bisecting cause commit starting from 1c273e10bc0cc7efb933e0ca10e260cdfc9f0b8c building syzkaller on 17810eaefa3a6802fa401bda89898b763680d1e4 testing commit 1c273e10bc0cc7efb933e0ca10e260cdfc9f0b8c with gcc (GCC) 10.2.1 20210217 kernel signature: 638f0cfcccc65b32539d637e92d77a970c349a037a58925a76d4ebb3b340e838 all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next testing release v5.11 testing commit f40ddce88593482919761f74910f42f4b84c004b with gcc (GCC) 10.2.1 20210217 kernel signature: 0060f998cf503ac1654a9c4262c8927768d9a752547f1a416fab09d8bbd9070a all runs: OK # git bisect start 1c273e10bc0cc7efb933e0ca10e260cdfc9f0b8c f40ddce88593482919761f74910f42f4b84c004b Bisecting: 6906 revisions left to test after this (roughly 13 steps) [a864e8f159b13babf552aff14a5fbe11abc017e4] ALSA: hda: intel-nhlt: verify config type testing commit a864e8f159b13babf552aff14a5fbe11abc017e4 with gcc (GCC) 10.2.1 20210217 kernel signature: db7c4730c8a54777b660724b0df6ecf5057fa54b8ed855537f6dcd49b0eaf219 run #0: crashed: KASAN: use-after-free Read in disk_part_iter_next run #1: crashed: KASAN: use-after-free Read in disk_part_iter_next run #2: crashed: KASAN: use-after-free Read in disk_part_iter_next run #3: crashed: KASAN: use-after-free Read in disk_part_iter_next run #4: crashed: KASAN: use-after-free Read in disk_part_iter_next run #5: crashed: KASAN: use-after-free Read in disk_part_iter_next run #6: crashed: KASAN: use-after-free Read in disk_part_iter_next run #7: crashed: KASAN: use-after-free Read in disk_part_iter_next run #8: crashed: KASAN: use-after-free Read in disk_part_iter_next run #9: boot failed: WARNING in kvm_wait # git bisect bad a864e8f159b13babf552aff14a5fbe11abc017e4 Bisecting: 2929 revisions left to test after this (roughly 12 steps) [e4286926abbbaab9b047c8bc25cae78ec990928f] Merge tag 'tty-5.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty testing commit e4286926abbbaab9b047c8bc25cae78ec990928f with gcc (GCC) 10.2.1 20210217 kernel signature: a665cf6fdec9d7b19a33666de345c4aafe3300dceaf1b2821458ba12a9be2b6c all runs: OK # git bisect good e4286926abbbaab9b047c8bc25cae78ec990928f Bisecting: 1417 revisions left to test after this (roughly 11 steps) [d089f48fba28db14d0fe7753248f2575a9ddfc73] Merge tag 'core-rcu-2021-02-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit d089f48fba28db14d0fe7753248f2575a9ddfc73 with gcc (GCC) 10.2.1 20210217 kernel signature: 4684430b97c9d93cf4e44ba1de789897bd72097e4f1cde7465a7d4dd4d49d569 all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad d089f48fba28db14d0fe7753248f2575a9ddfc73 Bisecting: 818 revisions left to test after this (roughly 10 steps) [f9d58de23152f2c16f326d7e014cfa2933b00304] Merge tag 'affs-for-5.12-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux testing commit f9d58de23152f2c16f326d7e014cfa2933b00304 with gcc (GCC) 10.2.1 20210217 kernel signature: f1cdbddf6f944a5a5fb38fb746dafc500fea2ad975c5ee03a800463379cb130b all runs: OK # git bisect good f9d58de23152f2c16f326d7e014cfa2933b00304 Bisecting: 442 revisions left to test after this (roughly 9 steps) [bd018bbaa58640da786d4289563e71c5ef3938c7] Merge tag 'for-5.12/libata-2021-02-17' of git://git.kernel.dk/linux-block testing commit bd018bbaa58640da786d4289563e71c5ef3938c7 with gcc (GCC) 10.2.1 20210217 kernel signature: 8cd28686003739bcced92301b5ddc6652ff7252596e97e7937d5e4b5aa0b2894 all runs: OK # git bisect good bd018bbaa58640da786d4289563e71c5ef3938c7 Bisecting: 268 revisions left to test after this (roughly 8 steps) [9820b4dca0f9c6b7ab8b4307286cdace171b724d] Merge tag 'for-5.12/drivers-2021-02-17' of git://git.kernel.dk/linux-block testing commit 9820b4dca0f9c6b7ab8b4307286cdace171b724d with gcc (GCC) 10.2.1 20210217 kernel signature: 098aef8f21088e0fcfdf7c260701be88d87ba86d404fd2eead4eeeac0ceda0d3 all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad 9820b4dca0f9c6b7ab8b4307286cdace171b724d Bisecting: 86 revisions left to test after this (roughly 7 steps) [203c018079e13510f913fd0fd426370f4de0fd05] Merge branch 'md-next' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into for-5.12/drivers testing commit 203c018079e13510f913fd0fd426370f4de0fd05 with gcc (GCC) 10.2.1 20210217 kernel signature: 3202a1f83ad439fc2979cdf47e464aed2a8b1bf63bdd53603a44baa2437682ed all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad 203c018079e13510f913fd0fd426370f4de0fd05 Bisecting: 43 revisions left to test after this (roughly 6 steps) [eb2fd80f9d2c515a901599362e83bc3356fc5e97] block, bfq: replace mechanism for evaluating I/O intensity testing commit eb2fd80f9d2c515a901599362e83bc3356fc5e97 with gcc (GCC) 10.2.1 20210217 kernel signature: 9488e758179493a4ea4016799ea4b90702bd4ec546d4795b4a109b9451c35088 all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad eb2fd80f9d2c515a901599362e83bc3356fc5e97 Bisecting: 21 revisions left to test after this (roughly 5 steps) [3c337690d2ebb7a01fa13bfa59ce4911f358df42] block, bfq: avoid spurious switches to soft_rt of interactive queues testing commit 3c337690d2ebb7a01fa13bfa59ce4911f358df42 with gcc (GCC) 10.2.1 20210217 kernel signature: 62a4cc0e955835de0db2ea3024efe3e10af88e54b2aff2d18960e9e73eeb1fda all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad 3c337690d2ebb7a01fa13bfa59ce4911f358df42 Bisecting: 10 revisions left to test after this (roughly 3 steps) [2f9f6221b9b9944e96c80455b469a6f0269c558b] block: simplify submit_bio_checks a bit testing commit 2f9f6221b9b9944e96c80455b469a6f0269c558b with gcc (GCC) 10.2.1 20210217 kernel signature: 77e8670f01872cc113dfd31991f1504a0ccfa75f536d6ec1ad491a24d5bca76f all runs: OK # git bisect good 2f9f6221b9b9944e96c80455b469a6f0269c558b Bisecting: 5 revisions left to test after this (roughly 3 steps) [0470dd9d5f103e7f1d5ba8f755f687c3106c7df1] block: remove DISK_PITER_REVERSE testing commit 0470dd9d5f103e7f1d5ba8f755f687c3106c7df1 with gcc (GCC) 10.2.1 20210217 kernel signature: 95e54ece7c0068b4d4bd98ba617047bdcf5622c58f24521369cbb68133e1f4f9 all runs: OK # git bisect good 0470dd9d5f103e7f1d5ba8f755f687c3106c7df1 Bisecting: 2 revisions left to test after this (roughly 2 steps) [d4fc3640ff361a09e359867e0bca898abd2b7ecb] block, bfq: set next_rq to waker_bfqq->next_rq in waker injection testing commit d4fc3640ff361a09e359867e0bca898abd2b7ecb with gcc (GCC) 10.2.1 20210217 kernel signature: ce248aff85cb6bb1b41c3845e1735c6b8fb5ec9893cff78dba5360dd566f24ba all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad d4fc3640ff361a09e359867e0bca898abd2b7ecb Bisecting: 0 revisions left to test after this (roughly 1 step) [b5f74ecacc3139ef873e69acc3aba28083ecc416] block, bfq: use half slice_idle as a threshold to check short ttime testing commit b5f74ecacc3139ef873e69acc3aba28083ecc416 with gcc (GCC) 10.2.1 20210217 kernel signature: 4a6d24ed3e6493fa70fc811845ee3d15b1eccffeeaa2e48b2e53b375fda58f82 all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad b5f74ecacc3139ef873e69acc3aba28083ecc416 Bisecting: 0 revisions left to test after this (roughly 0 steps) [a33df75c6328bf40078b35f2040d8e54d574c357] block: use an xarray for disk->part_tbl testing commit a33df75c6328bf40078b35f2040d8e54d574c357 with gcc (GCC) 10.2.1 20210217 kernel signature: 0dba9065fd28e83efae4f45d389d5055f594a14d62d96375b80e394af1c798ed all runs: crashed: KASAN: use-after-free Read in disk_part_iter_next # git bisect bad a33df75c6328bf40078b35f2040d8e54d574c357 a33df75c6328bf40078b35f2040d8e54d574c357 is the first bad commit commit a33df75c6328bf40078b35f2040d8e54d574c357 Author: Christoph Hellwig Date: Sun Jan 24 11:02:41 2021 +0100 block: use an xarray for disk->part_tbl Now that no fast path lookups in the partition table are left, there is no point in micro-optimizing the data structure for it. Just use a bog standard xarray. Signed-off-by: Christoph Hellwig Acked-by: Tejun Heo Signed-off-by: Jens Axboe block/blk-settings.c | 2 +- block/blk.h | 1 - block/genhd.c | 163 ++++-------------------------------------------- block/partitions/core.c | 31 ++------- include/linux/genhd.h | 18 +----- 5 files changed, 22 insertions(+), 193 deletions(-) culprit signature: 0dba9065fd28e83efae4f45d389d5055f594a14d62d96375b80e394af1c798ed parent signature: 95e54ece7c0068b4d4bd98ba617047bdcf5622c58f24521369cbb68133e1f4f9 revisions tested: 16, total time: 3h28m18.45262116s (build: 1h42m21.521930278s, test: 1h44m42.305954355s) first bad commit: a33df75c6328bf40078b35f2040d8e54d574c357 block: use an xarray for disk->part_tbl recipients (to): ["axboe@kernel.dk" "hch@lst.de" "tj@kernel.org"] recipients (cc): [] crash: KASAN: use-after-free Read in disk_part_iter_next ================================================================== BUG: KASAN: use-after-free in bdev_nr_sectors include/linux/genhd.h:266 [inline] BUG: KASAN: use-after-free in disk_part_iter_next+0x3a1/0x440 block/genhd.c:206 Read of size 8 at addr ffff888014ecb9a8 by task syz-executor.0/10166 CPU: 0 PID: 10166 Comm: syz-executor.0 Not tainted 5.11.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x9a/0xcc lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:230 __kasan_report mm/kasan/report.c:396 [inline] kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413 bdev_nr_sectors include/linux/genhd.h:266 [inline] disk_part_iter_next+0x3a1/0x440 block/genhd.c:206 blk_drop_partitions+0xe0/0x150 block/partitions/core.c:541 bdev_disk_changed+0x196/0x330 fs/block_dev.c:1229 __loop_clr_fd+0x6cd/0xea0 drivers/block/loop.c:1268 __blkdev_put+0x460/0x6c0 fs/block_dev.c:1571 blkdev_put+0x75/0x480 fs/block_dev.c:1624 blkdev_close+0x8b/0xd0 fs/block_dev.c:1632 __fput+0x204/0x870 fs/file_table.c:280 task_work_run+0xc0/0x160 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x249/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x41926b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffcd9046b80 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 000000000041926b RDX: 0000000000570238 RSI: 0000000000000081 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000570238 R13: 00007ffcd9046ca0 R14: 000000000056bf60 R15: 000000000000d576 Allocated by task 10138: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:401 [inline] ____kasan_kmalloc.constprop.0+0x82/0xa0 mm/kasan/common.c:429 kasan_slab_alloc include/linux/kasan.h:209 [inline] slab_post_alloc_hook mm/slab.h:512 [inline] slab_alloc_node mm/slub.c:2892 [inline] slab_alloc mm/slub.c:2900 [inline] kmem_cache_alloc+0x1c6/0x440 mm/slub.c:2905 bdev_alloc_inode+0x13/0x70 fs/block_dev.c:778 alloc_inode+0x56/0x1e0 fs/inode.c:233 new_inode_pseudo fs/inode.c:927 [inline] new_inode+0x1a/0x2d0 fs/inode.c:956 bdev_alloc+0x1b/0x2f0 fs/block_dev.c:868 add_partition+0x175/0x780 block/partitions/core.c:346 bdev_add_partition+0x93/0xe0 block/partitions/core.c:449 blkpg_do_ioctl+0x210/0x2c0 block/ioctl.c:43 blkpg_ioctl block/ioctl.c:60 [inline] blkdev_ioctl+0x49e/0x5f0 block/ioctl.c:541 block_ioctl+0xd4/0x130 fs/block_dev.c:1650 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 12: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:356 ____kasan_slab_free+0xe1/0x110 mm/kasan/common.c:362 kasan_slab_free include/linux/kasan.h:192 [inline] slab_free_hook mm/slub.c:1547 [inline] slab_free_freelist_hook+0x5d/0x150 mm/slub.c:1580 slab_free mm/slub.c:3143 [inline] kmem_cache_free+0x82/0x350 mm/slub.c:3159 rcu_do_batch kernel/rcu/tree.c:2489 [inline] rcu_core+0x5eb/0xf00 kernel/rcu/tree.c:2723 __do_softirq+0x29b/0x9f6 kernel/softirq.c:343 Last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_record_aux_stack+0xc5/0xf0 mm/kasan/generic.c:344 __call_rcu kernel/rcu/tree.c:2965 [inline] call_rcu+0xbb/0x700 kernel/rcu/tree.c:3038 disk_part_iter_exit block/genhd.c:235 [inline] disk_part_iter_next+0x83/0x440 block/genhd.c:202 blk_drop_partitions+0xe0/0x150 block/partitions/core.c:541 bdev_disk_changed+0x196/0x330 fs/block_dev.c:1229 loop_reread_partitions+0x22/0x40 drivers/block/loop.c:655 loop_set_status+0x5e8/0xee0 drivers/block/loop.c:1416 loop_set_status64 drivers/block/loop.c:1536 [inline] lo_ioctl+0x24a/0x1690 drivers/block/loop.c:1704 blkdev_ioctl+0x24c/0x5f0 block/ioctl.c:576 block_ioctl+0xd4/0x130 fs/block_dev.c:1650 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff888014ecb980 which belongs to the cache bdev_cache of size 2792 The buggy address is located 40 bytes inside of 2792-byte region [ffff888014ecb980, ffff888014ecc468) The buggy address belongs to the page: page:0000000031e76ac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14ec8 head:0000000031e76ac0 order:3 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head) raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888140005b40 raw: 0000000000000000 00000000800b000b 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888014ecb880: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc ffff888014ecb900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888014ecb980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888014ecba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888014ecba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================