From: syzbot <syzbot+87b8e6ed25dbc41759f7@syzkaller.appspotmail.com>
To: bernd.schubert@fastmail.fm, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [fuse?] KASAN: null-ptr-deref Read in fuse_copy_do
Date: Mon, 02 Dec 2024 14:32:03 -0800 [thread overview]
Message-ID: <674e3563.050a0220.17bd51.003c.GAE@google.com> (raw)
In-Reply-To: <cb177d36-82c1-4dbc-8f77-2619c79f93b8@fastmail.fm>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in fuse_copy_do
fuse: *val=0000000000000000 buf=ffff88807d82c550, cs->write=0 op-code=15
------------[ cut here ]------------
kernel BUG at fs/fuse/dev.c:810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 6694 Comm: syz.0.15 Not tainted 6.13.0-rc1-syzkaller-g4e968a4c8fcf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:fuse_copy_do+0x334/0x3d0 fs/fuse/dev.c:810
Code: 74 05 e8 7f f8 f5 fe 8b 6b 3c e8 67 10 93 fe 8b 4c 24 0c 41 89 e8 4c 89 fe 48 8b 14 24 48 c7 c7 40 05 a9 8b e8 6d 48 72 fe 90 <0f> 0b 48 8b 7c 24 10 e8 50 f8 f5 fe e9 2e fd ff ff 48 89 df e8 43
RSP: 0018:ffffc90003407898 EFLAGS: 00010286
RAX: 0000000000000048 RBX: ffff8880249eb220 RCX: ffffffff81794fa9
RDX: 0000000000000000 RSI: ffffffff8179f976 RDI: 0000000000000005
RBP: 000000000000000f R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffffc90003407978
R13: ffffc90003407ca4 R14: ffffc90003407c60 R15: 0000000000000000
FS: 00007feebcbfe6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000a000 CR3: 0000000037394000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
fuse_copy_one fs/fuse/dev.c:1072 [inline]
fuse_copy_args+0x1e6/0x770 fs/fuse/dev.c:1090
copy_out_args fs/fuse/dev.c:1973 [inline]
fuse_dev_do_write+0x1cc1/0x3720 fs/fuse/dev.c:2059
fuse_dev_write+0x14f/0x1e0 fs/fuse/dev.c:2094
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0x5ae/0x1150 fs/read_write.c:679
ksys_write+0x12b/0x250 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feebd97f2bf
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 8e 02 00 48
RSP: 002b:00007feebcbfdfd0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000020008380 RCX: 00007feebd97f2bf
RDX: 0000000000000015 RSI: 0000000020000540 RDI: 0000000000000003
RBP: 0000000000000050 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000020000c40 R14: 00007feebdb45fa0 R15: 00007fff5d43f8a8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fuse_copy_do+0x334/0x3d0 fs/fuse/dev.c:810
Code: 74 05 e8 7f f8 f5 fe 8b 6b 3c e8 67 10 93 fe 8b 4c 24 0c 41 89 e8 4c 89 fe 48 8b 14 24 48 c7 c7 40 05 a9 8b e8 6d 48 72 fe 90 <0f> 0b 48 8b 7c 24 10 e8 50 f8 f5 fe e9 2e fd ff ff 48 89 df e8 43
RSP: 0018:ffffc90003407898 EFLAGS: 00010286
RAX: 0000000000000048 RBX: ffff8880249eb220 RCX: ffffffff81794fa9
RDX: 0000000000000000 RSI: ffffffff8179f976 RDI: 0000000000000005
RBP: 000000000000000f R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffffc90003407978
R13: ffffc90003407ca4 R14: ffffc90003407c60 R15: 0000000000000000
FS: 00007feebcbfe6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000a000 CR3: 0000000037394000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 4e968a4c debug folio conversion null ptr
git tree: https://github.com/bsbernd/linux folio-syzbot-debug
console output: https://syzkaller.appspot.com/x/log.txt?x=114a2fc0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6851fe4f61792030
dashboard link: https://syzkaller.appspot.com/bug?extid=87b8e6ed25dbc41759f7
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
next parent reply other threads:[~2024-12-02 22:32 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cb177d36-82c1-4dbc-8f77-2619c79f93b8@fastmail.fm>
2024-12-02 22:32 ` syzbot [this message]
[not found] <1120cfcf-75d7-49ec-a19b-fbcf43a4a1f5@gmail.com>
2024-11-29 21:50 ` [syzbot] [fuse?] KASAN: null-ptr-deref Read in fuse_copy_do syzbot
2024-11-27 18:04 syzbot
2024-11-29 7:00 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=674e3563.050a0220.17bd51.003c.GAE@google.com \
--to=syzbot+87b8e6ed25dbc41759f7@syzkaller.appspotmail.com \
--cc=bernd.schubert@fastmail.fm \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.