From: syzbot <syzbot+ba5f49027aace342d24d@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, richard120310@gmail.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP
Date: Tue, 06 May 2025 08:38:03 -0700 [thread overview]
Message-ID: <681a2cdb.050a0220.a19a9.0010.GAE@google.com> (raw)
In-Reply-To: <20250506142010.802613-1-richard120310@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: use-after-free in dtSearch
loop0: detected capacity change from 0 to 32768
=====================================================
BUG: KMSAN: use-after-free in UniStrncmp_le fs/jfs/jfs_unicode.h:55 [inline]
BUG: KMSAN: use-after-free in dtCompare fs/jfs/jfs_dtree.c:3340 [inline]
BUG: KMSAN: use-after-free in dtSearch+0x1261/0x3d30 fs/jfs/jfs_dtree.c:650
UniStrncmp_le fs/jfs/jfs_unicode.h:55 [inline]
dtCompare fs/jfs/jfs_dtree.c:3340 [inline]
dtSearch+0x1261/0x3d30 fs/jfs/jfs_dtree.c:650
jfs_lookup+0x18b/0x5a0 fs/jfs/namei.c:1461
lookup_one_qstr_excl_raw+0x204/0x5b0 fs/namei.c:1689
lookup_one_qstr_excl fs/namei.c:1711 [inline]
do_unlinkat+0x2e3/0xe50 fs/namei.c:4631
__do_sys_unlink fs/namei.c:4689 [inline]
__se_sys_unlink fs/namei.c:4687 [inline]
__x64_sys_unlink+0x71/0xb0 fs/namei.c:4687
x64_sys_call+0x29de/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_free_hook mm/slub.c:2324 [inline]
slab_free mm/slub.c:4656 [inline]
kmem_cache_free+0x286/0xf00 mm/slub.c:4758
__d_free+0x43/0x60 fs/dcache.c:336
rcu_do_batch kernel/rcu/tree.c:2568 [inline]
rcu_core+0xa5a/0x21e0 kernel/rcu/tree.c:2824
rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2841
handle_softirqs+0x166/0x6e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x66/0x180 kernel/softirq.c:680
irq_exit_rcu+0x12/0x20 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
CPU: 0 UID: 0 PID: 6979 Comm: syz.0.35 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
=====================================================
Tested on:
commit: 02ddfb98 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=134ee8f4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9dc42c34a3f5c357
dashboard link: https://syzkaller.appspot.com/bug?extid=ba5f49027aace342d24d
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=10efba70580000
next parent reply other threads:[~2025-05-06 15:38 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20250506142010.802613-1-richard120310@gmail.com>
2025-05-06 15:38 ` syzbot [this message]
[not found] <177644280177.3785830.6199963330622576626@talencesecurity.com>
2026-04-17 19:03 ` [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
[not found] <20260417101200.2489522-1-tristmd@gmail.com>
2026-04-17 11:43 ` syzbot
[not found] <CABPJ0vhxvUrsFsL7-q5UJeUOsy=gz4nUVJxCOLjBaPP5cB2hYA@mail.gmail.com>
2025-09-23 20:59 ` syzbot
[not found] <20250506130020.798216-1-richard120310@gmail.com>
2025-05-06 13:31 ` syzbot
2025-05-06 3:08 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=681a2cdb.050a0220.a19a9.0010.GAE@google.com \
--to=syzbot+ba5f49027aace342d24d@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=richard120310@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.