From: syzbot <syzbot+6cc93ec9a4035badb85f@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, baolin.wang@linux.alibaba.com,
hughd@google.com, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, syzkaller-bugs@googlegroups.com,
tahernady45@gmail.com
Subject: Re: [syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2)
Date: Thu, 16 Apr 2026 03:23:31 -0700 [thread overview]
Message-ID: <69e0b8a3.a00a0220.8f24c.017a.GAE@google.com> (raw)
In-Reply-To: <69ca48ca.050a0220.183828.001a.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: e6efabc0afca Add linux-next specific files for 20260414
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17908702580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56c2b36de3316f1b
dashboard link: https://syzkaller.appspot.com/bug?extid=6cc93ec9a4035badb85f
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14c798ce580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1142c4ce580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e7099cbf73e4/disk-e6efabc0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/439c402df1b9/vmlinux-e6efabc0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/fc0c0175fc76/bzImage-e6efabc0.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/94fa7bad6be9/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=17017b16580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6cc93ec9a4035badb85f@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in memcpy_from_iter lib/iov_iter.c:85 [inline]
BUG: KASAN: use-after-free in iterate_bvec include/linux/iov_iter.h:123 [inline]
BUG: KASAN: use-after-free in iterate_and_advance2 include/linux/iov_iter.h:306 [inline]
BUG: KASAN: use-after-free in iterate_and_advance include/linux/iov_iter.h:330 [inline]
BUG: KASAN: use-after-free in __copy_from_iter lib/iov_iter.c:261 [inline]
BUG: KASAN: use-after-free in copy_folio_from_iter_atomic+0xbb5/0x1ad0 lib/iov_iter.c:491
Read of size 4096 at addr ffff888037cb3000 by task kworker/u8:7/1020
CPU: 0 UID: 0 PID: 1020 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: loop0 loop_workfn
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
memcpy_from_iter lib/iov_iter.c:85 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:306 [inline]
iterate_and_advance include/linux/iov_iter.h:330 [inline]
__copy_from_iter lib/iov_iter.c:261 [inline]
copy_folio_from_iter_atomic+0xbb5/0x1ad0 lib/iov_iter.c:491
generic_perform_write+0x5b1/0x8b0 mm/filemap.c:4342
shmem_file_write_iter+0xfb/0x120 mm/shmem.c:3478
lo_rw_aio+0xc80/0xf00 include/linux/percpu-rwsem.h:-1
do_req_filebacked drivers/block/loop.c:433 [inline]
loop_handle_cmd drivers/block/loop.c:1925 [inline]
loop_process_work+0x637/0x11b0 drivers/block/loop.c:1960
process_one_work kernel/workqueue.c:3308 [inline]
process_scheduled_works+0xb68/0x1910 kernel/workqueue.c:3399
worker_thread+0xa90/0x1040 kernel/workqueue.c:3485
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x38 pfn:0x37cb3
flags: 0x80000000000000(node=0|zone=1)
raw: 0080000000000000 ffffea0000d17548 ffffea0001353448 0000000000000000
raw: 0000000000000038 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xdc0(GFP_KERNEL|__GFP_ZERO), pid 6098, tgid 6098 (syz.0.91), ts 154383709391, free_ts 154428922615
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
prep_new_page mm/page_alloc.c:1866 [inline]
get_page_from_freelist+0x27d6/0x2850 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2490
alloc_frozen_pages_noprof mm/mempolicy.c:2561 [inline]
alloc_pages_noprof+0xd2/0x2f0 mm/mempolicy.c:2581
lbmLogInit fs/jfs/jfs_logmgr.c:1813 [inline]
lmLogInit+0x357/0x1a00 fs/jfs/jfs_logmgr.c:1267
open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3834
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4399 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4376
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5945 tgid 5945 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1402 [inline]
__free_frozen_pages+0xf9b/0x10f0 mm/page_alloc.c:2943
lbmLogShutdown fs/jfs/jfs_logmgr.c:1861 [inline]
lmLogShutdown+0x44e/0x850 fs/jfs/jfs_logmgr.c:1681
lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:328 [inline]
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888037cb2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888037cb2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888037cb3000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888037cb3080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888037cb3100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2026-04-16 10:23 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-30 9:56 [syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2) syzbot
2026-04-16 10:23 ` syzbot [this message]
2026-04-17 20:43 ` Forwarded: " syzbot
2026-04-20 4:08 ` syzbot
2026-04-20 4:11 ` syzbot
2026-04-23 13:26 ` Forwarded: [PATCH 1/1] jfs: try syzbot fix syzbot
2026-04-24 21:16 ` Forwarded: Re: [syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2) syzbot
2026-04-25 11:24 ` Forwarded: [PATCH] jfs: fix use-after-free on log shutdown syzbot
[not found] <CAAMO5pgGENy_VO0b3uSEPpns6L_AZesZHW3fWv9=muqUFtKvyQ@mail.gmail.com>
2026-04-17 21:19 ` [syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2) syzbot
[not found] <CAAMO5pjxksZntoLX-6fCrsGFVE6Z+-goCM6xJ0pby-S5XKph+g@mail.gmail.com>
2026-04-20 4:18 ` syzbot
[not found] <CAAMO5ph3W9SPGJEqB4A7ObR0G=2LdGNXLev1Y6rMRQDmN2e51Q@mail.gmail.com>
2026-04-20 4:18 ` syzbot
[not found] <20260423132557.28264-2-jakovnovak30@gmail.com>
2026-04-23 13:57 ` syzbot
[not found] <20260424211614.47023-1-mashiro.chen@mailbox.org>
2026-04-24 21:23 ` syzbot
[not found] <20260425112428.81709-1-mashiro.chen@mailbox.org>
2026-04-25 12:02 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69e0b8a3.a00a0220.8f24c.017a.GAE@google.com \
--to=syzbot+6cc93ec9a4035badb85f@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=hughd@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tahernady45@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.