From: syzbot <syzbot+b3b14fb9f8a14c5d0267@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, axboe@kernel.dk, bvanassche@acm.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
reiserfs-devel@vger.kernel.org, song@kernel.org,
syzkaller-bugs@googlegroups.com, yi.zhang@huawei.com
Subject: Re: [syzbot] [reiserfs?] KASAN: slab-out-of-bounds Read in search_by_key (2)
Date: Mon, 25 Dec 2023 12:28:22 -0800 [thread overview]
Message-ID: <000000000000434c71060d5b6808@google.com> (raw)
In-Reply-To: <0000000000002d868805ec92cbf0@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 861deac3b092 Linux 6.7-rc7
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=121f1609e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=e0c7078a6b901aa3
dashboard link: https://syzkaller.appspot.com/bug?extid=b3b14fb9f8a14c5d0267
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10557e81e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14206fd6e80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0ea60ee8ed32/disk-861deac3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6d69fdc33021/vmlinux-861deac3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f0158750d452/bzImage-861deac3.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/445a7c3f980d/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b3b14fb9f8a14c5d0267@syzkaller.appspotmail.com
REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
=====================================================
BUG: KMSAN: uninit-value in comp_keys fs/reiserfs/stree.c:83 [inline]
BUG: KMSAN: uninit-value in bin_search fs/reiserfs/stree.c:173 [inline]
BUG: KMSAN: uninit-value in search_by_key+0x3293/0x6780 fs/reiserfs/stree.c:770
comp_keys fs/reiserfs/stree.c:83 [inline]
bin_search fs/reiserfs/stree.c:173 [inline]
search_by_key+0x3293/0x6780 fs/reiserfs/stree.c:770
reiserfs_delete_solid_item+0x4ec/0xe90 fs/reiserfs/stree.c:1419
remove_save_link+0x2ed/0x420 fs/reiserfs/super.c:540
reiserfs_truncate_file+0xd00/0x1b70 fs/reiserfs/inode.c:2314
reiserfs_setattr+0x1b79/0x1ee0 fs/reiserfs/inode.c:3388
notify_change+0x19fd/0x1af0 fs/attr.c:499
do_truncate+0x22a/0x2a0 fs/open.c:66
do_sys_ftruncate+0x81c/0xb30 fs/open.c:194
__do_sys_ftruncate fs/open.c:205 [inline]
__se_sys_ftruncate fs/open.c:203 [inline]
__x64_sys_ftruncate+0x71/0xa0 fs/open.c:203
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Local variable cpu_key created at:
reiserfs_delete_solid_item+0xbf/0xe90 fs/reiserfs/stree.c:1410
remove_save_link+0x2ed/0x420 fs/reiserfs/super.c:540
CPU: 0 PID: 5006 Comm: syz-executor429 Not tainted 6.7.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2023-12-25 20:28 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-03 15:41 [syzbot] KASAN: slab-out-of-bounds Read in search_by_key (2) syzbot
2023-12-25 20:28 ` syzbot [this message]
2023-12-26 0:11 ` [syzbot] [reiserfs?] " Edward Adam Davis
2023-12-26 2:07 ` syzbot
2023-12-26 7:16 ` [PATCH] reiserfs: fix uninit-value in comp_keys Edward Adam Davis
2023-12-28 10:57 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000434c71060d5b6808@google.com \
--to=syzbot+b3b14fb9f8a14c5d0267@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=reiserfs-devel@vger.kernel.org \
--cc=song@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yi.zhang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.