* [syzbot] [ext4?] KASAN: use-after-free Read in __ext4_check_dir_entry (2)
@ 2024-05-14 14:09 syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2024-05-14 14:09 UTC (permalink / raw)
To: adilger.kernel, linux-ext4, linux-kernel, syzkaller-bugs, tytso
Hello,
syzbot found the following issue on:
HEAD commit: 448b3fe5a0ea Merge tag 'hwmon-for-v6.9-rc8' of git://git.k..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1797c7a8980000
kernel config: https://syzkaller.appspot.com/x/.config?x=9d7ea7de0cb32587
dashboard link: https://syzkaller.appspot.com/bug?extid=11af34d3c0711f233fd4
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=105badd4980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f14fa8980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ccbdd58c1f3e/disk-448b3fe5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6786079c3170/vmlinux-448b3fe5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/496bdcf3d703/bzImage-448b3fe5.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/b2986628c43b/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+11af34d3c0711f233fd4@syzkaller.appspotmail.com
EXT4-fs error (device loop0): make_indexed_dir:2282: inode #2: block 255: comm syz-executor396: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5120, rec_len=0, size=993 fake=0
EXT4-fs warning (device loop0): dx_probe:832: inode #2: comm syz-executor396: Unrecognised inode hash code 49
EXT4-fs warning (device loop0): dx_probe:965: inode #2: comm syz-executor396: Corrupt directory, running e2fsck is recommended
==================================================================
BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x6fd/0x880 fs/ext4/dir.c:85
Read of size 2 at addr ffff8880683ae003 by task syz-executor396/5071
CPU: 0 PID: 5071 Comm: syz-executor396 Not tainted 6.9.0-rc7-syzkaller-00117-g448b3fe5a0ea #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__ext4_check_dir_entry+0x6fd/0x880 fs/ext4/dir.c:85
ext4_readdir+0x145d/0x3800 fs/ext4/dir.c:258
iterate_dir+0x539/0x6f0 fs/readdir.c:110
__do_sys_getdents64 fs/readdir.c:409 [inline]
__se_sys_getdents64+0x20d/0x4f0 fs/readdir.c:394
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8311a13ed9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd43d6adc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007ffd43d6ae10 RCX: 00007f8311a13ed9
RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007ffd43d6ae18 R08: 000055556bcad0c0 R09: 000055556bcad0c0
R10: 000055556bcad0c0 R11: 0000000000000246 R12: 00007f8311a906a0
R13: 00007ffd43d6ae10 R14: 0000000000000004 R15: 0000000000000003
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x683ae
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 ffffea0001a0ebc8 ffff8880b9444570 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5065, tgid -1706810074 (sftp-server), ts 5065, free_ts 54138803695
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
alloc_pages_mpol+0x3e8/0x680 mm/mempolicy.c:2264
vma_alloc_folio+0xf3/0x1f0 mm/mempolicy.c:2303
folio_prealloc+0x31/0x170
alloc_anon_folio mm/memory.c:4375 [inline]
do_anonymous_page mm/memory.c:4433 [inline]
do_pte_missing mm/memory.c:3878 [inline]
handle_pte_fault mm/memory.c:5300 [inline]
__handle_mm_fault+0x3a03/0x7250 mm/memory.c:5441
handle_mm_fault+0x27f/0x770 mm/memory.c:5606
do_user_addr_fault arch/x86/mm/fault.c:1331 [inline]
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x446/0x8a0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
page last free pid 5065 tgid 5065 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x97b/0xaa0 mm/page_alloc.c:2347
free_unref_folios+0x1f2/0xc10 mm/page_alloc.c:2536
folios_put_refs+0x93a/0xa60 mm/swap.c:1034
free_pages_and_swap_cache+0x2ea/0x690 mm/swap_state.c:329
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465
exit_mmap+0x4bb/0xd60 mm/mmap.c:3280
__mmput+0x115/0x3c0 kernel/fork.c:1346
exit_mm+0x220/0x310 kernel/exit.c:569
do_exit+0x99e/0x27e0 kernel/exit.c:865
do_group_exit+0x207/0x2c0 kernel/exit.c:1027
__do_sys_exit_group kernel/exit.c:1038 [inline]
__se_sys_exit_group kernel/exit.c:1036 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8880683adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880683adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880683ae000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8880683ae080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8880683ae100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [ext4?] KASAN: use-after-free Read in __ext4_check_dir_entry (2)
[not found] <20240515230145.GB202157@mit.edu>
@ 2024-05-16 0:01 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2024-05-16 0:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, tytso
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
e=vmci, major=10, minor=118)
[ 7.595612][ T1] Initialized host personality
[ 7.597261][ T1] usbcore: registered new interface driver rtsx_usb
[ 7.599908][ T1] usbcore: registered new interface driver viperboard
[ 7.603226][ T1] usbcore: registered new interface driver dln2
[ 7.605088][ T1] usbcore: registered new interface driver pn533_usb
[ 7.611678][ T1] nfcsim 0.2 initialized
[ 7.613262][ T1] usbcore: registered new interface driver port100
[ 7.614710][ T1] usbcore: registered new interface driver nfcmrvl
[ 7.622445][ T1] Loading iSCSI transport class v2.0-870.
[ 7.640265][ T1] virtio_scsi virtio0: 1/0/0 default/read/poll queues
[ 7.650480][ T1] ------------[ cut here ]------------
[ 7.651656][ T1] refcount_t: decrement hit 0; leaking memory.
[ 7.653009][ T1] WARNING: CPU: 0 PID: 1 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0
[ 7.654567][ T1] Modules linked in:
[ 7.655274][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc4-syzkaller-00039-g26770a717cac #0
[ 7.656739][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 7.658271][ T1] RIP: 0010:refcount_warn_saturate+0xfa/0x1d0
[ 7.659267][ T1] Code: b2 00 00 00 e8 57 49 f0 fc 5b 5d c3 cc cc cc cc e8 4b 49 f0 fc c6 05 4c 96 ec 0a 01 90 48 c7 c7 40 5d 1e 8c e8 c7 c5 b2 fc 90 <0f> 0b 90 90 eb d9 e8 2b 49 f0 fc c6 05 29 96 ec 0a 01 90 48 c7 c7
[ 7.662662][ T1] RSP: 0000:ffffc90000066e18 EFLAGS: 00010246
[ 7.663683][ T1] RAX: 6a628a5cb0f41700 RBX: ffff8881401ae78c RCX: ffff888016ac0000
[ 7.665039][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 7.666341][ T1] RBP: 0000000000000004 R08: ffffffff81587fc2 R09: fffffbfff1c39b48
[ 7.667553][ T1] R10: dffffc0000000000 R11: fffffbfff1c39b48 R12: ffffea0000858dc0
[ 7.669559][ T1] R13: ffffea0000858dc8 R14: 1ffffd400010b1b9 R15: 0000000000000000
[ 7.671059][ T1] FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
[ 7.672346][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.673289][ T1] CR2: ffff88823ffff000 CR3: 000000000e134000 CR4: 00000000003506f0
[ 7.674581][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7.675775][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 7.676905][ T1] Call Trace:
[ 7.677523][ T1] <TASK>
[ 7.678310][ T1] ? __warn+0x163/0x4e0
[ 7.679650][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.680990][ T1] ? report_bug+0x2b3/0x500
[ 7.681762][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.682951][ T1] ? handle_bug+0x3e/0x70
[ 7.683875][ T1] ? exc_invalid_op+0x1a/0x50
[ 7.684757][ T1] ? asm_exc_invalid_op+0x1a/0x20
[ 7.686125][ T1] ? __warn_printk+0x292/0x360
[ 7.687439][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.688770][ T1] ? refcount_warn_saturate+0xf9/0x1d0
[ 7.689853][ T1] __free_pages_ok+0xc54/0xd80
[ 7.690752][ T1] make_alloc_exact+0xa3/0xf0
[ 7.691436][ T1] vring_alloc_queue_split+0x20a/0x600
[ 7.692294][ T1] ? __pfx_vring_alloc_queue_split+0x10/0x10
[ 7.693145][ T1] ? vp_find_vqs+0x4c/0x4e0
[ 7.693988][ T1] ? virtscsi_probe+0x3ea/0xf60
[ 7.694794][ T1] ? virtio_dev_probe+0x991/0xaf0
[ 7.695541][ T1] ? really_probe+0x2b8/0xad0
[ 7.696410][ T1] ? driver_probe_device+0x50/0x430
[ 7.698097][ T1] vring_create_virtqueue_split+0xc6/0x310
[ 7.699062][ T1] ? ret_from_fork+0x4b/0x80
[ 7.699790][ T1] ? __pfx_vring_create_virtqueue_split+0x10/0x10
[ 7.700886][ T1] vring_create_virtqueue+0xca/0x110
[ 7.701895][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.703155][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.704118][ T1] setup_vq+0xe9/0x2d0
[ 7.704736][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.705391][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.706755][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.708116][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.708982][ T1] vp_setup_vq+0xbf/0x330
[ 7.709609][ T1] ? __pfx_vp_config_changed+0x10/0x10
[ 7.710370][ T1] ? ioread16+0x2f/0x90
[ 7.711005][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.711861][ T1] vp_find_vqs_msix+0x8b2/0xc80
[ 7.712762][ T1] vp_find_vqs+0x4c/0x4e0
[ 7.713463][ T1] virtscsi_init+0x8db/0xd00
[ 7.714142][ T1] ? __pfx_virtscsi_init+0x10/0x10
[ 7.715032][ T1] ? __pfx_default_calc_sets+0x10/0x10
[ 7.715928][ T1] ? scsi_host_alloc+0xa57/0xea0
[ 7.716710][ T1] ? vp_get+0xfd/0x140
[ 7.717535][ T1] virtscsi_probe+0x3ea/0xf60
[ 7.718252][ T1] ? __pfx_virtscsi_probe+0x10/0x10
[ 7.719062][ T1] ? vm_set+0xdd/0x3a0
[ 7.720396][ T1] ? __pfx_vp_set_status+0x10/0x10
[ 7.721514][ T1] ? vp_set_status+0x1a/0x40
[ 7.722164][ T1] ? virtio_no_restricted_mem_acc+0x9/0x10
[ 7.723108][ T1] ? virtio_features_ok+0x10c/0x270
[ 7.723887][ T1] virtio_dev_probe+0x991/0xaf0
[ 7.724709][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 7.725729][ T1] really_probe+0x2b8/0xad0
[ 7.726650][ T1] __driver_probe_device+0x1a2/0x390
[ 7.727503][ T1] driver_probe_device+0x50/0x430
[ 7.728243][ T1] __driver_attach+0x45f/0x710
[ 7.729022][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.729890][ T1] bus_for_each_dev+0x239/0x2b0
[ 7.730601][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.731421][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 7.732219][ T1] ? do_raw_spin_unlock+0x13c/0x8b0
[ 7.733309][ T1] bus_add_driver+0x347/0x620
[ 7.733992][ T1] driver_register+0x23a/0x320
[ 7.734667][ T1] virtio_scsi_init+0x69/0xe0
[ 7.735752][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.736692][ T1] do_one_initcall+0x248/0x880
[ 7.737732][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.738937][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 7.739803][ T1] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 7.740876][ T1] ? __pfx_parse_args+0x10/0x10
[ 7.741838][ T1] ? do_initcalls+0x1c/0x80
[ 7.742731][ T1] ? rcu_is_watching+0x15/0xb0
[ 7.743513][ T1] do_initcall_level+0x157/0x210
[ 7.744299][ T1] do_initcalls+0x3f/0x80
[ 7.745007][ T1] kernel_init_freeable+0x435/0x5d0
[ 7.746216][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 7.747097][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 7.748009][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.748782][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.749752][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.750548][ T1] kernel_init+0x1d/0x2b0
[ 7.751404][ T1] ret_from_fork+0x4b/0x80
[ 7.752121][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.752911][ T1] ret_from_fork_asm+0x1a/0x30
[ 7.753697][ T1] </TASK>
[ 7.754133][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 7.755272][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc4-syzkaller-00039-g26770a717cac #0
[ 7.757227][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 7.759031][ T1] Call Trace:
[ 7.759506][ T1] <TASK>
[ 7.759733][ T1] dump_stack_lvl+0x241/0x360
[ 7.759733][ T1] ? __pfx_dump_stack_lvl+0x10/0x10
[ 7.759733][ T1] ? __pfx__printk+0x10/0x10
[ 7.759733][ T1] ? _printk+0xd5/0x120
[ 7.759733][ T1] ? vscnprintf+0x5d/0x90
[ 7.759733][ T1] panic+0x349/0x860
[ 7.759733][ T1] ? __warn+0x172/0x4e0
[ 7.759733][ T1] ? __pfx_panic+0x10/0x10
[ 7.759733][ T1] ? show_trace_log_lvl+0x4e6/0x520
[ 7.759733][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 7.759733][ T1] __warn+0x346/0x4e0
[ 7.759733][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.759733][ T1] report_bug+0x2b3/0x500
[ 7.769119][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.769119][ T1] handle_bug+0x3e/0x70
[ 7.769119][ T1] exc_invalid_op+0x1a/0x50
[ 7.769119][ T1] asm_exc_invalid_op+0x1a/0x20
[ 7.769119][ T1] RIP: 0010:refcount_warn_saturate+0xfa/0x1d0
[ 7.769119][ T1] Code: b2 00 00 00 e8 57 49 f0 fc 5b 5d c3 cc cc cc cc e8 4b 49 f0 fc c6 05 4c 96 ec 0a 01 90 48 c7 c7 40 5d 1e 8c e8 c7 c5 b2 fc 90 <0f> 0b 90 90 eb d9 e8 2b 49 f0 fc c6 05 29 96 ec 0a 01 90 48 c7 c7
[ 7.769119][ T1] RSP: 0000:ffffc90000066e18 EFLAGS: 00010246
[ 7.769119][ T1] RAX: 6a628a5cb0f41700 RBX: ffff8881401ae78c RCX: ffff888016ac0000
[ 7.769119][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 7.778978][ T1] RBP: 0000000000000004 R08: ffffffff81587fc2 R09: fffffbfff1c39b48
[ 7.778978][ T1] R10: dffffc0000000000 R11: fffffbfff1c39b48 R12: ffffea0000858dc0
[ 7.778978][ T1] R13: ffffea0000858dc8 R14: 1ffffd400010b1b9 R15: 0000000000000000
[ 7.778978][ T1] ? __warn_printk+0x292/0x360
[ 7.778978][ T1] ? refcount_warn_saturate+0xf9/0x1d0
[ 7.778978][ T1] __free_pages_ok+0xc54/0xd80
[ 7.778978][ T1] make_alloc_exact+0xa3/0xf0
[ 7.778978][ T1] vring_alloc_queue_split+0x20a/0x600
[ 7.789051][ T1] ? __pfx_vring_alloc_queue_split+0x10/0x10
[ 7.789051][ T1] ? vp_find_vqs+0x4c/0x4e0
[ 7.789051][ T1] ? virtscsi_probe+0x3ea/0xf60
[ 7.789051][ T1] ? virtio_dev_probe+0x991/0xaf0
[ 7.789051][ T1] ? really_probe+0x2b8/0xad0
[ 7.789051][ T1] ? driver_probe_device+0x50/0x430
[ 7.789051][ T1] vring_create_virtqueue_split+0xc6/0x310
[ 7.789051][ T1] ? ret_from_fork+0x4b/0x80
[ 7.789051][ T1] ? __pfx_vring_create_virtqueue_split+0x10/0x10
[ 7.789051][ T1] vring_create_virtqueue+0xca/0x110
[ 7.789051][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.789051][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.798967][ T1] setup_vq+0xe9/0x2d0
[ 7.798967][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.798967][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.798967][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.798967][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.798967][ T1] vp_setup_vq+0xbf/0x330
[ 7.798967][ T1] ? __pfx_vp_config_changed+0x10/0x10
[ 7.798967][ T1] ? ioread16+0x2f/0x90
[ 7.798967][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.798967][ T1] vp_find_vqs_msix+0x8b2/0xc80
[ 7.798967][ T1] vp_find_vqs+0x4c/0x4e0
[ 7.798967][ T1] virtscsi_init+0x8db/0xd00
[ 7.798967][ T1] ? __pfx_virtscsi_init+0x10/0x10
[ 7.809054][ T1] ? __pfx_default_calc_sets+0x10/0x10
[ 7.809054][ T1] ? scsi_host_alloc+0xa57/0xea0
[ 7.809054][ T1] ? vp_get+0xfd/0x140
[ 7.809054][ T1] virtscsi_probe+0x3ea/0xf60
[ 7.809054][ T1] ? __pfx_virtscsi_probe+0x10/0x10
[ 7.809054][ T1] ? vm_set+0xdd/0x3a0
[ 7.809054][ T1] ? __pfx_vp_set_status+0x10/0x10
[ 7.809054][ T1] ? vp_set_status+0x1a/0x40
[ 7.809054][ T1] ? virtio_no_restricted_mem_acc+0x9/0x10
[ 7.809054][ T1] ? virtio_features_ok+0x10c/0x270
[ 7.809054][ T1] virtio_dev_probe+0x991/0xaf0
[ 7.809054][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 7.818989][ T1] really_probe+0x2b8/0xad0
[ 7.818989][ T1] __driver_probe_device+0x1a2/0x390
[ 7.818989][ T1] driver_probe_device+0x50/0x430
[ 7.818989][ T1] __driver_attach+0x45f/0x710
[ 7.818989][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.818989][ T1] bus_for_each_dev+0x239/0x2b0
[ 7.818989][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.818989][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 7.818989][ T1] ? do_raw_spin_unlock+0x13c/0x8b0
[ 7.818989][ T1] bus_add_driver+0x347/0x620
[ 7.818989][ T1] driver_register+0x23a/0x320
[ 7.818989][ T1] virtio_scsi_init+0x69/0xe0
[ 7.818989][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.828983][ T1] do_one_initcall+0x248/0x880
[ 7.829040][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.829040][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 7.829040][ T1] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 7.829040][ T1] ? __pfx_parse_args+0x10/0x10
[ 7.829040][ T1] ? do_initcalls+0x1c/0x80
[ 7.829040][ T1] ? rcu_is_watching+0x15/0xb0
[ 7.829040][ T1] do_initcall_level+0x157/0x210
[ 7.829040][ T1] do_initcalls+0x3f/0x80
[ 7.829040][ T1] kernel_init_freeable+0x435/0x5d0
[ 7.829040][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 7.829040][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 7.829040][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.838961][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.838961][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.838961][ T1] kernel_init+0x1d/0x2b0
[ 7.838961][ T1] ret_from_fork+0x4b/0x80
[ 7.838961][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.838961][ T1] ret_from_fork_asm+0x1a/0x30
[ 7.838961][ T1] </TASK>
[ 7.838961][ T1] Kernel Offset: disabled
[ 7.838961][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2122882332=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at de979bc20
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=de979bc20b2b73242b7d6fbbdf614a8cb4c574f4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240509-085021'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=de979bc20b2b73242b7d6fbbdf614a8cb4c574f4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240509-085021'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -std=c++11 -I. -Iexecutor/_include -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"de979bc20b2b73242b7d6fbbdf614a8cb4c574f4\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=168a0e20980000
Tested on:
commit: 26770a71 jbd2: add prefix 'jbd2' for 'shrink_type'
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git dev
kernel config: https://syzkaller.appspot.com/x/.config?x=f47e5e015c177e57
dashboard link: https://syzkaller.appspot.com/bug?extid=11af34d3c0711f233fd4
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [ext4?] KASAN: use-after-free Read in __ext4_check_dir_entry (2)
[not found] <20240516183454.GA287325@mit.edu>
@ 2024-05-16 19:25 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2024-05-16 19:25 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, tytso
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
[ T1] Guest personality initialized and is inactive
[ 8.065736][ T1] VMCI host device registered (name=vmci, major=10, minor=118)
[ 8.066898][ T1] Initialized host personality
[ 8.067968][ T1] usbcore: registered new interface driver rtsx_usb
[ 8.069719][ T1] usbcore: registered new interface driver viperboard
[ 8.071465][ T1] usbcore: registered new interface driver dln2
[ 8.073269][ T1] usbcore: registered new interface driver pn533_usb
[ 8.080360][ T1] nfcsim 0.2 initialized
[ 8.081593][ T1] usbcore: registered new interface driver port100
[ 8.083254][ T1] usbcore: registered new interface driver nfcmrvl
[ 8.090665][ T1] Loading iSCSI transport class v2.0-870.
[ 8.107172][ T1] virtio_scsi virtio0: 1/0/0 default/read/poll queues
[ 8.119694][ T1] ------------[ cut here ]------------
[ 8.120886][ T1] refcount_t: decrement hit 0; leaking memory.
[ 8.122941][ T1] WARNING: CPU: 1 PID: 1 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0
[ 8.124604][ T1] Modules linked in:
[ 8.125320][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc1-syzkaller #0
[ 8.127017][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 8.128730][ T1] RIP: 0010:refcount_warn_saturate+0xfa/0x1d0
[ 8.129741][ T1] Code: b2 00 00 00 e8 57 79 f2 fc 5b 5d c3 cc cc cc cc e8 4b 79 f2 fc c6 05 01 fb ce 0a 01 90 48 c7 c7 e0 54 fe 8b e8 a7 f7 b4 fc 90 <0f> 0b 90 90 eb d9 e8 2b 79 f2 fc c6 05 de fa ce 0a 01 90 48 c7 c7
[ 8.133290][ T1] RSP: 0000:ffffc90000066e18 EFLAGS: 00010246
[ 8.134369][ T1] RAX: b8e9523c774d7100 RBX: ffff8880203d0a8c RCX: ffff8880166c8000
[ 8.135762][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 8.137141][ T1] RBP: 0000000000000004 R08: ffffffff8157ffe2 R09: fffffbfff1bf96e0
[ 8.138764][ T1] R10: dffffc0000000000 R11: fffffbfff1bf96e0 R12: ffffea000502edc0
[ 8.141948][ T1] R13: ffffea000502edc8 R14: 1ffffd4000a05db9 R15: 0000000000000000
[ 8.144186][ T1] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
[ 8.146310][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.147355][ T1] CR2: 0000000000000000 CR3: 000000000df32000 CR4: 00000000003506f0
[ 8.149092][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.150505][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.151931][ T1] Call Trace:
[ 8.152557][ T1] <TASK>
[ 8.153004][ T1] ? __warn+0x163/0x4e0
[ 8.154626][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 8.156204][ T1] ? report_bug+0x2b3/0x500
[ 8.156899][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 8.158521][ T1] ? handle_bug+0x3e/0x70
[ 8.159414][ T1] ? exc_invalid_op+0x1a/0x50
[ 8.160449][ T1] ? asm_exc_invalid_op+0x1a/0x20
[ 8.161415][ T1] ? __warn_printk+0x292/0x360
[ 8.162726][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 8.164466][ T1] ? refcount_warn_saturate+0xf9/0x1d0
[ 8.165736][ T1] __free_pages_ok+0xc54/0xd80
[ 8.166494][ T1] make_alloc_exact+0xa3/0xf0
[ 8.167154][ T1] vring_alloc_queue_split+0x20a/0x600
[ 8.168021][ T1] ? __pfx_vring_alloc_queue_split+0x10/0x10
[ 8.168973][ T1] ? vp_find_vqs+0x4c/0x4e0
[ 8.169799][ T1] ? virtscsi_probe+0x3ea/0xf60
[ 8.170503][ T1] ? virtio_dev_probe+0x991/0xaf0
[ 8.172229][ T1] ? really_probe+0x2b8/0xad0
[ 8.173145][ T1] ? driver_probe_device+0x50/0x430
[ 8.175331][ T1] vring_create_virtqueue_split+0xc6/0x310
[ 8.176580][ T1] ? ret_from_fork+0x4b/0x80
[ 8.177623][ T1] ? __pfx_vring_create_virtqueue_split+0x10/0x10
[ 8.178852][ T1] vring_create_virtqueue+0xca/0x110
[ 8.179950][ T1] ? __pfx_vp_notify+0x10/0x10
[ 8.181275][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.182572][ T1] setup_vq+0xe9/0x2d0
[ 8.184410][ T1] ? __pfx_vp_notify+0x10/0x10
[ 8.185361][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.186662][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.188204][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.190228][ T1] vp_setup_vq+0xbf/0x330
[ 8.191078][ T1] ? __pfx_vp_config_changed+0x10/0x10
[ 8.192362][ T1] ? ioread16+0x2f/0x90
[ 8.193064][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.194742][ T1] vp_find_vqs_msix+0x8b2/0xc80
[ 8.196215][ T1] vp_find_vqs+0x4c/0x4e0
[ 8.197081][ T1] virtscsi_init+0x8db/0xd00
[ 8.198316][ T1] ? __pfx_virtscsi_init+0x10/0x10
[ 8.200122][ T1] ? __pfx_default_calc_sets+0x10/0x10
[ 8.200874][ T1] ? scsi_host_alloc+0xa57/0xea0
[ 8.201727][ T1] ? vp_get+0xfd/0x140
[ 8.202349][ T1] virtscsi_probe+0x3ea/0xf60
[ 8.203024][ T1] ? __pfx_virtscsi_probe+0x10/0x10
[ 8.204543][ T1] ? kernfs_add_one+0x156/0x8b0
[ 8.205433][ T1] ? virtio_no_restricted_mem_acc+0x9/0x10
[ 8.206402][ T1] ? virtio_features_ok+0x10c/0x270
[ 8.207289][ T1] virtio_dev_probe+0x991/0xaf0
[ 8.208213][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 8.209222][ T1] really_probe+0x2b8/0xad0
[ 8.210139][ T1] __driver_probe_device+0x1a2/0x390
[ 8.210945][ T1] driver_probe_device+0x50/0x430
[ 8.211643][ T1] __driver_attach+0x45f/0x710
[ 8.212336][ T1] ? __pfx___driver_attach+0x10/0x10
[ 8.214017][ T1] bus_for_each_dev+0x239/0x2b0
[ 8.215024][ T1] ? __pfx___driver_attach+0x10/0x10
[ 8.216260][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 8.217520][ T1] ? do_raw_spin_unlock+0x13c/0x8b0
[ 8.218492][ T1] bus_add_driver+0x347/0x620
[ 8.219338][ T1] driver_register+0x23a/0x320
[ 8.220395][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 8.221416][ T1] virtio_scsi_init+0x65/0xe0
[ 8.222076][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 8.222889][ T1] do_one_initcall+0x248/0x880
[ 8.223972][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 8.225067][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 8.226207][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 8.227041][ T1] ? __pfx_parse_args+0x10/0x10
[ 8.227810][ T1] ? do_initcalls+0x1c/0x80
[ 8.228630][ T1] ? rcu_is_watching+0x15/0xb0
[ 8.229515][ T1] do_initcall_level+0x157/0x210
[ 8.230699][ T1] do_initcalls+0x3f/0x80
[ 8.231545][ T1] kernel_init_freeable+0x435/0x5d0
[ 8.232482][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 8.233398][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 8.234520][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.236078][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.236866][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.237618][ T1] kernel_init+0x1d/0x2b0
[ 8.238281][ T1] ret_from_fork+0x4b/0x80
[ 8.238919][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.239745][ T1] ret_from_fork_asm+0x1a/0x30
[ 8.240541][ T1] </TASK>
[ 8.241009][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 8.241978][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc1-syzkaller #0
[ 8.243074][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 8.244259][ T1] Call Trace:
[ 8.244259][ T1] <TASK>
[ 8.244259][ T1] dump_stack_lvl+0x241/0x360
[ 8.244259][ T1] ? __pfx_dump_stack_lvl+0x10/0x10
[ 8.244259][ T1] ? __pfx__printk+0x10/0x10
[ 8.244259][ T1] ? _printk+0xd5/0x120
[ 8.244259][ T1] ? vscnprintf+0x5d/0x90
[ 8.244259][ T1] panic+0x349/0x860
[ 8.244259][ T1] ? __warn+0x172/0x4e0
[ 8.244259][ T1] ? __pfx_panic+0x10/0x10
[ 8.244259][ T1] ? show_trace_log_lvl+0x4e6/0x520
[ 8.244259][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 8.244259][ T1] __warn+0x346/0x4e0
[ 8.253569][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 8.253569][ T1] report_bug+0x2b3/0x500
[ 8.253569][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 8.253569][ T1] handle_bug+0x3e/0x70
[ 8.253569][ T1] exc_invalid_op+0x1a/0x50
[ 8.253569][ T1] asm_exc_invalid_op+0x1a/0x20
[ 8.253569][ T1] RIP: 0010:refcount_warn_saturate+0xfa/0x1d0
[ 8.253569][ T1] Code: b2 00 00 00 e8 57 79 f2 fc 5b 5d c3 cc cc cc cc e8 4b 79 f2 fc c6 05 01 fb ce 0a 01 90 48 c7 c7 e0 54 fe 8b e8 a7 f7 b4 fc 90 <0f> 0b 90 90 eb d9 e8 2b 79 f2 fc c6 05 de fa ce 0a 01 90 48 c7 c7
[ 8.253569][ T1] RSP: 0000:ffffc90000066e18 EFLAGS: 00010246
[ 8.263675][ T1] RAX: b8e9523c774d7100 RBX: ffff8880203d0a8c RCX: ffff8880166c8000
[ 8.263675][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 8.263675][ T1] RBP: 0000000000000004 R08: ffffffff8157ffe2 R09: fffffbfff1bf96e0
[ 8.263675][ T1] R10: dffffc0000000000 R11: fffffbfff1bf96e0 R12: ffffea000502edc0
[ 8.263675][ T1] R13: ffffea000502edc8 R14: 1ffffd4000a05db9 R15: 0000000000000000
[ 8.263675][ T1] ? __warn_printk+0x292/0x360
[ 8.263675][ T1] ? refcount_warn_saturate+0xf9/0x1d0
[ 8.263675][ T1] __free_pages_ok+0xc54/0xd80
[ 8.273618][ T1] make_alloc_exact+0xa3/0xf0
[ 8.273618][ T1] vring_alloc_queue_split+0x20a/0x600
[ 8.273618][ T1] ? __pfx_vring_alloc_queue_split+0x10/0x10
[ 8.273618][ T1] ? vp_find_vqs+0x4c/0x4e0
[ 8.273618][ T1] ? virtscsi_probe+0x3ea/0xf60
[ 8.273618][ T1] ? virtio_dev_probe+0x991/0xaf0
[ 8.273618][ T1] ? really_probe+0x2b8/0xad0
[ 8.273618][ T1] ? driver_probe_device+0x50/0x430
[ 8.273618][ T1] vring_create_virtqueue_split+0xc6/0x310
[ 8.273618][ T1] ? ret_from_fork+0x4b/0x80
[ 8.273618][ T1] ? __pfx_vring_create_virtqueue_split+0x10/0x10
[ 8.283681][ T1] vring_create_virtqueue+0xca/0x110
[ 8.283681][ T1] ? __pfx_vp_notify+0x10/0x10
[ 8.283681][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.283681][ T1] setup_vq+0xe9/0x2d0
[ 8.283681][ T1] ? __pfx_vp_notify+0x10/0x10
[ 8.283681][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.283681][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.283681][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.283681][ T1] vp_setup_vq+0xbf/0x330
[ 8.293704][ T1] ? __pfx_vp_config_changed+0x10/0x10
[ 8.293704][ T1] ? ioread16+0x2f/0x90
[ 8.293704][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 8.293704][ T1] vp_find_vqs_msix+0x8b2/0xc80
[ 8.293704][ T1] vp_find_vqs+0x4c/0x4e0
[ 8.293704][ T1] virtscsi_init+0x8db/0xd00
[ 8.293704][ T1] ? __pfx_virtscsi_init+0x10/0x10
[ 8.293704][ T1] ? __pfx_default_calc_sets+0x10/0x10
[ 8.293704][ T1] ? scsi_host_alloc+0xa57/0xea0
[ 8.293704][ T1] ? vp_get+0xfd/0x140
[ 8.293704][ T1] virtscsi_probe+0x3ea/0xf60
[ 8.303715][ T1] ? __pfx_virtscsi_probe+0x10/0x10
[ 8.303715][ T1] ? kernfs_add_one+0x156/0x8b0
[ 8.303715][ T1] ? virtio_no_restricted_mem_acc+0x9/0x10
[ 8.303715][ T1] ? virtio_features_ok+0x10c/0x270
[ 8.303715][ T1] virtio_dev_probe+0x991/0xaf0
[ 8.303715][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 8.303715][ T1] really_probe+0x2b8/0xad0
[ 8.303715][ T1] __driver_probe_device+0x1a2/0x390
[ 8.303715][ T1] driver_probe_device+0x50/0x430
[ 8.303715][ T1] __driver_attach+0x45f/0x710
[ 8.303715][ T1] ? __pfx___driver_attach+0x10/0x10
[ 8.313586][ T1] bus_for_each_dev+0x239/0x2b0
[ 8.313586][ T1] ? __pfx___driver_attach+0x10/0x10
[ 8.313586][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 8.313586][ T1] ? do_raw_spin_unlock+0x13c/0x8b0
[ 8.313586][ T1] bus_add_driver+0x347/0x620
[ 8.313586][ T1] driver_register+0x23a/0x320
[ 8.313586][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 8.313586][ T1] virtio_scsi_init+0x65/0xe0
[ 8.313586][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 8.313586][ T1] do_one_initcall+0x248/0x880
[ 8.313586][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 8.323752][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 8.323752][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 8.323752][ T1] ? __pfx_parse_args+0x10/0x10
[ 8.323752][ T1] ? do_initcalls+0x1c/0x80
[ 8.323752][ T1] ? rcu_is_watching+0x15/0xb0
[ 8.323752][ T1] do_initcall_level+0x157/0x210
[ 8.323752][ T1] do_initcalls+0x3f/0x80
[ 8.323752][ T1] kernel_init_freeable+0x435/0x5d0
[ 8.323752][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 8.323752][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 8.323752][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.333607][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.333607][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.333607][ T1] kernel_init+0x1d/0x2b0
[ 8.333607][ T1] ret_from_fork+0x4b/0x80
[ 8.333607][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.333607][ T1] ret_from_fork_asm+0x1a/0x30
[ 8.333607][ T1] </TASK>
[ 8.333607][ T1] Kernel Offset: disabled
[ 8.333607][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build414264796=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at de979bc20
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=de979bc20b2b73242b7d6fbbdf614a8cb4c574f4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240509-085021'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=de979bc20b2b73242b7d6fbbdf614a8cb4c574f4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240509-085021'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -std=c++11 -I. -Iexecutor/_include -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"de979bc20b2b73242b7d6fbbdf614a8cb4c574f4\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15f49684980000
Tested on:
commit: 4cece764 Linux 6.9-rc1
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git origin
kernel config: https://syzkaller.appspot.com/x/.config?x=e98db3f73f65c232
dashboard link: https://syzkaller.appspot.com/bug?extid=11af34d3c0711f233fd4
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [ext4?] KASAN: use-after-free Read in __ext4_check_dir_entry (2)
[not found] <20240626074013.30611-1-norbert.kaminski@3mdeb.com>
@ 2024-06-26 7:55 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2024-06-26 7:55 UTC (permalink / raw)
To: linux-kernel, norbert.kaminski, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed
2024/06/26 07:54:36 ignoring optional flag "sandboxArg"="0"
2024/06/26 07:54:37 parsed 1 programs
2024/06/26 07:54:37 [FATAL] failed to run ["./syz-executor" "setup" "fault" "binfmt_misc" "usb" "802154" "swap"]: exit status 67
mkdir(/syzcgroup) failed: 17
mount(binfmt_misc) failed: 16
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed
(errno 16: Device or resource busy)
Tested on:
commit: 55027e68 Merge tag 'input-for-v6.10-rc5' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1000b3b6980000
kernel config: https://syzkaller.appspot.com/x/.config?x=7bff6f9b539bef0c
dashboard link: https://syzkaller.appspot.com/bug?extid=11af34d3c0711f233fd4
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [ext4?] KASAN: use-after-free Read in __ext4_check_dir_entry (2)
[not found] <20240626080337.32736-1-norbert.kaminski@infogain.com>
@ 2024-06-26 8:10 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2024-06-26 8:10 UTC (permalink / raw)
To: linux-kernel, norbert.kaminski, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
scripts/extract-cert.c:46:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
scripts/extract-cert.c:59:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
scripts/sign-file.c:89:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
scripts/sign-file.c:102:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
orc_dump.c:106:9: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
orc_dump.c:111:9: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
elf.c:135:9: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:140:9: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free]
subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free]
Tested on:
commit: e40ff213 ext4: force revalidation of directory pointer..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=9d7ea7de0cb32587
dashboard link: https://syzkaller.appspot.com/bug?extid=11af34d3c0711f233fd4
compiler: Debian clang version 15.0.6
Note: no patches were applied.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-06-26 8:10 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20240516183454.GA287325@mit.edu>
2024-05-16 19:25 ` [syzbot] [ext4?] KASAN: use-after-free Read in __ext4_check_dir_entry (2) syzbot
[not found] <20240626080337.32736-1-norbert.kaminski@infogain.com>
2024-06-26 8:10 ` syzbot
[not found] <20240626074013.30611-1-norbert.kaminski@3mdeb.com>
2024-06-26 7:55 ` syzbot
[not found] <20240515230145.GB202157@mit.edu>
2024-05-16 0:01 ` syzbot
2024-05-14 14:09 syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox