[syzbot] [block?] KASAN: slab-out-of-bounds Read in bio_split_rw

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3674fbf0451d Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=110c779f280000
kernel config: https://syzkaller.appspot.com/x/.config?x=c9bf1936936ca698
dashboard link: https://syzkaller.appspot.com/bug?extid=6f66f3e78821b0fff882
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16223cb8a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13f13920a80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/42ed556782c3/disk-3674fbf0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1913e16e8565/vmlinux-3674fbf0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/469804b58a7c/bzImage-3674fbf0.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6f66f3...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in bio_split_rw+0x7e7/0x8b0 block/blk-merge.c:286
Read of size 8 at addr ffff88807a302100 by task syz-executor144/5006

CPU: 1 PID: 5006 Comm: syz-executor144 Not tainted 6.4.0-rc7-syzkaller-01944-g3674fbf0451d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351
print_report mm/kasan/report.c:462 [inline]
kasan_report+0x11c/0x130 mm/kasan/report.c:572
bio_split_rw+0x7e7/0x8b0 block/blk-merge.c:286
__bio_split_to_limits+0x235/0x9b0 block/blk-merge.c:370
blk_mq_submit_bio+0x235/0x1f50 block/blk-mq.c:2940
__submit_bio+0xfc/0x310 block/blk-core.c:594
__submit_bio_noacct_mq block/blk-core.c:673 [inline]
submit_bio_noacct_nocheck+0x7f9/0xb40 block/blk-core.c:702
submit_bio_noacct+0x945/0x19f0 block/blk-core.c:801
ext4_io_submit+0xa6/0x140 fs/ext4/page-io.c:378
ext4_do_writepages+0x141c/0x3290 fs/ext4/inode.c:2723
ext4_writepages+0x304/0x770 fs/ext4/inode.c:2792
do_writepages+0x1a8/0x640 mm/page-writeback.c:2551
filemap_fdatawrite_wbc mm/filemap.c:390 [inline]
filemap_fdatawrite_wbc+0x147/0x1b0 mm/filemap.c:380
__filemap_fdatawrite_range+0xb8/0xf0 mm/filemap.c:423
filemap_write_and_wait_range mm/filemap.c:678 [inline]
filemap_write_and_wait_range+0xa1/0x120 mm/filemap.c:669
__iomap_dio_rw+0x65f/0x1f90 fs/iomap/direct-io.c:569
iomap_dio_rw+0x40/0xa0 fs/iomap/direct-io.c:688
ext4_dio_read_iter fs/ext4/file.c:94 [inline]
ext4_file_read_iter+0x4be/0x690 fs/ext4/file.c:145
call_read_iter include/linux/fs.h:1862 [inline]
generic_file_splice_read+0x182/0x4b0 fs/splice.c:420
do_splice_to+0x1b9/0x240 fs/splice.c:1007


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has bisected this issue to:

commit b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4
Author: David Howells <dhow...@redhat.com>
Date: Fri Jun 16 11:10:32 2023 +0000

crypto: af_alg/hash: Fix recvmsg() after sendmsg(MSG_MORE)

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15763ae8a80000
start commit: 3674fbf0451d Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: net
final oops: https://syzkaller.appspot.com/x/report.txt?x=17763ae8a80000
console output: https://syzkaller.appspot.com/x/log.txt?x=13763ae8a80000

kernel config: https://syzkaller.appspot.com/x/.config?x=c9bf1936936ca698
dashboard link: https://syzkaller.appspot.com/bug?extid=6f66f3e78821b0fff882

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16223cb8a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13f13920a80000

Reported-by: syzbot+6f66f3...@syzkaller.appspotmail.com
Fixes: b6d972f68983 ("crypto: af_alg/hash: Fix recvmsg() after sendmsg(MSG_MORE)")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[David Howells]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 0b7ec177b589842c0abf9e91459c83ba28d32452

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+6f66f3...@syzkaller.appspotmail.com

Tested on:

commit: 0b7ec177 crypto: algif_hash - Fix race between MORE an..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=157554a1a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=bccf8d7311b80058
dashboard link: https://syzkaller.appspot.com/bug?extid=6f66f3e78821b0fff882
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

[syzbot]

> #syz dup: [syzbot] [ext4?] general protection fault in ext4_finish_bio

can't find the dup bug

>

[David Howells]

[David Howells]

#syz fix: crypto: algif_hash - Fix race between MORE and non-MORE sends