* [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
@ 2025-07-18 16:09 syzbot
2025-07-18 17:09 ` Kent Overstreet
` (2 more replies)
0 siblings, 3 replies; 12+ messages in thread
From: syzbot @ 2025-07-18 16:09 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 024e09e444bd Add linux-next specific files for 20250717
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=107317d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=99c60e2181be9059
dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ad7d8c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0a89a1e83302/disk-024e09e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e2264946780a/vmlinux-024e09e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d684a7204e1c/bzImage-024e09e4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/5f7f631c7091/mount_2.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2b98caf09c41174a9697@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
BUG: KASAN: slab-use-after-free in bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
BUG: KASAN: slab-use-after-free in bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
Write of size 8 at addr ffff888029ae2040 by task kworker/u9:0/51
CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: bcachefs_journal journal_write_done
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
bch2_do_discards+0x20/0x160 fs/bcachefs/alloc_background.c:1935
journal_write_done+0x11b9/0x13f0 fs/bcachefs/journal_io.c:1822
process_one_work kernel/workqueue.c:3239 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 7622:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4396
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
__bch2_dev_alloc+0xa7/0xc30 fs/bcachefs/super.c:1487
bch2_dev_alloc+0xcd/0x180 fs/bcachefs/super.c:1558
bch2_fs_alloc fs/bcachefs/super.c:1068 [inline]
bch2_fs_open+0x256f/0x2760 fs/bcachefs/super.c:2395
bch2_fs_get_tree+0x44f/0x1540 fs/bcachefs/fs.c:2440
vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 7622:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kfree+0x18e/0x440 mm/slub.c:4879
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
bch2_fs_free+0x4b3/0x5c0 fs/bcachefs/super.c:749
bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2572
vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
insert_work+0x3d/0x330 kernel/workqueue.c:2187
__queue_work+0xcd2/0xfb0 kernel/workqueue.c:2342
queue_work_on+0x181/0x270 kernel/workqueue.c:2393
bch2_btree_node_read_done+0x159b/0x5560 fs/bcachefs/btree_io.c:1156
btree_node_read_work+0x4ee/0xfa0 fs/bcachefs/btree_io.c:1444
bch2_btree_node_read+0x83e/0x2aa0 fs/bcachefs/btree_io.c:1865
__bch2_btree_root_read fs/bcachefs/btree_io.c:1906 [inline]
bch2_btree_root_read+0x5e5/0x780 fs/bcachefs/btree_io.c:1928
read_btree_roots+0x2b7/0x850 fs/bcachefs/recovery.c:602
bch2_fs_recovery+0x2513/0x38a0 fs/bcachefs/recovery.c:985
bch2_fs_start+0xa0f/0xcc0 fs/bcachefs/super.c:1216
bch2_fs_get_tree+0xb39/0x1540 fs/bcachefs/fs.c:2456
vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888029ae2000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 64 bytes inside of
freed 4096-byte region [ffff888029ae2000, ffff888029ae3000)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29ae0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000a6b801 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 59, tgid 59 (kworker/u8:4), ts 293379161383, free_ts 284295390486
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2487 [inline]
allocate_slab+0x8a/0x370 mm/slub.c:2655
new_slab mm/slub.c:2709 [inline]
___slab_alloc+0xbeb/0x1410 mm/slub.c:3891
__slab_alloc mm/slub.c:3981 [inline]
__slab_alloc_node mm/slub.c:4056 [inline]
slab_alloc_node mm/slub.c:4217 [inline]
__do_kmalloc_node mm/slub.c:4364 [inline]
__kmalloc_node_track_caller_noprof+0x2f8/0x4e0 mm/slub.c:4384
kmalloc_reserve+0x136/0x290 net/core/skbuff.c:600
__alloc_skb+0x142/0x2d0 net/core/skbuff.c:669
alloc_skb include/linux/skbuff.h:1336 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:761 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:818 [inline]
nsim_dev_trap_report_work+0x29a/0xb80 drivers/net/netdevsim/dev.c:864
process_one_work kernel/workqueue.c:3239 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 7530 tgid 7530 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
discard_slab mm/slub.c:2753 [inline]
__put_partials+0x156/0x1a0 mm/slub.c:3218
put_cpu_partial+0x17c/0x250 mm/slub.c:3293
__slab_free+0x2d5/0x3c0 mm/slub.c:4550
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4180 [inline]
slab_alloc_node mm/slub.c:4229 [inline]
__do_kmalloc_node mm/slub.c:4364 [inline]
__kmalloc_node_track_caller_noprof+0x216/0x4e0 mm/slub.c:4384
__do_krealloc mm/slub.c:4942 [inline]
krealloc_noprof+0x124/0x340 mm/slub.c:4995
bch2_printbuf_make_room+0x1f5/0x360 fs/bcachefs/printbuf.c:59
bch2_prt_printf+0x282/0x740 fs/bcachefs/printbuf.c:186
bch2_btree_path_to_text_short+0x148/0xde0 fs/bcachefs/btree_iter.c:1516
__bch2_trans_paths_to_text+0xe5/0x190 fs/bcachefs/btree_iter.c:1589
bch2_trans_update_max_paths+0x15f/0x390 fs/bcachefs/btree_iter.c:1625
btree_path_alloc+0x89a/0xa70 fs/bcachefs/btree_iter.c:1718
bch2_path_get+0x8bd/0x1540 fs/bcachefs/btree_iter.c:1774
Memory state around the buggy address:
ffff888029ae1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888029ae1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888029ae2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888029ae2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888029ae2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-18 16:09 [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev syzbot
@ 2025-07-18 17:09 ` Kent Overstreet
2025-07-18 17:09 ` syzbot
2025-07-19 16:58 ` syzbot
2025-07-19 17:35 ` Kent Overstreet
2 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2025-07-18 17:09 UTC (permalink / raw)
To: syzbot; +Cc: linux-bcachefs, linux-kernel, syzkaller-bugs
On Fri, Jul 18, 2025 at 09:09:35AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 024e09e444bd Add linux-next specific files for 20250717
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=107317d4580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=99c60e2181be9059
> dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ad7d8c580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/0a89a1e83302/disk-024e09e4.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/e2264946780a/vmlinux-024e09e4.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/d684a7204e1c/bzImage-024e09e4.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/5f7f631c7091/mount_2.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2b98caf09c41174a9697@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
> BUG: KASAN: slab-use-after-free in atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
> BUG: KASAN: slab-use-after-free in bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
> BUG: KASAN: slab-use-after-free in bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
> Write of size 8 at addr ffff888029ae2040 by task kworker/u9:0/51
>
> CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
> Workqueue: bcachefs_journal journal_write_done
> Call Trace:
> <TASK>
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0xca/0x230 mm/kasan/report.c:480
> kasan_report+0x118/0x150 mm/kasan/report.c:593
> check_region_inline mm/kasan/generic.c:-1 [inline]
> kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
> instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
> atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
> bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
> bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
> bch2_do_discards+0x20/0x160 fs/bcachefs/alloc_background.c:1935
> journal_write_done+0x11b9/0x13f0 fs/bcachefs/journal_io.c:1822
> process_one_work kernel/workqueue.c:3239 [inline]
> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
> kthread+0x70e/0x8a0 kernel/kthread.c:463
> ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
>
> Allocated by task 7622:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4396
> kmalloc_noprof include/linux/slab.h:905 [inline]
> kzalloc_noprof include/linux/slab.h:1039 [inline]
> __bch2_dev_alloc+0xa7/0xc30 fs/bcachefs/super.c:1487
> bch2_dev_alloc+0xcd/0x180 fs/bcachefs/super.c:1558
> bch2_fs_alloc fs/bcachefs/super.c:1068 [inline]
> bch2_fs_open+0x256f/0x2760 fs/bcachefs/super.c:2395
> bch2_fs_get_tree+0x44f/0x1540 fs/bcachefs/fs.c:2440
> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
> do_mount fs/namespace.c:4133 [inline]
> __do_sys_mount fs/namespace.c:4344 [inline]
> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Freed by task 7622:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2417 [inline]
> slab_free mm/slub.c:4680 [inline]
> kfree+0x18e/0x440 mm/slub.c:4879
> kobject_cleanup lib/kobject.c:689 [inline]
> kobject_release lib/kobject.c:720 [inline]
> kref_put include/linux/kref.h:65 [inline]
> kobject_put+0x22b/0x480 lib/kobject.c:737
> bch2_fs_free+0x4b3/0x5c0 fs/bcachefs/super.c:749
> bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2572
> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
> do_mount fs/namespace.c:4133 [inline]
> __do_sys_mount fs/namespace.c:4344 [inline]
> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Last potentially related work creation:
> kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
> kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
> insert_work+0x3d/0x330 kernel/workqueue.c:2187
> __queue_work+0xcd2/0xfb0 kernel/workqueue.c:2342
> queue_work_on+0x181/0x270 kernel/workqueue.c:2393
> bch2_btree_node_read_done+0x159b/0x5560 fs/bcachefs/btree_io.c:1156
> btree_node_read_work+0x4ee/0xfa0 fs/bcachefs/btree_io.c:1444
> bch2_btree_node_read+0x83e/0x2aa0 fs/bcachefs/btree_io.c:1865
> __bch2_btree_root_read fs/bcachefs/btree_io.c:1906 [inline]
> bch2_btree_root_read+0x5e5/0x780 fs/bcachefs/btree_io.c:1928
> read_btree_roots+0x2b7/0x850 fs/bcachefs/recovery.c:602
> bch2_fs_recovery+0x2513/0x38a0 fs/bcachefs/recovery.c:985
> bch2_fs_start+0xa0f/0xcc0 fs/bcachefs/super.c:1216
> bch2_fs_get_tree+0xb39/0x1540 fs/bcachefs/fs.c:2456
> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
> do_mount fs/namespace.c:4133 [inline]
> __do_sys_mount fs/namespace.c:4344 [inline]
> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> The buggy address belongs to the object at ffff888029ae2000
> which belongs to the cache kmalloc-4k of size 4096
> The buggy address is located 64 bytes inside of
> freed 4096-byte region [ffff888029ae2000, ffff888029ae3000)
>
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29ae0
> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
> page_type: f5(slab)
> raw: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
> raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
> head: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
> head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
> head: 00fff00000000003 ffffea0000a6b801 00000000ffffffff 00000000ffffffff
> head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 59, tgid 59 (kworker/u8:4), ts 293379161383, free_ts 284295390486
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
> prep_new_page mm/page_alloc.c:1859 [inline]
> get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
> __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
> alloc_slab_page mm/slub.c:2487 [inline]
> allocate_slab+0x8a/0x370 mm/slub.c:2655
> new_slab mm/slub.c:2709 [inline]
> ___slab_alloc+0xbeb/0x1410 mm/slub.c:3891
> __slab_alloc mm/slub.c:3981 [inline]
> __slab_alloc_node mm/slub.c:4056 [inline]
> slab_alloc_node mm/slub.c:4217 [inline]
> __do_kmalloc_node mm/slub.c:4364 [inline]
> __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 mm/slub.c:4384
> kmalloc_reserve+0x136/0x290 net/core/skbuff.c:600
> __alloc_skb+0x142/0x2d0 net/core/skbuff.c:669
> alloc_skb include/linux/skbuff.h:1336 [inline]
> nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:761 [inline]
> nsim_dev_trap_report drivers/net/netdevsim/dev.c:818 [inline]
> nsim_dev_trap_report_work+0x29a/0xb80 drivers/net/netdevsim/dev.c:864
> process_one_work kernel/workqueue.c:3239 [inline]
> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
> kthread+0x70e/0x8a0 kernel/kthread.c:463
> ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> page last free pid 7530 tgid 7530 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1395 [inline]
> __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
> discard_slab mm/slub.c:2753 [inline]
> __put_partials+0x156/0x1a0 mm/slub.c:3218
> put_cpu_partial+0x17c/0x250 mm/slub.c:3293
> __slab_free+0x2d5/0x3c0 mm/slub.c:4550
> qlink_free mm/kasan/quarantine.c:163 [inline]
> qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
> kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
> __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329
> kasan_slab_alloc include/linux/kasan.h:250 [inline]
> slab_post_alloc_hook mm/slub.c:4180 [inline]
> slab_alloc_node mm/slub.c:4229 [inline]
> __do_kmalloc_node mm/slub.c:4364 [inline]
> __kmalloc_node_track_caller_noprof+0x216/0x4e0 mm/slub.c:4384
> __do_krealloc mm/slub.c:4942 [inline]
> krealloc_noprof+0x124/0x340 mm/slub.c:4995
> bch2_printbuf_make_room+0x1f5/0x360 fs/bcachefs/printbuf.c:59
> bch2_prt_printf+0x282/0x740 fs/bcachefs/printbuf.c:186
> bch2_btree_path_to_text_short+0x148/0xde0 fs/bcachefs/btree_iter.c:1516
> __bch2_trans_paths_to_text+0xe5/0x190 fs/bcachefs/btree_iter.c:1589
> bch2_trans_update_max_paths+0x15f/0x390 fs/bcachefs/btree_iter.c:1625
> btree_path_alloc+0x89a/0xa70 fs/bcachefs/btree_iter.c:1718
> bch2_path_get+0x8bd/0x1540 fs/bcachefs/btree_iter.c:1774
>
> Memory state around the buggy address:
> ffff888029ae1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff888029ae1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >ffff888029ae2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff888029ae2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888029ae2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
#syz test:
From 84e7f95c41c2317265b3fb5a0524ed51c1d85aa4 Mon Sep 17 00:00:00 2001
From: Kent Overstreet <kent.overstreet@linux.dev>
Date: Fri, 18 Jul 2025 13:04:43 -0400
Subject: [PATCH] bcachefs: Fix UAF by journal write path
Previously, we handled synchronization with shutdown vs. the journal
write path by holding the journal lock until we were done, after marking
the write as completed.
But we don't want to be kicking off discards under the journal lock, so
we need an actual ref - just set the journal write closure's parent to
bch_fs.cl.
Fixes: b4d6e204f892 ("bcachefs: Fix triggering of discard by the journal path")
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
diff --git a/fs/bcachefs/journal.c b/fs/bcachefs/journal.c
index de03e20f6e30..376c9b3b20fe 100644
--- a/fs/bcachefs/journal.c
+++ b/fs/bcachefs/journal.c
@@ -182,6 +182,8 @@ journal_error_check_stuck(struct journal *j, int error, unsigned flags)
void bch2_journal_do_writes(struct journal *j)
{
+ struct bch_fs *c = container_of(j, struct bch_fs, journal);
+
for (u64 seq = journal_last_unwritten_seq(j);
seq <= journal_cur_seq(j);
seq++) {
@@ -196,7 +198,7 @@ void bch2_journal_do_writes(struct journal *j)
if (!journal_state_seq_count(j, j->reservations, seq)) {
j->seq_write_started = seq;
w->write_started = true;
- closure_call(&w->io, bch2_journal_write, j->wq, NULL);
+ closure_call(&w->io, bch2_journal_write, j->wq, &c->cl);
}
break;
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-18 17:09 ` Kent Overstreet
@ 2025-07-18 17:09 ` syzbot
2025-07-18 17:25 ` Kent Overstreet
0 siblings, 1 reply; 12+ messages in thread
From: syzbot @ 2025-07-18 17:09 UTC (permalink / raw)
To: kent.overstreet
Cc: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
> On Fri, Jul 18, 2025 at 09:09:35AM -0700, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 024e09e444bd Add linux-next specific files for 20250717
>> git tree: linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=107317d4580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=99c60e2181be9059
>> dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
>> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ad7d8c580000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/0a89a1e83302/disk-024e09e4.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/e2264946780a/vmlinux-024e09e4.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/d684a7204e1c/bzImage-024e09e4.xz
>> mounted in repro: https://storage.googleapis.com/syzbot-assets/5f7f631c7091/mount_2.gz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+2b98caf09c41174a9697@syzkaller.appspotmail.com
>>
>> ==================================================================
>> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
>> BUG: KASAN: slab-use-after-free in atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
>> BUG: KASAN: slab-use-after-free in bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
>> BUG: KASAN: slab-use-after-free in bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
>> Write of size 8 at addr ffff888029ae2040 by task kworker/u9:0/51
>>
>> CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full)
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
>> Workqueue: bcachefs_journal journal_write_done
>> Call Trace:
>> <TASK>
>> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
>> print_address_description mm/kasan/report.c:378 [inline]
>> print_report+0xca/0x230 mm/kasan/report.c:480
>> kasan_report+0x118/0x150 mm/kasan/report.c:593
>> check_region_inline mm/kasan/generic.c:-1 [inline]
>> kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
>> instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
>> atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
>> bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
>> bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
>> bch2_do_discards+0x20/0x160 fs/bcachefs/alloc_background.c:1935
>> journal_write_done+0x11b9/0x13f0 fs/bcachefs/journal_io.c:1822
>> process_one_work kernel/workqueue.c:3239 [inline]
>> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
>> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
>> kthread+0x70e/0x8a0 kernel/kthread.c:463
>> ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
>> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>> </TASK>
>>
>> Allocated by task 7622:
>> kasan_save_stack mm/kasan/common.c:47 [inline]
>> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
>> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
>> __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
>> kasan_kmalloc include/linux/kasan.h:260 [inline]
>> __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4396
>> kmalloc_noprof include/linux/slab.h:905 [inline]
>> kzalloc_noprof include/linux/slab.h:1039 [inline]
>> __bch2_dev_alloc+0xa7/0xc30 fs/bcachefs/super.c:1487
>> bch2_dev_alloc+0xcd/0x180 fs/bcachefs/super.c:1558
>> bch2_fs_alloc fs/bcachefs/super.c:1068 [inline]
>> bch2_fs_open+0x256f/0x2760 fs/bcachefs/super.c:2395
>> bch2_fs_get_tree+0x44f/0x1540 fs/bcachefs/fs.c:2440
>> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
>> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
>> do_mount fs/namespace.c:4133 [inline]
>> __do_sys_mount fs/namespace.c:4344 [inline]
>> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
>> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>>
>> Freed by task 7622:
>> kasan_save_stack mm/kasan/common.c:47 [inline]
>> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
>> kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
>> poison_slab_object mm/kasan/common.c:247 [inline]
>> __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
>> kasan_slab_free include/linux/kasan.h:233 [inline]
>> slab_free_hook mm/slub.c:2417 [inline]
>> slab_free mm/slub.c:4680 [inline]
>> kfree+0x18e/0x440 mm/slub.c:4879
>> kobject_cleanup lib/kobject.c:689 [inline]
>> kobject_release lib/kobject.c:720 [inline]
>> kref_put include/linux/kref.h:65 [inline]
>> kobject_put+0x22b/0x480 lib/kobject.c:737
>> bch2_fs_free+0x4b3/0x5c0 fs/bcachefs/super.c:749
>> bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2572
>> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
>> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
>> do_mount fs/namespace.c:4133 [inline]
>> __do_sys_mount fs/namespace.c:4344 [inline]
>> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
>> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>>
>> Last potentially related work creation:
>> kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
>> kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
>> insert_work+0x3d/0x330 kernel/workqueue.c:2187
>> __queue_work+0xcd2/0xfb0 kernel/workqueue.c:2342
>> queue_work_on+0x181/0x270 kernel/workqueue.c:2393
>> bch2_btree_node_read_done+0x159b/0x5560 fs/bcachefs/btree_io.c:1156
>> btree_node_read_work+0x4ee/0xfa0 fs/bcachefs/btree_io.c:1444
>> bch2_btree_node_read+0x83e/0x2aa0 fs/bcachefs/btree_io.c:1865
>> __bch2_btree_root_read fs/bcachefs/btree_io.c:1906 [inline]
>> bch2_btree_root_read+0x5e5/0x780 fs/bcachefs/btree_io.c:1928
>> read_btree_roots+0x2b7/0x850 fs/bcachefs/recovery.c:602
>> bch2_fs_recovery+0x2513/0x38a0 fs/bcachefs/recovery.c:985
>> bch2_fs_start+0xa0f/0xcc0 fs/bcachefs/super.c:1216
>> bch2_fs_get_tree+0xb39/0x1540 fs/bcachefs/fs.c:2456
>> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
>> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
>> do_mount fs/namespace.c:4133 [inline]
>> __do_sys_mount fs/namespace.c:4344 [inline]
>> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
>> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>>
>> The buggy address belongs to the object at ffff888029ae2000
>> which belongs to the cache kmalloc-4k of size 4096
>> The buggy address is located 64 bytes inside of
>> freed 4096-byte region [ffff888029ae2000, ffff888029ae3000)
>>
>> The buggy address belongs to the physical page:
>> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29ae0
>> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
>> flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
>> page_type: f5(slab)
>> raw: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
>> raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
>> head: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
>> head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
>> head: 00fff00000000003 ffffea0000a6b801 00000000ffffffff 00000000ffffffff
>> head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
>> page dumped because: kasan: bad access detected
>> page_owner tracks the page as allocated
>> page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 59, tgid 59 (kworker/u8:4), ts 293379161383, free_ts 284295390486
>> set_page_owner include/linux/page_owner.h:32 [inline]
>> post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
>> prep_new_page mm/page_alloc.c:1859 [inline]
>> get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
>> __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
>> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
>> alloc_slab_page mm/slub.c:2487 [inline]
>> allocate_slab+0x8a/0x370 mm/slub.c:2655
>> new_slab mm/slub.c:2709 [inline]
>> ___slab_alloc+0xbeb/0x1410 mm/slub.c:3891
>> __slab_alloc mm/slub.c:3981 [inline]
>> __slab_alloc_node mm/slub.c:4056 [inline]
>> slab_alloc_node mm/slub.c:4217 [inline]
>> __do_kmalloc_node mm/slub.c:4364 [inline]
>> __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 mm/slub.c:4384
>> kmalloc_reserve+0x136/0x290 net/core/skbuff.c:600
>> __alloc_skb+0x142/0x2d0 net/core/skbuff.c:669
>> alloc_skb include/linux/skbuff.h:1336 [inline]
>> nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:761 [inline]
>> nsim_dev_trap_report drivers/net/netdevsim/dev.c:818 [inline]
>> nsim_dev_trap_report_work+0x29a/0xb80 drivers/net/netdevsim/dev.c:864
>> process_one_work kernel/workqueue.c:3239 [inline]
>> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
>> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
>> kthread+0x70e/0x8a0 kernel/kthread.c:463
>> ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
>> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>> page last free pid 7530 tgid 7530 stack trace:
>> reset_page_owner include/linux/page_owner.h:25 [inline]
>> free_pages_prepare mm/page_alloc.c:1395 [inline]
>> __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
>> discard_slab mm/slub.c:2753 [inline]
>> __put_partials+0x156/0x1a0 mm/slub.c:3218
>> put_cpu_partial+0x17c/0x250 mm/slub.c:3293
>> __slab_free+0x2d5/0x3c0 mm/slub.c:4550
>> qlink_free mm/kasan/quarantine.c:163 [inline]
>> qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
>> kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
>> __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329
>> kasan_slab_alloc include/linux/kasan.h:250 [inline]
>> slab_post_alloc_hook mm/slub.c:4180 [inline]
>> slab_alloc_node mm/slub.c:4229 [inline]
>> __do_kmalloc_node mm/slub.c:4364 [inline]
>> __kmalloc_node_track_caller_noprof+0x216/0x4e0 mm/slub.c:4384
>> __do_krealloc mm/slub.c:4942 [inline]
>> krealloc_noprof+0x124/0x340 mm/slub.c:4995
>> bch2_printbuf_make_room+0x1f5/0x360 fs/bcachefs/printbuf.c:59
>> bch2_prt_printf+0x282/0x740 fs/bcachefs/printbuf.c:186
>> bch2_btree_path_to_text_short+0x148/0xde0 fs/bcachefs/btree_iter.c:1516
>> __bch2_trans_paths_to_text+0xe5/0x190 fs/bcachefs/btree_iter.c:1589
>> bch2_trans_update_max_paths+0x15f/0x390 fs/bcachefs/btree_iter.c:1625
>> btree_path_alloc+0x89a/0xa70 fs/bcachefs/btree_iter.c:1718
>> bch2_path_get+0x8bd/0x1540 fs/bcachefs/btree_iter.c:1774
>>
>> Memory state around the buggy address:
>> ffff888029ae1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffff888029ae1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> >ffff888029ae2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ^
>> ffff888029ae2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ffff888029ae2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ==================================================================
>>
>>
>> ---
>> This report is generated by a bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for more information about syzbot.
>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>>
>> syzbot will keep track of this issue. See:
>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>>
>> If the report is already addressed, let syzbot know by replying with:
>> #syz fix: exact-commit-title
>>
>> If you want syzbot to run the reproducer, reply with:
>> #syz test: git://repo/address.git branch-or-commit-hash
>> If you attach or paste a git patch, syzbot will apply it before testing.
>
> #syz test:
want either no args or 2 args (repo, branch), got 7
>
> From 84e7f95c41c2317265b3fb5a0524ed51c1d85aa4 Mon Sep 17 00:00:00 2001
> From: Kent Overstreet <kent.overstreet@linux.dev>
> Date: Fri, 18 Jul 2025 13:04:43 -0400
> Subject: [PATCH] bcachefs: Fix UAF by journal write path
>
> Previously, we handled synchronization with shutdown vs. the journal
> write path by holding the journal lock until we were done, after marking
> the write as completed.
>
> But we don't want to be kicking off discards under the journal lock, so
> we need an actual ref - just set the journal write closure's parent to
> bch_fs.cl.
>
> Fixes: b4d6e204f892 ("bcachefs: Fix triggering of discard by the journal path")
> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
>
> diff --git a/fs/bcachefs/journal.c b/fs/bcachefs/journal.c
> index de03e20f6e30..376c9b3b20fe 100644
> --- a/fs/bcachefs/journal.c
> +++ b/fs/bcachefs/journal.c
> @@ -182,6 +182,8 @@ journal_error_check_stuck(struct journal *j, int error, unsigned flags)
>
> void bch2_journal_do_writes(struct journal *j)
> {
> + struct bch_fs *c = container_of(j, struct bch_fs, journal);
> +
> for (u64 seq = journal_last_unwritten_seq(j);
> seq <= journal_cur_seq(j);
> seq++) {
> @@ -196,7 +198,7 @@ void bch2_journal_do_writes(struct journal *j)
> if (!journal_state_seq_count(j, j->reservations, seq)) {
> j->seq_write_started = seq;
> w->write_started = true;
> - closure_call(&w->io, bch2_journal_write, j->wq, NULL);
> + closure_call(&w->io, bch2_journal_write, j->wq, &c->cl);
> }
>
> break;
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-18 17:09 ` syzbot
@ 2025-07-18 17:25 ` Kent Overstreet
2025-07-18 22:13 ` syzbot
0 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2025-07-18 17:25 UTC (permalink / raw)
To: syzbot; +Cc: linux-bcachefs, linux-kernel, syzkaller-bugs
On Fri, Jul 18, 2025 at 10:09:54AM -0700, syzbot wrote:
> > On Fri, Jul 18, 2025 at 09:09:35AM -0700, syzbot wrote:
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit: 024e09e444bd Add linux-next specific files for 20250717
> >> git tree: linux-next
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=107317d4580000
> >> kernel config: https://syzkaller.appspot.com/x/.config?x=99c60e2181be9059
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
> >> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ad7d8c580000
> >>
> >> Downloadable assets:
> >> disk image: https://storage.googleapis.com/syzbot-assets/0a89a1e83302/disk-024e09e4.raw.xz
> >> vmlinux: https://storage.googleapis.com/syzbot-assets/e2264946780a/vmlinux-024e09e4.xz
> >> kernel image: https://storage.googleapis.com/syzbot-assets/d684a7204e1c/bzImage-024e09e4.xz
> >> mounted in repro: https://storage.googleapis.com/syzbot-assets/5f7f631c7091/mount_2.gz
> >>
> >> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >> Reported-by: syzbot+2b98caf09c41174a9697@syzkaller.appspotmail.com
> >>
> >> ==================================================================
> >> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
> >> BUG: KASAN: slab-use-after-free in atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
> >> BUG: KASAN: slab-use-after-free in bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
> >> BUG: KASAN: slab-use-after-free in bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
> >> Write of size 8 at addr ffff888029ae2040 by task kworker/u9:0/51
> >>
> >> CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full)
> >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
> >> Workqueue: bcachefs_journal journal_write_done
> >> Call Trace:
> >> <TASK>
> >> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> >> print_address_description mm/kasan/report.c:378 [inline]
> >> print_report+0xca/0x230 mm/kasan/report.c:480
> >> kasan_report+0x118/0x150 mm/kasan/report.c:593
> >> check_region_inline mm/kasan/generic.c:-1 [inline]
> >> kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
> >> instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
> >> atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
> >> bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
> >> bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
> >> bch2_do_discards+0x20/0x160 fs/bcachefs/alloc_background.c:1935
> >> journal_write_done+0x11b9/0x13f0 fs/bcachefs/journal_io.c:1822
> >> process_one_work kernel/workqueue.c:3239 [inline]
> >> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
> >> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
> >> kthread+0x70e/0x8a0 kernel/kthread.c:463
> >> ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
> >> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> >> </TASK>
> >>
> >> Allocated by task 7622:
> >> kasan_save_stack mm/kasan/common.c:47 [inline]
> >> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
> >> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> >> __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
> >> kasan_kmalloc include/linux/kasan.h:260 [inline]
> >> __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4396
> >> kmalloc_noprof include/linux/slab.h:905 [inline]
> >> kzalloc_noprof include/linux/slab.h:1039 [inline]
> >> __bch2_dev_alloc+0xa7/0xc30 fs/bcachefs/super.c:1487
> >> bch2_dev_alloc+0xcd/0x180 fs/bcachefs/super.c:1558
> >> bch2_fs_alloc fs/bcachefs/super.c:1068 [inline]
> >> bch2_fs_open+0x256f/0x2760 fs/bcachefs/super.c:2395
> >> bch2_fs_get_tree+0x44f/0x1540 fs/bcachefs/fs.c:2440
> >> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
> >> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
> >> do_mount fs/namespace.c:4133 [inline]
> >> __do_sys_mount fs/namespace.c:4344 [inline]
> >> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> >> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> >> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> >> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >>
> >> Freed by task 7622:
> >> kasan_save_stack mm/kasan/common.c:47 [inline]
> >> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
> >> kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
> >> poison_slab_object mm/kasan/common.c:247 [inline]
> >> __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
> >> kasan_slab_free include/linux/kasan.h:233 [inline]
> >> slab_free_hook mm/slub.c:2417 [inline]
> >> slab_free mm/slub.c:4680 [inline]
> >> kfree+0x18e/0x440 mm/slub.c:4879
> >> kobject_cleanup lib/kobject.c:689 [inline]
> >> kobject_release lib/kobject.c:720 [inline]
> >> kref_put include/linux/kref.h:65 [inline]
> >> kobject_put+0x22b/0x480 lib/kobject.c:737
> >> bch2_fs_free+0x4b3/0x5c0 fs/bcachefs/super.c:749
> >> bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2572
> >> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
> >> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
> >> do_mount fs/namespace.c:4133 [inline]
> >> __do_sys_mount fs/namespace.c:4344 [inline]
> >> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> >> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> >> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> >> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >>
> >> Last potentially related work creation:
> >> kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
> >> kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
> >> insert_work+0x3d/0x330 kernel/workqueue.c:2187
> >> __queue_work+0xcd2/0xfb0 kernel/workqueue.c:2342
> >> queue_work_on+0x181/0x270 kernel/workqueue.c:2393
> >> bch2_btree_node_read_done+0x159b/0x5560 fs/bcachefs/btree_io.c:1156
> >> btree_node_read_work+0x4ee/0xfa0 fs/bcachefs/btree_io.c:1444
> >> bch2_btree_node_read+0x83e/0x2aa0 fs/bcachefs/btree_io.c:1865
> >> __bch2_btree_root_read fs/bcachefs/btree_io.c:1906 [inline]
> >> bch2_btree_root_read+0x5e5/0x780 fs/bcachefs/btree_io.c:1928
> >> read_btree_roots+0x2b7/0x850 fs/bcachefs/recovery.c:602
> >> bch2_fs_recovery+0x2513/0x38a0 fs/bcachefs/recovery.c:985
> >> bch2_fs_start+0xa0f/0xcc0 fs/bcachefs/super.c:1216
> >> bch2_fs_get_tree+0xb39/0x1540 fs/bcachefs/fs.c:2456
> >> vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
> >> do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
> >> do_mount fs/namespace.c:4133 [inline]
> >> __do_sys_mount fs/namespace.c:4344 [inline]
> >> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> >> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> >> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> >> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >>
> >> The buggy address belongs to the object at ffff888029ae2000
> >> which belongs to the cache kmalloc-4k of size 4096
> >> The buggy address is located 64 bytes inside of
> >> freed 4096-byte region [ffff888029ae2000, ffff888029ae3000)
> >>
> >> The buggy address belongs to the physical page:
> >> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29ae0
> >> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> >> flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
> >> page_type: f5(slab)
> >> raw: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
> >> raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
> >> head: 00fff00000000040 ffff88801a442140 dead000000000122 0000000000000000
> >> head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
> >> head: 00fff00000000003 ffffea0000a6b801 00000000ffffffff 00000000ffffffff
> >> head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> >> page dumped because: kasan: bad access detected
> >> page_owner tracks the page as allocated
> >> page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 59, tgid 59 (kworker/u8:4), ts 293379161383, free_ts 284295390486
> >> set_page_owner include/linux/page_owner.h:32 [inline]
> >> post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
> >> prep_new_page mm/page_alloc.c:1859 [inline]
> >> get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
> >> __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
> >> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
> >> alloc_slab_page mm/slub.c:2487 [inline]
> >> allocate_slab+0x8a/0x370 mm/slub.c:2655
> >> new_slab mm/slub.c:2709 [inline]
> >> ___slab_alloc+0xbeb/0x1410 mm/slub.c:3891
> >> __slab_alloc mm/slub.c:3981 [inline]
> >> __slab_alloc_node mm/slub.c:4056 [inline]
> >> slab_alloc_node mm/slub.c:4217 [inline]
> >> __do_kmalloc_node mm/slub.c:4364 [inline]
> >> __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 mm/slub.c:4384
> >> kmalloc_reserve+0x136/0x290 net/core/skbuff.c:600
> >> __alloc_skb+0x142/0x2d0 net/core/skbuff.c:669
> >> alloc_skb include/linux/skbuff.h:1336 [inline]
> >> nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:761 [inline]
> >> nsim_dev_trap_report drivers/net/netdevsim/dev.c:818 [inline]
> >> nsim_dev_trap_report_work+0x29a/0xb80 drivers/net/netdevsim/dev.c:864
> >> process_one_work kernel/workqueue.c:3239 [inline]
> >> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
> >> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
> >> kthread+0x70e/0x8a0 kernel/kthread.c:463
> >> ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
> >> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> >> page last free pid 7530 tgid 7530 stack trace:
> >> reset_page_owner include/linux/page_owner.h:25 [inline]
> >> free_pages_prepare mm/page_alloc.c:1395 [inline]
> >> __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
> >> discard_slab mm/slub.c:2753 [inline]
> >> __put_partials+0x156/0x1a0 mm/slub.c:3218
> >> put_cpu_partial+0x17c/0x250 mm/slub.c:3293
> >> __slab_free+0x2d5/0x3c0 mm/slub.c:4550
> >> qlink_free mm/kasan/quarantine.c:163 [inline]
> >> qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
> >> kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
> >> __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329
> >> kasan_slab_alloc include/linux/kasan.h:250 [inline]
> >> slab_post_alloc_hook mm/slub.c:4180 [inline]
> >> slab_alloc_node mm/slub.c:4229 [inline]
> >> __do_kmalloc_node mm/slub.c:4364 [inline]
> >> __kmalloc_node_track_caller_noprof+0x216/0x4e0 mm/slub.c:4384
> >> __do_krealloc mm/slub.c:4942 [inline]
> >> krealloc_noprof+0x124/0x340 mm/slub.c:4995
> >> bch2_printbuf_make_room+0x1f5/0x360 fs/bcachefs/printbuf.c:59
> >> bch2_prt_printf+0x282/0x740 fs/bcachefs/printbuf.c:186
> >> bch2_btree_path_to_text_short+0x148/0xde0 fs/bcachefs/btree_iter.c:1516
> >> __bch2_trans_paths_to_text+0xe5/0x190 fs/bcachefs/btree_iter.c:1589
> >> bch2_trans_update_max_paths+0x15f/0x390 fs/bcachefs/btree_iter.c:1625
> >> btree_path_alloc+0x89a/0xa70 fs/bcachefs/btree_iter.c:1718
> >> bch2_path_get+0x8bd/0x1540 fs/bcachefs/btree_iter.c:1774
> >>
> >> Memory state around the buggy address:
> >> ffff888029ae1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >> ffff888029ae1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >> >ffff888029ae2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >> ^
> >> ffff888029ae2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >> ffff888029ae2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >> ==================================================================
> >>
> >>
> >> ---
> >> This report is generated by a bot. It may contain errors.
> >> See https://goo.gl/tpsmEJ for more information about syzbot.
> >> syzbot engineers can be reached at syzkaller@googlegroups.com.
> >>
> >> syzbot will keep track of this issue. See:
> >> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> >>
> >> If the report is already addressed, let syzbot know by replying with:
> >> #syz fix: exact-commit-title
> >>
> >> If you want syzbot to run the reproducer, reply with:
> >> #syz test: git://repo/address.git branch-or-commit-hash
> >> If you attach or paste a git patch, syzbot will apply it before testing.
> >
> > #syz test:
>
> want either no args or 2 args (repo, branch), got 7
#syz test: git://evilpiepirate.org/bcachefs.git bcachefs-testing
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-18 17:25 ` Kent Overstreet
@ 2025-07-18 22:13 ` syzbot
2025-07-19 18:23 ` Kent Overstreet
0 siblings, 1 reply; 12+ messages in thread
From: syzbot @ 2025-07-18 22:13 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in seq_buf_puts
shmem_inode_cache total: 7.91 MiB active: 7.89 MiB
kmalloc-8k total: 5.63 MiB active: 5.48 MiB
Shrinkers:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 6968 Comm: syz.4.25 Not tainted 6.16.0-rc6-syzkaller-gca12b17b7ceb #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:strlen+0x29/0x70 lib/string.c:420
Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00
RSP: 0018:ffffc90003dde7a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802c468000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003dde8f0 R08: ffff8880357dead7 R09: 1ffff11006afbd5a
R10: dffffc0000000000 R11: ffffed1006afbd5b R12: ffffc90003dde860
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff
FS: 00007fb031fe66c0(0000) GS:ffff888125d2a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe025a39e9c CR3: 0000000034726000 CR4: 00000000003526f0
Call Trace:
<TASK>
__fortify_strlen include/linux/fortify-string.h:268 [inline]
seq_buf_puts+0x34/0x1a0 lib/seq_buf.c:184
shrinker_to_text+0x115/0x3c0 mm/shrinker.c:836
shrinkers_to_text+0x840/0x960 mm/shrinker.c:911
__show_mem+0x242b/0x24d0 mm/show_mem.c:496
warn_alloc_show_mem mm/page_alloc.c:3719 [inline]
warn_alloc+0x2dd/0x310 mm/page_alloc.c:3744
__vmalloc_area_node mm/vmalloc.c:3702 [inline]
__vmalloc_node_range_noprof+0x67e/0x12f0 mm/vmalloc.c:3893
__kvmalloc_node_noprof+0x3b8/0x5f0 mm/slub.c:5037
bch2_fs_journal_start+0x2b4/0x12b0 fs/bcachefs/journal.c:1484
bch2_fs_recovery+0x1fbe/0x3860 fs/bcachefs/recovery.c:975
bch2_fs_start+0x957/0xbf0 fs/bcachefs/super.c:1216
bch2_fs_get_tree+0xb39/0x1540 fs/bcachefs/fs.c:2462
vfs_get_tree+0x92/0x2b0 fs/super.c:1804
do_new_mount+0x24a/0xa40 fs/namespace.c:3902
do_mount fs/namespace.c:4239 [inline]
__do_sys_mount fs/namespace.c:4450 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4427
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb0311900ca
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb031fe5e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb031fe5ef0 RCX: 00007fb0311900ca
RDX: 000020000000fec0 RSI: 000020000000ff00 RDI: 00007fb031fe5eb0
RBP: 000020000000fec0 R08: 00007fb031fe5ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000020000000ff00
R13: 00007fb031fe5eb0 R14: 000000000000fe88 R15: 000020000000ff40
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x29/0x70 lib/string.c:420
Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00
RSP: 0018:ffffc90003dde7a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802c468000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003dde8f0 R08: ffff8880357dead7 R09: 1ffff11006afbd5a
R10: dffffc0000000000 R11: ffffed1006afbd5b R12: ffffc90003dde860
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff
FS: 00007fb031fe66c0(0000) GS:ffff888125d2a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005578d9f91950 CR3: 0000000034726000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 41 57 push %r15
7: 41 56 push %r14
9: 41 54 push %r12
b: 53 push %rbx
c: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
13: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
1a: fc ff df
1d: 48 89 fb mov %rdi,%rbx
20: 49 89 c7 mov %rax,%r15
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 75 11 jne 0x44
33: 48 ff c3 inc %rbx
36: 49 8d 47 01 lea 0x1(%r15),%rax
3a: 42 80 7c 3f 01 00 cmpb $0x0,0x1(%rdi,%r15,1)
Tested on:
commit: ca12b17b bcachefs: fix check_extent_overbig() call
git tree: git://evilpiepirate.org/bcachefs.git bcachefs-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=1752038c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=37de60b3108b6d8f
dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Note: no patches were applied.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-18 16:09 [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev syzbot
2025-07-18 17:09 ` Kent Overstreet
@ 2025-07-19 16:58 ` syzbot
2025-07-19 17:35 ` Kent Overstreet
2 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-07-19 16:58 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: d086c886ceb9 Add linux-next specific files for 20250718
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17bd438c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cc0cd9fdf69889c3
dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1480c38c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=112df8f0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4435f80a19c4/disk-d086c886.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9a7dc57a5ea3/vmlinux-d086c886.xz
kernel image: https://storage.googleapis.com/syzbot-assets/da9f2dc22ae1/bzImage-d086c886.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/30708d56eaf8/mount_2.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2b98caf09c41174a9697@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
BUG: KASAN: slab-use-after-free in bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
BUG: KASAN: slab-use-after-free in bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
Write of size 8 at addr ffff88807b3cc040 by task kworker/u9:4/5922
CPU: 0 UID: 0 PID: 5922 Comm: kworker/u9:4 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: bcachefs_journal journal_write_done
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_long_inc_return include/linux/atomic/atomic-instrumented.h:3609 [inline]
bch2_dev_get fs/bcachefs/sb-members.h:114 [inline]
bch2_get_next_dev+0x38f/0x4e0 fs/bcachefs/sb-members.h:145
bch2_do_discards+0x20/0x160 fs/bcachefs/alloc_background.c:1935
journal_write_done+0x11b9/0x13f0 fs/bcachefs/journal_io.c:1822
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 5859:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4396
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
__bch2_dev_alloc+0xa7/0xc30 fs/bcachefs/super.c:1487
bch2_dev_alloc+0xcd/0x180 fs/bcachefs/super.c:1558
bch2_fs_alloc fs/bcachefs/super.c:1068 [inline]
bch2_fs_open+0x256f/0x2760 fs/bcachefs/super.c:2395
bch2_fs_get_tree+0x44f/0x1540 fs/bcachefs/fs.c:2440
vfs_get_tree+0x92/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5859:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kfree+0x18e/0x440 mm/slub.c:4879
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
bch2_fs_free+0x4b3/0x5c0 fs/bcachefs/super.c:749
bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2572
vfs_get_tree+0x92/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
insert_work+0x3d/0x330 kernel/workqueue.c:2184
__queue_work+0xcd2/0xfb0 kernel/workqueue.c:2339
queue_work_on+0x181/0x270 kernel/workqueue.c:2390
queue_work include/linux/workqueue.h:669 [inline]
bch2_dev_do_discards fs/bcachefs/alloc_background.c:1925 [inline]
bch2_do_discards+0xd0/0x160 fs/bcachefs/alloc_background.c:1936
journal_write_done+0x11b9/0x13f0 fs/bcachefs/journal_io.c:1822
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Second to last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
insert_work+0x3d/0x330 kernel/workqueue.c:2184
__queue_work+0xcd2/0xfb0 kernel/workqueue.c:2339
queue_work_on+0x181/0x270 kernel/workqueue.c:2390
queue_work include/linux/workqueue.h:669 [inline]
bch2_dev_do_discards fs/bcachefs/alloc_background.c:1925 [inline]
bch2_do_discards+0xd0/0x160 fs/bcachefs/alloc_background.c:1936
journal_write_done+0x11b9/0x13f0 fs/bcachefs/journal_io.c:1822
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88807b3cc000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 64 bytes inside of
freed 4096-byte region [ffff88807b3cc000, ffff88807b3cd000)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b3c8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801a442140 ffffea0000cdf200 dead000000000002
raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801a442140 ffffea0000cdf200 dead000000000002
head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0001ecf201 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5228, tgid 5228 (udevadm), ts 37270032838, free_ts 31080557231
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2487 [inline]
allocate_slab+0x8a/0x370 mm/slub.c:2655
new_slab mm/slub.c:2709 [inline]
___slab_alloc+0xbeb/0x1410 mm/slub.c:3891
__slab_alloc mm/slub.c:3981 [inline]
__slab_alloc_node mm/slub.c:4056 [inline]
slab_alloc_node mm/slub.c:4217 [inline]
__kmalloc_cache_noprof+0x296/0x3d0 mm/slub.c:4391
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
kernfs_iop_get_link+0x66/0x6c0 fs/kernfs/symlink.c:137
vfs_readlink+0x24d/0x550 fs/namei.c:5375
do_readlinkat+0x215/0x500 fs/stat.c:590
__do_sys_readlink fs/stat.c:613 [inline]
__se_sys_readlink fs/stat.c:610 [inline]
__x64_sys_readlink+0x7f/0x90 fs/stat.c:610
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
__free_pages mm/page_alloc.c:5260 [inline]
free_contig_range+0x1bd/0x4a0 mm/page_alloc.c:7117
destroy_args+0x7e/0x5d0 mm/debug_vm_pgtable.c:958
debug_vm_pgtable+0x404/0x420 mm/debug_vm_pgtable.c:1340
do_one_initcall+0x233/0x820 init/main.c:1269
do_initcall_level+0x137/0x1f0 init/main.c:1331
do_initcalls+0x69/0xd0 init/main.c:1347
kernel_init_freeable+0x3d9/0x590 init/main.c:1579
kernel_init+0x1d/0x1d0 init/main.c:1469
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff88807b3cbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807b3cbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807b3cc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807b3cc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807b3cc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-18 16:09 [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev syzbot
2025-07-18 17:09 ` Kent Overstreet
2025-07-19 16:58 ` syzbot
@ 2025-07-19 17:35 ` Kent Overstreet
2025-07-23 10:00 ` Aleksandr Nogikh
2 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2025-07-19 17:35 UTC (permalink / raw)
To: syzbot; +Cc: linux-bcachefs, linux-kernel, syzkaller-bugs
Will syzbot reopen if the fix is still in linux-next? Let's find out.
#syz fix: bcachefs: Fix UAF by journal write path
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-18 22:13 ` syzbot
@ 2025-07-19 18:23 ` Kent Overstreet
2025-07-19 18:47 ` syzbot
0 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2025-07-19 18:23 UTC (permalink / raw)
To: syzbot; +Cc: linux-bcachefs, linux-kernel, syzkaller-bugs
On Fri, Jul 18, 2025 at 03:13:04PM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in seq_buf_puts
>
> shmem_inode_cache total: 7.91 MiB active: 7.89 MiB
> kmalloc-8k total: 5.63 MiB active: 5.48 MiB
> Shrinkers:
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> CPU: 1 UID: 0 PID: 6968 Comm: syz.4.25 Not tainted 6.16.0-rc6-syzkaller-gca12b17b7ceb #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
> RIP: 0010:strlen+0x29/0x70 lib/string.c:420
> Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00
> RSP: 0018:ffffc90003dde7a0 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802c468000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffc90003dde8f0 R08: ffff8880357dead7 R09: 1ffff11006afbd5a
> R10: dffffc0000000000 R11: ffffed1006afbd5b R12: ffffc90003dde860
> R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff
> FS: 00007fb031fe66c0(0000) GS:ffff888125d2a000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fe025a39e9c CR3: 0000000034726000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> __fortify_strlen include/linux/fortify-string.h:268 [inline]
> seq_buf_puts+0x34/0x1a0 lib/seq_buf.c:184
> shrinker_to_text+0x115/0x3c0 mm/shrinker.c:836
> shrinkers_to_text+0x840/0x960 mm/shrinker.c:911
> __show_mem+0x242b/0x24d0 mm/show_mem.c:496
> warn_alloc_show_mem mm/page_alloc.c:3719 [inline]
> warn_alloc+0x2dd/0x310 mm/page_alloc.c:3744
> __vmalloc_area_node mm/vmalloc.c:3702 [inline]
> __vmalloc_node_range_noprof+0x67e/0x12f0 mm/vmalloc.c:3893
> __kvmalloc_node_noprof+0x3b8/0x5f0 mm/slub.c:5037
> bch2_fs_journal_start+0x2b4/0x12b0 fs/bcachefs/journal.c:1484
> bch2_fs_recovery+0x1fbe/0x3860 fs/bcachefs/recovery.c:975
> bch2_fs_start+0x957/0xbf0 fs/bcachefs/super.c:1216
> bch2_fs_get_tree+0xb39/0x1540 fs/bcachefs/fs.c:2462
> vfs_get_tree+0x92/0x2b0 fs/super.c:1804
> do_new_mount+0x24a/0xa40 fs/namespace.c:3902
> do_mount fs/namespace.c:4239 [inline]
> __do_sys_mount fs/namespace.c:4450 [inline]
> __se_sys_mount+0x317/0x410 fs/namespace.c:4427
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fb0311900ca
> Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fb031fe5e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00007fb031fe5ef0 RCX: 00007fb0311900ca
> RDX: 000020000000fec0 RSI: 000020000000ff00 RDI: 00007fb031fe5eb0
> RBP: 000020000000fec0 R08: 00007fb031fe5ef0 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 000020000000ff00
> R13: 00007fb031fe5eb0 R14: 000000000000fe88 R15: 000020000000ff40
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:strlen+0x29/0x70 lib/string.c:420
> Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00
> RSP: 0018:ffffc90003dde7a0 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802c468000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffc90003dde8f0 R08: ffff8880357dead7 R09: 1ffff11006afbd5a
> R10: dffffc0000000000 R11: ffffed1006afbd5b R12: ffffc90003dde860
> R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff
> FS: 00007fb031fe66c0(0000) GS:ffff888125d2a000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00005578d9f91950 CR3: 0000000034726000 CR4: 00000000003526f0
> ----------------
> Code disassembly (best guess):
> 0: 90 nop
> 1: f3 0f 1e fa endbr64
> 5: 41 57 push %r15
> 7: 41 56 push %r14
> 9: 41 54 push %r12
> b: 53 push %rbx
> c: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
> 13: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
> 1a: fc ff df
> 1d: 48 89 fb mov %rdi,%rbx
> 20: 49 89 c7 mov %rax,%r15
> 23: 48 89 d8 mov %rbx,%rax
> 26: 48 c1 e8 03 shr $0x3,%rax
> * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> 2f: 84 c0 test %al,%al
> 31: 75 11 jne 0x44
> 33: 48 ff c3 inc %rbx
> 36: 49 8d 47 01 lea 0x1(%r15),%rax
> 3a: 42 80 7c 3f 01 00 cmpb $0x0,0x1(%rdi,%r15,1)
>
>
> Tested on:
>
> commit: ca12b17b bcachefs: fix check_extent_overbig() call
> git tree: git://evilpiepirate.org/bcachefs.git bcachefs-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1752038c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=37de60b3108b6d8f
> dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>
> Note: no patches were applied.
#syz test: git://evilpiepirate.org/bcachefs.git for-next
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-19 18:23 ` Kent Overstreet
@ 2025-07-19 18:47 ` syzbot
2025-07-19 19:13 ` Kent Overstreet
0 siblings, 1 reply; 12+ messages in thread
From: syzbot @ 2025-07-19 18:47 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel panic: btree_update_nodes_written leaked btree_trans
Kernel panic - not syncing: btree_update_nodes_written leaked btree_trans
CPU: 0 UID: 0 PID: 7134 Comm: syz.4.31 Not tainted 6.16.0-rc6-syzkaller-gcbdeb0ffd5bf #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
panic+0x2db/0x790 kernel/panic.c:382
bch2_fs_btree_iter_exit+0x475/0x490 fs/bcachefs/btree_iter.c:3732
__bch2_fs_free fs/bcachefs/super.c:640 [inline]
bch2_fs_release+0x2ab/0x830 fs/bcachefs/super.c:690
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2578
vfs_get_tree+0x92/0x2b0 fs/super.c:1804
do_new_mount+0x24a/0xa40 fs/namespace.c:3902
do_mount fs/namespace.c:4239 [inline]
__do_sys_mount fs/namespace.c:4450 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4427
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f59aa99014a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f59ab804e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f59ab804ef0 RCX: 00007f59aa99014a
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00007f59ab804eb0
RBP: 00002000000000c0 R08: 00007f59ab804ef0 R09: 0000000000818001
R10: 0000000000818001 R11: 0000000000000246 R12: 0000200000000080
R13: 00007f59ab804eb0 R14: 000000000000596b R15: 0000200000000000
</TASK>
Kernel Offset: disabled
Tested on:
commit: cbdeb0ff bcachefs: Fix UAF by journal write path
git tree: git://evilpiepirate.org/bcachefs.git for-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1627f8f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=37de60b3108b6d8f
dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Note: no patches were applied.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-19 18:47 ` syzbot
@ 2025-07-19 19:13 ` Kent Overstreet
2025-07-19 21:11 ` syzbot
0 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2025-07-19 19:13 UTC (permalink / raw)
To: syzbot; +Cc: linux-bcachefs, linux-kernel, syzkaller-bugs
On Sat, Jul 19, 2025 at 11:47:02AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> kernel panic: btree_update_nodes_written leaked btree_trans
>
> Kernel panic - not syncing: btree_update_nodes_written leaked btree_trans
> CPU: 0 UID: 0 PID: 7134 Comm: syz.4.31 Not tainted 6.16.0-rc6-syzkaller-gcbdeb0ffd5bf #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
> Call Trace:
> <TASK>
> dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
> panic+0x2db/0x790 kernel/panic.c:382
> bch2_fs_btree_iter_exit+0x475/0x490 fs/bcachefs/btree_iter.c:3732
> __bch2_fs_free fs/bcachefs/super.c:640 [inline]
> bch2_fs_release+0x2ab/0x830 fs/bcachefs/super.c:690
> kobject_cleanup lib/kobject.c:689 [inline]
> kobject_release lib/kobject.c:720 [inline]
> kref_put include/linux/kref.h:65 [inline]
> kobject_put+0x22b/0x480 lib/kobject.c:737
> bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2578
> vfs_get_tree+0x92/0x2b0 fs/super.c:1804
> do_new_mount+0x24a/0xa40 fs/namespace.c:3902
> do_mount fs/namespace.c:4239 [inline]
> __do_sys_mount fs/namespace.c:4450 [inline]
> __se_sys_mount+0x317/0x410 fs/namespace.c:4427
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f59aa99014a
> Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f59ab804e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00007f59ab804ef0 RCX: 00007f59aa99014a
> RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00007f59ab804eb0
> RBP: 00002000000000c0 R08: 00007f59ab804ef0 R09: 0000000000818001
> R10: 0000000000818001 R11: 0000000000000246 R12: 0000200000000080
> R13: 00007f59ab804eb0 R14: 000000000000596b R15: 0000200000000000
> </TASK>
> Kernel Offset: disabled
>
>
> Tested on:
>
> commit: cbdeb0ff bcachefs: Fix UAF by journal write path
> git tree: git://evilpiepirate.org/bcachefs.git for-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1627f8f0580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=37de60b3108b6d8f
> dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>
> Note: no patches were applied.
appears we were missing a flush_work() in the shutdown path
#syz test: git://evilpiepirate.org/bcachefs.git bcachefs-testing
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-19 19:13 ` Kent Overstreet
@ 2025-07-19 21:11 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2025-07-19 21:11 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in seq_buf_puts
kmalloc-512 total: 10.9 MiB active: 9.75 MiB
kmalloc-cg-2k total: 9.78 MiB active: 8.77 MiB
shmem_inode_cache total: 8.09 MiB active: 8.06 MiB
kmalloc-8k total: 5.72 MiB active: 5.56 MiB
Shrinkers:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 7134 Comm: syz.0.42 Not tainted 6.16.0-rc6-syzkaller-g8546371cc837 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:strlen+0x29/0x70 lib/string.c:420
Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00
RSP: 0018:ffffc90003f8e700 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802d1fda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003f8e850 R08: ffff88814d01cad7 R09: 1ffff11029a0395a
R10: dffffc0000000000 R11: ffffed1029a0395b R12: ffffc90003f8e7c0
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff
FS: 00007f15d42266c0(0000) GS:ffff888125c29000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e6f5ff000 CR3: 00000000251d2000 CR4: 00000000003526f0
Call Trace:
<TASK>
__fortify_strlen include/linux/fortify-string.h:268 [inline]
seq_buf_puts+0x34/0x1a0 lib/seq_buf.c:184
shrinker_to_text+0x115/0x3c0 mm/shrinker.c:836
shrinkers_to_text+0x840/0x960 mm/shrinker.c:911
__show_mem+0x242b/0x24d0 mm/show_mem.c:496
warn_alloc_show_mem mm/page_alloc.c:3719 [inline]
warn_alloc+0x2dd/0x310 mm/page_alloc.c:3744
__vmalloc_area_node mm/vmalloc.c:3702 [inline]
__vmalloc_node_range_noprof+0x67e/0x12f0 mm/vmalloc.c:3893
__kvmalloc_node_noprof+0x3b8/0x5f0 mm/slub.c:5037
__bch2_darray_resize_noprof+0xd7/0x290 fs/bcachefs/darray.c:24
bch2_fs_btree_write_buffer_init+0x16e/0x1f0 fs/bcachefs/btree_write_buffer.c:885
bch2_fs_init_rw+0x226/0x2d0 fs/bcachefs/super.c:835
__bch2_fs_read_write+0x18f/0x5a0 fs/bcachefs/super.c:509
bch2_fs_read_write_early+0x26/0x40 fs/bcachefs/super.c:601
bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:487 [inline]
__bch2_run_recovery_passes+0x39a/0x1050 fs/bcachefs/recovery_passes.c:543
bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:614
bch2_fs_recovery+0x2544/0x3860 fs/bcachefs/recovery.c:996
bch2_fs_start+0x957/0xbf0 fs/bcachefs/super.c:1218
bch2_fs_get_tree+0xb39/0x1540 fs/bcachefs/fs.c:2462
vfs_get_tree+0x92/0x2b0 fs/super.c:1804
do_new_mount+0x24a/0xa40 fs/namespace.c:3902
do_mount fs/namespace.c:4239 [inline]
__do_sys_mount fs/namespace.c:4450 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4427
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f15d339014a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f15d4225e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f15d4225ef0 RCX: 00007f15d339014a
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00007f15d4225eb0
RBP: 00002000000000c0 R08: 00007f15d4225ef0 R09: 0000000000818001
R10: 0000000000818001 R11: 0000000000000246 R12: 0000200000000080
R13: 00007f15d4225eb0 R14: 000000000000596b R15: 0000200000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x29/0x70 lib/string.c:420
Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00
RSP: 0018:ffffc90003f8e700 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802d1fda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003f8e850 R08: ffff88814d01cad7 R09: 1ffff11029a0395a
R10: dffffc0000000000 R11: ffffed1029a0395b R12: ffffc90003f8e7c0
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff
FS: 00007f15d42266c0(0000) GS:ffff888125c29000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4538002565 CR3: 00000000251d2000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 41 57 push %r15
7: 41 56 push %r14
9: 41 54 push %r12
b: 53 push %rbx
c: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
13: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
1a: fc ff df
1d: 48 89 fb mov %rdi,%rbx
20: 49 89 c7 mov %rax,%r15
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 75 11 jne 0x44
33: 48 ff c3 inc %rbx
36: 49 8d 47 01 lea 0x1(%r15),%rax
3a: 42 80 7c 3f 01 00 cmpb $0x0,0x1(%rdi,%r15,1)
Tested on:
commit: 8546371c bcachefs: Flush btree_interior_update_work be..
git tree: git://evilpiepirate.org/bcachefs.git bcachefs-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=102f0b82580000
kernel config: https://syzkaller.appspot.com/x/.config?x=37de60b3108b6d8f
dashboard link: https://syzkaller.appspot.com/bug?extid=2b98caf09c41174a9697
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Note: no patches were applied.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev
2025-07-19 17:35 ` Kent Overstreet
@ 2025-07-23 10:00 ` Aleksandr Nogikh
0 siblings, 0 replies; 12+ messages in thread
From: Aleksandr Nogikh @ 2025-07-23 10:00 UTC (permalink / raw)
To: Kent Overstreet; +Cc: syzbot, linux-bcachefs, linux-kernel, syzkaller-bugs
On Sat, Jul 19, 2025 at 7:35 PM Kent Overstreet
<kent.overstreet@linux.dev> wrote:
>
> Will syzbot reopen if the fix is still in linux-next? Let's find out.
>
> #syz fix: bcachefs: Fix UAF by journal write path
>
Syzbot will actually "close' the bug only once the fix commit has
reached all the fuzzed trees. So it should be okay.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2025-07-23 10:00 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-18 16:09 [syzbot] [bcachefs?] KASAN: slab-use-after-free Write in bch2_get_next_dev syzbot
2025-07-18 17:09 ` Kent Overstreet
2025-07-18 17:09 ` syzbot
2025-07-18 17:25 ` Kent Overstreet
2025-07-18 22:13 ` syzbot
2025-07-19 18:23 ` Kent Overstreet
2025-07-19 18:47 ` syzbot
2025-07-19 19:13 ` Kent Overstreet
2025-07-19 21:11 ` syzbot
2025-07-19 16:58 ` syzbot
2025-07-19 17:35 ` Kent Overstreet
2025-07-23 10:00 ` Aleksandr Nogikh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).