KASAN: slab-out-of-bounds Write in __ext4_expand_extra_isize
6 views
Skip to first unread message
syzbot
Sep 8, 2019, 1:03:08 AM9/8/19
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 4eccd801 Merge 4.14.142 into android-4.14
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=1771f70a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=1b21e8476ec9e22c
dashboard link: https://syzkaller.appspot.com/bug?extid=401dfa07dd81434cb867
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+401dfa...@syzkaller.appspotmail.com
EXT4-fs (sda1): Unrecognized mount option "fsuuid=0���811f-Z" or missing
value
==================================================================
BUG: KASAN: slab-out-of-bounds in memset include/linux/string.h:332 [inline]
BUG: KASAN: slab-out-of-bounds in
__ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5796
Write of size 1091502048 at addr ffff8881d08b52a0 by task rs:main Q:Reg/1633
CPU: 0 PID: 1633 Comm: rs:main Q:Reg Not tainted 4.14.142+ #0
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
print_address_description+0x60/0x226 mm/kasan/report.c:187
__kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316
memset+0x20/0x40 mm/kasan/common.c:113
memset include/linux/string.h:332 [inline]
__ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5796
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5848 [inline]
ext4_mark_inode_dirty+0x471/0x7f0 fs/ext4/inode.c:5924
ext4_da_write_end+0x5ab/0xc40 fs/ext4/inode.c:3190
generic_perform_write+0x281/0x460 mm/filemap.c:3143
__generic_file_write_iter+0x32e/0x550 mm/filemap.c:3257
ext4_file_write_iter+0x58f/0xdb0 fs/ext4/file.c:268
call_write_iter include/linux/fs.h:1788 [inline]
new_sync_write fs/read_write.c:471 [inline]
__vfs_write+0x401/0x5a0 fs/read_write.c:484
vfs_write+0x17f/0x4d0 fs/read_write.c:546
SYSC_write fs/read_write.c:594 [inline]
SyS_write+0x102/0x250 fs/read_write.c:586
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f13a488719d
RSP: 002b:00007f13a2e28000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000080 RCX: 00007f13a488719d
RDX: 0000000000000080 RSI: 0000000001f56a90 RDI: 0000000000000005
RBP: 0000000001f56a90 R08: 0000000001f56a90 R09: 38cb83f6303d6469
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 00007f13a2e28480 R14: 0000000000000001 R15: 0000000001f56890
The buggy address belongs to the page:
page:ffffea0007422d40 count:2 mapcount:0 mapping:ffff8881da4114d0
index:0x427
flags: 0x400000000000203a(referenced|dirty|lru|active|private)
raw: 400000000000203a ffff8881da4114d0 0000000000000427 00000002ffffffff
raw: ffffea000730f3e0 ffffea00073f4f60 ffff8881ceb60bd0 ffff8881da81aa80
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8881da81aa80
Memory state around the buggy address:
ffff8881d100c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881d100c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff8881d100c180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
^
ffff8881d100c200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881d100c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI
Modules linked in:
CPU: 0 PID: 18687 Comm: syz-executor.2 Tainted: G B 4.14.142+
#0
task: 000000005a32e7b3 task.stack: 00000000f8b43f3a
RIP: 0010:perf_iterate_ctx+0x7d/0x2b0 kernel/events/core.c:6352
RSP: 0018:ffff8881c5daf068 EFLAGS: 00010006
RAX: 0000000000000011 RBX: ffff88819878b680 RCX: 0000000000036878
RDX: ffffffff813ebabe RSI: ffffc90005f3e000 RDI: 0000000000000088
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffffffff9fc2dd6b R12: 0000000000000000
R13: ffff88819c859780 R14: ffff8881c5daf180 R15: 0000000000000000
FS: 00007fc557073700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000014396b8 CR3: 000000019dad6001 CR4: 00000000001606b0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
perf_iterate_sb+0x3fd/0x570 kernel/events/core.c:6415
perf_event_switch kernel/events/core.c:7359 [inline]
__perf_event_task_sched_out+0x23a/0xef0 kernel/events/core.c:3122
perf_event_task_sched_out include/linux/perf_event.h:1104 [inline]
prepare_task_switch kernel/sched/core.c:2659 [inline]
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x15a7/0x1f80 kernel/sched/core.c:3454
preempt_schedule_irq+0x5e/0xa0 kernel/sched/core.c:3681
retint_kernel+0x1b/0x2d
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:121 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:182 [inline]
RIP: 0010:check_memory_region+0x9a/0x180 mm/kasan/generic.c:191
RSP: 0018:ffff8881c5daf3c0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: ffffed103b9eea80 RBX: ffffed103b74f494 RCX: ffffffff9db58c7b
RDX: 0000000000000001 RSI: 00000000410effe0 RDI: ffff8881dba7a4a0
RBP: ffffed104396d490 R08: ffffed104396d490 R09: 000000000821dff8
R10: ffffed104396d48f R11: ffff88821cb6a47f R12: 0000000000000004
R13: 0000000000000000 R14: ffff8881dba7a4a0 R15: 0000000000000001
memset+0x20/0x40 mm/kasan/common.c:113
memset include/linux/string.h:332 [inline]
__ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5796
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5848 [inline]
ext4_mark_inode_dirty+0x471/0x7f0 fs/ext4/inode.c:5924
ext4_dirty_inode+0x6c/0x90 fs/ext4/inode.c:5958
__mark_inode_dirty+0x69c/0x1080 fs/fs-writeback.c:2141
generic_update_time+0x1b0/0x270 fs/inode.c:1650
update_time fs/inode.c:1666 [inline]
file_update_time+0x269/0x390 fs/inode.c:1882
__generic_file_write_iter+0x1b9/0x550 mm/filemap.c:3207
blkdev_write_iter fs/block_dev.c:1914 [inline]
blkdev_write_iter+0x1fb/0x3d0 fs/block_dev.c:1891
call_write_iter include/linux/fs.h:1788 [inline]
do_iter_readv_writev+0x379/0x580 fs/read_write.c:679
do_iter_write fs/read_write.c:958 [inline]
do_iter_write+0x152/0x550 fs/read_write.c:939
vfs_iter_write+0x70/0xa0 fs/read_write.c:971
iter_file_splice_write+0x560/0xa50 fs/splice.c:749
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x118/0x160 fs/splice.c:1018
splice_direct_to_actor+0x292/0x760 fs/splice.c:973
do_splice_direct+0x177/0x240 fs/splice.c:1061
do_sendfile+0x493/0xb20 fs/read_write.c:1445
SYSC_sendfile64 fs/read_write.c:1506 [inline]
SyS_sendfile64+0x11f/0x140 fs/read_write.c:1492
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4598e9
RSP: 002b:00007fc557072c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0020000102000007 R11: 0000000000000246 R12: 00007fc5570736d4
R13: 00000000004c709e R14: 00000000004dc750 R15: 00000000ffffffff
Code: 24 24 0f 84 cf 01 00 00 48 bd 00 00 00 00 00 fc ff df e9 9c 00 00 00
e8 12 5c f2 ff 49 8d bc 24 88 00 00 00 48 89 f8 48 c1 e8 03 <0f> b6 04 28
84 c0 74 08 3c 03 0f 8e d1 01 00 00 41 8b 84 24 88
RIP: perf_iterate_ctx+0x7d/0x2b0 kernel/events/core.c:6352 RSP:
ffff8881c5daf068
---[ end trace 5158ac1ed18786bc ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 4eccd801 Merge 4.14.142 into android-4.14
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=1771f70a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=1b21e8476ec9e22c
dashboard link: https://syzkaller.appspot.com/bug?extid=401dfa07dd81434cb867
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+401dfa...@syzkaller.appspotmail.com
EXT4-fs (sda1): Unrecognized mount option "fsuuid=0���811f-Z" or missing
value
==================================================================
BUG: KASAN: slab-out-of-bounds in memset include/linux/string.h:332 [inline]
BUG: KASAN: slab-out-of-bounds in
__ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5796
Write of size 1091502048 at addr ffff8881d08b52a0 by task rs:main Q:Reg/1633
CPU: 0 PID: 1633 Comm: rs:main Q:Reg Not tainted 4.14.142+ #0
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
print_address_description+0x60/0x226 mm/kasan/report.c:187
__kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316
memset+0x20/0x40 mm/kasan/common.c:113
memset include/linux/string.h:332 [inline]
__ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5796
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5848 [inline]
ext4_mark_inode_dirty+0x471/0x7f0 fs/ext4/inode.c:5924
ext4_da_write_end+0x5ab/0xc40 fs/ext4/inode.c:3190
generic_perform_write+0x281/0x460 mm/filemap.c:3143
__generic_file_write_iter+0x32e/0x550 mm/filemap.c:3257
ext4_file_write_iter+0x58f/0xdb0 fs/ext4/file.c:268
call_write_iter include/linux/fs.h:1788 [inline]
new_sync_write fs/read_write.c:471 [inline]
__vfs_write+0x401/0x5a0 fs/read_write.c:484
vfs_write+0x17f/0x4d0 fs/read_write.c:546
SYSC_write fs/read_write.c:594 [inline]
SyS_write+0x102/0x250 fs/read_write.c:586
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f13a488719d
RSP: 002b:00007f13a2e28000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000080 RCX: 00007f13a488719d
RDX: 0000000000000080 RSI: 0000000001f56a90 RDI: 0000000000000005
RBP: 0000000001f56a90 R08: 0000000001f56a90 R09: 38cb83f6303d6469
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 00007f13a2e28480 R14: 0000000000000001 R15: 0000000001f56890
The buggy address belongs to the page:
page:ffffea0007422d40 count:2 mapcount:0 mapping:ffff8881da4114d0
index:0x427
flags: 0x400000000000203a(referenced|dirty|lru|active|private)
raw: 400000000000203a ffff8881da4114d0 0000000000000427 00000002ffffffff
raw: ffffea000730f3e0 ffffea00073f4f60 ffff8881ceb60bd0 ffff8881da81aa80
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8881da81aa80
Memory state around the buggy address:
ffff8881d100c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881d100c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff8881d100c180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
^
ffff8881d100c200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881d100c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI
Modules linked in:
CPU: 0 PID: 18687 Comm: syz-executor.2 Tainted: G B 4.14.142+
#0
task: 000000005a32e7b3 task.stack: 00000000f8b43f3a
RIP: 0010:perf_iterate_ctx+0x7d/0x2b0 kernel/events/core.c:6352
RSP: 0018:ffff8881c5daf068 EFLAGS: 00010006
RAX: 0000000000000011 RBX: ffff88819878b680 RCX: 0000000000036878
RDX: ffffffff813ebabe RSI: ffffc90005f3e000 RDI: 0000000000000088
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffffffff9fc2dd6b R12: 0000000000000000
R13: ffff88819c859780 R14: ffff8881c5daf180 R15: 0000000000000000
FS: 00007fc557073700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000014396b8 CR3: 000000019dad6001 CR4: 00000000001606b0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
perf_iterate_sb+0x3fd/0x570 kernel/events/core.c:6415
perf_event_switch kernel/events/core.c:7359 [inline]
__perf_event_task_sched_out+0x23a/0xef0 kernel/events/core.c:3122
perf_event_task_sched_out include/linux/perf_event.h:1104 [inline]
prepare_task_switch kernel/sched/core.c:2659 [inline]
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x15a7/0x1f80 kernel/sched/core.c:3454
preempt_schedule_irq+0x5e/0xa0 kernel/sched/core.c:3681
retint_kernel+0x1b/0x2d
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:121 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:182 [inline]
RIP: 0010:check_memory_region+0x9a/0x180 mm/kasan/generic.c:191
RSP: 0018:ffff8881c5daf3c0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: ffffed103b9eea80 RBX: ffffed103b74f494 RCX: ffffffff9db58c7b
RDX: 0000000000000001 RSI: 00000000410effe0 RDI: ffff8881dba7a4a0
RBP: ffffed104396d490 R08: ffffed104396d490 R09: 000000000821dff8
R10: ffffed104396d48f R11: ffff88821cb6a47f R12: 0000000000000004
R13: 0000000000000000 R14: ffff8881dba7a4a0 R15: 0000000000000001
memset+0x20/0x40 mm/kasan/common.c:113
memset include/linux/string.h:332 [inline]
__ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5796
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5848 [inline]
ext4_mark_inode_dirty+0x471/0x7f0 fs/ext4/inode.c:5924
ext4_dirty_inode+0x6c/0x90 fs/ext4/inode.c:5958
__mark_inode_dirty+0x69c/0x1080 fs/fs-writeback.c:2141
generic_update_time+0x1b0/0x270 fs/inode.c:1650
update_time fs/inode.c:1666 [inline]
file_update_time+0x269/0x390 fs/inode.c:1882
__generic_file_write_iter+0x1b9/0x550 mm/filemap.c:3207
blkdev_write_iter fs/block_dev.c:1914 [inline]
blkdev_write_iter+0x1fb/0x3d0 fs/block_dev.c:1891
call_write_iter include/linux/fs.h:1788 [inline]
do_iter_readv_writev+0x379/0x580 fs/read_write.c:679
do_iter_write fs/read_write.c:958 [inline]
do_iter_write+0x152/0x550 fs/read_write.c:939
vfs_iter_write+0x70/0xa0 fs/read_write.c:971
iter_file_splice_write+0x560/0xa50 fs/splice.c:749
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x118/0x160 fs/splice.c:1018
splice_direct_to_actor+0x292/0x760 fs/splice.c:973
do_splice_direct+0x177/0x240 fs/splice.c:1061
do_sendfile+0x493/0xb20 fs/read_write.c:1445
SYSC_sendfile64 fs/read_write.c:1506 [inline]
SyS_sendfile64+0x11f/0x140 fs/read_write.c:1492
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4598e9
RSP: 002b:00007fc557072c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0020000102000007 R11: 0000000000000246 R12: 00007fc5570736d4
R13: 00000000004c709e R14: 00000000004dc750 R15: 00000000ffffffff
Code: 24 24 0f 84 cf 01 00 00 48 bd 00 00 00 00 00 fc ff df e9 9c 00 00 00
e8 12 5c f2 ff 49 8d bc 24 88 00 00 00 48 89 f8 48 c1 e8 03 <0f> b6 04 28
84 c0 74 08 3c 03 0f 8e d1 01 00 00 41 8b 84 24 88
RIP: perf_iterate_ctx+0x7d/0x2b0 kernel/events/core.c:6352 RSP:
ffff8881c5daf068
---[ end trace 5158ac1ed18786bc ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Mar 21, 2020, 6:22:10 AM3/21/20
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages