KASAN: use-after-free Read in dput
14 views
Skip to first unread message
syzbot
Aug 28, 2020, 3:40:19 PM8/28/20
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 34364883 ANDROID: ion: export some ion symbols
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=128aa669900000
kernel config: https://syzkaller.appspot.com/x/.config?x=b5e85a4a81932633
dashboard link: https://syzkaller.appspot.com/bug?extid=d5b50dcdc423754d6d4f
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13bcd7c5900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5b50d...@syzkaller.appspotmail.com
BUG: KASAN: use-after-free in fast_dput fs/dcache.c:727 [inline]
BUG: KASAN: use-after-free in dput+0x238/0x5e0 fs/dcache.c:846
Read of size 4 at addr ffff8881cd3e5550 by task syz-executor.2/4307
CPU: 1 PID: 4307 Comm: syz-executor.2 Not tainted 5.4.61-syzkaller-00823-g34364883b1f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x14a/0x1ce lib/dump_stack.c:118
print_address_description+0x93/0x620 mm/kasan/report.c:374
__kasan_report+0x16d/0x1e0 mm/kasan/report.c:506
kasan_report+0x36/0x60 mm/kasan/common.c:634
fast_dput fs/dcache.c:727 [inline]
dput+0x238/0x5e0 fs/dcache.c:846
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
get_signal+0x1e74/0x1f00 kernel/signal.c:2537
do_signal+0x95/0x5d0 arch/x86/kernel/signal.c:815
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1aaba10c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9
RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9
RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000080 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff4ed677df R14: 00007f1aaba119c0 R15: 000000000118cf4c
Allocated by task 4307:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x12c/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2793 [inline]
slab_alloc mm/slub.c:2801 [inline]
kmem_cache_alloc+0x1d5/0x260 mm/slub.c:2806
__d_alloc+0x2a/0x6b0 fs/dcache.c:1688
d_alloc_pseudo+0x19/0x70 fs/dcache.c:1817
alloc_file_pseudo+0x15b/0x340 fs/file_table.c:225
dma_buf_getfile drivers/dma-buf/dma-buf.c:443 [inline]
dma_buf_export+0x4e0/0x7b0 drivers/dma-buf/dma-buf.c:553
ion_dmabuf_alloc+0x199/0x230 drivers/staging/android/ion/ion_dma_buf.c:378
ion_alloc_fd drivers/staging/android/ion/ion.c:54 [inline]
ion_ioctl+0x2e8/0x9c0 drivers/staging/android/ion/ion.c:194
do_vfs_ioctl+0x770/0x1750 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:714 [inline]
__do_sys_ioctl fs/ioctl.c:721 [inline]
__se_sys_ioctl fs/ioctl.c:719 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:719
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 4315:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x181/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1443 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1476
slab_free mm/slub.c:3041 [inline]
kmem_cache_free+0xac/0x600 mm/slub.c:3057
dentry_kill fs/dcache.c:673 [inline]
dput+0x2e1/0x5e0 fs/dcache.c:859
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
get_signal+0x1e74/0x1f00 kernel/signal.c:2537
do_signal+0x95/0x5d0 arch/x86/kernel/signal.c:815
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881cd3e5550
which belongs to the cache dentry of size 208
The buggy address is located 0 bytes inside of
208-byte region [ffff8881cd3e5550, ffff8881cd3e5620)
The buggy address belongs to the page:
page:ffffea000734f940 refcount:1 mapcount:0 mapping:ffff8881da8eea00 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 0000000000000000 0000000900000001 ffff8881da8eea00
raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881cd3e5400: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8881cd3e5480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881cd3e5500: fb fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb
^
ffff8881cd3e5580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881cd3e5600: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
==================================================================
WARNING: CPU: 1 PID: 4307 at fs/dcache.c:637 retain_dentry+0x12d/0x360 fs/dcache.c:637
Modules linked in:
CPU: 1 PID: 4307 Comm: syz-executor.2 Tainted: G B 5.4.61-syzkaller-00823-g34364883b1f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:retain_dentry+0x12d/0x360 fs/dcache.c:637
Code: 40 31 ff e8 c5 c3 c7 ff 89 d8 83 e0 40 0f 84 f2 00 00 00 e8 15 c0 c7 ff b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 03 c0 c7 ff <0f> 0b e9 1f ff ff ff e8 f7 bf c7 ff 31 c0 eb e0 e8 ee bf c7 ff 31
RSP: 0018:ffff8881d935fa88 EFLAGS: 00010293
RAX: ffffffff817a492d RBX: 00000000d910b880 RCX: ffff8881c7d85d00
RDX: 0000000000000000 RSI: 0000000010000000 RDI: 0000000000000000
RBP: 0000000010000000 R08: ffffffff817a4846 R09: ffffed1038fb0ba1
R10: ffffed1038fb0ba1 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff11039a7caaa R14: ffff8881cd3e55a8 R15: ffff8881cd3e5550
FS: 00007f1aaba11700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff6c0de4e8 CR3: 00000001c8fb0002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d5b9
RSP: 002b:00007f1aaba10c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9
RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9
RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000080 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff4ed677df R14: 00007f1aaba119c0 R15: 000000000118cf4c
---[ end trace 91e69d842442845e ]---
list_del corruption, ffff8881c8088878->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:47!
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
CPU: 1 PID: 4307 Comm: syz-executor.2 Tainted: G B D W 5.4.61-syzkaller-00823-g34364883b1f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_del_entry_valid+0xbb/0x100 lib/list_debug.c:45
Code: 89 df e8 78 ce 72 ff 48 8b 13 4c 39 f2 75 43 b0 01 5b 41 5c 41 5e 41 5f c3 48 c7 c7 c3 fa 98 84 4c 89 f6 31 c0 e8 81 55 2e ff <0f> 0b 48 c7 c7 fb fa 98 84 4c 89 f6 31 c0 e8 6e 55 2e ff 0f 0b 48
RSP: 0018:ffff8881d935fa18 EFLAGS: 00010246
RAX: 000000000000004e RBX: dead000000000100 RCX: e24f97b0bb5e1c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff812bef2e R09: ffffed103b725e00
R10: ffffed103b725e00 R11: 0000000000000000 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff8881c8088878 R15: dead000000000122
FS: 00007f1aaba11700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff6c0de4e8 CR3: 00000001c8fb0002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:131 [inline]
list_del include/linux/list.h:139 [inline]
dma_buf_release+0x115/0x2f0 drivers/dma-buf/dma-buf.c:78
__dentry_kill+0x41b/0x5a0 fs/dcache.c:584
dentry_kill fs/dcache.c:673 [inline]
dput+0x2e1/0x5e0 fs/dcache.c:859
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
get_signal+0x1e74/0x1f00 kernel/signal.c:2537
do_signal+0x95/0x5d0 arch/x86/kernel/signal.c:815
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1aaba10c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9
RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9
RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000080 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff4ed677df R14: 00007f1aaba119c0 R15: 000000000118cf4c
Modules linked in:
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 34364883 ANDROID: ion: export some ion symbols
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=128aa669900000
kernel config: https://syzkaller.appspot.com/x/.config?x=b5e85a4a81932633
dashboard link: https://syzkaller.appspot.com/bug?extid=d5b50dcdc423754d6d4f
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13bcd7c5900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5b50d...@syzkaller.appspotmail.com
BUG: KASAN: use-after-free in fast_dput fs/dcache.c:727 [inline]
BUG: KASAN: use-after-free in dput+0x238/0x5e0 fs/dcache.c:846
Read of size 4 at addr ffff8881cd3e5550 by task syz-executor.2/4307
CPU: 1 PID: 4307 Comm: syz-executor.2 Not tainted 5.4.61-syzkaller-00823-g34364883b1f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x14a/0x1ce lib/dump_stack.c:118
print_address_description+0x93/0x620 mm/kasan/report.c:374
__kasan_report+0x16d/0x1e0 mm/kasan/report.c:506
kasan_report+0x36/0x60 mm/kasan/common.c:634
fast_dput fs/dcache.c:727 [inline]
dput+0x238/0x5e0 fs/dcache.c:846
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
get_signal+0x1e74/0x1f00 kernel/signal.c:2537
do_signal+0x95/0x5d0 arch/x86/kernel/signal.c:815
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1aaba10c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9
RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9
RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000080 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff4ed677df R14: 00007f1aaba119c0 R15: 000000000118cf4c
Allocated by task 4307:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x12c/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2793 [inline]
slab_alloc mm/slub.c:2801 [inline]
kmem_cache_alloc+0x1d5/0x260 mm/slub.c:2806
__d_alloc+0x2a/0x6b0 fs/dcache.c:1688
d_alloc_pseudo+0x19/0x70 fs/dcache.c:1817
alloc_file_pseudo+0x15b/0x340 fs/file_table.c:225
dma_buf_getfile drivers/dma-buf/dma-buf.c:443 [inline]
dma_buf_export+0x4e0/0x7b0 drivers/dma-buf/dma-buf.c:553
ion_dmabuf_alloc+0x199/0x230 drivers/staging/android/ion/ion_dma_buf.c:378
ion_alloc_fd drivers/staging/android/ion/ion.c:54 [inline]
ion_ioctl+0x2e8/0x9c0 drivers/staging/android/ion/ion.c:194
do_vfs_ioctl+0x770/0x1750 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:714 [inline]
__do_sys_ioctl fs/ioctl.c:721 [inline]
__se_sys_ioctl fs/ioctl.c:719 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:719
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 4315:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x181/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1443 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1476
slab_free mm/slub.c:3041 [inline]
kmem_cache_free+0xac/0x600 mm/slub.c:3057
dentry_kill fs/dcache.c:673 [inline]
dput+0x2e1/0x5e0 fs/dcache.c:859
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
get_signal+0x1e74/0x1f00 kernel/signal.c:2537
do_signal+0x95/0x5d0 arch/x86/kernel/signal.c:815
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881cd3e5550
which belongs to the cache dentry of size 208
The buggy address is located 0 bytes inside of
208-byte region [ffff8881cd3e5550, ffff8881cd3e5620)
The buggy address belongs to the page:
page:ffffea000734f940 refcount:1 mapcount:0 mapping:ffff8881da8eea00 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 0000000000000000 0000000900000001 ffff8881da8eea00
raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881cd3e5400: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8881cd3e5480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881cd3e5500: fb fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb
^
ffff8881cd3e5580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881cd3e5600: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
==================================================================
WARNING: CPU: 1 PID: 4307 at fs/dcache.c:637 retain_dentry+0x12d/0x360 fs/dcache.c:637
Modules linked in:
CPU: 1 PID: 4307 Comm: syz-executor.2 Tainted: G B 5.4.61-syzkaller-00823-g34364883b1f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:retain_dentry+0x12d/0x360 fs/dcache.c:637
Code: 40 31 ff e8 c5 c3 c7 ff 89 d8 83 e0 40 0f 84 f2 00 00 00 e8 15 c0 c7 ff b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 03 c0 c7 ff <0f> 0b e9 1f ff ff ff e8 f7 bf c7 ff 31 c0 eb e0 e8 ee bf c7 ff 31
RSP: 0018:ffff8881d935fa88 EFLAGS: 00010293
RAX: ffffffff817a492d RBX: 00000000d910b880 RCX: ffff8881c7d85d00
RDX: 0000000000000000 RSI: 0000000010000000 RDI: 0000000000000000
RBP: 0000000010000000 R08: ffffffff817a4846 R09: ffffed1038fb0ba1
R10: ffffed1038fb0ba1 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff11039a7caaa R14: ffff8881cd3e55a8 R15: ffff8881cd3e5550
FS: 00007f1aaba11700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff6c0de4e8 CR3: 00000001c8fb0002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d5b9
RSP: 002b:00007f1aaba10c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9
RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9
RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000080 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff4ed677df R14: 00007f1aaba119c0 R15: 000000000118cf4c
---[ end trace 91e69d842442845e ]---
list_del corruption, ffff8881c8088878->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:47!
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
CPU: 1 PID: 4307 Comm: syz-executor.2 Tainted: G B D W 5.4.61-syzkaller-00823-g34364883b1f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_del_entry_valid+0xbb/0x100 lib/list_debug.c:45
Code: 89 df e8 78 ce 72 ff 48 8b 13 4c 39 f2 75 43 b0 01 5b 41 5c 41 5e 41 5f c3 48 c7 c7 c3 fa 98 84 4c 89 f6 31 c0 e8 81 55 2e ff <0f> 0b 48 c7 c7 fb fa 98 84 4c 89 f6 31 c0 e8 6e 55 2e ff 0f 0b 48
RSP: 0018:ffff8881d935fa18 EFLAGS: 00010246
RAX: 000000000000004e RBX: dead000000000100 RCX: e24f97b0bb5e1c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff812bef2e R09: ffffed103b725e00
R10: ffffed103b725e00 R11: 0000000000000000 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff8881c8088878 R15: dead000000000122
FS: 00007f1aaba11700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff6c0de4e8 CR3: 00000001c8fb0002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:131 [inline]
list_del include/linux/list.h:139 [inline]
dma_buf_release+0x115/0x2f0 drivers/dma-buf/dma-buf.c:78
__dentry_kill+0x41b/0x5a0 fs/dcache.c:584
dentry_kill fs/dcache.c:673 [inline]
dput+0x2e1/0x5e0 fs/dcache.c:859
__fput+0x46b/0x6c0 fs/file_table.c:293
task_work_run+0x176/0x1a0 kernel/task_work.c:113
get_signal+0x1e74/0x1f00 kernel/signal.c:2537
do_signal+0x95/0x5d0 arch/x86/kernel/signal.c:815
exit_to_usermode_loop arch/x86/entry/common.c:159 [inline]
prepare_exit_to_usermode+0x207/0x2e0 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1aaba10c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9
RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9
RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000080 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff4ed677df R14: 00007f1aaba119c0 R15: 000000000118cf4c
Modules linked in:
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Apr 14, 2023, 6:36:31 AM4/14/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages