From: syzbot <syzbot+64b645917ce07d89bde5@syzkaller.appspotmail.com>
To: adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, tytso@mit.edu
Subject: [syzbot] [ext4?] WARNING in kvfree (2)
Date: Wed, 15 Mar 2023 10:57:56 -0700 [thread overview]
Message-ID: <00000000000075fe1b05f6f415f7@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: fe15c26ee26e Linux 6.3-rc1
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1100fce2c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=7573cbcd881a88c9
dashboard link: https://syzkaller.appspot.com/bug?extid=64b645917ce07d89bde5
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/89d41abd07bd/disk-fe15c26e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fa75f5030ade/vmlinux-fe15c26e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/590d0f5903ee/Image-fe15c26e.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+64b645917ce07d89bde5@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 9389 at mm/slab_common.c:935 free_large_kmalloc+0x34/0x138 mm/slab_common.c:936
Modules linked in:
CPU: 1 PID: 9389 Comm: syz-executor.5 Not tainted 6.3.0-rc1-syzkaller-gfe15c26ee26e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : free_large_kmalloc+0x34/0x138 mm/slab_common.c:936
lr : kfree+0x184/0x228 mm/slab_common.c:1013
sp : ffff8000227974e0
x29: ffff8000227974e0 x28: 00000000000003bc x27: ffff000142fd15a4
x26: dfff800000000000 x25: 0000000000000020 x24: ffff0000c4f01c00
x23: 0000000000000020 x22: ffff00012f6d48e8 x21: ffff800008829ce8
x20: ffff000142fd15a4 x19: fffffc00050bf440 x18: ffff8000227970e0
x17: ffff800015cdd000 x16: ffff800008313a3c x15: 0000000000000000
x14: 00000000ffff8000 x13: 00000000ecdf532c x12: 0000000000000003
x11: ff8080000809b854 x10: 0000000000000000 x9 : 05ffc0000000203a
x8 : ffff8000186ee000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : fffffffffffffff0 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff000142fd15a4 x0 : fffffc00050bf440
Call trace:
free_large_kmalloc+0x34/0x138 mm/slab_common.c:936
kfree+0x184/0x228 mm/slab_common.c:1013
kvfree+0x40/0x50 mm/util.c:649
ext4_xattr_move_to_block fs/ext4/xattr.c:2680 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2743 [inline]
ext4_expand_extra_isize_ea+0xcf8/0x1620 fs/ext4/xattr.c:2835
__ext4_expand_extra_isize+0x290/0x348 fs/ext4/inode.c:5955
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5998 [inline]
__ext4_mark_inode_dirty+0x5dc/0xa94 fs/ext4/inode.c:6076
__ext4_unlink+0x768/0x998 fs/ext4/namei.c:3256
ext4_unlink+0x2ec/0xb10 fs/ext4/namei.c:3299
vfs_unlink+0x2f0/0x508 fs/namei.c:4250
do_unlinkat+0x4c8/0x82c fs/namei.c:4316
__do_sys_unlinkat fs/namei.c:4359 [inline]
__se_sys_unlinkat fs/namei.c:4352 [inline]
__arm64_sys_unlinkat+0xcc/0xfc fs/namei.c:4352
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 3482
hardirqs last enabled at (3481): [<ffff80000898bb44>] kasan_quarantine_put+0x1a0/0x1c8 mm/kasan/quarantine.c:242
hardirqs last disabled at (3482): [<ffff80001245e098>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (3300): [<ffff800008034240>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (3298): [<ffff80000803420c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
object pointer: 0x000000000b8c335f
==================================================================
BUG: KASAN: invalid-free in kfree+0x184/0x228 mm/slab_common.c:1013
Free of addr ffff000142fd15a4 by task syz-executor.5/9389
CPU: 0 PID: 9389 Comm: syz-executor.5 Tainted: G W 6.3.0-rc1-syzkaller-gfe15c26ee26e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:319 [inline]
print_report+0x174/0x514 mm/kasan/report.c:430
kasan_report_invalid_free+0xc4/0x114 mm/kasan/report.c:501
__kasan_kfree_large+0xa4/0xc0 mm/kasan/common.c:272
kasan_kfree_large include/linux/kasan.h:170 [inline]
free_large_kmalloc+0x70/0x138 mm/slab_common.c:939
kfree+0x184/0x228 mm/slab_common.c:1013
kvfree+0x40/0x50 mm/util.c:649
ext4_xattr_move_to_block fs/ext4/xattr.c:2680 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2743 [inline]
ext4_expand_extra_isize_ea+0xcf8/0x1620 fs/ext4/xattr.c:2835
__ext4_expand_extra_isize+0x290/0x348 fs/ext4/inode.c:5955
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5998 [inline]
__ext4_mark_inode_dirty+0x5dc/0xa94 fs/ext4/inode.c:6076
__ext4_unlink+0x768/0x998 fs/ext4/namei.c:3256
ext4_unlink+0x2ec/0xb10 fs/ext4/namei.c:3299
vfs_unlink+0x2f0/0x508 fs/namei.c:4250
do_unlinkat+0x4c8/0x82c fs/namei.c:4316
__do_sys_unlinkat fs/namei.c:4359 [inline]
__se_sys_unlinkat fs/namei.c:4352 [inline]
__arm64_sys_unlinkat+0xcc/0xfc fs/namei.c:4352
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
The buggy address belongs to the physical page:
page:000000004ed01e6f refcount:2 mapcount:0 mapping:0000000047d3c139 index:0x1 pfn:0x182fd1
memcg:ffff000131a56000
aops:def_blk_aops ino:700005
flags: 0x5ffc0000000203a(referenced|dirty|lru|active|private|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc0000000203a fffffc0003531048 fffffc0005118988 ffff0000c0497610
raw: 0000000000000001 ffff0000e0738cb0 00000002ffffffff ffff000131a56000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff000142fd1480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff000142fd1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff000142fd1580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff000142fd1600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff000142fd1680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
next reply other threads:[~2023-03-15 17:58 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-15 17:57 syzbot [this message]
2023-05-06 21:59 ` [syzbot] [ext4?] WARNING in kvfree (2) syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=00000000000075fe1b05f6f415f7@google.com \
--to=syzbot+64b645917ce07d89bde5@syzkaller.appspotmail.com \
--cc=adilger.kernel@dilger.ca \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.