KASAN: slab-out-of-bounds Read in f2fs_build_segment_manager
24 views
Skip to first unread message
syzbot
Sep 25, 2020, 3:37:25 AM9/25/20
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=176b3365900000
kernel config: https://syzkaller.appspot.com/x/.config?x=a189fc0e5a79868a
dashboard link: https://syzkaller.appspot.com/bug?extid=b68367189599ff1c5061
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b68367...@syzkaller.appspotmail.com
F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop4): Fix alignment : done, start(4096) end(147456) block(12288)
F2FS-fs (loop4): invalid crc_offset: 0
==================================================================
BUG: KASAN: slab-out-of-bounds in init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
BUG: KASAN: slab-out-of-bounds in f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
Read of size 8 at addr ffff8881784593e0 by task syz-executor.4/19327
CPU: 1 PID: 19327 Comm: syz-executor.4 Not tainted 5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
__kasan_report+0x14b/0x1c0 mm/kasan/report.c:506
kasan_report+0x27/0x50 mm/kasan/common.c:634
init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
f2fs_fill_super+0x691a/0x9a40 fs/f2fs/super.c:3625
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x1883/0x2630 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x460bca
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 87 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 87 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007f93a32eca88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f93a32ecb20 RCX: 0000000000460bca
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f93a32ecae0
RBP: 00007f93a32ecae0 R08: 00007f93a32ecb20 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 0000000020000140 R15: 0000000020000200
Allocated by task 19327:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
__kmalloc+0xf7/0x2c0 mm/slub.c:3848
__kmalloc_node include/linux/slab.h:422 [inline]
kmalloc_node include/linux/slab.h:599 [inline]
kvmalloc_node+0xc2/0x120 mm/util.c:564
kvmalloc include/linux/mm.h:690 [inline]
f2fs_kvmalloc fs/f2fs/f2fs.h:3027 [inline]
f2fs_kvzalloc fs/f2fs/f2fs.h:3033 [inline]
build_sit_info fs/f2fs/segment.c:4029 [inline]
f2fs_build_segment_manager+0xd5f/0x88b0 fs/f2fs/segment.c:4768
f2fs_fill_super+0x691a/0x9a40 fs/f2fs/super.c:3625
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x1883/0x2630 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 18543:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x168/0x220 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1443 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1476
slab_free mm/slub.c:3041 [inline]
kfree+0x12b/0x5d0 mm/slub.c:4002
skb_release_all net/core/skbuff.c:666 [inline]
__kfree_skb+0x55/0x180 net/core/skbuff.c:680
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x884/0xa20 net/netlink/af_netlink.c:1329
netlink_sendmsg+0x9a7/0xd40 net/netlink/af_netlink.c:1918
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x56f/0x860 net/socket.c:2298
___sys_sendmsg net/socket.c:2352 [inline]
__sys_sendmsg+0x26a/0x350 net/socket.c:2398
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff888178459000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 992 bytes inside of
1024-byte region [ffff888178459000, ffff888178459400)
The buggy address belongs to the page:
page:ffffea0005e11600 refcount:1 mapcount:0 mapping:ffff8881da802280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0005721c00 0000000500000005 ffff8881da802280
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888178459280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888178459300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888178459380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
^
ffff888178459400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888178459480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
F2FS-fs (loop4): Try to recover 1th superblock, ret: 0
F2FS-fs (loop4): Mounted with checkpoint version = 27d57943
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=176b3365900000
kernel config: https://syzkaller.appspot.com/x/.config?x=a189fc0e5a79868a
dashboard link: https://syzkaller.appspot.com/bug?extid=b68367189599ff1c5061
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b68367...@syzkaller.appspotmail.com
F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop4): Fix alignment : done, start(4096) end(147456) block(12288)
F2FS-fs (loop4): invalid crc_offset: 0
==================================================================
BUG: KASAN: slab-out-of-bounds in init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
BUG: KASAN: slab-out-of-bounds in f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
Read of size 8 at addr ffff8881784593e0 by task syz-executor.4/19327
CPU: 1 PID: 19327 Comm: syz-executor.4 Not tainted 5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
__kasan_report+0x14b/0x1c0 mm/kasan/report.c:506
kasan_report+0x27/0x50 mm/kasan/common.c:634
init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
f2fs_fill_super+0x691a/0x9a40 fs/f2fs/super.c:3625
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x1883/0x2630 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x460bca
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 87 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 87 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007f93a32eca88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f93a32ecb20 RCX: 0000000000460bca
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f93a32ecae0
RBP: 00007f93a32ecae0 R08: 00007f93a32ecb20 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 0000000020000140 R15: 0000000020000200
Allocated by task 19327:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
__kmalloc+0xf7/0x2c0 mm/slub.c:3848
__kmalloc_node include/linux/slab.h:422 [inline]
kmalloc_node include/linux/slab.h:599 [inline]
kvmalloc_node+0xc2/0x120 mm/util.c:564
kvmalloc include/linux/mm.h:690 [inline]
f2fs_kvmalloc fs/f2fs/f2fs.h:3027 [inline]
f2fs_kvzalloc fs/f2fs/f2fs.h:3033 [inline]
build_sit_info fs/f2fs/segment.c:4029 [inline]
f2fs_build_segment_manager+0xd5f/0x88b0 fs/f2fs/segment.c:4768
f2fs_fill_super+0x691a/0x9a40 fs/f2fs/super.c:3625
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x1883/0x2630 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 18543:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x168/0x220 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1443 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1476
slab_free mm/slub.c:3041 [inline]
kfree+0x12b/0x5d0 mm/slub.c:4002
skb_release_all net/core/skbuff.c:666 [inline]
__kfree_skb+0x55/0x180 net/core/skbuff.c:680
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x884/0xa20 net/netlink/af_netlink.c:1329
netlink_sendmsg+0x9a7/0xd40 net/netlink/af_netlink.c:1918
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x56f/0x860 net/socket.c:2298
___sys_sendmsg net/socket.c:2352 [inline]
__sys_sendmsg+0x26a/0x350 net/socket.c:2398
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff888178459000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 992 bytes inside of
1024-byte region [ffff888178459000, ffff888178459400)
The buggy address belongs to the page:
page:ffffea0005e11600 refcount:1 mapcount:0 mapping:ffff8881da802280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0005721c00 0000000500000005 ffff8881da802280
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888178459280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888178459300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888178459380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
^
ffff888178459400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888178459480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
F2FS-fs (loop4): Try to recover 1th superblock, ret: 0
F2FS-fs (loop4): Mounted with checkpoint version = 27d57943
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Sep 25, 2020, 3:54:24 AM9/25/20
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=17fea809900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10cff481900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b68367...@syzkaller.appspotmail.com
F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): Fix alignment : done, start(4096) end(147456) block(12288)
F2FS-fs (loop0): invalid crc_offset: 0
CPU: 1 PID: 341 Comm: syz-executor844 Not tainted 5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc8d626778 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc8d6267d0 RCX: 0000000000446ffa
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc8d626790
RBP: 00007ffc8d626790 R08: 00007ffc8d6267d0 R09: 00007ffc00000015
R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000008
R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003
Allocated by task 341:
Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff8881c5eab000
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881da802280
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
ffff8881c5eab300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881c5eab380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
^
ffff8881c5eab400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881c5eab480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
F2FS-fs (loop0): inconsistent node block, nid:3, node_footer[nid:0,ino:0,ofs:0,cpver:0,blkaddr:0]
F2FS-fs (loop0): Failed to read root inode
HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=a189fc0e5a79868a
dashboard link: https://syzkaller.appspot.com/bug?extid=b68367189599ff1c5061
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=116d5cd3900000
dashboard link: https://syzkaller.appspot.com/bug?extid=b68367189599ff1c5061
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10cff481900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b68367...@syzkaller.appspotmail.com
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): Fix alignment : done, start(4096) end(147456) block(12288)
F2FS-fs (loop0): invalid crc_offset: 0
==================================================================
BUG: KASAN: slab-out-of-bounds in init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
BUG: KASAN: slab-out-of-bounds in f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
Read of size 8 at addr ffff8881c5eab3e0 by task syz-executor844/341
BUG: KASAN: slab-out-of-bounds in init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
BUG: KASAN: slab-out-of-bounds in f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
CPU: 1 PID: 341 Comm: syz-executor844 Not tainted 5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
__kasan_report+0x14b/0x1c0 mm/kasan/report.c:506
kasan_report+0x27/0x50 mm/kasan/common.c:634
init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
f2fs_fill_super+0x691a/0x9a40 fs/f2fs/super.c:3625
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x1883/0x2630 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446ffa
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
__kasan_report+0x14b/0x1c0 mm/kasan/report.c:506
kasan_report+0x27/0x50 mm/kasan/common.c:634
init_min_max_mtime fs/f2fs/segment.c:4710 [inline]
f2fs_build_segment_manager+0x7ed0/0x88b0 fs/f2fs/segment.c:4792
f2fs_fill_super+0x691a/0x9a40 fs/f2fs/super.c:3625
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x1883/0x2630 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc8d626778 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc8d6267d0 RCX: 0000000000446ffa
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc8d626790
RBP: 00007ffc8d626790 R08: 00007ffc8d6267d0 R09: 00007ffc00000015
R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000008
R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003
Allocated by task 341:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
__kmalloc_node include/linux/slab.h:422 [inline]
kmalloc_node include/linux/slab.h:599 [inline]
kvmalloc_node+0xc2/0x120 mm/util.c:564
kmalloc_node include/linux/slab.h:599 [inline]
kvmalloc_node+0xc2/0x120 mm/util.c:564
f2fs_fill_super+0x691a/0x9a40 fs/f2fs/super.c:3625
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
mount_bdev+0x22d/0x340 fs/super.c:1417
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x1883/0x2630 fs/namespace.c:3142
do_mount+0x1883/0x2630 fs/namespace.c:3142
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
entry_SYSCALL_64_after_hwframe+0x44/0xa9
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff8881c5eab000
which belongs to the cache kmalloc-1k of size 1024
1024-byte region [ffff8881c5eab000, ffff8881c5eab400)
The buggy address belongs to the page:
page:ffffea000717aa00 refcount:1 mapcount:0 mapping:ffff8881da802280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881da802280
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881c5eab280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Memory state around the buggy address:
ffff8881c5eab300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881c5eab380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
^
ffff8881c5eab400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881c5eab480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
F2FS-fs (loop0): inconsistent node block, nid:3, node_footer[nid:0,ino:0,ofs:0,cpver:0,blkaddr:0]
F2FS-fs (loop0): Failed to read root inode
syzbot
Apr 17, 2023, 3:54:35 AM4/17/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages