KASAN: use-after-free Read in f2fs_available_free_memory
19 views
Skip to first unread message
syzbot
Nov 4, 2021, 5:17:21 AM11/4/21
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 4944ec82ebb9 Merge 5.10.76 into android12-5.10-lts
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=1353b45ab00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a9fabc39a1bc8139
dashboard link: https://syzkaller.appspot.com/bug?extid=0fa13b1412bfc003747b
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0fa13b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
Read of size 4 at addr ffff888156384810 by task f2fs_discard-7:/23446
CPU: 0 PID: 23446 Comm: f2fs_discard-7: Tainted: G W 5.10.76-syzkaller-01178-g4944ec82ebb9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
__kasan_report+0x142/0x220 mm/kasan/report.c:419
kasan_report+0x51/0x70 mm/kasan/report.c:436
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
issue_discard_thread+0x2dd/0x1b00 fs/f2fs/segment.c:1761
kthread+0x371/0x390 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Allocated by task 23438:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:507
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:516
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x210/0x3a0 mm/slub.c:2975
kmalloc include/linux/slab.h:552 [inline]
f2fs_kmalloc fs/f2fs/f2fs.h:3167 [inline]
f2fs_kzalloc fs/f2fs/f2fs.h:3173 [inline]
f2fs_build_node_manager+0x57/0x1390 fs/f2fs/node.c:3211
f2fs_fill_super+0x6447/0x8f90 fs/f2fs/super.c:3992
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 23438:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:357
____kasan_slab_free+0x133/0x170 mm/kasan/common.c:360
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1596 [inline]
slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1622
slab_free mm/slub.c:3204 [inline]
kfree+0xd5/0x320 mm/slub.c:4192
f2fs_destroy_node_manager+0xdfd/0xf60 fs/f2fs/node.c:3304
f2fs_fill_super+0x7475/0x8f90 fs/f2fs/super.c:4203
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Last potentially related work creation:
kasan_save_stack+0x36/0x60 mm/kasan/common.c:38
kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:345
__call_rcu kernel/rcu/tree.c:2962 [inline]
call_rcu+0x134/0x1470 kernel/rcu/tree.c:3036
fib6_info_release include/net/ip6_fib.h:346 [inline]
ip6_route_info_create+0xc5c/0x1aa0 net/ipv6/route.c:3724
ip6_route_add+0x27/0x130 net/ipv6/route.c:3738
addrconf_add_mroute net/ipv6/addrconf.c:2500 [inline]
addrconf_add_dev+0x419/0x5f0 net/ipv6/addrconf.c:2518
inet6_addr_add+0x216/0x1140 net/ipv6/addrconf.c:2934
inet6_rtm_newaddr+0x8f6/0x2a20 net/ipv6/addrconf.c:4895
rtnetlink_rcv_msg+0xbae/0xd70 net/core/rtnetlink.c:5567
netlink_rcv_skb+0x200/0x470 net/netlink/af_netlink.c:2502
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5585
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1337
netlink_sendmsg+0xa20/0xe00 net/netlink/af_netlink.c:1927
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg net/socket.c:672 [inline]
__sys_sendto+0x541/0x700 net/socket.c:1982
__do_sys_sendto net/socket.c:1994 [inline]
__se_sys_sendto net/socket.c:1990 [inline]
__x64_sys_sendto+0xe5/0x100 net/socket.c:1990
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff888156384800
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 16 bytes inside of
512-byte region [ffff888156384800, ffff888156384a00)
The buggy address belongs to the page:
page:ffffea000558e100 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888156384000 pfn:0x156384
head:ffffea000558e100 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 0000000000000000 0000000100000001 ffff888100043080
raw: ffff888156384000 000000008010000b 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 383, ts 82133568221, free_ts 0
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook mm/page_alloc.c:2385 [inline]
prep_new_page mm/page_alloc.c:2391 [inline]
get_page_from_freelist+0xa74/0xa90 mm/page_alloc.c:4063
__alloc_pages_nodemask+0x3c8/0x820 mm/page_alloc.c:5106
alloc_slab_page mm/slub.c:1807 [inline]
allocate_slab+0x6b/0x350 mm/slub.c:1809
new_slab mm/slub.c:1870 [inline]
new_slab_objects mm/slub.c:2629 [inline]
___slab_alloc+0x143/0x2f0 mm/slub.c:2792
__slab_alloc mm/slub.c:2832 [inline]
slab_alloc_node mm/slub.c:2914 [inline]
slab_alloc mm/slub.c:2956 [inline]
kmem_cache_alloc_trace+0x278/0x3a0 mm/slub.c:2973
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
ipv6_add_addr+0x42c/0x1710 net/ipv6/addrconf.c:1085
addrconf_add_linklocal+0x31a/0x9b0 net/ipv6/addrconf.c:3203
addrconf_addr_gen+0x595/0xcd0 net/ipv6/addrconf.c:3334
addrconf_dev_config+0x32e/0x570 net/ipv6/addrconf.c:3386
addrconf_notify+0x170d/0x3a80 net/ipv6/addrconf.c:3619
notifier_call_chain kernel/notifier.c:83 [inline]
raw_notifier_call_chain+0x8e/0xf0 kernel/notifier.c:410
__dev_notify_flags+0x306/0x5e0 net/core/dev.c:2054
dev_change_flags+0xec/0x190 net/core/dev.c:8558
do_setlink+0xd2f/0x4190 net/core/rtnetlink.c:2707
__rtnl_newlink net/core/rtnetlink.c:3375 [inline]
rtnl_newlink+0x16e2/0x1db0 net/core/rtnetlink.c:3501
rtnetlink_rcv_msg+0xbae/0xd70 net/core/rtnetlink.c:5567
page_owner free stack trace missing
Memory state around the buggy address:
ffff888156384700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888156384780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888156384800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888156384880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888156384900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 4944ec82ebb9 Merge 5.10.76 into android12-5.10-lts
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=1353b45ab00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a9fabc39a1bc8139
dashboard link: https://syzkaller.appspot.com/bug?extid=0fa13b1412bfc003747b
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0fa13b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
Read of size 4 at addr ffff888156384810 by task f2fs_discard-7:/23446
CPU: 0 PID: 23446 Comm: f2fs_discard-7: Tainted: G W 5.10.76-syzkaller-01178-g4944ec82ebb9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
__kasan_report+0x142/0x220 mm/kasan/report.c:419
kasan_report+0x51/0x70 mm/kasan/report.c:436
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
issue_discard_thread+0x2dd/0x1b00 fs/f2fs/segment.c:1761
kthread+0x371/0x390 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Allocated by task 23438:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:507
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:516
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x210/0x3a0 mm/slub.c:2975
kmalloc include/linux/slab.h:552 [inline]
f2fs_kmalloc fs/f2fs/f2fs.h:3167 [inline]
f2fs_kzalloc fs/f2fs/f2fs.h:3173 [inline]
f2fs_build_node_manager+0x57/0x1390 fs/f2fs/node.c:3211
f2fs_fill_super+0x6447/0x8f90 fs/f2fs/super.c:3992
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 23438:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:357
____kasan_slab_free+0x133/0x170 mm/kasan/common.c:360
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1596 [inline]
slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1622
slab_free mm/slub.c:3204 [inline]
kfree+0xd5/0x320 mm/slub.c:4192
f2fs_destroy_node_manager+0xdfd/0xf60 fs/f2fs/node.c:3304
f2fs_fill_super+0x7475/0x8f90 fs/f2fs/super.c:4203
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Last potentially related work creation:
kasan_save_stack+0x36/0x60 mm/kasan/common.c:38
kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:345
__call_rcu kernel/rcu/tree.c:2962 [inline]
call_rcu+0x134/0x1470 kernel/rcu/tree.c:3036
fib6_info_release include/net/ip6_fib.h:346 [inline]
ip6_route_info_create+0xc5c/0x1aa0 net/ipv6/route.c:3724
ip6_route_add+0x27/0x130 net/ipv6/route.c:3738
addrconf_add_mroute net/ipv6/addrconf.c:2500 [inline]
addrconf_add_dev+0x419/0x5f0 net/ipv6/addrconf.c:2518
inet6_addr_add+0x216/0x1140 net/ipv6/addrconf.c:2934
inet6_rtm_newaddr+0x8f6/0x2a20 net/ipv6/addrconf.c:4895
rtnetlink_rcv_msg+0xbae/0xd70 net/core/rtnetlink.c:5567
netlink_rcv_skb+0x200/0x470 net/netlink/af_netlink.c:2502
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5585
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1337
netlink_sendmsg+0xa20/0xe00 net/netlink/af_netlink.c:1927
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg net/socket.c:672 [inline]
__sys_sendto+0x541/0x700 net/socket.c:1982
__do_sys_sendto net/socket.c:1994 [inline]
__se_sys_sendto net/socket.c:1990 [inline]
__x64_sys_sendto+0xe5/0x100 net/socket.c:1990
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff888156384800
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 16 bytes inside of
512-byte region [ffff888156384800, ffff888156384a00)
The buggy address belongs to the page:
page:ffffea000558e100 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888156384000 pfn:0x156384
head:ffffea000558e100 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 0000000000000000 0000000100000001 ffff888100043080
raw: ffff888156384000 000000008010000b 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 383, ts 82133568221, free_ts 0
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook mm/page_alloc.c:2385 [inline]
prep_new_page mm/page_alloc.c:2391 [inline]
get_page_from_freelist+0xa74/0xa90 mm/page_alloc.c:4063
__alloc_pages_nodemask+0x3c8/0x820 mm/page_alloc.c:5106
alloc_slab_page mm/slub.c:1807 [inline]
allocate_slab+0x6b/0x350 mm/slub.c:1809
new_slab mm/slub.c:1870 [inline]
new_slab_objects mm/slub.c:2629 [inline]
___slab_alloc+0x143/0x2f0 mm/slub.c:2792
__slab_alloc mm/slub.c:2832 [inline]
slab_alloc_node mm/slub.c:2914 [inline]
slab_alloc mm/slub.c:2956 [inline]
kmem_cache_alloc_trace+0x278/0x3a0 mm/slub.c:2973
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
ipv6_add_addr+0x42c/0x1710 net/ipv6/addrconf.c:1085
addrconf_add_linklocal+0x31a/0x9b0 net/ipv6/addrconf.c:3203
addrconf_addr_gen+0x595/0xcd0 net/ipv6/addrconf.c:3334
addrconf_dev_config+0x32e/0x570 net/ipv6/addrconf.c:3386
addrconf_notify+0x170d/0x3a80 net/ipv6/addrconf.c:3619
notifier_call_chain kernel/notifier.c:83 [inline]
raw_notifier_call_chain+0x8e/0xf0 kernel/notifier.c:410
__dev_notify_flags+0x306/0x5e0 net/core/dev.c:2054
dev_change_flags+0xec/0x190 net/core/dev.c:8558
do_setlink+0xd2f/0x4190 net/core/rtnetlink.c:2707
__rtnl_newlink net/core/rtnetlink.c:3375 [inline]
rtnl_newlink+0x16e2/0x1db0 net/core/rtnetlink.c:3501
rtnetlink_rcv_msg+0xbae/0xd70 net/core/rtnetlink.c:5567
page_owner free stack trace missing
Memory state around the buggy address:
ffff888156384700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888156384780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888156384800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888156384880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888156384900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Dec 31, 2021, 3:55:19 AM12/31/21
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 9b28b48fb343 Merge 5.10.89 into android12-5.10-lts
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=16e68e35b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=194b6725650cc3e2
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0fa13b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
Read of size 4 at addr ffff88810e9a7c10 by task f2fs_discard-7:/8436
CPU: 0 PID: 8436 Comm: f2fs_discard-7: Not tainted 5.10.89-syzkaller-00788-g9b28b48fb343 #0
head:ffffea00043a6900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0004341400 0000000300000003 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
kmalloc include/linux/slab.h:557 [inline]
kzalloc include/linux/slab.h:664 [inline]
neigh_alloc net/core/neighbour.c:406 [inline]
___neigh_create+0x608/0x1a50 net/core/neighbour.c:590
__neigh_create+0x32/0x40 net/core/neighbour.c:678
ip6_finish_output2+0xa11/0x1930 net/ipv6/ip6_output.c:142
__ip6_finish_output+0x610/0x7b0 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x1e0 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x211/0x4c0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK include/linux/netfilter.h:304 [inline]
ndisc_send_skb+0x6fe/0xc10 net/ipv6/ndisc.c:508
ndisc_send_rs+0x522/0x690 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x8ee/0xdc0 net/ipv6/addrconf.c:4224
addrconf_dad_work+0xe4b/0x1d40 net/ipv6/addrconf.c:3989
process_one_work+0x6b4/0xfb0 kernel/workqueue.c:2289
page last free stack trace:
reset_page_owner include/linux/page_owner.h:28 [inline]
free_pages_prepare mm/page_alloc.c:1331 [inline]
__free_pages_ok+0xbe7/0xc20 mm/page_alloc.c:1611
free_the_page mm/page_alloc.c:5167 [inline]
__free_pages+0x2d6/0x4a0 mm/page_alloc.c:5173
__free_slab+0xdf/0x1a0 mm/slub.c:1895
free_slab mm/slub.c:1910 [inline]
discard_slab mm/slub.c:1916 [inline]
unfreeze_partials+0x17d/0x1b0 mm/slub.c:2410
put_cpu_partial+0xc8/0x190 mm/slub.c:2446
__slab_free+0x2eb/0x4e0 mm/slub.c:3096
do_slab_free mm/slub.c:3192 [inline]
___cache_free+0x131/0x150 mm/slub.c:3211
qlink_free+0x38/0x40 mm/kasan/quarantine.c:146
qlist_free_all mm/kasan/quarantine.c:165 [inline]
kasan_quarantine_reduce+0x178/0x1d0 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:438
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2948 [inline]
slab_alloc mm/slub.c:2956 [inline]
kmem_cache_alloc_trace+0x1a5/0x3a0 mm/slub.c:2973
kmalloc include/linux/slab.h:552 [inline]
__kthread_create_on_node+0x11f/0x410 kernel/kthread.c:358
kthread_create_on_node+0xda/0x120 kernel/kthread.c:447
loop_prepare_queue drivers/block/loop.c:931 [inline]
loop_configure+0x702/0x15b0 drivers/block/loop.c:1124
lo_ioctl+0x821/0x2380 drivers/block/loop.c:1690
__blkdev_driver_ioctl block/ioctl.c:237 [inline]
blkdev_ioctl+0x2c3/0x5f0 block/ioctl.c:632
Memory state around the buggy address:
ffff88810e9a7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88810e9a7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88810e9a7c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88810e9a7c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88810e9a7d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: 9b28b48fb343 Merge 5.10.89 into android12-5.10-lts
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=16e68e35b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=194b6725650cc3e2
dashboard link: https://syzkaller.appspot.com/bug?extid=0fa13b1412bfc003747b
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14be4b71b00000
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0fa13b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
CPU: 0 PID: 8436 Comm: f2fs_discard-7: Not tainted 5.10.89-syzkaller-00788-g9b28b48fb343 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
__kasan_report+0x142/0x220 mm/kasan/report.c:419
kasan_report+0x51/0x70 mm/kasan/report.c:436
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
issue_discard_thread+0x2dd/0x1b00 fs/f2fs/segment.c:1761
kthread+0x371/0x390 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Allocated by task 8420:
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
__kasan_report+0x142/0x220 mm/kasan/report.c:419
kasan_report+0x51/0x70 mm/kasan/report.c:436
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
f2fs_available_free_memory+0xa98/0xb00 fs/f2fs/node.c:99
issue_discard_thread+0x2dd/0x1b00 fs/f2fs/segment.c:1761
kthread+0x371/0x390 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:507
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:516
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x210/0x3a0 mm/slub.c:2975
kmalloc include/linux/slab.h:552 [inline]
f2fs_kmalloc fs/f2fs/f2fs.h:3167 [inline]
f2fs_kzalloc fs/f2fs/f2fs.h:3173 [inline]
f2fs_build_node_manager+0x57/0x1390 fs/f2fs/node.c:3212
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:507
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:516
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x210/0x3a0 mm/slub.c:2975
kmalloc include/linux/slab.h:552 [inline]
f2fs_kmalloc fs/f2fs/f2fs.h:3167 [inline]
f2fs_kzalloc fs/f2fs/f2fs.h:3173 [inline]
f2fs_fill_super+0x6447/0x8f90 fs/f2fs/super.c:3992
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 8420:
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:357
____kasan_slab_free+0x133/0x170 mm/kasan/common.c:360
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1596 [inline]
slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1622
slab_free mm/slub.c:3204 [inline]
kfree+0xd5/0x320 mm/slub.c:4192
f2fs_destroy_node_manager+0xdfd/0xf60 fs/f2fs/node.c:3305
kasan_set_track+0x4c/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:357
____kasan_slab_free+0x133/0x170 mm/kasan/common.c:360
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1596 [inline]
slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1622
slab_free mm/slub.c:3204 [inline]
kfree+0xd5/0x320 mm/slub.c:4192
f2fs_fill_super+0x7475/0x8f90 fs/f2fs/super.c:4203
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff88810e9a7c00
mount_bdev+0x25f/0x370 fs/super.c:1419
f2fs_mount+0x34/0x40 fs/f2fs/super.c:4258
legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
vfs_get_tree+0x89/0x270 fs/super.c:1549
do_new_mount fs/namespace.c:2899 [inline]
path_mount+0x1975/0x2ab0 fs/namespace.c:3229
do_mount fs/namespace.c:3242 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2f7/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 16 bytes inside of
512-byte region [ffff88810e9a7c00, ffff88810e9a7e00)
The buggy address is located 16 bytes inside of
The buggy address belongs to the page:
page:ffffea00043a6900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e9a4
head:ffffea00043a6900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0004341400 0000000300000003 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 74, ts 331215856380, free_ts 331138087770
page_owner tracks the page as allocated
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook mm/page_alloc.c:2385 [inline]
prep_new_page mm/page_alloc.c:2391 [inline]
get_page_from_freelist+0xa74/0xa90 mm/page_alloc.c:4063
__alloc_pages_nodemask+0x3c8/0x820 mm/page_alloc.c:5106
alloc_slab_page mm/slub.c:1807 [inline]
allocate_slab+0x6b/0x350 mm/slub.c:1809
new_slab mm/slub.c:1870 [inline]
new_slab_objects mm/slub.c:2629 [inline]
___slab_alloc+0x143/0x2f0 mm/slub.c:2792
__slab_alloc mm/slub.c:2832 [inline]
slab_alloc_node mm/slub.c:2914 [inline]
slab_alloc mm/slub.c:2956 [inline]
__kmalloc+0x2af/0x3d0 mm/slub.c:4030
post_alloc_hook mm/page_alloc.c:2385 [inline]
prep_new_page mm/page_alloc.c:2391 [inline]
get_page_from_freelist+0xa74/0xa90 mm/page_alloc.c:4063
__alloc_pages_nodemask+0x3c8/0x820 mm/page_alloc.c:5106
alloc_slab_page mm/slub.c:1807 [inline]
allocate_slab+0x6b/0x350 mm/slub.c:1809
new_slab mm/slub.c:1870 [inline]
new_slab_objects mm/slub.c:2629 [inline]
___slab_alloc+0x143/0x2f0 mm/slub.c:2792
__slab_alloc mm/slub.c:2832 [inline]
slab_alloc_node mm/slub.c:2914 [inline]
slab_alloc mm/slub.c:2956 [inline]
kmalloc include/linux/slab.h:557 [inline]
kzalloc include/linux/slab.h:664 [inline]
neigh_alloc net/core/neighbour.c:406 [inline]
___neigh_create+0x608/0x1a50 net/core/neighbour.c:590
__neigh_create+0x32/0x40 net/core/neighbour.c:678
ip6_finish_output2+0xa11/0x1930 net/ipv6/ip6_output.c:142
__ip6_finish_output+0x610/0x7b0 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x1e0 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x211/0x4c0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK include/linux/netfilter.h:304 [inline]
ndisc_send_skb+0x6fe/0xc10 net/ipv6/ndisc.c:508
ndisc_send_rs+0x522/0x690 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x8ee/0xdc0 net/ipv6/addrconf.c:4224
addrconf_dad_work+0xe4b/0x1d40 net/ipv6/addrconf.c:3989
process_one_work+0x6b4/0xfb0 kernel/workqueue.c:2289
page last free stack trace:
reset_page_owner include/linux/page_owner.h:28 [inline]
free_pages_prepare mm/page_alloc.c:1331 [inline]
__free_pages_ok+0xbe7/0xc20 mm/page_alloc.c:1611
free_the_page mm/page_alloc.c:5167 [inline]
__free_pages+0x2d6/0x4a0 mm/page_alloc.c:5173
__free_slab+0xdf/0x1a0 mm/slub.c:1895
free_slab mm/slub.c:1910 [inline]
discard_slab mm/slub.c:1916 [inline]
unfreeze_partials+0x17d/0x1b0 mm/slub.c:2410
put_cpu_partial+0xc8/0x190 mm/slub.c:2446
__slab_free+0x2eb/0x4e0 mm/slub.c:3096
do_slab_free mm/slub.c:3192 [inline]
___cache_free+0x131/0x150 mm/slub.c:3211
qlink_free+0x38/0x40 mm/kasan/quarantine.c:146
qlist_free_all mm/kasan/quarantine.c:165 [inline]
kasan_quarantine_reduce+0x178/0x1d0 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:438
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2948 [inline]
slab_alloc mm/slub.c:2956 [inline]
kmem_cache_alloc_trace+0x1a5/0x3a0 mm/slub.c:2973
kmalloc include/linux/slab.h:552 [inline]
__kthread_create_on_node+0x11f/0x410 kernel/kthread.c:358
kthread_create_on_node+0xda/0x120 kernel/kthread.c:447
loop_prepare_queue drivers/block/loop.c:931 [inline]
loop_configure+0x702/0x15b0 drivers/block/loop.c:1124
lo_ioctl+0x821/0x2380 drivers/block/loop.c:1690
__blkdev_driver_ioctl block/ioctl.c:237 [inline]
blkdev_ioctl+0x2c3/0x5f0 block/ioctl.c:632
Memory state around the buggy address:
ffff88810e9a7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88810e9a7c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88810e9a7c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88810e9a7d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syzbot
Aug 30, 2022, 4:44:21 PM8/30/22
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages