From: syzbot <syzbot+3168625f36f4a539237e@syzkaller.appspotmail.com>
To: anna.luese@v-bien.de, kent.overstreet@linux.dev,
linux-bcachefs@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Read in bch2_copygc
Date: Tue, 08 Jul 2025 07:41:18 -0700 [thread overview]
Message-ID: <686d2e0e.050a0220.1ffab7.0010.GAE@google.com> (raw)
In-Reply-To: <686d2569.050a0220.1ffab7.000e.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 7482bb149b9f Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=12bf4a8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3c06e3e2454512b3
dashboard link: https://syzkaller.appspot.com/bug?extid=3168625f36f4a539237e
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f63f70580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16bf4a8c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f623d741d651/disk-7482bb14.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/483e23ae71b1/vmlinux-7482bb14.xz
kernel image: https://storage.googleapis.com/syzbot-assets/79b5baaa1b50/Image-7482bb14.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/f9688b789a98/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3168625f36f4a539237e@syzkaller.appspotmail.com
bcachefs (loop1): Detected missing backpointers in bucket 34, now have 1/128 with missing
Unable to handle kernel paging request at virtual address ffff60021a145c30
KASAN: probably wild-memory-access in range [0xffff0010d0a2e180-0xffff0010d0a2e187]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000207144000
[ffff60021a145c30] pgd=0000000000000000, p4d=000000023397b003, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6717 Comm: bch-copygc/loop Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline]
pc : bch2_bucket_bitmap_test fs/bcachefs/backpointers.h:194 [inline]
pc : bch2_bucket_is_movable fs/bcachefs/movinggc.c:78 [inline]
pc : bch2_copygc_get_buckets fs/bcachefs/movinggc.c:157 [inline]
pc : bch2_copygc+0xab4/0x3460 fs/bcachefs/movinggc.c:221
lr : rcu_read_unlock include/linux/rcupdate.h:873 [inline]
lr : class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
lr : bch2_dev_tryget_noerror fs/bcachefs/sb-members.h:241 [inline]
lr : bch2_dev_tryget fs/bcachefs/sb-members.h:245 [inline]
lr : bch2_bucket_is_movable fs/bcachefs/movinggc.c:74 [inline]
lr : bch2_copygc_get_buckets fs/bcachefs/movinggc.c:157 [inline]
lr : bch2_copygc+0xa7c/0x3460 fs/bcachefs/movinggc.c:221
sp : ffff80009e0c74c0
x29: ffff80009e0c7920 x28: 0000008000000022 x27: ffff80009e0c76c8
x26: dfff800000000000 x25: ffff80009e0c7cf8 x24: 0000000000000000
x23: ffff0000f5890000 x22: 0000000000000000 x21: ffff0000f2d00000
x20: ffff0010d0a2e180
x19: ffff0000df09cc28 x18: 00000000ffffffff
x17: ffff800093363000 x16: ffff80008aefcb18 x15: 0000000000000001
x14: 1fffe0001eb12008 x13: 0000000000000000 x12: 0000000000000000
x11: ffff60001eb12009 x10: 0000000000ff0100 x9 : 0000001000000000
x8 : 1fffe0021a145c30 x7 : ffff800082a0df54 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800082a0edd4
x2 : 0000000000000001 x1 : 0000000000000080 x0 : ffff0000cc76bd00
Call trace:
generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline] (P)
bch2_bucket_bitmap_test fs/bcachefs/backpointers.h:194 [inline] (P)
bch2_bucket_is_movable fs/bcachefs/movinggc.c:78 [inline] (P)
bch2_copygc_get_buckets fs/bcachefs/movinggc.c:157 [inline] (P)
bch2_copygc+0xab4/0x3460 fs/bcachefs/movinggc.c:221 (P)
bch2_copygc_thread+0x898/0xd8c fs/bcachefs/movinggc.c:409
kthread+0x5fc/0x75c kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
Code: d343fd29 927da529 8b090114 d343fe88 (387a6908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: d343fd29 lsr x9, x9, #3
4: 927da529 and x9, x9, #0x1ffffffffff8
8: 8b090114 add x20, x8, x9
c: d343fe88 lsr x8, x20, #3
* 10: 387a6908 ldrb w8, [x8, x26] <-- trapping instruction
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2025-07-08 14:41 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-08 14:04 [syzbot] [bcachefs?] KASAN: slab-use-after-free Read in bch2_copygc syzbot
2025-07-08 14:41 ` syzbot [this message]
2025-07-09 19:34 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=686d2e0e.050a0220.1ffab7.0010.GAE@google.com \
--to=syzbot+3168625f36f4a539237e@syzkaller.appspotmail.com \
--cc=anna.luese@v-bien.de \
--cc=kent.overstreet@linux.dev \
--cc=linux-bcachefs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.