[v5.15] KASAN: use-after-free Read in f2fs_iget
0 views
Skip to first unread message
syzbot
May 5, 2024, 8:48:27 AMMay 5
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 284087d4f7d5 Linux 5.15.158
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=130097c4980000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab74f93e8454887c
dashboard link: https://syzkaller.appspot.com/bug?extid=0b1e85354f790743db08
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0accc7dacf9d/disk-284087d4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb6b5b110f8c/vmlinux-284087d4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6763bebdbfea/Image-284087d4.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0b1e85...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in sanity_check_inode fs/f2fs/inode.c:272 [inline]
BUG: KASAN: use-after-free in do_read_inode fs/f2fs/inode.c:406 [inline]
BUG: KASAN: use-after-free in f2fs_iget+0x3f0c/0x53b8 fs/f2fs/inode.c:505
Read of size 4 at addr ffff0000dc79c280 by task syz-executor.3/8566
CPU: 1 PID: 8566 Comm: syz-executor.3 Not tainted 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load4_noabort+0x44/0x50 mm/kasan/report_generic.c:308
sanity_check_inode fs/f2fs/inode.c:272 [inline]
do_read_inode fs/f2fs/inode.c:406 [inline]
f2fs_iget+0x3f0c/0x53b8 fs/f2fs/inode.c:505
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2633 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2643 [inline]
__grab_extent_tree fs/f2fs/extent_cache.c:295 [inline]
__f2fs_init_extent_tree fs/f2fs/extent_cache.c:381 [inline]
f2fs_init_extent_tree+0x4c8/0xb70 fs/f2fs/extent_cache.c:404
do_read_inode fs/f2fs/inode.c:383 [inline]
f2fs_iget+0x1088/0x53b8 fs/f2fs/inode.c:505
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
f2fs_destroy_extent_tree+0x2e0/0x6e0 fs/f2fs/extent_cache.c:845
f2fs_evict_inode+0x330/0x1564 fs/f2fs/inode.c:758
evict+0x260/0x68c fs/inode.c:587
iput_final fs/inode.c:1705 [inline]
iput+0x744/0x824 fs/inode.c:1731
iget_failed+0x154/0x1a4 fs/bad_inode.c:250
f2fs_iget+0x588/0x53b8 fs/f2fs/inode.c:557
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000dc79c258
which belongs to the cache f2fs_extent_tree of size 136
The buggy address is located 40 bytes inside of
136-byte region [ffff0000dc79c258, ffff0000dc79c2e0)
The buggy address belongs to the page:
page:000000004dfaf67d refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000dc79c3e8 pfn:0x11c79c
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6912900
raw: ffff0000dc79c3e8 0000000080140011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000dc79c180: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000dc79c200: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
>ffff0000dc79c280: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff0000dc79c300: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
ffff0000dc79c380: fb fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb
==================================================================
F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3499 [inline]
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
CPU: 0 PID: 8566 Comm: syz-executor.3 Tainted: G B 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
kasan_report_invalid_free+0x64/0x94 mm/kasan/report.c:373
____kasan_slab_free+0x134/0x164
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
f2fs_destroy_extent_tree+0x2e0/0x6e0 fs/f2fs/extent_cache.c:845
f2fs_evict_inode+0x330/0x1564 fs/f2fs/inode.c:758
evict+0x260/0x68c fs/inode.c:587
iput_final fs/inode.c:1705 [inline]
iput+0x744/0x824 fs/inode.c:1731
iget_failed+0x154/0x1a4 fs/bad_inode.c:250
f2fs_iget+0x588/0x53b8 fs/f2fs/inode.c:557
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2633 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2643 [inline]
__grab_extent_tree fs/f2fs/extent_cache.c:295 [inline]
__f2fs_init_extent_tree fs/f2fs/extent_cache.c:381 [inline]
f2fs_init_extent_tree+0x4c8/0xb70 fs/f2fs/extent_cache.c:404
do_read_inode fs/f2fs/inode.c:383 [inline]
f2fs_iget+0x1088/0x53b8 fs/f2fs/inode.c:505
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
f2fs_destroy_extent_tree+0x2e0/0x6e0 fs/f2fs/extent_cache.c:845
f2fs_evict_inode+0x330/0x1564 fs/f2fs/inode.c:758
evict+0x260/0x68c fs/inode.c:587
iput_final fs/inode.c:1705 [inline]
iput+0x744/0x824 fs/inode.c:1731
iget_failed+0x154/0x1a4 fs/bad_inode.c:250
f2fs_iget+0x588/0x53b8 fs/f2fs/inode.c:557
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000dc79c258
which belongs to the cache f2fs_extent_tree of size 136
The buggy address is located 0 bytes inside of
136-byte region [ffff0000dc79c258, ffff0000dc79c2e0)
The buggy address belongs to the page:
page:000000004dfaf67d refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000dc79c3e8 pfn:0x11c79c
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6912900
raw: ffff0000dc79c3e8 0000000080140011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000dc79c100: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
ffff0000dc79c180: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000dc79c200: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
^
ffff0000dc79c280: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff0000dc79c300: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 284087d4f7d5 Linux 5.15.158
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=130097c4980000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab74f93e8454887c
dashboard link: https://syzkaller.appspot.com/bug?extid=0b1e85354f790743db08
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0accc7dacf9d/disk-284087d4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb6b5b110f8c/vmlinux-284087d4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6763bebdbfea/Image-284087d4.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0b1e85...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in sanity_check_inode fs/f2fs/inode.c:272 [inline]
BUG: KASAN: use-after-free in do_read_inode fs/f2fs/inode.c:406 [inline]
BUG: KASAN: use-after-free in f2fs_iget+0x3f0c/0x53b8 fs/f2fs/inode.c:505
Read of size 4 at addr ffff0000dc79c280 by task syz-executor.3/8566
CPU: 1 PID: 8566 Comm: syz-executor.3 Not tainted 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load4_noabort+0x44/0x50 mm/kasan/report_generic.c:308
sanity_check_inode fs/f2fs/inode.c:272 [inline]
do_read_inode fs/f2fs/inode.c:406 [inline]
f2fs_iget+0x3f0c/0x53b8 fs/f2fs/inode.c:505
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2633 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2643 [inline]
__grab_extent_tree fs/f2fs/extent_cache.c:295 [inline]
__f2fs_init_extent_tree fs/f2fs/extent_cache.c:381 [inline]
f2fs_init_extent_tree+0x4c8/0xb70 fs/f2fs/extent_cache.c:404
do_read_inode fs/f2fs/inode.c:383 [inline]
f2fs_iget+0x1088/0x53b8 fs/f2fs/inode.c:505
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
f2fs_destroy_extent_tree+0x2e0/0x6e0 fs/f2fs/extent_cache.c:845
f2fs_evict_inode+0x330/0x1564 fs/f2fs/inode.c:758
evict+0x260/0x68c fs/inode.c:587
iput_final fs/inode.c:1705 [inline]
iput+0x744/0x824 fs/inode.c:1731
iget_failed+0x154/0x1a4 fs/bad_inode.c:250
f2fs_iget+0x588/0x53b8 fs/f2fs/inode.c:557
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000dc79c258
which belongs to the cache f2fs_extent_tree of size 136
The buggy address is located 40 bytes inside of
136-byte region [ffff0000dc79c258, ffff0000dc79c2e0)
The buggy address belongs to the page:
page:000000004dfaf67d refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000dc79c3e8 pfn:0x11c79c
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6912900
raw: ffff0000dc79c3e8 0000000080140011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000dc79c180: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000dc79c200: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
>ffff0000dc79c280: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff0000dc79c300: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
ffff0000dc79c380: fb fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb
==================================================================
F2FS-fs (loop3): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3499 [inline]
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
CPU: 0 PID: 8566 Comm: syz-executor.3 Tainted: G B 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
kasan_report_invalid_free+0x64/0x94 mm/kasan/report.c:373
____kasan_slab_free+0x134/0x164
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
f2fs_destroy_extent_tree+0x2e0/0x6e0 fs/f2fs/extent_cache.c:845
f2fs_evict_inode+0x330/0x1564 fs/f2fs/inode.c:758
evict+0x260/0x68c fs/inode.c:587
iput_final fs/inode.c:1705 [inline]
iput+0x744/0x824 fs/inode.c:1731
iget_failed+0x154/0x1a4 fs/bad_inode.c:250
f2fs_iget+0x588/0x53b8 fs/f2fs/inode.c:557
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2633 [inline]
f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2643 [inline]
__grab_extent_tree fs/f2fs/extent_cache.c:295 [inline]
__f2fs_init_extent_tree fs/f2fs/extent_cache.c:381 [inline]
f2fs_init_extent_tree+0x4c8/0xb70 fs/f2fs/extent_cache.c:404
do_read_inode fs/f2fs/inode.c:383 [inline]
f2fs_iget+0x1088/0x53b8 fs/f2fs/inode.c:505
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 8501:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
f2fs_destroy_extent_tree+0x2e0/0x6e0 fs/f2fs/extent_cache.c:845
f2fs_evict_inode+0x330/0x1564 fs/f2fs/inode.c:758
evict+0x260/0x68c fs/inode.c:587
iput_final fs/inode.c:1705 [inline]
iput+0x744/0x824 fs/inode.c:1731
iget_failed+0x154/0x1a4 fs/bad_inode.c:250
f2fs_iget+0x588/0x53b8 fs/f2fs/inode.c:557
f2fs_nfs_get_inode+0x80/0x118 fs/f2fs/super.c:3091
generic_fh_to_dentry+0x9c/0x104 fs/libfs.c:1044
f2fs_fh_to_dentry+0x44/0x58 fs/f2fs/super.c:3105
exportfs_decode_fh_raw+0x114/0x4b4 fs/exportfs/expfs.c:436
exportfs_decode_fh+0x50/0x80 fs/exportfs/expfs.c:576
do_handle_to_path fs/fhandle.c:152 [inline]
handle_to_path fs/fhandle.c:207 [inline]
do_handle_open+0x5b8/0x9fc fs/fhandle.c:223
__do_sys_open_by_handle_at fs/fhandle.c:265 [inline]
__se_sys_open_by_handle_at fs/fhandle.c:256 [inline]
__arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:256
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000dc79c258
which belongs to the cache f2fs_extent_tree of size 136
The buggy address is located 0 bytes inside of
136-byte region [ffff0000dc79c258, ffff0000dc79c2e0)
The buggy address belongs to the page:
page:000000004dfaf67d refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000dc79c3e8 pfn:0x11c79c
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6912900
raw: ffff0000dc79c3e8 0000000080140011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000dc79c100: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
ffff0000dc79c180: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000dc79c200: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
^
ffff0000dc79c280: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff0000dc79c300: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
May 5, 2024, 9:44:20 AMMay 5
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 284087d4f7d5 Linux 5.15.158
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=109ebc97180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d90b38980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0accc7dacf9d/disk-284087d4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb6b5b110f8c/vmlinux-284087d4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6763bebdbfea/Image-284087d4.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/ccdd05af1bb1/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0b1e85...@syzkaller.appspotmail.com
CPU: 0 PID: 3997 Comm: syz-executor491 Not tainted 5.15.158-syzkaller #0
Allocated by task 3972:
Freed by task 3972:
The buggy address belongs to the object at ffff0000deced000
raw: 0000000000000000 0000000080140014 00000001ffffffff 0000000000000000
ffff0000dececf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000deced000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000deced080: fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00
ffff0000deced100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
==================================================================
F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix
Allocated by task 3972:
Freed by task 3972:
The buggy address belongs to the object at ffff0000deced000
raw: 0000000000000000 0000000080140014 00000001ffffffff 0000000000000000
ffff0000dececf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000deced000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000deced080: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
ffff0000deced100: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 284087d4f7d5 Linux 5.15.158
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=ab74f93e8454887c
dashboard link: https://syzkaller.appspot.com/bug?extid=0b1e85354f790743db08
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=126a0ac0980000
dashboard link: https://syzkaller.appspot.com/bug?extid=0b1e85354f790743db08
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d90b38980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0accc7dacf9d/disk-284087d4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb6b5b110f8c/vmlinux-284087d4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6763bebdbfea/Image-284087d4.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0b1e85...@syzkaller.appspotmail.com
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
==================================================================
BUG: KASAN: use-after-free in sanity_check_inode fs/f2fs/inode.c:272 [inline]
BUG: KASAN: use-after-free in do_read_inode fs/f2fs/inode.c:406 [inline]
BUG: KASAN: use-after-free in f2fs_iget+0x3f0c/0x53b8 fs/f2fs/inode.c:505
Read of size 4 at addr ffff0000deced028 by task syz-executor491/3997
BUG: KASAN: use-after-free in sanity_check_inode fs/f2fs/inode.c:272 [inline]
BUG: KASAN: use-after-free in do_read_inode fs/f2fs/inode.c:406 [inline]
BUG: KASAN: use-after-free in f2fs_iget+0x3f0c/0x53b8 fs/f2fs/inode.c:505
CPU: 0 PID: 3997 Comm: syz-executor491 Not tainted 5.15.158-syzkaller #0
which belongs to the cache f2fs_extent_tree of size 136
The buggy address is located 40 bytes inside of
136-byte region [ffff0000deced000, ffff0000deced088)
The buggy address is located 40 bytes inside of
The buggy address belongs to the page:
page:00000000f4f3a067 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eced
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6604d80
raw: 0000000000000000 0000000080140014 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000dececf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Memory state around the buggy address:
ffff0000dececf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000deced000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000deced080: fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00
ffff0000deced100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
==================================================================
F2FS-fs (loop0): sanity_check_inode: inode (ino=8) extent info [5634, 0, 3] is incorrect, run fsck to fix
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3499 [inline]
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
CPU: 0 PID: 3997 Comm: syz-executor491 Tainted: G B 5.15.158-syzkaller #0
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3499 [inline]
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
which belongs to the cache f2fs_extent_tree of size 136
The buggy address is located 0 bytes inside of
136-byte region [ffff0000deced000, ffff0000deced088)
The buggy address is located 0 bytes inside of
The buggy address belongs to the page:
page:00000000f4f3a067 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eced
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c6604d80
raw: 0000000000000000 0000000080140014 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000dececf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Memory state around the buggy address:
ffff0000dececf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000deced000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000deced080: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
ffff0000deced100: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages