Hello,
syzbot found the following issue on:
HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output:
https://syzkaller.appspot.com/x/log.txt?x=14c689ab900000
kernel config:
https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link:
https://syzkaller.appspot.com/bug?extid=9ab7fed86898172b0402
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+9ab7fe...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
Read of size 8 at addr ffff888090ab5968 by task loop5/1593
CPU: 1 PID: 1593 Comm: loop5 Not tainted 4.14.198-syzkaller #0
attempt to access beyond end of device
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
attempt to access beyond end of device
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
loop2: rw=0, want=30736, limit=640
__lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
loop1: rw=0, want=30736, limit=640
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
__wake_up_common_lock+0x9d/0x140 kernel/sched/wait.c:124
lbmIODone+0x3c6/0xe00 fs/jfs/jfs_logmgr.c:2307
bio_endio+0x27a/0x680 block/bio.c:1918
req_bio_endio block/blk-core.c:204 [inline]
blk_update_request+0x2d0/0xa30 block/blk-core.c:2765
blk_mq_end_request+0x4c/0x1e0 block/blk-mq.c:530
__blk_mq_complete_request+0x30b/0x6c0 block/blk-mq.c:571
blk_mq_complete_request+0x52/0x60 block/blk-mq.c:591
loop_handle_cmd drivers/block/loop.c:1784 [inline]
loop_queue_work+0x227/0x1e80 drivers/block/loop.c:1793
kthread_worker_fn+0x271/0x6c0 kernel/kthread.c:642
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Allocated by task 1590:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1842 [inline]
lmLogInit+0x2f1/0x12f0 fs/jfs/jfs_logmgr.c:1292
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x6b1/0x10e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x236/0x430 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x78a/0xab0 fs/jfs/super.c:598
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
Freed by task 1590:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
lbmLogShutdown fs/jfs/jfs_logmgr.c:1885 [inline]
lmLogInit+0xeaf/0x12f0 fs/jfs/jfs_logmgr.c:1437
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x6b1/0x10e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x236/0x430 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x78a/0xab0 fs/jfs/super.c:598
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
The buggy address belongs to the object at ffff888090ab5900
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 104 bytes inside of
192-byte region [ffff888090ab5900, ffff888090ab59c0)
The buggy address belongs to the page:
page:ffffea000242ad40 count:1 mapcount:0 mapping:ffff888090ab5000 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff888090ab5000 0000000000000000 0000000100000010
raw: ffffea0002962f60 ffffea00027b9320 ffff88812fe50040 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888090ab5800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888090ab5880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888090ab5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888090ab5980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888090ab5a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.