bisecting cause commit starting from e69ec487b2c7c82ef99b4b15122f58a2a99289a3 building syzkaller on 4de4e9f01d7139b72102ae0b8a1e810730467774 testing commit e69ec487b2c7c82ef99b4b15122f58a2a99289a3 with gcc (GCC) 8.1.0 kernel signature: d1a035a57469ed8209e8059861d214d3899899cb all runs: crashed: KASAN: slab-out-of-bounds Write in mpol_parse_str testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: 628f7544a82c31f9eb8a53a8b6f45a9a270277ff all runs: crashed: KASAN: slab-out-of-bounds Write in mpol_parse_str testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: ae53cf5df7a4ed5658223a14bf2683fceddebb47 all runs: OK # git bisect start 219d54332a09e8d8741c1e1982f5eae56099de85 4d856f72c10ecb060868ed10ff1b1453943fc6c8 Bisecting: 7882 revisions left to test after this (roughly 13 steps) [a9f8b38a071b468276a243ea3ea5a0636e848cf2] Merge tag 'for-linus-5.4-1' of git://github.com/cminyard/linux-ipmi testing commit a9f8b38a071b468276a243ea3ea5a0636e848cf2 with gcc (GCC) 8.1.0 kernel signature: 5499014909e41110b31eaa3fc50b873fd33560d6 all runs: crashed: KASAN: slab-out-of-bounds Write in mpol_parse_str # git bisect bad a9f8b38a071b468276a243ea3ea5a0636e848cf2 Bisecting: 3920 revisions left to test after this (roughly 12 steps) [fe38bd6862074c0a2b9be7f31f043aaa70b2af5f] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm testing commit fe38bd6862074c0a2b9be7f31f043aaa70b2af5f with gcc (GCC) 8.1.0 kernel signature: 5bde019b96b7f892aaa1930a0f0161741a068f44 all runs: OK # git bisect good fe38bd6862074c0a2b9be7f31f043aaa70b2af5f Bisecting: 1962 revisions left to test after this (roughly 11 steps) [069841ef8293697e951c34f9a45601b77fb541d7] Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue testing commit 069841ef8293697e951c34f9a45601b77fb541d7 with gcc (GCC) 8.1.0 kernel signature: 4e79ebf510afa47bb8397c6dcd89deb7dc00f1f7 all runs: OK # git bisect good 069841ef8293697e951c34f9a45601b77fb541d7 Bisecting: 939 revisions left to test after this (roughly 10 steps) [6cfae0c26b21dce323fe8799b66cf4bc996e3565] Merge tag 'char-misc-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit 6cfae0c26b21dce323fe8799b66cf4bc996e3565 with gcc (GCC) 8.1.0 kernel signature: 694bd2abdb974b1732fad7b8640824afb6d20702 all runs: OK # git bisect good 6cfae0c26b21dce323fe8799b66cf4bc996e3565 Bisecting: 471 revisions left to test after this (roughly 9 steps) [81160dda9a7aad13c04e78bb2cfd3c4630e3afab] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit 81160dda9a7aad13c04e78bb2cfd3c4630e3afab with gcc (GCC) 8.1.0 kernel signature: 1b2a546a493e943232196944b7ee3627320f72a0 all runs: OK # git bisect good 81160dda9a7aad13c04e78bb2cfd3c4630e3afab Bisecting: 248 revisions left to test after this (roughly 8 steps) [e6bc9de714972cac34daa1dc1567ee48a47a9342] Merge tag 'vfs-5.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux testing commit e6bc9de714972cac34daa1dc1567ee48a47a9342 with gcc (GCC) 8.1.0 kernel signature: 09c3c1427d8d2840f4128e8e0f6b91922d8d8325 all runs: OK # git bisect good e6bc9de714972cac34daa1dc1567ee48a47a9342 Bisecting: 119 revisions left to test after this (roughly 7 steps) [7e3d2c8210e67ebff472a0b371bb0efb4236ef52] Merge tag '5.4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 testing commit 7e3d2c8210e67ebff472a0b371bb0efb4236ef52 with gcc (GCC) 8.1.0 kernel signature: e71b952c41788e60d3417cf23f8d4f2f85cac701 all runs: crashed: KASAN: slab-out-of-bounds Write in mpol_parse_str # git bisect bad 7e3d2c8210e67ebff472a0b371bb0efb4236ef52 Bisecting: 61 revisions left to test after this (roughly 6 steps) [cfb82e1df8b7c76991ea12958855897c2fb4debc] Merge tag 'y2038-vfs' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground testing commit cfb82e1df8b7c76991ea12958855897c2fb4debc with gcc (GCC) 8.1.0 kernel signature: bd8f1002185cf5905658b3a66136e330aec27219 all runs: OK # git bisect good cfb82e1df8b7c76991ea12958855897c2fb4debc Bisecting: 30 revisions left to test after this (roughly 5 steps) [96d9f7ed00b86104bf03adeffc8980897e9694ab] smb3: fix unmount hang in open_shroot testing commit 96d9f7ed00b86104bf03adeffc8980897e9694ab with gcc (GCC) 8.1.0 kernel signature: 40e5c864afc58733e6e9f4c1f69e8dbdbcfa2dd2 all runs: OK # git bisect good 96d9f7ed00b86104bf03adeffc8980897e9694ab Bisecting: 15 revisions left to test after this (roughly 4 steps) [74983ac20aeafc88d9ceed64a8bf2a9024c488d5] vfs: Make fs_parse() handle fs_param_is_fd-type params better testing commit 74983ac20aeafc88d9ceed64a8bf2a9024c488d5 with gcc (GCC) 8.1.0 kernel signature: 817532d221873b73e1b4a10eac48a4025063fed7 all runs: crashed: KASAN: slab-out-of-bounds Write in mpol_parse_str # git bisect bad 74983ac20aeafc88d9ceed64a8bf2a9024c488d5 Bisecting: 7 revisions left to test after this (roughly 3 steps) [d401727ea0d7a48eaa01a8089f6b91a8121dcaac] devtmpfs: don't mix {ramfs,shmem}_fill_super() with mount_single() testing commit d401727ea0d7a48eaa01a8089f6b91a8121dcaac with gcc (GCC) 8.1.0 kernel signature: d174aea6d5e933c3cefccf4275fa69b79919f458 all runs: OK # git bisect good d401727ea0d7a48eaa01a8089f6b91a8121dcaac Bisecting: 3 revisions left to test after this (roughly 2 steps) [f6490b7fbb8216e15c0b52409b5fd9d035fe3530] shmem_parse_options(): don't bother with mpol in separate variable testing commit f6490b7fbb8216e15c0b52409b5fd9d035fe3530 with gcc (GCC) 8.1.0 kernel signature: bd0ae8119d708c9addd372d13172c614a4757186 all runs: OK # git bisect good f6490b7fbb8216e15c0b52409b5fd9d035fe3530 Bisecting: 1 revision left to test after this (roughly 1 step) [626c3920aeb4575f53c96b0d4ad4e651a21cbb66] shmem_parse_one(): switch to use of fs_parse() testing commit 626c3920aeb4575f53c96b0d4ad4e651a21cbb66 with gcc (GCC) 8.1.0 kernel signature: 27f6c53e1408f4793615b310a8e17134a179cb7a all runs: crashed: KASAN: slab-out-of-bounds Write in mpol_parse_str # git bisect bad 626c3920aeb4575f53c96b0d4ad4e651a21cbb66 Bisecting: 0 revisions left to test after this (roughly 0 steps) [e04dc423ae2c0fc862fef6b43ed9083226375e98] shmem_parse_options(): take handling a single option into a helper testing commit e04dc423ae2c0fc862fef6b43ed9083226375e98 with gcc (GCC) 8.1.0 kernel signature: e64dceec5635f800ab4aad5cf9c44d827005a22a all runs: OK # git bisect good e04dc423ae2c0fc862fef6b43ed9083226375e98 626c3920aeb4575f53c96b0d4ad4e651a21cbb66 is the first bad commit commit 626c3920aeb4575f53c96b0d4ad4e651a21cbb66 Author: Al Viro Date: Sun Sep 8 20:28:06 2019 -0400 shmem_parse_one(): switch to use of fs_parse() This thing will eventually become our ->parse_param(), while shmem_parse_options() - ->parse_monolithic(). At that point shmem_parse_options() will start calling vfs_parse_fs_string(), rather than calling shmem_parse_one() directly. Signed-off-by: Al Viro mm/shmem.c | 183 +++++++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 116 insertions(+), 67 deletions(-) culprit signature: 27f6c53e1408f4793615b310a8e17134a179cb7a parent signature: e64dceec5635f800ab4aad5cf9c44d827005a22a revisions tested: 17, total time: 4h3m16.823437508s (build: 1h47m15.757740401s, test: 2h14m42.058978547s) first bad commit: 626c3920aeb4575f53c96b0d4ad4e651a21cbb66 shmem_parse_one(): switch to use of fs_parse() cc: ["hughd@google.com" "linux-kernel@vger.kernel.org" "linux-mm@kvack.org" "viro@zeniv.linux.org.uk"] crash: KASAN: slab-out-of-bounds Write in mpol_parse_str ================================================================== BUG: KASAN: slab-out-of-bounds in mpol_parse_str+0x6bc/0x8f0 mm/mempolicy.c:2868 Write of size 1 at addr ffff8880a09727bf by task syz-executor.2/9408 CPU: 0 PID: 9408 Comm: syz-executor.2 Not tainted 5.3.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x318 mm/kasan/report.c:351 __kasan_report.cold.9+0x1b/0x3f mm/kasan/report.c:482 kasan_report+0x12/0x17 mm/kasan/common.c:612 __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:134 mpol_parse_str+0x6bc/0x8f0 mm/mempolicy.c:2868 shmem_parse_one mm/shmem.c:3472 [inline] shmem_parse_options+0x5a2/0xa40 mm/shmem.c:3520 shmem_fill_super+0x7f6/0xa60 mm/shmem.c:3652 mount_nodev+0x48/0xe0 fs/super.c:1454 shmem_mount+0x13/0x20 mm/shmem.c:3847 legacy_get_tree+0x101/0x1f0 fs/fs_context.c:659 vfs_get_tree+0x86/0x350 fs/super.c:1538 do_new_mount fs/namespace.c:2791 [inline] do_mount+0x10fa/0x1b60 fs/namespace.c:3111 ksys_mount+0xba/0xe0 fs/namespace.c:3320 __do_sys_mount fs/namespace.c:3334 [inline] __se_sys_mount fs/namespace.c:3331 [inline] __x64_sys_mount+0xb9/0x150 fs/namespace.c:3331 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45d99a Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 4d 8c fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 2a 8c fb ff c3 66 0f 1f 84 00 00 00 00 00 RSP: 002b:00007f3ef2a86a68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000045d99a RDX: 00007f3ef2a86ae0 RSI: 00000000200000c0 RDI: 00007f3ef2a86b00 RBP: 000000000075bf20 R08: 00007f3ef2a86b40 R09: 00007f3ef2a86ae0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3ef2a876d4 R13: 00000000004cbf00 R14: 00000000004e6ba8 R15: 00000000ffffffff Allocated by task 0: (stack is not available) Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880a0972780 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 31 bytes to the right of 32-byte region [ffff8880a0972780, ffff8880a09727a0) The buggy address belongs to the page: page:ffffea0002825c80 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a0972fc1 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002822e88 ffff8880aa401248 ffff8880aa4001c0 raw: ffff8880a0972fc1 ffff8880a0972000 000000010000003f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a0972680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a0972700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880a0972780: fc fc fc fc fc fc fc fc 00 05 fc fc fc fc fc fc ^ ffff8880a0972800: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc ffff8880a0972880: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc ==================================================================