m retest repro upstream OK log
2024/02/17 11:46 16m retest repro upstream OK log
2024/01/17 19:14 21m retest repro upstream OK log
2024/01/17 19:14 20m retest repro upstream OK log
2024/01/17 19:14 20m retest repro upstream OK log
2024/01/17 17:27 21m retest repro upstream OK log
2024/01/17 17:27 20m retest repro upstream OK log
2024/01/17 17:27 20m retest repro upstream OK log
Fix bisection attempts (7)
Created Duration User Patch Repo Result
2023/12/21 19:59 1h29m bisect fix upstream job log (0) log
2023/08/01 14:02 1h36m bisect fix upstream job log (0) log
2023/06/01 22:38 25m bisect fix upstream job log (0) log
2023/05/02 20:34 1h00m bisect fix upstream job log (0) log
2023/04/02 11:08 38m bisect fix upstream job log (0) log
2023/03/03 10:30 38m bisect fix upstream job log (0) log
2023/02/01 06:21 27m bisect fix upstream job log (0) log

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x234/0x250 fs/hfsplus/bnode.c:32
Read of size 8 at addr ffff88802083e3c0 by task syz-executor215/5163

CPU: 3 PID: 5163 Comm: syz-executor215 Not tainted 6.8.0-rc7-syzkaller-00130-g135288b73cef #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 hfsplus_bnode_read+0x234/0x250 fs/hfsplus/bnode.c:32
 hfsplus_bnode_read_u16 fs/hfsplus/bnode.c:45 [inline]
 hfsplus_bnode_dump+0x2a2/0x3e0 fs/hfsplus/bnode.c:321
 hfsplus_brec_remove+0x3e2/0x4f0 fs/hfsplus/brec.c:229
 __hfsplus_delete_attr+0x2a2/0x3b0 fs/hfsplus/attributes.c:299
 hfsplus_delete_all_attrs+0x271/0x330 fs/hfsplus/attributes.c:378
 hfsplus_delete_cat+0x844/0xdd0 fs/hfsplus/catalog.c:425
 hfsplus_unlink+0x213/0x7f0 fs/hfsplus/dir.c:385
 vfs_unlink+0x2fb/0x910 fs/namei.c:4338
 do_unlinkat+0x5c0/0x750 fs/namei.c:4402
 __do_sys_unlink fs/namei.c:4450 [inline]
 __se_sys_unlink fs/namei.c:4448 [inline]
 __x64_sys_unlink+0xc8/0x110 fs/namei.c:4448
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f28327c46b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd7a1a4cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 00007ffd7a1a4e98 RCX: 00007f28327c46b9
RDX: 00007f28327c3751 RSI: 0000000000000000 RDI: 0000000020000000
RBP: 00007f2832837610 R08: 00000000000005f2 R09: 0000000000000000
R10: 00007ffd7a1a4b80 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd7a1a4e88 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Allocated by task 5163:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3981 [inline]
 __kmalloc+0x1f9/0x440 mm/slub.c:3994
 kmalloc include/linux/slab.h:594 [inline]
 kzalloc include/linux/slab.h:711 [inline]
 __hfs_bnode_create+0x108/0x870 fs/hfsplus/bnode.c:409
 hfsplus_bnode_find+0x2c8/0xcb0 fs/hfsplus/bnode.c:486
 hfsplus_brec_find+0x2b9/0x520 fs/hfsplus/bfind.c:183
 hfsplus_find_attr fs/hfsplus/attributes.c:160 [inline]
 hfsplus_delete_all_attrs+0x24a/0x330 fs/hfsplus/attributes.c:371
 hfsplus_delete_cat+0x844/0xdd0 fs/hfsplus/catalog.c:425
 hfsplus_unlink+0x213/0x7f0 fs/hfsplus/dir.c:385
 vfs_unlink+0x2fb/0x910 fs/namei.c:4338
 do_unlinkat+0x5c0/0x750 fs/namei.c:4402
 __do_sys_unlink fs/namei.c:4450 [inline]
 __se_sys_unlink fs/namei.c:4448 [inline]
 __x64_sys_unlink+0xc8/0x110 fs/namei.c:4448
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

The buggy address belongs to the object at ffff88802083e300
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 40 bytes to the right of
 allocated 152-byte region [ffff88802083e300, ffff88802083e398)

The buggy address belongs to the physical page:
page:ffffea0000820f80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2083e
flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000800 ffff888014c42a00 ffffea0000820e40 0000000000000006
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 17932989593, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2190 [inline]
 allocate_slab mm/slub.c:2354 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2407
 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3625
 __slab_alloc_node mm/slub.c:3678 [inline]
 slab_alloc_node mm/slub.c:3850 [inline]
 kmalloc_trace+0x30b/0x340 mm/slub.c:4007
 kmalloc include/linux/slab.h:590 [inline]
 kzalloc include/linux/slab.h:711 [inline]
 call_usermodehelper_setup+0x9a/0x340 kernel/umh.c:363
 kobject_uevent_env+0x1694/0x1820 lib/kobject_uevent.c:614
 kset_register+0x1b6/0x2b0 lib/kobject.c:877
 class_register+0x22e/0x340 drivers/base/class.c:203
 konepure_init+0x16/0x80 drivers/hid/hid-roccat-konepure.c:213
 do_one_initcall+0x11c/0x670 init/main.c:1236
 do_initcall_level init/main.c:1298 [inline]
 do_initcalls init/main.c:1314 [inline]
 do_basic_setup init/main.c:1333 [inline]
 kernel_init_freeable+0x68d/0xc10 init/main.c:1551
 kernel_init+0x1c/0x2a0 init/main.c:1441
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88802083e280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88802083e300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88802083e380: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
                                           ^
 ffff88802083e400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88802083e480: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/08 07:44 upstream 135288b73cef cf82cde1 .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-qemu-upstream KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2024/03/07 06:30 upstream 67be068d31d4 f39a7eed .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-qemu-upstream KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2024/01/03 14:16 upstream 610a9b8f49fb fb427a07 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-selinux-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/12/25 20:42 upstream 861deac3b092 fb427a07 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-selinux-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/06/27 08:21 upstream c0a572d9d32f 4cd5bb25 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/06/15 22:08 upstream b6dad5178cea 757d26ed .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-selinux-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/06/06 14:28 upstream f8dba31b0a82 a4ae4f42 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2022/12/12 23:20 upstream 830b3c68c1fb 67be1ae7 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2022/12/11 04:46 upstream 296a7b7eb792 67be1ae7 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2022/11/27 20:03 upstream faf68e3523c2 f4470a7b .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2022/11/25 22:12 upstream 08ad43d554ba f4470a7b .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/08/13 06:04 linux-next 21ef7b1e17d0 39990d51 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/08/06 18:10 linux-next bdffb18b5dd8 4ffcc9ef .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/08/08 07:49 upstream a027b2eca0b7 b1b6ae3d .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-selinux-root general protection fault in hfsplus_bnode_read
2022/12/24 23:35 upstream 72a85e2b0a1e 9da18ae8 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: wild-memory-access Read in hfsplus_bnode_read
2024/02/03 10:22 upstream 6897cea71837 60bf9982 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2024/01/22 09:55 upstream 4fbbed787267 9bd8dcda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/11/07 16:54 upstream be3ca57cfb77 83211397 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/10/10 10:10 upstream 94f6f0550c62 c9be5398 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2024/03/18 18:15 upstream f6cef5f8c37f fc090d20 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2024/02/03 03:22 upstream 56897d51886f 60bf9982 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2023/06/06 14:11 upstream f8dba31b0a82 a4ae4f42 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
2022/11/27 16:50 upstream faf68e3523c2 f4470a7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in hfsplus_bnode_read
* Struck through repros no longer work on HEAD.