From: syzbot <syzbot+552d3bff86d241487b03@syzkaller.appspotmail.com>
To: chao@kernel.org, jaegeuk@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [f2fs-dev] [syzbot] [f2fs?] KASAN: use-after-free Read in __shrink_extent_tree
Date: Tue, 31 Jan 2023 05:48:49 -0800 [thread overview]
Message-ID: <0000000000006b3ead05f38f970e@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 7c46948a6e9c Merge tag 'fs.fuse.acl.v6.2-rc6' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c1d8ed480000
kernel config: https://syzkaller.appspot.com/x/.config?x=c8d5c2ee6c2bd4b8
dashboard link: https://syzkaller.appspot.com/bug?extid=552d3bff86d241487b03
compiler: Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cc51645b6401/disk-7c46948a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/be036b5604a3/vmlinux-7c46948a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/274f5abf2c8f/bzImage-7c46948a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+552d3bff86d241487b03@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:72 [inline]
BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in queued_write_trylock include/asm-generic/qrwlock.h:67 [inline]
BUG: KASAN: use-after-free in do_raw_write_trylock+0x6e/0x1f0 kernel/locking/spinlock_debug.c:216
Read of size 4 at addr ffff8880276cd510 by task syz-executor.1/5105
CPU: 0 PID: 5105 Comm: syz-executor.1 Not tainted 6.2.0-rc5-syzkaller-00047-g7c46948a6e9c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:306
print_report+0x107/0x1f0 mm/kasan/report.c:417
kasan_report+0xcd/0x100 mm/kasan/report.c:517
kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:72 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
queued_write_trylock include/asm-generic/qrwlock.h:67 [inline]
do_raw_write_trylock+0x6e/0x1f0 kernel/locking/spinlock_debug.c:216
__raw_write_trylock include/linux/rwlock_api_smp.h:132 [inline]
_raw_write_trylock+0x1c/0x70 kernel/locking/spinlock.c:292
__shrink_extent_tree+0x85d/0xc50 fs/f2fs/extent_cache.c:1015
f2fs_leave_shrinker+0x80/0x250 fs/f2fs/shrinker.c:142
f2fs_put_super+0x59b/0xc20 fs/f2fs/super.c:1597
generic_shutdown_super+0x130/0x310 fs/super.c:492
kill_block_super+0x79/0xd0 fs/super.c:1386
kill_f2fs_super+0x2f9/0x3c0 fs/f2fs/super.c:4640
deactivate_locked_super+0xa7/0xf0 fs/super.c:332
cleanup_mnt+0x494/0x520 fs/namespace.c:1291
task_work_run+0x243/0x300 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171
exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f779e88d537
Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5ea91f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f779e88d537
RDX: 00007fff5ea9206a RSI: 000000000000000a RDI: 00007fff5ea92060
RBP: 00007fff5ea92060 R08: 00000000ffffffff R09: 00007fff5ea91e30
R10: 0000555555e448b3 R11: 0000000000000246 R12: 00007f779e8e6b24
R13: 00007fff5ea93120 R14: 0000555555e44810 R15: 00007fff5ea93160
</TASK>
Allocated by task 9209:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
__kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:761 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]
kmem_cache_alloc+0x1b3/0x350 mm/slub.c:3476
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2796 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2806 [inline]
__grab_extent_tree+0x19b/0x420 fs/f2fs/extent_cache.c:423
f2fs_init_extent_tree+0x20c/0x450 fs/f2fs/extent_cache.c:533
f2fs_new_inode+0xd89/0x1060 fs/f2fs/namei.c:312
__f2fs_tmpfile+0xa5/0x380 fs/f2fs/namei.c:852
f2fs_ioc_start_atomic_write+0x3ec/0x970 fs/f2fs/file.c:2098
__f2fs_ioctl+0x137d/0xb540
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9242:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0x94/0x1d0 mm/slub.c:3809
__destroy_extent_tree+0x6fa/0x880 fs/f2fs/extent_cache.c:1193
f2fs_destroy_extent_tree+0x13/0x20 fs/f2fs/extent_cache.c:1204
f2fs_evict_inode+0x324/0x1310 fs/f2fs/inode.c:789
evict+0x2a4/0x620 fs/inode.c:664
f2fs_abort_atomic_write+0xc7/0x410 fs/f2fs/segment.c:196
f2fs_ioc_abort_atomic_write fs/f2fs/file.c:2182 [inline]
__f2fs_ioctl+0x3294/0xb540 fs/f2fs/file.c:4156
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff8880276cd4e0
which belongs to the cache f2fs_extent_tree of size 144
The buggy address is located 48 bytes inside of
144-byte region [ffff8880276cd4e0, ffff8880276cd570)
The buggy address belongs to the physical page:
page:ffffea00009db340 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880276cd820 pfn:0x276cd
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff8880193cab40 dead000000000122 0000000000000000
raw: ffff8880276cd820 000000008013000b 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 6721, tgid 6674 (syz-executor.5), ts 321161536352, free_ts 299722486648
prep_new_page mm/page_alloc.c:2531 [inline]
get_page_from_freelist+0x742/0x7c0 mm/page_alloc.c:4283
__alloc_pages+0x259/0x560 mm/page_alloc.c:5549
alloc_slab_page+0xbd/0x190 mm/slub.c:1851
allocate_slab+0x5e/0x3c0 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0x782/0xe20 mm/slub.c:3193
__slab_alloc mm/slub.c:3292 [inline]
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]
kmem_cache_alloc+0x268/0x350 mm/slub.c:3476
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2796 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2806 [inline]
__grab_extent_tree+0x19b/0x420 fs/f2fs/extent_cache.c:423
f2fs_init_extent_tree+0x20c/0x450 fs/f2fs/extent_cache.c:533
f2fs_new_inode+0xd89/0x1060 fs/f2fs/namei.c:312
__f2fs_tmpfile+0xa5/0x380 fs/f2fs/namei.c:852
f2fs_ioc_start_atomic_write+0x3ec/0x970 fs/f2fs/file.c:2098
__f2fs_ioctl+0x137d/0xb540
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1446 [inline]
free_pcp_prepare+0x751/0x780 mm/page_alloc.c:1496
free_unref_page_prepare mm/page_alloc.c:3369 [inline]
free_unref_page+0x19/0x4c0 mm/page_alloc.c:3464
qlist_free_all+0x2b/0x70 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x156/0x170 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:761 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x1e0/0x340 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc+0x9e/0x190 mm/slab_common.c:981
kmalloc include/linux/slab.h:584 [inline]
kzalloc include/linux/slab.h:720 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80
tomoyo_path_perm+0x344/0x670 security/tomoyo/file.c:831
tomoyo_path_symlink+0xda/0x110 security/tomoyo/tomoyo.c:211
security_path_symlink+0xd6/0x160 security/security.c:1212
do_symlinkat+0x11b/0x5f0 fs/namei.c:4425
__do_sys_symlinkat fs/namei.c:4447 [inline]
__se_sys_symlinkat fs/namei.c:4444 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4444
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff8880276cd400: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880276cd480: fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb
>ffff8880276cd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
^
ffff8880276cd580: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
ffff8880276cd600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: syzbot <syzbot+552d3bff86d241487b03@syzkaller.appspotmail.com>
To: chao@kernel.org, jaegeuk@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [f2fs?] KASAN: use-after-free Read in __shrink_extent_tree
Date: Tue, 31 Jan 2023 05:48:49 -0800 [thread overview]
Message-ID: <0000000000006b3ead05f38f970e@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 7c46948a6e9c Merge tag 'fs.fuse.acl.v6.2-rc6' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c1d8ed480000
kernel config: https://syzkaller.appspot.com/x/.config?x=c8d5c2ee6c2bd4b8
dashboard link: https://syzkaller.appspot.com/bug?extid=552d3bff86d241487b03
compiler: Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cc51645b6401/disk-7c46948a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/be036b5604a3/vmlinux-7c46948a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/274f5abf2c8f/bzImage-7c46948a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+552d3bff86d241487b03@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:72 [inline]
BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in queued_write_trylock include/asm-generic/qrwlock.h:67 [inline]
BUG: KASAN: use-after-free in do_raw_write_trylock+0x6e/0x1f0 kernel/locking/spinlock_debug.c:216
Read of size 4 at addr ffff8880276cd510 by task syz-executor.1/5105
CPU: 0 PID: 5105 Comm: syz-executor.1 Not tainted 6.2.0-rc5-syzkaller-00047-g7c46948a6e9c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:306
print_report+0x107/0x1f0 mm/kasan/report.c:417
kasan_report+0xcd/0x100 mm/kasan/report.c:517
kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:72 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
queued_write_trylock include/asm-generic/qrwlock.h:67 [inline]
do_raw_write_trylock+0x6e/0x1f0 kernel/locking/spinlock_debug.c:216
__raw_write_trylock include/linux/rwlock_api_smp.h:132 [inline]
_raw_write_trylock+0x1c/0x70 kernel/locking/spinlock.c:292
__shrink_extent_tree+0x85d/0xc50 fs/f2fs/extent_cache.c:1015
f2fs_leave_shrinker+0x80/0x250 fs/f2fs/shrinker.c:142
f2fs_put_super+0x59b/0xc20 fs/f2fs/super.c:1597
generic_shutdown_super+0x130/0x310 fs/super.c:492
kill_block_super+0x79/0xd0 fs/super.c:1386
kill_f2fs_super+0x2f9/0x3c0 fs/f2fs/super.c:4640
deactivate_locked_super+0xa7/0xf0 fs/super.c:332
cleanup_mnt+0x494/0x520 fs/namespace.c:1291
task_work_run+0x243/0x300 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171
exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f779e88d537
Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5ea91f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f779e88d537
RDX: 00007fff5ea9206a RSI: 000000000000000a RDI: 00007fff5ea92060
RBP: 00007fff5ea92060 R08: 00000000ffffffff R09: 00007fff5ea91e30
R10: 0000555555e448b3 R11: 0000000000000246 R12: 00007f779e8e6b24
R13: 00007fff5ea93120 R14: 0000555555e44810 R15: 00007fff5ea93160
</TASK>
Allocated by task 9209:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
__kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:761 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]
kmem_cache_alloc+0x1b3/0x350 mm/slub.c:3476
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2796 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2806 [inline]
__grab_extent_tree+0x19b/0x420 fs/f2fs/extent_cache.c:423
f2fs_init_extent_tree+0x20c/0x450 fs/f2fs/extent_cache.c:533
f2fs_new_inode+0xd89/0x1060 fs/f2fs/namei.c:312
__f2fs_tmpfile+0xa5/0x380 fs/f2fs/namei.c:852
f2fs_ioc_start_atomic_write+0x3ec/0x970 fs/f2fs/file.c:2098
__f2fs_ioctl+0x137d/0xb540
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9242:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0x94/0x1d0 mm/slub.c:3809
__destroy_extent_tree+0x6fa/0x880 fs/f2fs/extent_cache.c:1193
f2fs_destroy_extent_tree+0x13/0x20 fs/f2fs/extent_cache.c:1204
f2fs_evict_inode+0x324/0x1310 fs/f2fs/inode.c:789
evict+0x2a4/0x620 fs/inode.c:664
f2fs_abort_atomic_write+0xc7/0x410 fs/f2fs/segment.c:196
f2fs_ioc_abort_atomic_write fs/f2fs/file.c:2182 [inline]
__f2fs_ioctl+0x3294/0xb540 fs/f2fs/file.c:4156
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff8880276cd4e0
which belongs to the cache f2fs_extent_tree of size 144
The buggy address is located 48 bytes inside of
144-byte region [ffff8880276cd4e0, ffff8880276cd570)
The buggy address belongs to the physical page:
page:ffffea00009db340 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880276cd820 pfn:0x276cd
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff8880193cab40 dead000000000122 0000000000000000
raw: ffff8880276cd820 000000008013000b 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Reclaimable, gfp_mask 0x112c50(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 6721, tgid 6674 (syz-executor.5), ts 321161536352, free_ts 299722486648
prep_new_page mm/page_alloc.c:2531 [inline]
get_page_from_freelist+0x742/0x7c0 mm/page_alloc.c:4283
__alloc_pages+0x259/0x560 mm/page_alloc.c:5549
alloc_slab_page+0xbd/0x190 mm/slub.c:1851
allocate_slab+0x5e/0x3c0 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0x782/0xe20 mm/slub.c:3193
__slab_alloc mm/slub.c:3292 [inline]
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]
kmem_cache_alloc+0x268/0x350 mm/slub.c:3476
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2796 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2806 [inline]
__grab_extent_tree+0x19b/0x420 fs/f2fs/extent_cache.c:423
f2fs_init_extent_tree+0x20c/0x450 fs/f2fs/extent_cache.c:533
f2fs_new_inode+0xd89/0x1060 fs/f2fs/namei.c:312
__f2fs_tmpfile+0xa5/0x380 fs/f2fs/namei.c:852
f2fs_ioc_start_atomic_write+0x3ec/0x970 fs/f2fs/file.c:2098
__f2fs_ioctl+0x137d/0xb540
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1446 [inline]
free_pcp_prepare+0x751/0x780 mm/page_alloc.c:1496
free_unref_page_prepare mm/page_alloc.c:3369 [inline]
free_unref_page+0x19/0x4c0 mm/page_alloc.c:3464
qlist_free_all+0x2b/0x70 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x156/0x170 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:761 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x1e0/0x340 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc+0x9e/0x190 mm/slab_common.c:981
kmalloc include/linux/slab.h:584 [inline]
kzalloc include/linux/slab.h:720 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80
tomoyo_path_perm+0x344/0x670 security/tomoyo/file.c:831
tomoyo_path_symlink+0xda/0x110 security/tomoyo/tomoyo.c:211
security_path_symlink+0xd6/0x160 security/security.c:1212
do_symlinkat+0x11b/0x5f0 fs/namei.c:4425
__do_sys_symlinkat fs/namei.c:4447 [inline]
__se_sys_symlinkat fs/namei.c:4444 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4444
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff8880276cd400: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880276cd480: fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb
>ffff8880276cd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
^
ffff8880276cd580: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
ffff8880276cd600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
next reply other threads:[~2023-01-31 13:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-31 13:48 syzbot [this message]
2023-01-31 13:48 ` [syzbot] [f2fs?] KASAN: use-after-free Read in __shrink_extent_tree syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000006b3ead05f38f970e@google.com \
--to=syzbot+552d3bff86d241487b03@syzkaller.appspotmail.com \
--cc=chao@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.