* [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync
@ 2024-04-07 14:10 syzbot
2024-04-12 4:44 ` syzbot
` (2 more replies)
0 siblings, 3 replies; 96+ messages in thread
From: syzbot @ 2024-04-07 14:10 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 8568bb2ccc27 Add linux-next specific files for 20240405
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1344efc5180000
kernel config: https://syzkaller.appspot.com/x/.config?x=48ca5acf8d2eb3bc
dashboard link: https://syzkaller.appspot.com/bug?extid=27209997e4015fb4702e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1d120b5e779c/disk-8568bb2c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a89e3589a585/vmlinux-8568bb2c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/045e657c0e0d/bzImage-8568bb2c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+27209997e4015fb4702e@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-use-after-free in refcount_read include/linux/refcount.h:136 [inline]
BUG: KASAN: slab-use-after-free in skb_unref include/linux/skbuff.h:1227 [inline]
BUG: KASAN: slab-use-after-free in __kfree_skb_reason net/core/skbuff.c:1197 [inline]
BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0 net/core/skbuff.c:1224
Read of size 4 at addr ffff8880645c9864 by task syz-executor.1/5107
CPU: 1 PID: 5107 Comm: syz-executor.1 Not tainted 6.9.0-rc2-next-20240405-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
refcount_read include/linux/refcount.h:136 [inline]
skb_unref include/linux/skbuff.h:1227 [inline]
__kfree_skb_reason net/core/skbuff.c:1197 [inline]
kfree_skb_reason+0x41/0x3b0 net/core/skbuff.c:1224
kfree_skb include/linux/skbuff.h:1262 [inline]
__hci_req_sync+0x62f/0x950 net/bluetooth/hci_request.c:184
hci_req_sync+0xa9/0xd0 net/bluetooth/hci_request.c:206
hci_dev_cmd+0x518/0xa90 net/bluetooth/hci_core.c:797
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x72/0x7a
RIP: 0033:0x7fd8f7e7dbcb
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffc3d1858e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd8f7e7dbcb
RDX: 00007ffc3d185958 RSI: 00000000400448dd RDI: 0000000000000003
RBP: 00005555747dc430 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000003 R14: 00007fd8f7fac9d8 R15: 000000000000000c
</TASK>
Allocated by task 5105:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3897 [inline]
slab_alloc_node mm/slub.c:3957 [inline]
kmem_cache_alloc_noprof+0x135/0x290 mm/slub.c:3964
skb_clone+0x20c/0x390 net/core/skbuff.c:2036
hci_send_cmd_sync net/bluetooth/hci_core.c:4234 [inline]
hci_cmd_work+0x29e/0x670 net/bluetooth/hci_core.c:4254
process_one_work kernel/workqueue.c:3218 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Freed by task 5109:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2190 [inline]
slab_free mm/slub.c:4393 [inline]
kmem_cache_free+0x145/0x340 mm/slub.c:4468
kfree_skb include/linux/skbuff.h:1262 [inline]
hci_req_sync_complete+0xe7/0x290 net/bluetooth/hci_request.c:109
hci_event_packet+0xc71/0x1540 net/bluetooth/hci_event.c:7620
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4185
process_one_work kernel/workqueue.c:3218 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
The buggy address belongs to the object at ffff8880645c9780
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 228 bytes inside of
freed 240-byte region [ffff8880645c9780, ffff8880645c9870)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x645c9
flags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffefff(slab)
raw: 00fff80000000000 ffff888018ec2780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffefff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 5106, tgid 1501860599 (kworker/u9:4), ts 5106, free_ts 23287202140
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1490
prep_new_page mm/page_alloc.c:1498 [inline]
get_page_from_freelist+0x2e7e/0x2f40 mm/page_alloc.c:3454
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4712
__alloc_pages_node_noprof include/linux/gfp.h:244 [inline]
alloc_pages_node_noprof include/linux/gfp.h:271 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2259
allocate_slab+0x5a/0x2e0 mm/slub.c:2422
new_slab mm/slub.c:2475 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3624
__slab_alloc+0x58/0xa0 mm/slub.c:3714
__slab_alloc_node mm/slub.c:3767 [inline]
slab_alloc_node mm/slub.c:3945 [inline]
kmem_cache_alloc_node_noprof+0x1fe/0x310 mm/slub.c:4000
__alloc_skb+0x1c3/0x440 net/core/skbuff.c:658
alloc_skb include/linux/skbuff.h:1313 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:490 [inline]
hci_si_event net/bluetooth/hci_sock.c:784 [inline]
hci_sock_dev_event+0x100/0x5f0 net/bluetooth/hci_sock.c:826
hci_dev_open_sync+0xfbe/0x33d0 net/bluetooth/hci_sync.c:5000
hci_dev_do_open net/bluetooth/hci_core.c:490 [inline]
hci_power_on+0x1c8/0x700 net/bluetooth/hci_core.c:1022
process_one_work kernel/workqueue.c:3218 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1110 [inline]
free_unref_page+0xd3c/0xec0 mm/page_alloc.c:2617
free_contig_range+0x9e/0x160 mm/page_alloc.c:6667
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1037
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1417
do_one_initcall+0x248/0x880 init/main.c:1258
do_initcall_level+0x157/0x210 init/main.c:1320
do_initcalls+0x3f/0x80 init/main.c:1336
kernel_init_freeable+0x435/0x5d0 init/main.c:1569
kernel_init+0x1d/0x2b0 init/main.c:1458
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Memory state around the buggy address:
ffff8880645c9700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
ffff8880645c9780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880645c9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
^
ffff8880645c9880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff8880645c9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 96+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync
2024-04-07 14:10 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync syzbot
@ 2024-04-12 4:44 ` syzbot
2024-04-12 10:44 ` Hillf Danton
2024-04-13 7:58 ` syzbot
2026-05-20 18:09 ` Forwarded: syzbot
2 siblings, 1 reply; 96+ messages in thread
From: syzbot @ 2024-04-12 4:44 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 00dcf5d862e8 Merge tag 'acpi-6.9-rc4' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15f84c93180000
kernel config: https://syzkaller.appspot.com/x/.config?x=285be8dd6baeb438
dashboard link: https://syzkaller.appspot.com/bug?extid=27209997e4015fb4702e
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=179a3b4d180000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-00dcf5d8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7a72277e36da/vmlinux-00dcf5d8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5c529702b5e0/bzImage-00dcf5d8.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+27209997e4015fb4702e@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-use-after-free in refcount_read include/linux/refcount.h:136 [inline]
BUG: KASAN: slab-use-after-free in skb_unref include/linux/skbuff.h:1227 [inline]
BUG: KASAN: slab-use-after-free in __kfree_skb_reason net/core/skbuff.c:1224 [inline]
BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x36/0x210 net/core/skbuff.c:1251
Read of size 4 at addr ffff88801d9c3b24 by task syz-executor.2/5302
CPU: 3 PID: 5302 Comm: syz-executor.2 Not tainted 6.9.0-rc3-syzkaller-00189-g00dcf5d862e8 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
refcount_read include/linux/refcount.h:136 [inline]
skb_unref include/linux/skbuff.h:1227 [inline]
__kfree_skb_reason net/core/skbuff.c:1224 [inline]
kfree_skb_reason+0x36/0x210 net/core/skbuff.c:1251
kfree_skb include/linux/skbuff.h:1262 [inline]
__hci_req_sync+0x61d/0x980 net/bluetooth/hci_request.c:184
hci_req_sync+0x97/0xd0 net/bluetooth/hci_request.c:206
hci_dev_cmd+0x653/0x9c0 net/bluetooth/hci_core.c:790
hci_sock_ioctl+0x4f3/0x8e0 net/bluetooth/hci_sock.c:1153
sock_do_ioctl+0x116/0x280 net/socket.c:1222
sock_ioctl+0x22e/0x6c0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:904 [inline]
__se_sys_ioctl fs/ioctl.c:890 [inline]
__x64_sys_ioctl+0x193/0x220 fs/ioctl.c:890
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f98e227dbcb
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007fff8983d770 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f98e227dbcb
RDX: 00007fff8983d7e8 RSI: 00000000400448dd RDI: 0000000000000003
RBP: 0000555556cf6430 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000003 R14: 0000000000000001 R15: 00000000fffffff1
</TASK>
Allocated by task 5308:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc+0x136/0x320 mm/slub.c:3852
skb_clone+0x190/0x3f0 net/core/skbuff.c:2063
hci_send_cmd_sync net/bluetooth/hci_core.c:4220 [inline]
hci_cmd_work+0x66a/0x710 net/bluetooth/hci_core.c:4240
process_one_work+0x9a9/0x1ac0 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 5308:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:240 [inline]
__kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kmem_cache_free+0x12e/0x380 mm/slub.c:4344
kfree_skbmem+0x10e/0x200 net/core/skbuff.c:1159
__kfree_skb net/core/skbuff.c:1217 [inline]
kfree_skb_reason+0x13a/0x210 net/core/skbuff.c:1252
kfree_skb include/linux/skbuff.h:1262 [inline]
hci_req_sync_complete+0x16c/0x270 net/bluetooth/hci_request.c:109
hci_event_packet+0x963/0x1170 net/bluetooth/hci_event.c:7604
hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4171
process_one_work+0x9a9/0x1ac0 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff88801d9c3a40
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 228 bytes inside of
freed 240-byte region [ffff88801d9c3a40, ffff88801d9c3b30)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d9c2
head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff80000000840 ffff888015b8e000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
head: 00fff80000000840 ffff888015b8e000 dead000000000122 0000000000000000
head: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
head: 00fff80000000001 ffffea0000767081 dead000000000122 00000000ffffffff
head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5314, tgid 5314 (kworker/u33:8), ts 1081717469726, free_ts 1081659697828
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3317
__alloc_pages+0x22b/0x2460 mm/page_alloc.c:4575
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0xcc/0x3a0 mm/slub.c:2391
___slab_alloc+0x66d/0x1790 mm/slub.c:3525
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc+0x2e9/0x320 mm/slub.c:3852
skb_clone+0x190/0x3f0 net/core/skbuff.c:2063
hci_send_cmd_sync net/bluetooth/hci_core.c:4220 [inline]
hci_cmd_work+0x66a/0x710 net/bluetooth/hci_core.c:4240
process_one_work+0x9a9/0x1ac0 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
page last free pid 5294 tgid 5294 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347
free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmalloc_trace+0x147/0x330 mm/slub.c:3992
kmalloc include/linux/slab.h:628 [inline]
kzalloc include/linux/slab.h:749 [inline]
tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
tomoyo_init_log+0xcb6/0x2180 security/tomoyo/audit.c:264
tomoyo_supervisor+0x30c/0xea0 security/tomoyo/common.c:2089
tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
tomoyo_env_perm+0x193/0x210 security/tomoyo/environ.c:63
tomoyo_environ security/tomoyo/domain.c:672 [inline]
tomoyo_find_next_domain+0xef9/0x2020 security/tomoyo/domain.c:878
tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
tomoyo_bprm_check_security+0x12e/0x1d0 security/tomoyo/tomoyo.c:92
security_bprm_check+0x65/0xb0 security/security.c:1191
search_binary_handler fs/exec.c:1766 [inline]
exec_binprm fs/exec.c:1820 [inline]
bprm_execve fs/exec.c:1872 [inline]
bprm_execve+0x642/0x19b0 fs/exec.c:1848
do_execveat_common.isra.0+0x5cb/0x750 fs/exec.c:1979
do_execve fs/exec.c:2053 [inline]
__do_sys_execve fs/exec.c:2129 [inline]
__se_sys_execve fs/exec.c:2124 [inline]
__x64_sys_execve+0x8c/0xb0 fs/exec.c:2124
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
Memory state around the buggy address:
ffff88801d9c3a00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff88801d9c3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801d9c3b00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
^
ffff88801d9c3b80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801d9c3c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 96+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync
2024-04-12 4:44 ` syzbot
@ 2024-04-12 10:44 ` Hillf Danton
2024-04-12 11:05 ` syzbot
0 siblings, 1 reply; 96+ messages in thread
From: Hillf Danton @ 2024-04-12 10:44 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Thu, 11 Apr 2024 21:44:17 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 00dcf5d862e8 Merge tag 'acpi-6.9-rc4' of git://git.kernel...
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=179a3b4d180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 00dcf5d862e8
--- x/net/bluetooth/hci_request.c
+++ y/net/bluetooth/hci_request.c
@@ -102,6 +102,7 @@ void hci_req_sync_complete(struct hci_de
{
bt_dev_dbg(hdev, "result 0x%2.2x", result);
+ hci_req_sync_lock(hdev);
if (hdev->req_status == HCI_REQ_PEND) {
hdev->req_result = result;
hdev->req_status = HCI_REQ_DONE;
@@ -111,6 +112,7 @@ void hci_req_sync_complete(struct hci_de
}
wake_up_interruptible(&hdev->req_wait_q);
}
+ hci_req_sync_unlock(hdev);
}
/* Execute request and wait for completion. */
--
^ permalink raw reply [flat|nested] 96+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync
2024-04-12 10:44 ` Hillf Danton
@ 2024-04-12 11:05 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2024-04-12 11:05 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
8ed6ff4a8ed6ff 4a8ed6ff4a8ed6ff 4a8ed6ff4a8ed6ff
ZMM27=6e943afe6e943afe 6e943afe6e943afe 6e943afe6e943afe 6e943afe6e943afe 6e943afe6e943afe 6e943afe6e943afe 6e943afe6e943afe 6e943afe6e943afe
ZMM28=000000100000000f 0000000e0000000d 0000000c0000000b 0000000a00000009 0000000800000007 0000000600000005 0000000400000003 0000000200000001
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0600000006000000 0600000006000000 0600000006000000 0600000006000000 0600000006000000 0600000006000000 0600000006000000 0600000006000000
info registers vcpu 2
CPU#2
RAX=000000000002eedf RBX=0000000000000002 RCX=ffffffff8ada9639 RDX=0000000000000000
RSI=ffffffff8b0cae80 RDI=ffffffff8b6f4de0 RBP=ffffed1002f54910 RSP=ffffc90000187e08
R8 =0000000000000001 R9 =ffffed100d686fdd R10=ffff88806b437eeb R11=ffffffff8b0f3940
R12=0000000000000002 R13=ffff888017aa4880 R14=ffffffff8f9f0150 R15=0000000000000000
RIP=ffffffff8adaaa2f RFL=00000242 [---Z---] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88806b400000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe000008f000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000559737519600 CR3=000000000d57a000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fffffe00 Opmask01=0000000000000000 Opmask02=0000000001e1f9ff Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3010618acb7d7b1a 2112f12ae4453470
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 e5ee0ce20966b47b 6ffa03f7f09fa836
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5fa6630d8b71e143 3ab69ece09a12fae
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ccf069236b58b8e2 4838cb2249d1eec5
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000100
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 275e2648807110fc 8f63b2ee9bb034ae
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 22761a7e72b46797 73e1392d07f9fc4c
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2d7d825141dc2181 20d0c4c9a276a097
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3ae380b7f917da84 8f00916d9c8e26e9
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 70c38b0d62dad3cd 451d8604954593f3
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 c3f3dfc3f6e74c96 4067d9ad16df8442
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000055 9777330000000055 97374fa630000072 656c6c616b7a7973
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6864203a73250070 6475646e65735f70 636864203a732500 73646e6f63657320
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4d41051f56000055 4150414b40565f55 464d41051f560000 56414b4a46405605
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6966652036202065 616365200a326420 3220363220362064 6562656400316f00
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 656265200a202062 61630a200a326420 2020323220360a64 2062656200200a00
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbf2b313423342c
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 262821df2e2e33df 3228df3232202b22 df312e232d2435bf 2324353124322431
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020
info registers vcpu 3
CPU#3
RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff84f98cf5 RDI=ffffffff949438e0 RBP=ffffffff949438a0 RSP=ffffc9000339f180
R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=63722d302e392e36
R12=0000000000000000 R13=0000000000000020 R14=ffffffff84f98c90 R15=0000000000000000
RIP=ffffffff84f98d1f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88806b500000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe00000d6000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fc8cccd9514 CR3=000000000d57a000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000004880004 Opmask01=0000000000000001 Opmask02=00000000ffffbfef Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc8ccd7f063 00007fc8ccd7f063
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffff9bd95f0 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000800000
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000001000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000800000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc8ccc7acea
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3d656c6966000a64 25203a7325206574 697277206f742064 656c696166000a29
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1840494c43000a41 00051f5600054051 4c5752054a510541 40494c4443000a0c
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build616238421=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 27de0a5cc
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=27de0a5cccaebe20ffd8fce48c2c5ec9d4b358fa -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240411-171414'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=27de0a5cccaebe20ffd8fce48c2c5ec9d4b358fa -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240411-171414'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=27de0a5cccaebe20ffd8fce48c2c5ec9d4b358fa -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240411-171414'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"27de0a5cccaebe20ffd8fce48c2c5ec9d4b358fa\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=128ef293180000
Tested on:
commit: 00dcf5d8 Merge tag 'acpi-6.9-rc4' of git://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=285be8dd6baeb438
dashboard link: https://syzkaller.appspot.com/bug?extid=27209997e4015fb4702e
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=15d98eeb180000
^ permalink raw reply [flat|nested] 96+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync
2024-04-07 14:10 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync syzbot
2024-04-12 4:44 ` syzbot
@ 2024-04-13 7:58 ` syzbot
2024-04-13 8:55 ` Hillf Danton
2026-05-20 18:09 ` Forwarded: syzbot
2 siblings, 1 reply; 96+ messages in thread
From: syzbot @ 2024-04-13 7:58 UTC (permalink / raw)
To: hdanton, johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz,
marcel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 8f2c057754b2 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16952da3180000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5a8421528fe0176
dashboard link: https://syzkaller.appspot.com/bug?extid=27209997e4015fb4702e
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14905af5180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171da243180000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-8f2c0577.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4ed4e9e9deb1/vmlinux-8f2c0577.xz
kernel image: https://storage.googleapis.com/syzbot-assets/136318846a1c/bzImage-8f2c0577.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+27209997e4015fb4702e@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-use-after-free in refcount_read include/linux/refcount.h:136 [inline]
BUG: KASAN: slab-use-after-free in skb_unref include/linux/skbuff.h:1227 [inline]
BUG: KASAN: slab-use-after-free in __kfree_skb_reason net/core/skbuff.c:1224 [inline]
BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x36/0x210 net/core/skbuff.c:1251
Read of size 4 at addr ffff888029a1fee4 by task syz-executor145/5234
CPU: 0 PID: 5234 Comm: syz-executor145 Not tainted 6.9.0-rc3-syzkaller-00344-g8f2c057754b2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
refcount_read include/linux/refcount.h:136 [inline]
skb_unref include/linux/skbuff.h:1227 [inline]
__kfree_skb_reason net/core/skbuff.c:1224 [inline]
kfree_skb_reason+0x36/0x210 net/core/skbuff.c:1251
kfree_skb include/linux/skbuff.h:1262 [inline]
__hci_req_sync+0x61d/0x980 net/bluetooth/hci_request.c:184
hci_req_sync+0x97/0xd0 net/bluetooth/hci_request.c:206
hci_dev_cmd+0x653/0x9c0 net/bluetooth/hci_core.c:790
hci_sock_ioctl+0x4f3/0x8e0 net/bluetooth/hci_sock.c:1153
hci_sock_compat_ioctl net/bluetooth/hci_sock.c:1180 [inline]
hci_sock_compat_ioctl+0x68/0x80 net/bluetooth/hci_sock.c:1169
compat_sock_ioctl+0x181/0x7f0 net/socket.c:3521
__do_compat_sys_ioctl+0x2c3/0x330 fs/ioctl.c:1004
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x75/0x120 arch/x86/entry/common.c:321
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:346
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7e3c579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ffa29e34 EFLAGS: 00000292 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000400448dd
RDX: 00000000ffa29f04 RSI: 00000000f7f0bff4 RDI: 00000000577e83d8
RBP: 00000000ffa2a118 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Allocated by task 5243:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc+0x136/0x320 mm/slub.c:3852
skb_clone+0x190/0x3f0 net/core/skbuff.c:2063
hci_send_cmd_sync net/bluetooth/hci_core.c:4220 [inline]
hci_cmd_work+0x66a/0x710 net/bluetooth/hci_core.c:4240
process_one_work+0x902/0x1a30 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 5243:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:240 [inline]
__kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kmem_cache_free+0x12e/0x380 mm/slub.c:4344
kfree_skbmem+0x10e/0x200 net/core/skbuff.c:1159
__kfree_skb net/core/skbuff.c:1217 [inline]
kfree_skb_reason+0x13a/0x210 net/core/skbuff.c:1252
kfree_skb include/linux/skbuff.h:1262 [inline]
hci_req_sync_complete+0x16c/0x270 net/bluetooth/hci_request.c:109
hci_event_packet+0x963/0x1190 net/bluetooth/hci_event.c:7604
hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4171
process_one_work+0x902/0x1a30 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff888029a1fe00
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 228 bytes inside of
freed 240-byte region [ffff888029a1fe00, ffff888029a1fef0)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29a1e
head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff80000000840 ffff888015fa8780 ffffea00009fee80 0000000000000004
raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
head: 00fff80000000840 ffff888015fa8780 ffffea00009fee80 0000000000000004
head: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
head: 00fff80000000001 ffffea0000a68781 dead000000000122 00000000ffffffff
head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5111, tgid 5111 (sshd), ts 41611078310, free_ts 41590764657
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3317
__alloc_pages+0x22b/0x2460 mm/page_alloc.c:4575
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0xcc/0x3a0 mm/slub.c:2391
___slab_alloc+0x670/0x16d0 mm/slub.c:3525
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc_node+0x10a/0x340 mm/slub.c:3888
__alloc_skb+0x2b3/0x380 net/core/skbuff.c:658
alloc_skb include/linux/skbuff.h:1313 [inline]
__tcp_send_ack.part.0+0x64/0x720 net/ipv4/tcp_output.c:4206
__tcp_send_ack net/ipv4/tcp_output.c:4238 [inline]
tcp_send_ack+0x82/0xa0 net/ipv4/tcp_output.c:4238
__tcp_cleanup_rbuf+0x278/0x4b0 net/ipv4/tcp.c:1492
tcp_recvmsg_locked+0x114e/0x24c0 net/ipv4/tcp.c:2548
tcp_recvmsg+0x12e/0x680 net/ipv4/tcp.c:2578
inet_recvmsg+0x12b/0x6a0 net/ipv4/af_inet.c:883
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg+0x1b2/0x250 net/socket.c:1068
sock_read_iter+0x2c7/0x3c0 net/socket.c:1138
page last free pid 5111 tgid 5111 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347
free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487
skb_free_frag include/linux/skbuff.h:3336 [inline]
skb_free_head+0xa6/0x1e0 net/core/skbuff.c:1106
skb_release_data+0x76c/0x990 net/core/skbuff.c:1136
skb_release_all net/core/skbuff.c:1202 [inline]
__kfree_skb net/core/skbuff.c:1216 [inline]
skb_attempt_defer_free+0x3be/0x580 net/core/skbuff.c:7016
tcp_eat_recv_skb net/ipv4/tcp.c:1513 [inline]
tcp_recvmsg_locked+0x10dd/0x24c0 net/ipv4/tcp.c:2532
tcp_recvmsg+0x12e/0x680 net/ipv4/tcp.c:2578
inet_recvmsg+0x12b/0x6a0 net/ipv4/af_inet.c:883
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg+0x1b2/0x250 net/socket.c:1068
sock_read_iter+0x2c7/0x3c0 net/socket.c:1138
call_read_iter include/linux/fs.h:2104 [inline]
new_sync_read fs/read_write.c:395 [inline]
vfs_read+0x9fd/0xb80 fs/read_write.c:476
ksys_read+0x1f8/0x260 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888029a1fd80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
ffff888029a1fe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888029a1fe80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
^
ffff888029a1ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888029a1ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 10 06 adc %al,(%rsi)
2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
6: 10 07 adc %al,(%rdi)
8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
c: 10 08 adc %cl,(%rax)
e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1e: 00 51 52 add %dl,0x52(%rcx)
21: 55 push %rbp
22: 89 e5 mov %esp,%ebp
24: 0f 34 sysenter
26: cd 80 int $0x80
* 28: 5d pop %rbp <-- trapping instruction
29: 5a pop %rdx
2a: 59 pop %rcx
2b: c3 ret
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 96+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync
2024-04-13 7:58 ` syzbot
@ 2024-04-13 8:55 ` Hillf Danton
2024-04-13 9:11 ` syzbot
0 siblings, 1 reply; 96+ messages in thread
From: Hillf Danton @ 2024-04-13 8:55 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 13 Apr 2024 00:58:39 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 8f2c057754b2 Merge tag 'arm64-fixes' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171da243180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8f2c057754b2
--- x/net/bluetooth/hci_request.c
+++ y/net/bluetooth/hci_request.c
@@ -102,6 +102,7 @@ void hci_req_sync_complete(struct hci_de
{
bt_dev_dbg(hdev, "result 0x%2.2x", result);
+ hci_req_sync_lock(hdev);
if (hdev->req_status == HCI_REQ_PEND) {
hdev->req_result = result;
hdev->req_status = HCI_REQ_DONE;
@@ -111,6 +112,7 @@ void hci_req_sync_complete(struct hci_de
}
wake_up_interruptible(&hdev->req_wait_q);
}
+ hci_req_sync_unlock(hdev);
}
/* Execute request and wait for completion. */
--
^ permalink raw reply [flat|nested] 96+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync
2024-04-13 8:55 ` Hillf Danton
@ 2024-04-13 9:11 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2024-04-13 9:11 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
00
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 2
CPU#2
RAX=0000000000000073 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff84f77435 RDI=ffffffff948c8500 RBP=ffffffff948c84c0 RSP=ffffc900036a71e8
R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=63722d302e392e36
R12=0000000000000000 R13=0000000000000073 R14=ffffffff84f773d0 R15=0000000000000000
RIP=ffffffff84f7745f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA]
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA]
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88802c400000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe000008f000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00000000f73bc199 CR3=000000000d57a000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ffffffff
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ff00000000000000 0000000000000000
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 3
CPU#3
RAX=0000000000000001 RBX=ffff88802c4464e0 RCX=ffffffff81825cab RDX=0000000000000001
RSI=0000000000000000 RDI=0000000000000005 RBP=0000000000000003 RSP=ffffc900003e7910
R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000
R12=ffffed1005888c9d R13=0000000000000001 R14=ffff88802c4464e8 R15=ffff88802c53fc40
RIP=ffffffff818e4f20 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88802c500000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe00000d6000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=000055e3cc373698 CR3=000000000d57a000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 fab27cccfa4e3c92 f318f37d8660cd1a
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 bfe62e42fefa39ef
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3f9f1a4515355880
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000005 0000000000bfb029
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000002510a10
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000005 0000000000bfb02e
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000002510a0e
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000006 0000000000bfd6d8
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000002510a0b
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000003 0000000000bf87e3
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000002510a0c
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000006 0000000000bfd6de
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000002510a0a
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0000000000bf9665
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3291469263=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at c8349e485
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c8349e48534ea6d8f01515335d95de8ebf5da8df -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240412-102842'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c8349e48534ea6d8f01515335d95de8ebf5da8df -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240412-102842'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=c8349e48534ea6d8f01515335d95de8ebf5da8df -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240412-102842'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_386
x86_64-linux-gnu-gcc -o ./bin/linux_386/syz-executor executor/executor.cc \
-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_386=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"c8349e48534ea6d8f01515335d95de8ebf5da8df\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1713aadb180000
Tested on:
commit: 8f2c0577 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=c5a8421528fe0176
dashboard link: https://syzkaller.appspot.com/bug?extid=27209997e4015fb4702e
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=17319d33180000
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
@ 2025-07-15 14:15 ` syzbot
2025-07-15 14:29 ` Forwarded: syzbot
2025-07-16 6:28 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-15 14:15 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-15 14:15 ` Forwarded: syzbot
@ 2025-07-15 14:29 ` syzbot
2025-07-16 6:28 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-15 14:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-15 14:15 ` Forwarded: syzbot
2025-07-15 14:29 ` Forwarded: syzbot
@ 2025-07-16 6:28 ` syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-16 6:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
@ 2025-07-19 7:57 ` syzbot
2025-07-20 6:54 ` Forwarded: syzbot
2025-07-20 7:29 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-19 7:57 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz-test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-17 3:31 [syzbot] [arm?] [crypto?] [bcachefs?] KASAN: slab-use-after-free Read in neon_poly1305_update syzbot
@ 2025-07-19 22:01 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-19 22:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Move bset size check before csum check
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-11-29 12:12 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_peek_slot syzbot
@ 2025-07-19 22:03 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-19 22:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: fix assert in bch2_btree_path_traverse_cached()
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-06 21:30 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in __bch2_alloc_to_v4 syzbot
@ 2025-07-19 22:04 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-19 22:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix __bch2_alloc_to_v4 copy
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-14 10:38 [syzbot] [bcachefs?] WARNING in bch2_printbuf_make_room syzbot
@ 2025-07-19 23:27 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-19 23:27 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: fix the memory leak in exception case
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-02-04 14:07 [syzbot] [net?] general protection fault in ip6_pol_route (3) syzbot
@ 2025-07-20 4:02 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 4:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: net
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-03-16 18:05 [syzbot] [mm?] [bcachefs?] general protection fault in xas_create syzbot
@ 2025-07-20 4:03 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 4:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: mm
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-02-14 19:59 [syzbot] [mm?] [bcachefs?] KASAN: slab-out-of-bounds Read in folio_try_get syzbot
@ 2025-07-20 4:04 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 4:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: mm
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-02-06 17:01 [syzbot] [mm?] [bcachefs?] UBSAN: shift-out-of-bounds in xas_reload syzbot
@ 2025-07-20 4:05 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 4:05 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: mm
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-06-10 19:15 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in bch2_sb_members_v1_to_text syzbot
@ 2025-07-20 4:06 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 4:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't trust sb->nr_devices in members_to_text()
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
2025-07-19 7:57 ` Forwarded: syzbot
@ 2025-07-20 6:54 ` syzbot
2025-07-20 7:29 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 6:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz-test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
2025-07-19 7:57 ` Forwarded: syzbot
2025-07-20 6:54 ` Forwarded: syzbot
@ 2025-07-20 7:29 ` syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 7:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz-test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-03-25 5:16 [syzbot] [bcachefs?] INFO: task hung in __bch2_fsck_err syzbot
@ 2025-07-20 14:42 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 14:42 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix possible console lock involved deadlock
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-05-24 1:52 [syzbot] [block?] [bcachefs?] kernel BUG in blk_mq_end_request syzbot
@ 2025-07-20 14:44 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 14:44 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: block
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-11-25 13:27 [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_btree_node_read_done syzbot
@ 2025-07-20 14:54 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 14:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Move bset size check before csum check
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-05-11 12:57 [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_checksum syzbot
@ 2025-07-20 14:55 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 14:55 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Move bset size check before csum check
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-05-31 18:28 [syzbot] [bcachefs?] WARNING in bch2_fs_journal_start syzbot
@ 2025-07-20 17:30 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 17:30 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't allow mounting with crazy numbers of dirty journal entries
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-14 17:09 [syzbot] [bluetooth?] [bcachefs?] KASAN: slab-use-after-free Read in hci_uart_write_work syzbot
@ 2025-07-20 17:34 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-20 17:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: bluetooth
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-07-18 1:20 [syzbot] [bcachefs?] BUG: unable to handle kernel paging request in bch2_dirent_to_text syzbot
@ 2025-07-21 17:30 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-21 17:30 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Add missing validation for superblock section clean
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-02-12 11:52 [syzbot] [bcachefs?] kernel BUG in bch2_journal_keys_peek_max syzbot
@ 2025-07-21 17:37 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-21 17:37 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: btree_iter: fix updates, journal overlay
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-11-29 8:43 [syzbot] [bcachefs?] general protection fault in bch2_prt_vprintf syzbot
@ 2025-07-22 16:18 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-22 16:18 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: journal_entry_btree_keys_to_text() is more careful
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-04-19 8:36 [syzbot] [block?] [bcachefs?] kernel panic: KASAN: panic_on_warn set syzbot
@ 2025-07-22 17:56 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-22 17:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: block fs
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-05-12 20:55 [syzbot] [bcachefs?] possible deadlock in __bch2_folio_reservation_get (2) syzbot
@ 2025-07-22 18:22 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-22 18:22 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix possible console lock involved deadlock
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-01-20 2:27 [syzbot] [bcachefs?] possible deadlock in bch2_trans_begin syzbot
@ 2025-07-22 18:23 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-22 18:23 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix possible console lock involved deadlock
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-13 10:19 [syzbot] BUG: Bad rss-counter state (5) syzbot
@ 2025-07-22 18:31 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-22 18:31 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: mm: memory: extend finish_fault() to support large folio
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-31 8:43 [syzbot] [bcachefs?] INFO: task hung in bch2_copygc_stop syzbot
@ 2025-07-23 1:17 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-23 1:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Increase BCH_MIN_NR_NBUCKETS
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-03 17:32 [syzbot] [bcachefs?] INFO: task hung in __closure_sync syzbot
@ 2025-07-23 1:18 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-23 1:18 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Increase BCH_MIN_NR_NBUCKETS
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-04 7:58 [syzbot] [bcachefs?] WARNING in bchfs_truncate syzbot
@ 2025-07-23 1:21 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-23 1:21 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Increase BCH_MIN_NR_NBUCKETS
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-06-15 9:58 [syzbot] [bcachefs?] INFO: task hung in __bch2_fs_stop syzbot
@ 2025-07-23 1:56 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-23 1:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Increase BCH_MIN_NR_NBUCKETS
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-04-16 17:47 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_alloc_sectors_start_trans (2) syzbot
@ 2025-07-23 10:59 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-23 10:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Add missing ei_last_dirtied update
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-03-30 8:27 [syzbot] [afs?] WARNING: ODEBUG bug in delete_node (3) syzbot
@ 2025-07-24 15:32 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-07-24 15:32 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz set subsystems: afs
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-31 9:11 [syzbot] [bcachefs?] kernel BUG in bch2_btree_repair_topology_recurse syzbot
@ 2025-08-01 23:03 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-08-01 23:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: btree_check_root_boundaries()
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-30 21:21 [syzbot] [bcachefs?] kernel panic: in transaction restart: transaction_restart_relock, last restarted by syzbot
@ 2025-08-03 18:30 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-08-03 18:30 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix incorrect transaction handling
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-08-04 7:18 [syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_accounting_validate syzbot
@ 2025-08-04 22:56 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-08-04 22:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Ignore accounting key type larger than BCH_DISK_ACCOUNTING_TYPE_NR
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-09-29 7:31 [syzbot] [bcachefs?] possible deadlock in bch2_symlink syzbot
@ 2025-08-04 23:12 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-08-04 23:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't lock inode around page_symlink
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-08-16 3:08 [syzbot] [usb?] UBSAN: shift-out-of-bounds in ax88772_bind syzbot
@ 2025-08-17 19:42 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-08-17 19:42 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: abinashsinghlalotra@gmail.com
#syz test
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -872,6 +872,11 @@ static int ax88772_bind(struct usbnet *dev, struct
usb_interface *intf)
if (ret < 0)
return ret;
+ if (ret >= 32) {
+ netdev_warn(dev->net, "Invalid PHY address %d, clamping\n", ret);
+ return -EINVAL;
+ }
+
priv->phy_addr = ret;
priv->embd_phy = ((priv->phy_addr & 0x1f) == AX_EMBD_PHY_ADDR);
--
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-08-16 3:08 [syzbot] [overlayfs?] WARNING in shmem_unlink syzbot
@ 2025-08-17 19:52 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-08-17 19:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: abinashsinghlalotra@gmail.com
#syz test
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -33,6 +33,12 @@ static int ovl_cleanup_locked(struct dentry *workdir,
struct dentry *dentry)
struct inode *dir = d_inode(workdir);
struct inode *inode = d_inode(dentry);
+ /* Avoid unlinking an already unlinked inode */
+ if (inode && inode->i_nlink == 0) {
+ d_drop(dentry);
+ return 0;
+ }
+
if (ovl_is_whiteout(dentry))
return ovl_remove_and_whiteout(workdir, dentry, true);
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-08-13 8:00 [syzbot] [sound?] linux-next test error: general protection fault in snd_seq_oss_midi_check_new_port syzbot
@ 2025-09-01 8:48 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-09-01 8:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
No longer relevant
#syz invalid
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-07-01 12:30 [syzbot] [fs?] linux-next test error: WARNING: suspicious RCU usage in proc_sys_compare syzbot
@ 2025-09-01 8:49 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-09-01 8:49 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
no longer relevant
#syz invalid
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-08-01 7:54 [syzbot] [dri?] upstream test error: WARNING in __ww_mutex_wound syzbot
@ 2025-09-01 8:51 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-09-01 8:51 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
@ 2025-09-17 10:45 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-09-17 10:45 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: deepak.takumi.120@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-09 14:45 [syzbot] [gfs2?] WARNING in gfs2_ri_update (2) syzbot
@ 2025-09-18 19:46 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-09-18 19:46 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: kriish.sharma2006@gmail.com
#syz test
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 26d6c1eea559..a879e8030568 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -760,7 +760,7 @@ static int compute_bitstructs(struct gfs2_rgrpd *rgd)
u32 bytes_left, bytes;
int x;
- if (!length)
+ if (!length || length > KMALLOC_MAX_SIZE / sizeof(struct
gfs2_bitmap))
return -EINVAL;
rgd->rd_bits = kcalloc(length, sizeof(struct gfs2_bitmap),
GFP_NOFS);
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-09-03 17:36 [syzbot] [kernel?] KASAN: slab-out-of-bounds Read in change_page_attr_set_clr syzbot
@ 2025-09-29 7:50 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-09-29 7:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nooraineqbal@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
Resending this patch in the existing thread with a '#syz test:' directive
so syzbot can test it.
From 1bb35c6722b8fb03e9262f6e6530d240629a44df Mon Sep 17 00:00:00 2001
From: neqbal <nooraineqbal@gmail.com>
Date: Sun, 28 Sep 2025 03:52:44 +0530
Subject: [PATCH] x86/mm: Fix off-by-one error in set_memory
Correct end page calculation by subtracting 1 to prevent
out-of-bounds access.
Reported-by: syzbot+e34177f6091df113ef20@syzkaller.appspotmail.com
Signed-off-by: neqbal <nooraineqbal@gmail.com>
---
arch/x86/mm/pat/set_memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index d2d54b8c4dbb..daefc96403f1 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -446,7 +446,7 @@ static void cpa_flush(struct cpa_data *cpa, int cache)
}
start = fix_addr(__cpa_addr(cpa, 0));
- end = fix_addr(__cpa_addr(cpa, cpa->numpages));
+ end = fix_addr(__cpa_addr(cpa, cpa->numpages - 1));
if (cpa->force_flush_all)
end = TLB_FLUSH_ALL;
--
2.51.0
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-05 23:30 [syzbot] [ntfs3?] WARNING in indx_insert_into_buffer (3) syzbot
@ 2025-10-07 21:52 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-07 21:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
fs/ntfs3/index.c | 10 +++++-----
fs/ntfs3/ntfs.h | 5 ++++-
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 6d1bf890929d..2e512abc7000 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1808,7 +1808,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
CLST new_vbn;
__le64 t_vbn, *sub_vbn;
u16 sp_size;
- void *hdr1_saved = NULL;
+ void *blk1_saved = NULL;
/* Try the most easy case. */
e = fnd->level - 1 == level ? fnd->de[level] : NULL;
@@ -1842,8 +1842,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
memcpy(up_e, sp, sp_size);
used1 = le32_to_cpu(hdr1->used);
- hdr1_saved = kmemdup(hdr1, used1, GFP_NOFS);
- if (!hdr1_saved) {
+ blk1_saved = kmemdup(&n1->index->blk, used1, GFP_NOFS);
+ if (!blk1_saved) {
err = -ENOMEM;
goto out;
}
@@ -1924,13 +1924,13 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
- memcpy(hdr1, hdr1_saved, used1);
+ memcpy(&n1->index->blk, blk1_saved, used1);
indx_write(indx, ni, n1, 0);
}
out:
kfree(up_e);
- kfree(hdr1_saved);
+ kfree(blk1_saved);
return err;
}
diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 552b97905813..d5e2b22eacd7 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -754,7 +754,10 @@ static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr)
struct INDEX_BUFFER {
struct NTFS_RECORD_HEADER rhdr; // 'INDX'
__le64 vbn; // 0x10: vcn if index >= cluster or vsn id index < cluster
- struct INDEX_HDR ihdr; // 0x18:
+ struct_group(blk,
+ struct INDEX_HDR ihdr; // 0x18:
+ u8 data[]; // NTFS_DE entries
+ );
};
static_assert(sizeof(struct INDEX_BUFFER) == 0x28);
--
2.51.0
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-05-09 4:43 [syzbot] [jfs?] WARNING in jfs_rename syzbot
@ 2025-10-12 16:19 ` syzbot
2025-10-12 17:45 ` Forwarded: syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-12 16:19 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/namei.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..37cd16a423c5 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
jfs_err("jfs_rename: dtInsert returned -EIO");
goto out_tx;
}
- if (S_ISDIR(old_ip->i_mode))
+ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
inc_nlink(new_dir);
}
/*
@@ -1244,8 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
goto out_tx;
}
if (S_ISDIR(old_ip->i_mode)) {
- drop_nlink(old_dir);
if (old_dir != new_dir) {
+ drop_nlink(old_dir);
+
/*
* Change inode number of parent for moved directory
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-05-09 4:43 [syzbot] [jfs?] WARNING in jfs_rename syzbot
2025-10-12 16:19 ` Forwarded: syzbot
@ 2025-10-12 17:45 ` syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-12 17:45 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/namei.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..7879c049632b 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
jfs_err("jfs_rename: dtInsert returned -EIO");
goto out_tx;
}
- if (S_ISDIR(old_ip->i_mode))
+ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
inc_nlink(new_dir);
}
/*
@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
goto out_tx;
}
if (S_ISDIR(old_ip->i_mode)) {
- drop_nlink(old_dir);
+ if (new_ip || old_dir != new_dir)
+ drop_nlink(old_dir);
+
if (old_dir != new_dir) {
/*
* Change inode number of parent for moved directory
--
2.51.0
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
@ 2025-10-13 13:38 ` syzbot
2025-10-14 15:24 ` Forwarded: syzbot
` (4 subsequent siblings)
5 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-13 13:38 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/namei.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..86779a6ec1a7 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -224,7 +224,7 @@ static int minix_rename(struct mnt_idmap *idmap,
err = minix_add_link(new_dentry, old_inode);
if (err)
goto out_dir;
- if (dir_de)
+ if (dir_de && old_dir != new_dir)
inode_inc_link_count(new_dir);
}
@@ -236,7 +236,7 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de) {
err = minix_set_link(dir_de, dir_folio, new_dir);
- if (!err)
+ if (!err && (new_inode || old_dir != new_dir))
inode_dec_link_count(old_dir);
}
out_dir:
--
2.51.0
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-01-08 12:17 [syzbot] [fs?] WARNING in minix_rmdir syzbot
@ 2025-10-14 13:36 ` syzbot
2025-11-02 12:47 ` Forwarded: syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-14 13:36 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/inode.c | 14 ++++++++++++++
fs/minix/namei.c | 22 ++++++++++++++--------
2 files changed, 28 insertions(+), 8 deletions(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EIO;
+
+ if (dir->i_nlink <= 2)
+ goto out;
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
}
+out:
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-10-13 13:38 ` Forwarded: syzbot
@ 2025-10-14 15:24 ` syzbot
2025-11-02 14:41 ` Forwarded: syzbot
` (3 subsequent siblings)
5 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-14 15:24 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/inode.c | 14 ++++++++++++++
fs/minix/namei.c | 22 ++++++++++++++--------
2 files changed, 28 insertions(+), 8 deletions(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EIO;
+
+ if (dir->i_nlink <= 2)
+ goto out;
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
}
+out:
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-17 5:53 [syzbot] [net?] kernel BUG in set_ipsecrequest syzbot
@ 2025-10-20 11:19 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-20 11:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: clf700383@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
From 6dc2deb09faf7d53707cc9e75e175b09644fd181 Mon Sep 17 00:00:00 2001
From: clingfei <clf700383@gmail.com>
Date: Mon, 20 Oct 2025 13:48:54 +0800
Subject: [PATCH] fix integer overflow in set_ipsecrequest
syzbot reported a kernel BUG in set_ipsecrequest() due to an skb_over_panic.
The mp->new_family and mp->old_family is u16, while set_ipsecrequest receives
family as uint8_t, causing a integer overflow and the later size_req calculation
error, which exceeds the size used in alloc_skb, and ultimately triggered the
kernel bug in skb_put.
Reported-by: syzbot+be97dd4da14ae88b6ba4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=be97dd4da14ae88b6ba4
Signed-off-by: Cheng Lingfei <clf700383@gmail.com>
---
net/key/af_key.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 2ebde0352245..08f4cde01994 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3518,7 +3518,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *
static int set_ipsecrequest(struct sk_buff *skb,
uint8_t proto, uint8_t mode, int level,
- uint32_t reqid, uint8_t family,
+ uint32_t reqid, uint16_t family,
const xfrm_address_t *src, const xfrm_address_t *dst)
{
struct sadb_x_ipsecrequest *rq;
--
2.34.1
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-09-17 22:54 [syzbot] [bfs?] INFO: task hung in bfs_lookup (6) syzbot
@ 2025-10-20 18:09 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-20 18:09 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: zlatistiv@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-09-17 22:55 [syzbot] [ntfs3?] KMSAN: uninit-value in ntfs_read_hdr (3) syzbot
@ 2025-10-26 15:54 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-26 15:54 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: kubik.bartlomiej@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
@ 2025-10-27 23:06 ` syzbot
2025-10-28 17:25 ` Forwarded: syzbot
2025-10-28 20:53 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-27 23:06 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..07dd01c79ca2 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
int ri, struct component_name * key, int flag);
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
- ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+ ddata_t * data, struct dt_lock **);
static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
lv->length = 1;
dtlck->index++;
- dtInsertEntry(p, index, name, &data, &dtlck);
+ if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+ return rc;
/* linelock stbl of non-root leaf page */
if (!(p->header.flag & BT_ROOT)) {
@@ -3627,7 +3628,7 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */
*
* return: entry slot index
*/
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
ddata_t * data, struct dt_lock ** dtlock)
{
struct dtslot *h, *t;
@@ -3649,6 +3650,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* allocate a free slot */
hsi = fsi = p->header.freelist;
+ if (fsi >= p->header.maxslot) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
h = &p->slot[fsi];
p->header.freelist = h->next;
--p->header.freecnt;
@@ -3697,6 +3702,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
while (klen) {
/* get free slot */
fsi = p->header.freelist;
+ if (fsi >= p->header.maxslot) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
t = &p->slot[fsi];
p->header.freelist = t->next;
--p->header.freecnt;
@@ -3774,6 +3783,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* advance next available entry index of stbl */
++p->header.nextindex;
+
+ return 0;
}
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
2025-10-27 23:06 ` Forwarded: syzbot
@ 2025-10-28 17:25 ` syzbot
2025-10-28 18:02 ` Forwarded: Al Viro
2025-10-28 20:53 ` Forwarded: syzbot
2 siblings, 1 reply; 96+ messages in thread
From: syzbot @ 2025-10-28 17:25 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/jfs_dtree.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..e919de01c42a 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
int ri, struct component_name * key, int flag);
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
- ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+ ddata_t * data, struct dt_lock **);
static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
lv->length = 1;
dtlck->index++;
- dtInsertEntry(p, index, name, &data, &dtlck);
+ if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+ return rc;
/* linelock stbl of non-root leaf page */
if (!(p->header.flag & BT_ROOT)) {
@@ -3625,9 +3626,10 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */
* function: allocate free slot(s) and
* write a leaf/internal entry
*
- * return: entry slot index
+ * * return: 0 - success;
+ * errno - failure;
*/
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
ddata_t * data, struct dt_lock ** dtlock)
{
struct dtslot *h, *t;
@@ -3649,6 +3651,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* allocate a free slot */
hsi = fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
h = &p->slot[fsi];
p->header.freelist = h->next;
--p->header.freecnt;
@@ -3697,6 +3703,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
while (klen) {
/* get free slot */
fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
t = &p->slot[fsi];
p->header.freelist = t->next;
--p->header.freecnt;
@@ -3774,6 +3784,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* advance next available entry index of stbl */
++p->header.nextindex;
+
+ return 0;
}
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Re: Forwarded:
2025-10-28 17:25 ` Forwarded: syzbot
@ 2025-10-28 18:02 ` Al Viro
0 siblings, 0 replies; 96+ messages in thread
From: Al Viro @ 2025-10-28 18:02 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel
On Tue, Oct 28, 2025 at 10:25:20AM -0700, syzbot wrote:
> For archival purposes, forwarding an incoming command email to
> linux-kernel@vger.kernel.org.
For fuck sake, either generate a more useful subject, or take
that to a separate list just for syzbot use.
Do you really intend to end up in a bunch of .procmailrc?
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
2025-10-27 23:06 ` Forwarded: syzbot
2025-10-28 17:25 ` Forwarded: syzbot
@ 2025-10-28 20:53 ` syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-10-28 20:53 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/jfs_dtree.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..e919de01c42a 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
int ri, struct component_name * key, int flag);
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
- ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+ ddata_t * data, struct dt_lock **);
static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
lv->length = 1;
dtlck->index++;
- dtInsertEntry(p, index, name, &data, &dtlck);
+ if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+ return rc;
/* linelock stbl of non-root leaf page */
if (!(p->header.flag & BT_ROOT)) {
@@ -3625,9 +3626,10 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */
* function: allocate free slot(s) and
* write a leaf/internal entry
*
- * return: entry slot index
+ * * return: 0 - success;
+ * errno - failure;
*/
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
ddata_t * data, struct dt_lock ** dtlock)
{
struct dtslot *h, *t;
@@ -3649,6 +3651,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* allocate a free slot */
hsi = fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
h = &p->slot[fsi];
p->header.freelist = h->next;
--p->header.freecnt;
@@ -3697,6 +3703,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
while (klen) {
/* get free slot */
fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
t = &p->slot[fsi];
p->header.freelist = t->next;
--p->header.freecnt;
@@ -3774,6 +3784,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* advance next available entry index of stbl */
++p->header.nextindex;
+
+ return 0;
}
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-01-08 12:17 [syzbot] [fs?] WARNING in minix_rmdir syzbot
2025-10-14 13:36 ` Forwarded: syzbot
@ 2025-11-02 12:47 ` syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 12:47 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/minix.h | 2 ++
fs/minix/namei.c | 26 ++++++++++++++++++--------
2 files changed, 20 insertions(+), 8 deletions(-)
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..a8d5a7e22b7b 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,25 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EFSCORRUPTED;
+
+ if (dir->i_nlink <= 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out;
}
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
+ }
+
+out:
return err;
}
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-10-13 13:38 ` Forwarded: syzbot
2025-10-14 15:24 ` Forwarded: syzbot
@ 2025-11-02 14:41 ` syzbot
2025-11-02 14:56 ` Forwarded: syzbot
` (2 subsequent siblings)
5 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 14:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (dir_de && new_inode->i_nlink != 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (2 preceding siblings ...)
2025-11-02 14:41 ` Forwarded: syzbot
@ 2025-11-02 14:56 ` syzbot
2025-11-02 15:50 ` Forwarded: syzbot
2025-11-02 16:58 ` Forwarded: syzbot
5 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 14:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (dir_de && new_inode->i_nlink != 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (3 preceding siblings ...)
2025-11-02 14:56 ` Forwarded: syzbot
@ 2025-11-02 15:50 ` syzbot
2025-11-02 16:58 ` Forwarded: syzbot
5 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 15:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..493a75eff2c9 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -208,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", new_inode->i_ino);
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-29 0:12 [syzbot] [ntfs3?] WARNING in ntfs_fill_super (2) syzbot
@ 2025-11-02 16:40 ` syzbot
2025-11-03 13:28 ` Forwarded: syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 16:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index aae1f32f4dab..f193912d8632 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -704,8 +704,8 @@ static void ntfs_put_super(struct super_block *sb)
ntfs_set_state(sbi, NTFS_DIRTY_CLEAR);
if (sbi->options) {
+ kfree(sbi->options->nls_name);
unload_nls(sbi->options->nls);
- kfree(sbi->options->nls);
kfree(sbi->options);
sbi->options = NULL;
}
@@ -1670,8 +1670,8 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
iput(inode);
out:
if (sbi && sbi->options) {
+ kfree(sbi->options->nls_name);
unload_nls(sbi->options->nls);
- kfree(sbi->options->nls);
kfree(sbi->options);
sbi->options = NULL;
}
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (4 preceding siblings ...)
2025-11-02 15:50 ` Forwarded: syzbot
@ 2025-11-02 16:58 ` syzbot
5 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 16:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..f18f7474aca4 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -145,6 +145,12 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
struct minix_dir_entry * de;
int err;
+ if (inode->i_nlink < 1) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", inode->i_ino);
+ return -EFSCORRUPTED;
+ }
+
de = minix_find_entry(dentry, &folio);
if (!de)
return -ENOENT;
@@ -218,6 +224,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", new_inode->i_ino);
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
@ 2025-11-02 18:07 ` syzbot
2025-11-02 19:22 ` Forwarded: syzbot
2025-11-03 12:27 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 18:07 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
- if (!inode)
- return -ENOMEM;
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index fff149af89da..6808b1316b60 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -273,4 +273,6 @@ static inline void hfs_bitmap_dirty(struct super_block *sb)
__bh; \
})
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..ef46a2d29d6a 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -188,7 +188,7 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
s64 folder_count;
if (!inode)
- return NULL;
+ return ERR_PTR(-ENOMEM);
mutex_init(&HFS_I(inode)->extents_lock);
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
@@ -209,7 +209,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
if (S_ISDIR(mode)) {
inode->i_size = 2;
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
- BUG_ON(folder_count > U32_MAX);
+ if (folder_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: folder count on super block is corrupt");
+ return ERR_PTR(-EFSCORRUPTED);
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_dirs++;
inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +222,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
} else if (S_ISREG(mode)) {
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
- BUG_ON(file_count > U32_MAX);
+ if (file_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: file count on super block is corrupt");
+ return ERR_PTR(-EFSCORRUPTED);
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_files++;
inode->i_op = &hfs_file_inode_operations;
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
2025-11-02 18:07 ` Forwarded: syzbot
@ 2025-11-02 19:22 ` syzbot
2025-11-03 12:27 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-02 19:22 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
- if (!inode)
- return -ENOMEM;
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index fff149af89da..6808b1316b60 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -273,4 +273,6 @@ static inline void hfs_bitmap_dirty(struct super_block *sb)
__bh; \
})
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..cb74904994cc 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -186,16 +186,22 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
s64 next_id;
s64 file_count;
s64 folder_count;
+ int err = -ENOMEM;
if (!inode)
- return NULL;
+ goto out_err;
+
+ err = -EFSCORRUPTED;
mutex_init(&HFS_I(inode)->extents_lock);
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
spin_lock_init(&HFS_I(inode)->open_dir_lock);
hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
- BUG_ON(next_id > U32_MAX);
+ if (next_id > U32_MAX) {
+ printk(KERN_CRIT "hfs error: next file id on super block is corrupt");
+ goto out_discard;
+ }
inode->i_ino = (u32)next_id;
inode->i_mode = mode;
inode->i_uid = current_fsuid();
@@ -209,7 +215,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
if (S_ISDIR(mode)) {
inode->i_size = 2;
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
- BUG_ON(folder_count > U32_MAX);
+ if (folder_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: folder count on super block is corrupt");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_dirs++;
inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +228,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
} else if (S_ISREG(mode)) {
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
- BUG_ON(file_count > U32_MAX);
+ if (file_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: file count on super block is corrupt");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_files++;
inode->i_op = &hfs_file_inode_operations;
@@ -243,6 +255,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
hfs_mark_mdb_dirty(sb);
return inode;
+
+ out_discard:
+ iput(inode);
+ out_err:
+ return ERR_PTR(err);
}
void hfs_delete_inode(struct inode *inode)
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
2025-11-02 18:07 ` Forwarded: syzbot
2025-11-02 19:22 ` Forwarded: syzbot
@ 2025-11-03 12:27 ` syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-03 12:27 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
- if (!inode)
- return -ENOMEM;
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..beec6fe7e801 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -186,16 +186,23 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
s64 next_id;
s64 file_count;
s64 folder_count;
+ int err = -ENOMEM;
if (!inode)
- return NULL;
+ goto out_err;
+
+ err = -ENOSPC;
mutex_init(&HFS_I(inode)->extents_lock);
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
spin_lock_init(&HFS_I(inode)->open_dir_lock);
hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
- BUG_ON(next_id > U32_MAX);
+ if (next_id > U32_MAX) {
+ pr_err("hfs: next file ID exceeds 32-bit limit — possible "
+ "superblock corruption");
+ goto out_discard;
+ }
inode->i_ino = (u32)next_id;
inode->i_mode = mode;
inode->i_uid = current_fsuid();
@@ -209,7 +216,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
if (S_ISDIR(mode)) {
inode->i_size = 2;
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
- BUG_ON(folder_count > U32_MAX);
+ if (folder_count > U32_MAX) {
+ pr_err("hfs: folder count exceeds 32-bit limit — possible "
+ "superblock corruption");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_dirs++;
inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +230,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
} else if (S_ISREG(mode)) {
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
- BUG_ON(file_count > U32_MAX);
+ if (file_count > U32_MAX) {
+ pr_err("hfs: file count exceeds 32-bit limit — possible "
+ "superblock corruption");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_files++;
inode->i_op = &hfs_file_inode_operations;
@@ -243,6 +258,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
hfs_mark_mdb_dirty(sb);
return inode;
+
+ out_discard:
+ iput(inode);
+ out_err:
+ return ERR_PTR(err);
}
void hfs_delete_inode(struct inode *inode)
@@ -251,7 +271,6 @@ void hfs_delete_inode(struct inode *inode)
hfs_dbg("ino %lu\n", inode->i_ino);
if (S_ISDIR(inode->i_mode)) {
- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
atomic64_dec(&HFS_SB(sb)->folder_count);
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
HFS_SB(sb)->root_dirs--;
@@ -260,7 +279,6 @@ void hfs_delete_inode(struct inode *inode)
return;
}
- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
atomic64_dec(&HFS_SB(sb)->file_count);
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
HFS_SB(sb)->root_files--;
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 53f3fae60217..1c3fb631cc8e 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -273,15 +273,12 @@ void hfs_mdb_commit(struct super_block *sb)
/* These parameters may have been modified, so write them back */
mdb->drLsMod = hfs_mtime();
mdb->drFreeBks = cpu_to_be16(HFS_SB(sb)->free_ablocks);
- BUG_ON(atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX);
mdb->drNxtCNID =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->next_id));
mdb->drNmFls = cpu_to_be16(HFS_SB(sb)->root_files);
mdb->drNmRtDirs = cpu_to_be16(HFS_SB(sb)->root_dirs);
- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
mdb->drFilCnt =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->file_count));
- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
mdb->drDirCnt =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->folder_count));
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-10-29 0:12 [syzbot] [ntfs3?] WARNING in ntfs_fill_super (2) syzbot
2025-11-02 16:40 ` Forwarded: syzbot
@ 2025-11-03 13:28 ` syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-03 13:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz dup: WARNING in ntfs_put_super
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-11-02 23:48 [syzbot] [nbd?] KASAN: slab-use-after-free Write in recv_work (3) syzbot
@ 2025-11-05 14:40 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-05 14:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
@ 2025-11-14 1:20 ` syzbot
2025-11-14 3:54 ` Forwarded: syzbot
2025-11-14 4:17 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-14 1:20 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
2025-11-14 1:20 ` Forwarded: syzbot
@ 2025-11-14 3:54 ` syzbot
2025-11-14 4:17 ` Forwarded: syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-14 3:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
2025-11-14 1:20 ` Forwarded: syzbot
2025-11-14 3:54 ` Forwarded: syzbot
@ 2025-11-14 4:17 ` syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-14 4:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-11-13 4:38 [syzbot] [input?] [usb?] memory leak in dualshock4_get_calibration_data syzbot
@ 2025-11-15 1:12 ` syzbot
2025-11-15 1:44 ` Forwarded: syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-15 1:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-11-13 4:38 [syzbot] [input?] [usb?] memory leak in dualshock4_get_calibration_data syzbot
2025-11-15 1:12 ` Forwarded: syzbot
@ 2025-11-15 1:44 ` syzbot
1 sibling, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-15 1:44 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2021-12-13 7:17 [syzbot] UBSAN: shift-out-of-bounds in minix_statfs syzbot
@ 2025-11-17 18:53 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-11-17 18:53 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/inode.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 7897f5123b3d..bee191c50010 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -171,7 +171,15 @@ static bool minix_check_superblock(struct super_block *sb)
{
struct minix_sb_info *sbi = minix_sb(sb);
- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+ if (sbi->s_log_zone_size != 0) {
+ printk("minix-fs error: zone size must equal block size. "
+ "s_log_zone_size > 0 is not supported.\n");
+ return false;
+ }
+
+ if (sbi->s_imap_blocks < 1 || sbi->s_zmap_blocks < 1 ||
+ sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
+ sbi->s_firstdatazone >= sbi->s_nzones)
return false;
/*
--
2.51.2
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2025-12-07 6:24 [syzbot] [block?] kernel BUG in bio_chain syzbot
@ 2025-12-12 12:17 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-12-12 12:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: agruenba@redhat.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
4daba9379bbd702c63459f54ef448746bfeab42d
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2025-11-04 9:17 [syzbot] linux-next build error (24) syzbot
@ 2025-12-17 13:51 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2025-12-17 13:51 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: pimyn@google.com
#syz invalid
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2022-11-25 9:45 [syzbot] kernel BUG in hfs_write_inode syzbot
@ 2026-03-09 23:04 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-03-09 23:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: contact@gvernon.com
#syz test
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-11-21 15:03 [syzbot] [kvm?] WARNING: locking bug in kvm_xen_set_evtchn_fast syzbot
@ 2026-03-15 13:58 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-03-15 13:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: klnm1908v@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index 91fd3673c09a..e588a188f50a 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -126,23 +126,10 @@ static enum hrtimer_restart
xen_timer_callback(struct hrtimer *timer)
{
struct kvm_vcpu *vcpu = container_of(timer, struct kvm_vcpu,
arch.xen.timer);
- struct kvm_xen_evtchn e;
- int rc;
if (atomic_read(&vcpu->arch.xen.timer_pending))
return HRTIMER_NORESTART;
- e.vcpu_id = vcpu->vcpu_id;
- e.vcpu_idx = vcpu->vcpu_idx;
- e.port = vcpu->arch.xen.timer_virq;
- e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
-
- rc = kvm_xen_set_evtchn_fast(&e, vcpu->kvm);
- if (rc != -EWOULDBLOCK) {
- vcpu->arch.xen.timer_expires = 0;
- return HRTIMER_NORESTART;
- }
-
atomic_inc(&vcpu->arch.xen.timer_pending);
kvm_make_request(KVM_REQ_UNBLOCK, vcpu);
kvm_vcpu_kick(vcpu);
^ permalink raw reply related [flat|nested] 96+ messages in thread
* Forwarded:
2026-02-14 12:34 [syzbot] [media?] KASAN: slab-use-after-free Read in dvb_frontend_release (3) syzbot
@ 2026-04-16 13:14 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-04-16 13:14 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: halves@igalia.com
#syz test
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -147,6 +147,7 @@ int dvb_generic_open(struct inode *inode, struct file *file)
dvbdev->writers--;
}
+ dvb_device_get(dvbdev);
dvbdev->users--;
return 0;
}
--
2.53.0
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2026-05-07 23:35 [syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (3) syzbot
@ 2026-05-08 2:56 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-08 2:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: daiky0325@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2023-12-21 13:47 [syzbot] [net?] WARNING: ODEBUG bug in advance_sched syzbot
@ 2026-05-11 21:06 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-11 21:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
The bug is actually fixed long time ago.
#syz invalid
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-04-18 20:00 [syzbot] [bpf?] possible deadlock in __stack_map_get syzbot
@ 2026-05-12 10:06 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-12 10:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
The bug is actually no longer present.
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-05-18 21:05 [syzbot] [bpf?] [net?] KMSAN: uninit-value in dev_map_hash_lookup_elem syzbot
@ 2026-05-13 20:04 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-13 20:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
The bug has actually been already fixed.
#syz invalid
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2020-09-09 9:58 general protection fault in skb_release_data (2) syzbot
@ 2026-05-18 16:41 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-18 16:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Doesn't happen for a long time in fact.
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-04-07 14:10 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync syzbot
2024-04-12 4:44 ` syzbot
2024-04-13 7:58 ` syzbot
@ 2026-05-20 18:09 ` syzbot
2 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-20 18:09 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Actually fixed long ago.
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2024-01-09 18:18 [syzbot] [kernel?] WARNING in signal_wake_up_state syzbot
@ 2026-05-20 18:10 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-20 18:10 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Fixed long ago
^ permalink raw reply [flat|nested] 96+ messages in thread
* Forwarded:
2026-03-17 17:43 [syzbot] [wireless?] WARNING in cfg80211_chandef_create syzbot
@ 2026-05-21 20:49 ` syzbot
0 siblings, 0 replies; 96+ messages in thread
From: syzbot @ 2026-05-21 20:49 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Actually already fixed
^ permalink raw reply [flat|nested] 96+ messages in thread
end of thread, other threads:[~2026-05-21 20:49 UTC | newest]
Thread overview: 96+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-07 14:10 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync syzbot
2024-04-12 4:44 ` syzbot
2024-04-12 10:44 ` Hillf Danton
2024-04-12 11:05 ` syzbot
2024-04-13 7:58 ` syzbot
2024-04-13 8:55 ` Hillf Danton
2024-04-13 9:11 ` syzbot
2026-05-20 18:09 ` Forwarded: syzbot
-- strict thread matches above, loose matches on Subject: below --
2026-05-07 23:35 [syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (3) syzbot
2026-05-08 2:56 ` Forwarded: syzbot
2026-03-17 17:43 [syzbot] [wireless?] WARNING in cfg80211_chandef_create syzbot
2026-05-21 20:49 ` Forwarded: syzbot
2026-02-14 12:34 [syzbot] [media?] KASAN: slab-use-after-free Read in dvb_frontend_release (3) syzbot
2026-04-16 13:14 ` Forwarded: syzbot
2025-12-07 6:24 [syzbot] [block?] kernel BUG in bio_chain syzbot
2025-12-12 12:17 ` Forwarded: syzbot
2025-11-13 4:38 [syzbot] [input?] [usb?] memory leak in dualshock4_get_calibration_data syzbot
2025-11-15 1:12 ` Forwarded: syzbot
2025-11-15 1:44 ` Forwarded: syzbot
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
2025-11-14 1:20 ` Forwarded: syzbot
2025-11-14 3:54 ` Forwarded: syzbot
2025-11-14 4:17 ` Forwarded: syzbot
2025-11-04 9:17 [syzbot] linux-next build error (24) syzbot
2025-12-17 13:51 ` Forwarded: syzbot
2025-11-02 23:48 [syzbot] [nbd?] KASAN: slab-use-after-free Write in recv_work (3) syzbot
2025-11-05 14:40 ` Forwarded: syzbot
2025-10-29 0:12 [syzbot] [ntfs3?] WARNING in ntfs_fill_super (2) syzbot
2025-11-02 16:40 ` Forwarded: syzbot
2025-11-03 13:28 ` Forwarded: syzbot
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
2025-10-27 23:06 ` Forwarded: syzbot
2025-10-28 17:25 ` Forwarded: syzbot
2025-10-28 18:02 ` Forwarded: Al Viro
2025-10-28 20:53 ` Forwarded: syzbot
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
2025-11-02 18:07 ` Forwarded: syzbot
2025-11-02 19:22 ` Forwarded: syzbot
2025-11-03 12:27 ` Forwarded: syzbot
2025-10-17 5:53 [syzbot] [net?] kernel BUG in set_ipsecrequest syzbot
2025-10-20 11:19 ` Forwarded: syzbot
2025-10-05 23:30 [syzbot] [ntfs3?] WARNING in indx_insert_into_buffer (3) syzbot
2025-10-07 21:52 ` Forwarded: syzbot
2025-09-17 22:55 [syzbot] [ntfs3?] KMSAN: uninit-value in ntfs_read_hdr (3) syzbot
2025-10-26 15:54 ` Forwarded: syzbot
2025-09-17 22:54 [syzbot] [bfs?] INFO: task hung in bfs_lookup (6) syzbot
2025-10-20 18:09 ` Forwarded: syzbot
2025-09-03 17:36 [syzbot] [kernel?] KASAN: slab-out-of-bounds Read in change_page_attr_set_clr syzbot
2025-09-29 7:50 ` Forwarded: syzbot
2025-08-16 3:08 [syzbot] [usb?] UBSAN: shift-out-of-bounds in ax88772_bind syzbot
2025-08-17 19:42 ` Forwarded: syzbot
2025-08-16 3:08 [syzbot] [overlayfs?] WARNING in shmem_unlink syzbot
2025-08-17 19:52 ` Forwarded: syzbot
2025-08-13 8:00 [syzbot] [sound?] linux-next test error: general protection fault in snd_seq_oss_midi_check_new_port syzbot
2025-09-01 8:48 ` Forwarded: syzbot
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
2025-09-17 10:45 ` Forwarded: syzbot
2025-08-04 7:18 [syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_accounting_validate syzbot
2025-08-04 22:56 ` Forwarded: syzbot
2025-08-01 7:54 [syzbot] [dri?] upstream test error: WARNING in __ww_mutex_wound syzbot
2025-09-01 8:51 ` Forwarded: syzbot
2025-07-31 9:11 [syzbot] [bcachefs?] kernel BUG in bch2_btree_repair_topology_recurse syzbot
2025-08-01 23:03 ` Forwarded: syzbot
2025-07-30 21:21 [syzbot] [bcachefs?] kernel panic: in transaction restart: transaction_restart_relock, last restarted by syzbot
2025-08-03 18:30 ` Forwarded: syzbot
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
2025-07-19 7:57 ` Forwarded: syzbot
2025-07-20 6:54 ` Forwarded: syzbot
2025-07-20 7:29 ` Forwarded: syzbot
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-15 14:15 ` Forwarded: syzbot
2025-07-15 14:29 ` Forwarded: syzbot
2025-07-16 6:28 ` Forwarded: syzbot
2025-07-14 17:09 [syzbot] [bluetooth?] [bcachefs?] KASAN: slab-use-after-free Read in hci_uart_write_work syzbot
2025-07-20 17:34 ` Forwarded: syzbot
2025-07-06 21:30 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in __bch2_alloc_to_v4 syzbot
2025-07-19 22:04 ` Forwarded: syzbot
2025-07-01 12:30 [syzbot] [fs?] linux-next test error: WARNING: suspicious RCU usage in proc_sys_compare syzbot
2025-09-01 8:49 ` Forwarded: syzbot
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-10-13 13:38 ` Forwarded: syzbot
2025-10-14 15:24 ` Forwarded: syzbot
2025-11-02 14:41 ` Forwarded: syzbot
2025-11-02 14:56 ` Forwarded: syzbot
2025-11-02 15:50 ` Forwarded: syzbot
2025-11-02 16:58 ` Forwarded: syzbot
2025-06-10 19:15 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in bch2_sb_members_v1_to_text syzbot
2025-07-20 4:06 ` Forwarded: syzbot
2025-05-31 18:28 [syzbot] [bcachefs?] WARNING in bch2_fs_journal_start syzbot
2025-07-20 17:30 ` Forwarded: syzbot
2025-05-24 1:52 [syzbot] [block?] [bcachefs?] kernel BUG in blk_mq_end_request syzbot
2025-07-20 14:44 ` Forwarded: syzbot
2025-05-12 20:55 [syzbot] [bcachefs?] possible deadlock in __bch2_folio_reservation_get (2) syzbot
2025-07-22 18:22 ` Forwarded: syzbot
2025-05-11 12:57 [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_checksum syzbot
2025-07-20 14:55 ` Forwarded: syzbot
2025-05-09 4:43 [syzbot] [jfs?] WARNING in jfs_rename syzbot
2025-10-12 16:19 ` Forwarded: syzbot
2025-10-12 17:45 ` Forwarded: syzbot
2025-04-19 8:36 [syzbot] [block?] [bcachefs?] kernel panic: KASAN: panic_on_warn set syzbot
2025-07-22 17:56 ` Forwarded: syzbot
2025-04-16 17:47 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_alloc_sectors_start_trans (2) syzbot
2025-07-23 10:59 ` Forwarded: syzbot
2025-03-30 8:27 [syzbot] [afs?] WARNING: ODEBUG bug in delete_node (3) syzbot
2025-07-24 15:32 ` Forwarded: syzbot
2025-03-25 5:16 [syzbot] [bcachefs?] INFO: task hung in __bch2_fsck_err syzbot
2025-07-20 14:42 ` Forwarded: syzbot
2025-03-16 18:05 [syzbot] [mm?] [bcachefs?] general protection fault in xas_create syzbot
2025-07-20 4:03 ` Forwarded: syzbot
2025-02-14 19:59 [syzbot] [mm?] [bcachefs?] KASAN: slab-out-of-bounds Read in folio_try_get syzbot
2025-07-20 4:04 ` Forwarded: syzbot
2025-02-12 11:52 [syzbot] [bcachefs?] kernel BUG in bch2_journal_keys_peek_max syzbot
2025-07-21 17:37 ` Forwarded: syzbot
2025-02-06 17:01 [syzbot] [mm?] [bcachefs?] UBSAN: shift-out-of-bounds in xas_reload syzbot
2025-07-20 4:05 ` Forwarded: syzbot
2025-02-04 14:07 [syzbot] [net?] general protection fault in ip6_pol_route (3) syzbot
2025-07-20 4:02 ` Forwarded: syzbot
2025-01-20 2:27 [syzbot] [bcachefs?] possible deadlock in bch2_trans_begin syzbot
2025-07-22 18:23 ` Forwarded: syzbot
2025-01-08 12:17 [syzbot] [fs?] WARNING in minix_rmdir syzbot
2025-10-14 13:36 ` Forwarded: syzbot
2025-11-02 12:47 ` Forwarded: syzbot
2024-11-29 12:12 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_peek_slot syzbot
2025-07-19 22:03 ` Forwarded: syzbot
2024-11-29 8:43 [syzbot] [bcachefs?] general protection fault in bch2_prt_vprintf syzbot
2025-07-22 16:18 ` Forwarded: syzbot
2024-11-25 13:27 [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_btree_node_read_done syzbot
2025-07-20 14:54 ` Forwarded: syzbot
2024-11-21 15:03 [syzbot] [kvm?] WARNING: locking bug in kvm_xen_set_evtchn_fast syzbot
2026-03-15 13:58 ` Forwarded: syzbot
2024-09-29 7:31 [syzbot] [bcachefs?] possible deadlock in bch2_symlink syzbot
2025-08-04 23:12 ` Forwarded: syzbot
2024-07-18 1:20 [syzbot] [bcachefs?] BUG: unable to handle kernel paging request in bch2_dirent_to_text syzbot
2025-07-21 17:30 ` Forwarded: syzbot
2024-06-15 9:58 [syzbot] [bcachefs?] INFO: task hung in __bch2_fs_stop syzbot
2025-07-23 1:56 ` Forwarded: syzbot
2024-05-31 8:43 [syzbot] [bcachefs?] INFO: task hung in bch2_copygc_stop syzbot
2025-07-23 1:17 ` Forwarded: syzbot
2024-05-18 21:05 [syzbot] [bpf?] [net?] KMSAN: uninit-value in dev_map_hash_lookup_elem syzbot
2026-05-13 20:04 ` Forwarded: syzbot
2024-05-17 3:31 [syzbot] [arm?] [crypto?] [bcachefs?] KASAN: slab-use-after-free Read in neon_poly1305_update syzbot
2025-07-19 22:01 ` Forwarded: syzbot
2024-05-14 10:38 [syzbot] [bcachefs?] WARNING in bch2_printbuf_make_room syzbot
2025-07-19 23:27 ` Forwarded: syzbot
2024-05-13 10:19 [syzbot] BUG: Bad rss-counter state (5) syzbot
2025-07-22 18:31 ` Forwarded: syzbot
2024-05-09 14:45 [syzbot] [gfs2?] WARNING in gfs2_ri_update (2) syzbot
2025-09-18 19:46 ` Forwarded: syzbot
2024-05-04 7:58 [syzbot] [bcachefs?] WARNING in bchfs_truncate syzbot
2025-07-23 1:21 ` Forwarded: syzbot
2024-05-03 17:32 [syzbot] [bcachefs?] INFO: task hung in __closure_sync syzbot
2025-07-23 1:18 ` Forwarded: syzbot
2024-04-18 20:00 [syzbot] [bpf?] possible deadlock in __stack_map_get syzbot
2026-05-12 10:06 ` Forwarded: syzbot
2024-01-09 18:18 [syzbot] [kernel?] WARNING in signal_wake_up_state syzbot
2026-05-20 18:10 ` Forwarded: syzbot
2023-12-21 13:47 [syzbot] [net?] WARNING: ODEBUG bug in advance_sched syzbot
2026-05-11 21:06 ` Forwarded: syzbot
2022-11-25 9:45 [syzbot] kernel BUG in hfs_write_inode syzbot
2026-03-09 23:04 ` Forwarded: syzbot
2021-12-13 7:17 [syzbot] UBSAN: shift-out-of-bounds in minix_statfs syzbot
2025-11-17 18:53 ` Forwarded: syzbot
2020-09-09 9:58 general protection fault in skb_release_data (2) syzbot
2026-05-18 16:41 ` Forwarded: syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.