[v5.15] KASAN: slab-out-of-bounds Read in copy_page_from_iter_atomic

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8020ae3c051d Linux 5.15.103
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10db9491c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4215fb4040f8f8d
dashboard link: https://syzkaller.appspot.com/bug?extid=73537d8cac715987374b
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/857e17de0f0a/disk-8020ae3c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9efc49fcd441/vmlinux-8020ae3c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f14c38b6bfa7/bzImage-8020ae3c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+73537d...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0x8e3/0x1230 lib/iov_iter.c:978
Read of size 2048 at addr ffff88801a1df400 by task kworker/u4:11/3894

CPU: 1 PID: 3894 Comm: kworker/u4:11 Not tainted 5.15.103-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: loop0 loop_workfn
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description+0x63/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
kasan_check_range+0x27e/0x290 mm/kasan/generic.c:189
memcpy+0x25/0x60 mm/kasan/shadow.c:65
copy_page_from_iter_atomic+0x8e3/0x1230 lib/iov_iter.c:978
generic_perform_write+0x33a/0x5b0 mm/filemap.c:3784
__generic_file_write_iter+0x243/0x4f0 mm/filemap.c:3903
generic_file_write_iter+0xa7/0x1b0 mm/filemap.c:3935
do_iter_readv_writev+0x594/0x7a0
do_iter_write+0x1ea/0x760 fs/read_write.c:855
lo_write_bvec+0x297/0x740 drivers/block/loop.c:316
lo_write_simple drivers/block/loop.c:338 [inline]
do_req_filebacked drivers/block/loop.c:656 [inline]
loop_handle_cmd drivers/block/loop.c:2208 [inline]
loop_process_work+0x209c/0x2b30 drivers/block/loop.c:2248
process_one_work+0x90d/0x1270 kernel/workqueue.c:2306
worker_thread+0xaca/0x1280 kernel/workqueue.c:2453
kthread+0x3f6/0x4f0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>

Allocated by task 9047:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc+0x152/0x290 mm/slub.c:4407
kmalloc include/linux/slab.h:596 [inline]
hfsplus_read_wrapper+0x4e3/0x13b0 fs/hfsplus/wrapper.c:180
hfsplus_fill_super+0x38a/0x1c90 fs/hfsplus/super.c:413
mount_bdev+0x26d/0x3a0 fs/super.c:1369
legacy_get_tree+0xeb/0x180 fs/fs_context.c:610
vfs_get_tree+0x88/0x270 fs/super.c:1499
do_new_mount+0x28b/0xad0 fs/namespace.c:2994
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3522
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

Last potentially related work creation:
kasan_save_stack+0x36/0x60 mm/kasan/common.c:38
kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:348
insert_work+0x54/0x3e0 kernel/workqueue.c:1362
__queue_work+0x9ca/0xdc0 kernel/workqueue.c:1528
call_timer_fn+0x1d7/0x6f0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1461 [inline]
__run_timers+0x6a8/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3da/0xa10 kernel/softirq.c:558

The buggy address belongs to the object at ffff88801a1df400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
512-byte region [ffff88801a1df400, ffff88801a1df600)
The buggy address belongs to the page:
page:ffffea0000687700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a1dc
head:ffffea0000687700 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea0001f00200 0000000500000005 ffff888011c41c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3590, ts 147323833202, free_ts 147298342346
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x32dd/0x3470 mm/page_alloc.c:4159
__alloc_pages+0x272/0x790 mm/page_alloc.c:5421
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xbb/0x4b0 mm/slub.c:1975
___slab_alloc+0x6f6/0xe10 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
__kmalloc_node_track_caller+0x1e9/0x310 mm/slub.c:4958
kmalloc_reserve net/core/skbuff.c:356 [inline]
__alloc_skb+0x12c/0x590 net/core/skbuff.c:427
__napi_alloc_skb+0x15c/0x2d0 net/core/skbuff.c:568
napi_alloc_skb include/linux/skbuff.h:3045 [inline]
page_to_skb+0x294/0xd20 drivers/net/virtio_net.c:454
receive_mergeable drivers/net/virtio_net.c:1066 [inline]
receive_buf+0x1218/0x6490 drivers/net/virtio_net.c:1176
virtnet_receive drivers/net/virtio_net.c:1468 [inline]
virtnet_poll+0x629/0x1270 drivers/net/virtio_net.c:1581
__napi_poll+0xc7/0x440 net/core/dev.c:7008
napi_poll net/core/dev.c:7075 [inline]
net_rx_action+0x617/0xda0 net/core/dev.c:7162
__do_softirq+0x3da/0xa10 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0xcb7/0xd70 mm/page_alloc.c:3317
free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
free_slab mm/slub.c:2015 [inline]
discard_slab mm/slub.c:2021 [inline]
__unfreeze_partials+0x1b7/0x210 mm/slub.c:2507
put_cpu_partial+0x132/0x1a0 mm/slub.c:2587
do_slab_free mm/slub.c:3487 [inline]
___cache_free+0xe3/0x100 mm/slub.c:3506
qlist_free_all+0x36/0x90 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x162/0x180 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x53/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
kmem_cache_alloc_node+0x121/0x320 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb_fclone include/linux/skbuff.h:1216 [inline]
sk_stream_alloc_skb+0x1fc/0xad0 net/ipv4/tcp.c:885
tcp_sendmsg_locked+0xe0c/0x3ab0 net/ipv4/tcp.c:1308
tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1460
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg net/socket.c:724 [inline]
sock_write_iter+0x39b/0x530 net/socket.c:1060
call_write_iter include/linux/fs.h:2103 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0xacf/0xe50 fs/read_write.c:594

Memory state around the buggy address:
ffff88801a1df500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88801a1df580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88801a1df600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88801a1df680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801a1df700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15e4ee22280000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e93d602da27af41

dashboard link: https://syzkaller.appspot.com/bug?extid=73537d8cac715987374b
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=147ca36c280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1443e67a280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/16bea75b636d/disk-8a7f2a5c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b169e33dcf2/vmlinux-8a7f2a5c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/190d08a00950/Image-8a7f2a5c.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/5598d6b7f27a/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+73537d...@syzkaller.appspotmail.com

==================================================================

BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0x834/0xffc lib/iov_iter.c:978
Read of size 2048 at addr ffff0000cf7f1000 by task kworker/u4:4/563

CPU: 0 PID: 563 Comm: kworker/u4:4 Not tainted 5.15.110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: loop0 loop_rootcg_workfn
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
kasan_check_range+0x274/0x2b4 mm/kasan/generic.c:189
memcpy+0x90/0xe8 mm/kasan/shadow.c:65
copy_page_from_iter_atomic+0x834/0xffc lib/iov_iter.c:978
generic_perform_write+0x2d0/0x520 mm/filemap.c:3784
__generic_file_write_iter+0x230/0x454 mm/filemap.c:3903
generic_file_write_iter+0xb4/0x1b8 mm/filemap.c:3935
do_iter_readv_writev+0x420/0x5f8
do_iter_write+0x1b8/0x664 fs/read_write.c:855
vfs_iter_write+0x88/0xac fs/read_write.c:896
lo_write_bvec+0x394/0xb4c drivers/block/loop.c:316

lo_write_simple drivers/block/loop.c:338 [inline]
do_req_filebacked drivers/block/loop.c:656 [inline]

loop_handle_cmd drivers/block/loop.c:2234 [inline]
loop_process_work+0x1bcc/0x2790 drivers/block/loop.c:2274
loop_rootcg_workfn+0x28/0x38 drivers/block/loop.c:2305
process_one_work+0x790/0x11b8 kernel/workqueue.c:2306
worker_thread+0x910/0x1034 kernel/workqueue.c:2453
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

Allocated by task 3966:

kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]

____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc+0x29c/0x4c8 mm/slub.c:4407
kmalloc include/linux/slab.h:596 [inline]
hfsplus_read_wrapper+0x3b8/0xfc8 fs/hfsplus/wrapper.c:180
hfsplus_fill_super+0x2f0/0x167c fs/hfsplus/super.c:413
mount_bdev+0x26c/0x368 fs/super.c:1378
hfsplus_mount+0x44/0x58 fs/hfsplus/super.c:641
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1508
do_new_mount+0x25c/0x8c8 fs/namespace.c:2994
path_mount+0x590/0x104c fs/namespace.c:3324

do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]

__se_sys_mount fs/namespace.c:3522 [inline]
__arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

The buggy address belongs to the object at ffff0000cf7f1000

which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of

512-byte region [ffff0000cf7f1000, ffff0000cf7f1200)

The buggy address belongs to the page:

page:0000000030ef9c33 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f7f0
head:0000000030ef9c33 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 fffffc0003680800 0000000600000006 ffff0000c0002600

raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff0000cf7f1100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000cf7f1180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000cf7f1200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff0000cf7f1280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000cf7f1300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.