From: syzbot <syzbot+f687659f3c2acfa34201@syzkaller.appspotmail.com>
To: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [hfs?] KASAN: wild-memory-access Read in hfsplus_bnode_dump
Date: Thu, 25 May 2023 13:03:54 -0700 [thread overview]
Message-ID: <000000000000ba2ea605fc8a1e3e@google.com> (raw)
In-Reply-To: <0000000000005cf71b05f9818cc2@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 933174ae28ba Merge tag 'spi-fix-v6.4-rc3' of git://git.ker..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1716f189280000
kernel config: https://syzkaller.appspot.com/x/.config?x=7d8067683055e3f5
dashboard link: https://syzkaller.appspot.com/bug?extid=f687659f3c2acfa34201
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13582a4d280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10e6d339280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/189d556c105e/disk-933174ae.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/498458304963/vmlinux-933174ae.xz
kernel image: https://storage.googleapis.com/syzbot-assets/68bcd9d7c04c/bzImage-933174ae.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/a584867d6b9f/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f687659f3c2acfa34201@syzkaller.appspotmail.com
memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4993 'syz-executor106'
loop0: detected capacity change from 0 to 1024
hfsplus: request for non-existent node 32768 in B*Tree
hfsplus: request for non-existent node 32768 in B*Tree
==================================================================
BUG: KASAN: wild-memory-access in memcpy_from_page include/linux/highmem.h:417 [inline]
BUG: KASAN: wild-memory-access in hfsplus_bnode_read fs/hfsplus/bnode.c:32 [inline]
BUG: KASAN: wild-memory-access in hfsplus_bnode_read_u16 fs/hfsplus/bnode.c:45 [inline]
BUG: KASAN: wild-memory-access in hfsplus_bnode_dump+0x403/0xba0 fs/hfsplus/bnode.c:305
Read of size 2 at addr 000508800000103e by task syz-executor106/4993
CPU: 0 PID: 4993 Comm: syz-executor106 Not tainted 6.4.0-rc3-syzkaller-00032-g933174ae28ba #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/16/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_report+0xe6/0x540 mm/kasan/report.c:465
kasan_report+0x176/0x1b0 mm/kasan/report.c:572
kasan_check_range+0x283/0x290 mm/kasan/generic.c:187
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
memcpy_from_page include/linux/highmem.h:417 [inline]
hfsplus_bnode_read fs/hfsplus/bnode.c:32 [inline]
hfsplus_bnode_read_u16 fs/hfsplus/bnode.c:45 [inline]
hfsplus_bnode_dump+0x403/0xba0 fs/hfsplus/bnode.c:305
hfsplus_brec_remove+0x42c/0x4f0 fs/hfsplus/brec.c:229
__hfsplus_delete_attr+0x275/0x450 fs/hfsplus/attributes.c:299
hfsplus_delete_all_attrs+0x26b/0x3c0 fs/hfsplus/attributes.c:378
hfsplus_delete_cat+0xb87/0xfc0 fs/hfsplus/catalog.c:425
hfsplus_unlink+0x363/0x7f0 fs/hfsplus/dir.c:385
vfs_unlink+0x35d/0x5f0 fs/namei.c:4327
do_unlinkat+0x4a7/0x950 fs/namei.c:4393
__do_sys_unlink fs/namei.c:4441 [inline]
__se_sys_unlink fs/namei.c:4439 [inline]
__x64_sys_unlink+0x49/0x50 fs/namei.c:4439
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5196975789
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc9b401ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5196975789
RDX: 00007f5196933e03 RSI: 0000000000000000 RDI: 0000000020000140
RBP: 00007f5196935020 R08: 0000000000000640 R09: 0000000000000000
R10: 00007ffc9b401bb0 R11: 0000000000000246 R12: 00007f51969350b0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2023-05-25 20:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-17 5:34 [syzbot] [hfs?] KASAN: wild-memory-access Read in hfsplus_bnode_dump syzbot
2023-05-25 20:03 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000ba2ea605fc8a1e3e@google.com \
--to=syzbot+f687659f3c2acfa34201@syzkaller.appspotmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.