[Android 5.10] KASAN: use-after-free Read in f2fs_remove_dirty_inode
3 views
Skip to first unread message
syzbot
Mar 18, 2023, 2:37:50 PM3/18/23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 416c4356f372 Merge 5.10.161 into android12-5.10-lts
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=14f982d6c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=ba29236d2f217808
dashboard link: https://syzkaller.appspot.com/bug?extid=64c79ff4360a83c22371
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=100f83bec80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15320ad6c80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0149809cf436/disk-416c4356.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2bf0b26aed77/vmlinux-416c4356.xz
kernel image: https://storage.googleapis.com/syzbot-assets/224b4978be5c/bzImage-416c4356.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/ac9544d90fd5/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/8e22d4f00baa/mount_1.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+64c79f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __list_del_entry_valid+0x88/0x130 lib/list_debug.c:59
Read of size 8 at addr ffff88810c35a498 by task kworker/u4:1/9
CPU: 0 PID: 9 Comm: kworker/u4:1 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x81/0x3c0 mm/kasan/report.c:233
__kasan_report mm/kasan/report.c:419 [inline]
kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
__list_del_entry_valid+0x88/0x130 lib/list_debug.c:59
__list_del_entry include/linux/list.h:132 [inline]
list_del_init include/linux/list.h:204 [inline]
__remove_dirty_inode fs/f2fs/checkpoint.c:1015 [inline]
f2fs_remove_dirty_inode+0x217/0x3f0 fs/f2fs/checkpoint.c:1051
__f2fs_write_data_pages+0x245b/0x2c80 fs/f2fs/data.c:3219
f2fs_write_data_pages+0x74/0x80 fs/f2fs/data.c:3233
do_writepages+0x13a/0x280 mm/page-writeback.c:2358
__writeback_single_inode+0xb8/0x6e0 fs/fs-writeback.c:1467
writeback_sb_inodes+0x999/0x1700 fs/fs-writeback.c:1730
wb_writeback+0x42f/0xc20 fs/fs-writeback.c:1905
wb_do_writeback+0x222/0xbd0 fs/fs-writeback.c:2050
wb_workfn+0xf8/0x3f0 fs/fs-writeback.c:2091
process_one_work+0x726/0xc10 kernel/workqueue.c:2296
worker_thread+0xb27/0x1550 kernel/workqueue.c:2442
kthread+0x349/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299
Allocated by task 160:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:507
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:516
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x1dd/0x330 mm/slub.c:2983
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
uevent_show+0x166/0x330 drivers/base/core.c:2277
dev_attr_show+0x56/0xd0 drivers/base/core.c:1984
sysfs_kf_seq_show+0x26b/0x400 fs/sysfs/file.c:61
kernfs_seq_show+0x117/0x160 fs/kernfs/file.c:168
seq_read_iter+0x429/0xd20 fs/seq_file.c:230
kernfs_fop_read_iter+0x161/0x490 fs/kernfs/file.c:241
call_read_iter include/linux/fs.h:1963 [inline]
new_sync_read fs/read_write.c:415 [inline]
vfs_read+0x9e2/0xbf0 fs/read_write.c:496
ksys_read+0x198/0x2c0 fs/read_write.c:634
__do_sys_read fs/read_write.c:644 [inline]
__se_sys_read fs/read_write.c:642 [inline]
__x64_sys_read+0x7b/0x90 fs/read_write.c:642
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
Freed by task 160:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:357
____kasan_slab_free+0x121/0x160 mm/kasan/common.c:360
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1604 [inline]
slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1630
slab_free mm/slub.c:3212 [inline]
kfree+0xc3/0x290 mm/slub.c:4200
uevent_show+0x1dc/0x330 drivers/base/core.c:2290
dev_attr_show+0x56/0xd0 drivers/base/core.c:1984
sysfs_kf_seq_show+0x26b/0x400 fs/sysfs/file.c:61
kernfs_seq_show+0x117/0x160 fs/kernfs/file.c:168
seq_read_iter+0x429/0xd20 fs/seq_file.c:230
kernfs_fop_read_iter+0x161/0x490 fs/kernfs/file.c:241
call_read_iter include/linux/fs.h:1963 [inline]
new_sync_read fs/read_write.c:415 [inline]
vfs_read+0x9e2/0xbf0 fs/read_write.c:496
ksys_read+0x198/0x2c0 fs/read_write.c:634
__do_sys_read fs/read_write.c:644 [inline]
__se_sys_read fs/read_write.c:642 [inline]
__x64_sys_read+0x7b/0x90 fs/read_write.c:642
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
The buggy address belongs to the object at ffff88810c35a000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1176 bytes inside of
4096-byte region [ffff88810c35a000, ffff88810c35b000)
The buggy address belongs to the page:
page:ffffea000430d600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c358
head:ffffea000430d600 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0004309400 0000000300000003 ffff888100042c00
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 160, ts 655275465318, free_ts 655173665067
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook mm/page_alloc.c:2386 [inline]
prep_new_page mm/page_alloc.c:2392 [inline]
get_page_from_freelist+0x755/0x810 mm/page_alloc.c:4073
__alloc_pages_nodemask+0x3b6/0x890 mm/page_alloc.c:5160
alloc_slab_page mm/slub.c:1815 [inline]
allocate_slab+0x78/0x540 mm/slub.c:1817
new_slab mm/slub.c:1878 [inline]
new_slab_objects mm/slub.c:2636 [inline]
___slab_alloc+0x131/0x2e0 mm/slub.c:2800
__slab_alloc+0x63/0xa0 mm/slub.c:2840
slab_alloc_node mm/slub.c:2922 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc_trace+0x20e/0x330 mm/slub.c:2981
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
kernfs_iop_get_link+0x65/0x590 fs/kernfs/symlink.c:135
vfs_readlink+0x177/0x420 fs/namei.c:4631
do_readlinkat+0x28f/0x3b0 fs/stat.c:426
__do_sys_readlink fs/stat.c:447 [inline]
__se_sys_readlink fs/stat.c:444 [inline]
__x64_sys_readlink+0x7f/0x90 fs/stat.c:444
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
page last free stack trace:
reset_page_owner include/linux/page_owner.h:28 [inline]
free_pages_prepare mm/page_alloc.c:1332 [inline]
__free_pages_ok+0x7f8/0x830 mm/page_alloc.c:1612
free_the_page mm/page_alloc.c:5221 [inline]
__free_pages+0x383/0x570 mm/page_alloc.c:5228
__free_slab+0xd3/0x190 mm/slub.c:1903
free_slab mm/slub.c:1918 [inline]
discard_slab mm/slub.c:1924 [inline]
unfreeze_partials+0x17d/0x1b0 mm/slub.c:2419
put_cpu_partial+0xc8/0x190 mm/slub.c:2455
__slab_free+0x2d8/0x3a0 mm/slub.c:3104
do_slab_free mm/slub.c:3200 [inline]
___cache_free+0x11f/0x140 mm/slub.c:3219
qlink_free+0x38/0x40 mm/kasan/quarantine.c:146
qlist_free_all+0x4c/0xc0 mm/kasan/quarantine.c:165
kasan_quarantine_reduce+0x15a/0x170 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:438
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook include/../mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x16c/0x300 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xe6/0x1330 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1615
lookup_slow fs/namei.c:1647 [inline]
lookup_one_len_unlocked+0x458/0x680 fs/namei.c:2673
Memory state around the buggy address:
ffff88810c35a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88810c35a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88810c35a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88810c35a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88810c35a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
list_del corruption. prev->next should be ffff88811a223720, but was 0000000000000000
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9 Comm: kworker/u4:1 Tainted: G B 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:__list_del_entry_valid+0x11a/0x130 lib/list_debug.c:59
Code: 69 fd 41 02 0f 0b 48 c7 c7 40 0b 44 85 4c 89 f6 31 c0 e8 56 fd 41 02 0f 0b 48 c7 c7 a0 0b 44 85 4c 89 f6 31 c0 e8 43 fd 41 02 <0f> 0b 48 c7 c7 00 0c 44 85 4c 89 f6 31 c0 e8 30 fd 41 02 0f 0b 90
RSP: 0018:ffffc90000097008 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff88810c35a498 RCX: a22677a9736aaa00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000097028 R08: ffffffff81540db8 R09: ffffed103ee0a5e8
R10: ffffed103ee0a5e8 R11: 1ffff1103ee0a5e7 R12: dffffc0000000000
R13: ffff88811a223720 R14: ffff88811a223720 R15: ffff88810c35a498
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5547f0a88 CR3: 000000010da56000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:132 [inline]
list_del_init include/linux/list.h:204 [inline]
__remove_dirty_inode fs/f2fs/checkpoint.c:1015 [inline]
f2fs_remove_dirty_inode+0x217/0x3f0 fs/f2fs/checkpoint.c:1051
__f2fs_write_data_pages+0x245b/0x2c80 fs/f2fs/data.c:3219
f2fs_write_data_pages+0x74/0x80 fs/f2fs/data.c:3233
do_writepages+0x13a/0x280 mm/page-writeback.c:2358
__writeback_single_inode+0xb8/0x6e0 fs/fs-writeback.c:1467
writeback_sb_inodes+0x999/0x1700 fs/fs-writeback.c:1730
wb_writeback+0x42f/0xc20 fs/fs-writeback.c:1905
wb_do_writeback+0x222/0xbd0 fs/fs-writeback.c:2050
wb_workfn+0xf8/0x3f0 fs/fs-writeback.c:2091
process_one_work+0x726/0xc10 kernel/workqueue.c:2296
worker_thread+0xb27/0x1550 kernel/workqueue.c:2442
kthread+0x349/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299
Modules linked in:
---[ end trace 63ef9a687ec438b8 ]---
RIP: 0010:__list_del_entry_valid+0x11a/0x130 lib/list_debug.c:59
Code: 69 fd 41 02 0f 0b 48 c7 c7 40 0b 44 85 4c 89 f6 31 c0 e8 56 fd 41 02 0f 0b 48 c7 c7 a0 0b 44 85 4c 89 f6 31 c0 e8 43 fd 41 02 <0f> 0b 48 c7 c7 00 0c 44 85 4c 89 f6 31 c0 e8 30 fd 41 02 0f 0b 90
RSP: 0018:ffffc90000097008 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff88810c35a498 RCX: a22677a9736aaa00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000097028 R08: ffffffff81540db8 R09: ffffed103ee0a5e8
R10: ffffed103ee0a5e8 R11: 1ffff1103ee0a5e7 R12: dffffc0000000000
R13: ffff88811a223720 R14: ffff88811a223720 R15: ffff88810c35a498
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5547f0a88 CR3: 000000010da56000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 416c4356f372 Merge 5.10.161 into android12-5.10-lts
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=14f982d6c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=ba29236d2f217808
dashboard link: https://syzkaller.appspot.com/bug?extid=64c79ff4360a83c22371
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=100f83bec80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15320ad6c80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0149809cf436/disk-416c4356.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2bf0b26aed77/vmlinux-416c4356.xz
kernel image: https://storage.googleapis.com/syzbot-assets/224b4978be5c/bzImage-416c4356.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/ac9544d90fd5/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/8e22d4f00baa/mount_1.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+64c79f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __list_del_entry_valid+0x88/0x130 lib/list_debug.c:59
Read of size 8 at addr ffff88810c35a498 by task kworker/u4:1/9
CPU: 0 PID: 9 Comm: kworker/u4:1 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x81/0x3c0 mm/kasan/report.c:233
__kasan_report mm/kasan/report.c:419 [inline]
kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
__list_del_entry_valid+0x88/0x130 lib/list_debug.c:59
__list_del_entry include/linux/list.h:132 [inline]
list_del_init include/linux/list.h:204 [inline]
__remove_dirty_inode fs/f2fs/checkpoint.c:1015 [inline]
f2fs_remove_dirty_inode+0x217/0x3f0 fs/f2fs/checkpoint.c:1051
__f2fs_write_data_pages+0x245b/0x2c80 fs/f2fs/data.c:3219
f2fs_write_data_pages+0x74/0x80 fs/f2fs/data.c:3233
do_writepages+0x13a/0x280 mm/page-writeback.c:2358
__writeback_single_inode+0xb8/0x6e0 fs/fs-writeback.c:1467
writeback_sb_inodes+0x999/0x1700 fs/fs-writeback.c:1730
wb_writeback+0x42f/0xc20 fs/fs-writeback.c:1905
wb_do_writeback+0x222/0xbd0 fs/fs-writeback.c:2050
wb_workfn+0xf8/0x3f0 fs/fs-writeback.c:2091
process_one_work+0x726/0xc10 kernel/workqueue.c:2296
worker_thread+0xb27/0x1550 kernel/workqueue.c:2442
kthread+0x349/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299
Allocated by task 160:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:507
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:516
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x1dd/0x330 mm/slub.c:2983
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
uevent_show+0x166/0x330 drivers/base/core.c:2277
dev_attr_show+0x56/0xd0 drivers/base/core.c:1984
sysfs_kf_seq_show+0x26b/0x400 fs/sysfs/file.c:61
kernfs_seq_show+0x117/0x160 fs/kernfs/file.c:168
seq_read_iter+0x429/0xd20 fs/seq_file.c:230
kernfs_fop_read_iter+0x161/0x490 fs/kernfs/file.c:241
call_read_iter include/linux/fs.h:1963 [inline]
new_sync_read fs/read_write.c:415 [inline]
vfs_read+0x9e2/0xbf0 fs/read_write.c:496
ksys_read+0x198/0x2c0 fs/read_write.c:634
__do_sys_read fs/read_write.c:644 [inline]
__se_sys_read fs/read_write.c:642 [inline]
__x64_sys_read+0x7b/0x90 fs/read_write.c:642
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
Freed by task 160:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:357
____kasan_slab_free+0x121/0x160 mm/kasan/common.c:360
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1604 [inline]
slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1630
slab_free mm/slub.c:3212 [inline]
kfree+0xc3/0x290 mm/slub.c:4200
uevent_show+0x1dc/0x330 drivers/base/core.c:2290
dev_attr_show+0x56/0xd0 drivers/base/core.c:1984
sysfs_kf_seq_show+0x26b/0x400 fs/sysfs/file.c:61
kernfs_seq_show+0x117/0x160 fs/kernfs/file.c:168
seq_read_iter+0x429/0xd20 fs/seq_file.c:230
kernfs_fop_read_iter+0x161/0x490 fs/kernfs/file.c:241
call_read_iter include/linux/fs.h:1963 [inline]
new_sync_read fs/read_write.c:415 [inline]
vfs_read+0x9e2/0xbf0 fs/read_write.c:496
ksys_read+0x198/0x2c0 fs/read_write.c:634
__do_sys_read fs/read_write.c:644 [inline]
__se_sys_read fs/read_write.c:642 [inline]
__x64_sys_read+0x7b/0x90 fs/read_write.c:642
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
The buggy address belongs to the object at ffff88810c35a000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1176 bytes inside of
4096-byte region [ffff88810c35a000, ffff88810c35b000)
The buggy address belongs to the page:
page:ffffea000430d600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c358
head:ffffea000430d600 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0004309400 0000000300000003 ffff888100042c00
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 160, ts 655275465318, free_ts 655173665067
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook mm/page_alloc.c:2386 [inline]
prep_new_page mm/page_alloc.c:2392 [inline]
get_page_from_freelist+0x755/0x810 mm/page_alloc.c:4073
__alloc_pages_nodemask+0x3b6/0x890 mm/page_alloc.c:5160
alloc_slab_page mm/slub.c:1815 [inline]
allocate_slab+0x78/0x540 mm/slub.c:1817
new_slab mm/slub.c:1878 [inline]
new_slab_objects mm/slub.c:2636 [inline]
___slab_alloc+0x131/0x2e0 mm/slub.c:2800
__slab_alloc+0x63/0xa0 mm/slub.c:2840
slab_alloc_node mm/slub.c:2922 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc_trace+0x20e/0x330 mm/slub.c:2981
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
kernfs_iop_get_link+0x65/0x590 fs/kernfs/symlink.c:135
vfs_readlink+0x177/0x420 fs/namei.c:4631
do_readlinkat+0x28f/0x3b0 fs/stat.c:426
__do_sys_readlink fs/stat.c:447 [inline]
__se_sys_readlink fs/stat.c:444 [inline]
__x64_sys_readlink+0x7f/0x90 fs/stat.c:444
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
page last free stack trace:
reset_page_owner include/linux/page_owner.h:28 [inline]
free_pages_prepare mm/page_alloc.c:1332 [inline]
__free_pages_ok+0x7f8/0x830 mm/page_alloc.c:1612
free_the_page mm/page_alloc.c:5221 [inline]
__free_pages+0x383/0x570 mm/page_alloc.c:5228
__free_slab+0xd3/0x190 mm/slub.c:1903
free_slab mm/slub.c:1918 [inline]
discard_slab mm/slub.c:1924 [inline]
unfreeze_partials+0x17d/0x1b0 mm/slub.c:2419
put_cpu_partial+0xc8/0x190 mm/slub.c:2455
__slab_free+0x2d8/0x3a0 mm/slub.c:3104
do_slab_free mm/slub.c:3200 [inline]
___cache_free+0x11f/0x140 mm/slub.c:3219
qlink_free+0x38/0x40 mm/kasan/quarantine.c:146
qlist_free_all+0x4c/0xc0 mm/kasan/quarantine.c:165
kasan_quarantine_reduce+0x15a/0x170 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:438
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook include/../mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x16c/0x300 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xe6/0x1330 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1615
lookup_slow fs/namei.c:1647 [inline]
lookup_one_len_unlocked+0x458/0x680 fs/namei.c:2673
Memory state around the buggy address:
ffff88810c35a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88810c35a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88810c35a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88810c35a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88810c35a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
list_del corruption. prev->next should be ffff88811a223720, but was 0000000000000000
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9 Comm: kworker/u4:1 Tainted: G B 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:__list_del_entry_valid+0x11a/0x130 lib/list_debug.c:59
Code: 69 fd 41 02 0f 0b 48 c7 c7 40 0b 44 85 4c 89 f6 31 c0 e8 56 fd 41 02 0f 0b 48 c7 c7 a0 0b 44 85 4c 89 f6 31 c0 e8 43 fd 41 02 <0f> 0b 48 c7 c7 00 0c 44 85 4c 89 f6 31 c0 e8 30 fd 41 02 0f 0b 90
RSP: 0018:ffffc90000097008 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff88810c35a498 RCX: a22677a9736aaa00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000097028 R08: ffffffff81540db8 R09: ffffed103ee0a5e8
R10: ffffed103ee0a5e8 R11: 1ffff1103ee0a5e7 R12: dffffc0000000000
R13: ffff88811a223720 R14: ffff88811a223720 R15: ffff88810c35a498
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5547f0a88 CR3: 000000010da56000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:132 [inline]
list_del_init include/linux/list.h:204 [inline]
__remove_dirty_inode fs/f2fs/checkpoint.c:1015 [inline]
f2fs_remove_dirty_inode+0x217/0x3f0 fs/f2fs/checkpoint.c:1051
__f2fs_write_data_pages+0x245b/0x2c80 fs/f2fs/data.c:3219
f2fs_write_data_pages+0x74/0x80 fs/f2fs/data.c:3233
do_writepages+0x13a/0x280 mm/page-writeback.c:2358
__writeback_single_inode+0xb8/0x6e0 fs/fs-writeback.c:1467
writeback_sb_inodes+0x999/0x1700 fs/fs-writeback.c:1730
wb_writeback+0x42f/0xc20 fs/fs-writeback.c:1905
wb_do_writeback+0x222/0xbd0 fs/fs-writeback.c:2050
wb_workfn+0xf8/0x3f0 fs/fs-writeback.c:2091
process_one_work+0x726/0xc10 kernel/workqueue.c:2296
worker_thread+0xb27/0x1550 kernel/workqueue.c:2442
kthread+0x349/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299
Modules linked in:
---[ end trace 63ef9a687ec438b8 ]---
RIP: 0010:__list_del_entry_valid+0x11a/0x130 lib/list_debug.c:59
Code: 69 fd 41 02 0f 0b 48 c7 c7 40 0b 44 85 4c 89 f6 31 c0 e8 56 fd 41 02 0f 0b 48 c7 c7 a0 0b 44 85 4c 89 f6 31 c0 e8 43 fd 41 02 <0f> 0b 48 c7 c7 00 0c 44 85 4c 89 f6 31 c0 e8 30 fd 41 02 0f 0b 90
RSP: 0018:ffffc90000097008 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff88810c35a498 RCX: a22677a9736aaa00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000097028 R08: ffffffff81540db8 R09: ffffed103ee0a5e8
R10: ffffed103ee0a5e8 R11: 1ffff1103ee0a5e7 R12: dffffc0000000000
R13: ffff88811a223720 R14: ffff88811a223720 R15: ffff88810c35a498
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5547f0a88 CR3: 000000010da56000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Aug 23, 2023, 5:03:39 AM8/23/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages