From: syzbot <syzbot+82df44ede2faca24c729@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [udf?] KASAN: use-after-free Read in udf_sync_fs
Date: Sat, 12 Aug 2023 18:34:34 -0700 [thread overview]
Message-ID: <000000000000baea640602c3f2e9@google.com> (raw)
In-Reply-To: <20230813010800.1071-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in udf_sync_fs
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5372 at fs/udf/super.c:2341 udf_sync_fs+0x321/0x450
Modules linked in:
CPU: 1 PID: 5372 Comm: syz-executor.0 Not tainted 6.5.0-rc5-syzkaller-00296-gf8de32cc060b-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:udf_sync_fs+0x321/0x450 fs/udf/super.c:2340
Code: 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 0f 85 34 01 00 00 31 c0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 cf ad 88 fe <0f> 0b e9 78 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 8c fd ff
RSP: 0018:ffffc900064b7be0 EFLAGS: 00010293
RAX: ffffffff83030a61 RBX: 0000000000000200 RCX: ffff888022cabb80
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000004e25
RBP: ffffc900064b7cb0 R08: ffffffff830308d2 R09: 1ffffffff1d30e8d
R10: dffffc0000000000 R11: fffffbfff1d30e8e R12: 0000000000004e25
R13: ffff88802baba018 R14: ffffc900064b7c40 R15: ffff8880679f7000
FS: 0000555555808480(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555811938 CR3: 000000002b2fe000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
sync_filesystem+0xec/0x220 fs/sync.c:56
generic_shutdown_super+0x6f/0x340 fs/super.c:472
kill_block_super+0x68/0xa0 fs/super.c:1417
deactivate_locked_super+0xa4/0x110 fs/super.c:330
cleanup_mnt+0x426/0x4c0 fs/namespace.c:1254
task_work_run+0x24a/0x300 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xd9/0x100 kernel/entry/common.c:171
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x64/0x280 kernel/entry/common.c:297
do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f506367de17
Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffc04cedad8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f506367de17
RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffc04cedb90
RBP: 00007ffc04cedb90 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc04ceec50
R13: 00007f50636c73b9 R14: 0000000000014bdb R15: 0000000000000007
</TASK>
Tested on:
commit: f8de32cc Merge tag 'tpmdd-v6.5-rc7' of git://git.kerne..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=134267c3a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=171b698bc2e613cf
dashboard link: https://syzkaller.appspot.com/bug?extid=82df44ede2faca24c729
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13debc65a80000
next parent reply other threads:[~2023-08-13 1:34 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20230813010800.1071-1-hdanton@sina.com>
2023-08-13 1:34 ` syzbot [this message]
[not found] <20230813074848.1185-1-hdanton@sina.com>
2023-08-13 8:45 ` [syzbot] [udf?] KASAN: use-after-free Read in udf_sync_fs syzbot
[not found] <20230813020336.1128-1-hdanton@sina.com>
2023-08-13 2:41 ` syzbot
2023-08-12 10:09 syzbot
2023-08-14 20:07 ` syzbot
2024-02-01 0:18 ` syzbot
2024-02-01 9:14 ` Jan Kara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000baea640602c3f2e9@google.com \
--to=syzbot+82df44ede2faca24c729@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.