From: syzbot <syzbot+8aa6090cbe3c97dc9565@syzkaller.appspotmail.com>
To: adilger.kernel@dilger.ca, jack@suse.cz, libaokun1@huawei.com,
linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org,
ritesh.list@gmail.com, syzkaller-bugs@googlegroups.com,
tytso@mit.edu
Subject: [syzbot] [ext4?] kernel BUG in ext4_inline_data_truncate
Date: Sun, 01 Sep 2024 00:32:29 -0700 [thread overview]
Message-ID: <000000000000a0ed7b062109d3da@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 86987d84b968 Merge tag 'v6.11-rc5-client-fixes' of git://g..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=14411109980000
kernel config: https://syzkaller.appspot.com/x/.config?x=a0455552d0b27491
dashboard link: https://syzkaller.appspot.com/bug?extid=8aa6090cbe3c97dc9565
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=147eff87980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f6122b980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/87692913ef45/disk-86987d84.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a27da6973d7f/vmlinux-86987d84.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2e28d02ce725/bzImage-86987d84.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/dd0ff7b97552/mount_0.gz
The issue was bisected to:
commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3
Author: Baokun Li <libaokun1@huawei.com>
Date: Thu Jun 16 02:13:56 2022 +0000
ext4: fix use-after-free in ext4_xattr_set_entry
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1282b835980000
final oops: https://syzkaller.appspot.com/x/report.txt?x=1182b835980000
console output: https://syzkaller.appspot.com/x/log.txt?x=1682b835980000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8aa6090cbe3c97dc9565@syzkaller.appspotmail.com
Fixes: 67d7d8ad99be ("ext4: fix use-after-free in ext4_xattr_set_entry")
loop0: detected capacity change from 1024 to 1023
------------[ cut here ]------------
kernel BUG at fs/ext4/inline.c:1953!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 5220 Comm: syz-executor398 Not tainted 6.11.0-rc5-syzkaller-00057-g86987d84b968 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:ext4_inline_data_truncate+0xced/0xcf0 fs/ext4/inline.c:1953
Code: e9 17 fd ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 44 fd ff ff e8 c3 fb a1 ff e9 3a fd ff ff e8 09 ad 58 09 e8 04 df 3d ff 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e
RSP: 0018:ffffc900035cf660 EFLAGS: 00010293
RAX: ffffffff8255ac9c RBX: ffffc900035cf700 RCX: ffff8880241b9e00
RDX: 0000000000000000 RSI: 00000000ffffffc3 RDI: 0000000000000000
RBP: ffffc900035cf7f0 R08: ffffffff8255a948 R09: 1ffff1100e59f149
R10: dffffc0000000000 R11: ffffed100e59f14a R12: ffffc900035cf760
R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005649eaf8b000 CR3: 000000000e534000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ext4_truncate+0x3c7/0x11a0 fs/ext4/inode.c:4174
ext4_evict_inode+0x90f/0xf50 fs/ext4/inode.c:258
evict+0x532/0x950 fs/inode.c:704
__dentry_kill+0x20d/0x630 fs/dcache.c:610
dput+0x19f/0x2b0 fs/dcache.c:852
__fput+0x5f8/0x8a0 fs/file_table.c:430
task_work_run+0x24f/0x310 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xa2f/0x27f0 kernel/exit.c:882
do_group_exit+0x207/0x2c0 kernel/exit.c:1031
__do_sys_exit_group kernel/exit.c:1042 [inline]
__se_sys_exit_group kernel/exit.c:1040 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040
x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f841d2244b9
Code: Unable to access opcode bytes at 0x7f841d22448f.
RSP: 002b:00007fffda637bd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f841d2244b9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f841d2a0370 R08: ffffffffffffffb8 R09: 00007fffda637df8
R10: 0000000000000007 R11: 0000000000000246 R12: 00007f841d2a0370
R13: 0000000000000000 R14: 00007f841d2a10e0 R15: 00007f841d1f2d80
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_inline_data_truncate+0xced/0xcf0 fs/ext4/inline.c:1953
Code: e9 17 fd ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 44 fd ff ff e8 c3 fb a1 ff e9 3a fd ff ff e8 09 ad 58 09 e8 04 df 3d ff 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e
RSP: 0018:ffffc900035cf660 EFLAGS: 00010293
RAX: ffffffff8255ac9c RBX: ffffc900035cf700 RCX: ffff8880241b9e00
RDX: 0000000000000000 RSI: 00000000ffffffc3 RDI: 0000000000000000
RBP: ffffc900035cf7f0 R08: ffffffff8255a948 R09: 1ffff1100e59f149
R10: dffffc0000000000 R11: ffffed100e59f14a R12: ffffc900035cf760
R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005649eaf8b000 CR3: 000000000e534000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2024-09-01 7:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-01 7:32 syzbot [this message]
2024-09-01 11:52 ` [syzbot] [ext4?] kernel BUG in ext4_inline_data_truncate Edward Adam Davis
2024-09-01 12:34 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000a0ed7b062109d3da@google.com \
--to=syzbot+8aa6090cbe3c97dc9565@syzkaller.appspotmail.com \
--cc=adilger.kernel@dilger.ca \
--cc=jack@suse.cz \
--cc=libaokun1@huawei.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ritesh.list@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.