KASAN: use-after-free Read in blkdev_get
15 views
Skip to first unread message
syzbot
Dec 23, 2019, 8:45:09 AM12/23/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 672481c2 Linux 4.19.91
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=116b16c1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=445a712574d168a6
dashboard link: https://syzkaller.appspot.com/bug?extid=95b294092411849b2ac1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+95b294...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic64_read
include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in atomic_long_read
include/asm-generic/atomic-long.h:47 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x9b/0x6b0
kernel/locking/mutex.c:1206
Read of size 8 at addr ffff88809499f758 by task syz-executor.2/10109
CPU: 0 PID: 10109 Comm: syz-executor.2 Not tainted 4.19.91-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic64_read include/asm-generic/atomic-instrumented.h:27 [inline]
atomic_long_read include/asm-generic/atomic-long.h:47 [inline]
__mutex_unlock_slowpath+0x9b/0x6b0 kernel/locking/mutex.c:1206
mutex_unlock+0xd/0x10 kernel/locking/mutex.c:713
blkdev_get+0x5a4/0x990 fs/block_dev.c:1668
blkdev_get_by_dev+0x42/0x80 fs/block_dev.c:1747
lock_rdev+0xa0/0x160 drivers/md/md.c:2307
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc38/0x1ab6 block/ioctl.c:601
block_ioctl+0xee/0x130 fs/block_dev.c:1891
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a919
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffb8965ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000008
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffb8965b6d4
R13: 00000000004c2230 R14: 00000000004d73b8 R15: 00000000ffffffff
Allocated by task 10109:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559
bdev_alloc_inode+0x1c/0x50 fs/block_dev.c:744
alloc_inode+0x64/0x190 fs/inode.c:210
iget5_locked fs/inode.c:1123 [inline]
iget5_locked+0x63/0xe0 fs/inode.c:1116
bdget+0x97/0x550 fs/block_dev.c:885
blkdev_get_by_dev+0x27/0x80 fs/block_dev.c:1743
lock_rdev+0xa0/0x160 drivers/md/md.c:2307
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc38/0x1ab6 block/ioctl.c:601
block_ioctl+0xee/0x130 fs/block_dev.c:1891
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 11443:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3765
bdev_i_callback+0x20/0x30 fs/block_dev.c:755
__rcu_reclaim kernel/rcu/rcu.h:236 [inline]
rcu_do_batch kernel/rcu/tree.c:2584 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
__do_softirq+0x25c/0x921 kernel/softirq.c:292
The buggy address belongs to the object at ffff88809499f740
which belongs to the cache bdev_cache(65:syz2) of size 1344
The buggy address is located 24 bytes inside of
1344-byte region [ffff88809499f740, ffff88809499fc80)
The buggy address belongs to the page:
page:ffffea00025267c0 count:1 mapcount:0 mapping:ffff888076080500
index:0xffff88809499fffe
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea0000e224c8 ffffea0002523688 ffff888076080500
raw: ffff88809499fffe ffff88809499f180 0000000100000002 ffff888052cb6140
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff888052cb6140
Memory state around the buggy address:
ffff88809499f600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809499f680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> ffff88809499f700: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff88809499f780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809499f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 672481c2 Linux 4.19.91
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=116b16c1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=445a712574d168a6
dashboard link: https://syzkaller.appspot.com/bug?extid=95b294092411849b2ac1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+95b294...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic64_read
include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in atomic_long_read
include/asm-generic/atomic-long.h:47 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x9b/0x6b0
kernel/locking/mutex.c:1206
Read of size 8 at addr ffff88809499f758 by task syz-executor.2/10109
CPU: 0 PID: 10109 Comm: syz-executor.2 Not tainted 4.19.91-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic64_read include/asm-generic/atomic-instrumented.h:27 [inline]
atomic_long_read include/asm-generic/atomic-long.h:47 [inline]
__mutex_unlock_slowpath+0x9b/0x6b0 kernel/locking/mutex.c:1206
mutex_unlock+0xd/0x10 kernel/locking/mutex.c:713
blkdev_get+0x5a4/0x990 fs/block_dev.c:1668
blkdev_get_by_dev+0x42/0x80 fs/block_dev.c:1747
lock_rdev+0xa0/0x160 drivers/md/md.c:2307
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc38/0x1ab6 block/ioctl.c:601
block_ioctl+0xee/0x130 fs/block_dev.c:1891
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a919
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffb8965ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000008
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffb8965b6d4
R13: 00000000004c2230 R14: 00000000004d73b8 R15: 00000000ffffffff
Allocated by task 10109:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559
bdev_alloc_inode+0x1c/0x50 fs/block_dev.c:744
alloc_inode+0x64/0x190 fs/inode.c:210
iget5_locked fs/inode.c:1123 [inline]
iget5_locked+0x63/0xe0 fs/inode.c:1116
bdget+0x97/0x550 fs/block_dev.c:885
blkdev_get_by_dev+0x27/0x80 fs/block_dev.c:1743
lock_rdev+0xa0/0x160 drivers/md/md.c:2307
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc38/0x1ab6 block/ioctl.c:601
block_ioctl+0xee/0x130 fs/block_dev.c:1891
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 11443:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3765
bdev_i_callback+0x20/0x30 fs/block_dev.c:755
__rcu_reclaim kernel/rcu/rcu.h:236 [inline]
rcu_do_batch kernel/rcu/tree.c:2584 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
__do_softirq+0x25c/0x921 kernel/softirq.c:292
The buggy address belongs to the object at ffff88809499f740
which belongs to the cache bdev_cache(65:syz2) of size 1344
The buggy address is located 24 bytes inside of
1344-byte region [ffff88809499f740, ffff88809499fc80)
The buggy address belongs to the page:
page:ffffea00025267c0 count:1 mapcount:0 mapping:ffff888076080500
index:0xffff88809499fffe
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea0000e224c8 ffffea0002523688 ffff888076080500
raw: ffff88809499fffe ffff88809499f180 0000000100000002 ffff888052cb6140
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff888052cb6140
Memory state around the buggy address:
ffff88809499f600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809499f680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> ffff88809499f700: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff88809499f780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809499f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Dec 24, 2019, 2:21:11 PM12/24/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: e1f7d50a Linux 4.14.160
syzbot found the following crash on:
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16910ac1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=46599517442ad9fb
dashboard link: https://syzkaller.appspot.com/bug?extid=59a29b27d3a7b378dadd
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+59a29b...@syzkaller.appspotmail.com
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
kobject: 'rx-0' (ffff88809fd106d0): fill_kobj_path: path
= '/devices/virtual/net/bpq0/queues/rx-0'
kobject: 'tx-0' (ffff888056994a58): kobject_add_internal: parent: 'queues',
set: 'queues'
kobject: 'tx-0' (ffff888056994a58): kobject_uevent_env
kobject: 'tx-0' (ffff888056994a58): fill_kobj_path: path
= '/devices/virtual/net/bpq0/queues/tx-0'
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183
[inline]
BUG: KASAN: use-after-free in atomic64_read
arch/x86/include/asm/atomic64_64.h:22 [inline]
BUG: KASAN: use-after-free in atomic_long_read
include/asm-generic/atomic-long.h:45 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x656/0x800
kernel/locking/mutex.c:1027
Read of size 8 at addr ffff888090087098 by task syz-executor.1/10888
CPU: 1 PID: 10888 Comm: syz-executor.1 Not tainted 4.14.160-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
Google 01/01/2011
Call Trace:
dump_stack+0x142/0x197 lib/dump_stack.c:58
print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
__read_once_size include/linux/compiler.h:183 [inline]
atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
__mutex_unlock_slowpath+0x656/0x800 kernel/locking/mutex.c:1027
mutex_unlock+0xd/0x10 kernel/locking/mutex.c:614
blkdev_get+0x555/0x8e0 fs/block_dev.c:1655
blkdev_get_by_dev+0x42/0x80 fs/block_dev.c:1734
lock_rdev+0x83/0x110 drivers/md/md.c:2293
md_import_device+0x1cd/0x450 drivers/md/md.c:3466
add_new_disk+0x4e2/0x15f0 drivers/md/md.c:6320
md_ioctl+0x38d0/0x4bd0 drivers/md/md.c:7338
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a919
RSP: 002b:00007f632d553c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000008
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f632d5546d4
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000008
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R13: 00000000004c2230 R14: 00000000004d73b8 R15: 00000000ffffffff
Allocated by task 10888:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:489
kmem_cache_alloc+0x12e/0x780 mm/slab.c:3552
bdev_alloc_inode+0x1c/0x50 fs/block_dev.c:754
alloc_inode+0x64/0x180 fs/inode.c:209
iget5_locked+0x170/0x460 fs/inode.c:1042
bdget+0x82/0x4e0 fs/block_dev.c:895
blkdev_get_by_dev+0x27/0x80 fs/block_dev.c:1730
lock_rdev+0x83/0x110 drivers/md/md.c:2293
md_import_device+0x1cd/0x450 drivers/md/md.c:3466
add_new_disk+0x4e2/0x15f0 drivers/md/md.c:6320
md_ioctl+0x38d0/0x4bd0 drivers/md/md.c:7338
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x96b/0x1860 block/ioctl.c:594
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Freed by task 17:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kmem_cache_free+0x83/0x2b0 mm/slab.c:3758
bdev_i_callback+0x20/0x30 fs/block_dev.c:765
__rcu_reclaim kernel/rcu/rcu.h:195 [inline]
rcu_do_batch kernel/rcu/tree.c:2699 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
rcu_process_callbacks+0x7b8/0x12b0 kernel/rcu/tree.c:2946
__do_softirq+0x244/0x9a0 kernel/softirq.c:288
The buggy address belongs to the object at ffff888090087080
which belongs to the cache bdev_cache of size 1352
The buggy address is located 24 bytes inside of
1352-byte region [ffff888090087080, ffff8880900875c8)
The buggy address belongs to the page:
page:ffffea00024021c0 count:1 mapcount:0 mapping:ffff888090087080
index:0xffff888090087ffe
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff888090087080 ffff888090087ffe 0000000100000002
raw: ffffea000240b8e0 ffffea00021338e0 ffff88821f8b5980 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888090086f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888090087000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff888090087080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888090087100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888090087180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
syzbot
Jan 26, 2020, 7:01:11 AM1/26/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: d183c8e2 Linux 4.19.98
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12911611e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2ec5d533b79bf93
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15b315c9e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+95b294...@syzkaller.appspotmail.com
md: could not open unknown-block(8,3).
md: md_import_device returned -6
md: could not open unknown-block(8,3).
md: md_import_device returned -6
CPU: 1 PID: 3049 Comm: syz-executor769 Not tainted 4.19.98-syzkaller #0
blkdev_get_by_dev+0x42/0x80 fs/block_dev.c:1750
block_ioctl+0xee/0x130 fs/block_dev.c:1894
Code: e8 7c e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fba13f00ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006e7a08 RCX: 000000000044ad89
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000005
RBP: 00000000006e7a00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e7a0c
R13: 00007ffe7b20a92f R14: 00007fba13f019c0 R15: 0000000000000000
Allocated by task 3049:
iget5_locked+0x63/0xe0 fs/inode.c:1123
bdget+0x97/0x550 fs/block_dev.c:885
blkdev_get_by_dev+0x27/0x80 fs/block_dev.c:1746
block_ioctl+0xee/0x130 fs/block_dev.c:1894
which belongs to the cache bdev_cache(33:syz3) of size 1344
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea0001a152c8 ffff888098a3be48 ffff88809f983080
raw: ffff888068bd4ffe ffff888068bd4240 0000000100000002 ffff8880a1378580
Memory state around the buggy address:
ffff888068bd4700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888068bd4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888068bd4800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888068bd4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888068bd4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: d183c8e2 Linux 4.19.98
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12911611e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2ec5d533b79bf93
dashboard link: https://syzkaller.appspot.com/bug?extid=95b294092411849b2ac1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16e78479e00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15b315c9e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+95b294...@syzkaller.appspotmail.com
md: md_import_device returned -6
md: could not open unknown-block(8,3).
md: md_import_device returned -6
==================================================================
BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:47 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x9b/0x6b0 kernel/locking/mutex.c:1206
Read of size 8 at addr ffff888068bd4818 by task syz-executor769/3049
BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:47 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x9b/0x6b0 kernel/locking/mutex.c:1206
CPU: 1 PID: 3049 Comm: syz-executor769 Not tainted 4.19.98-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic64_read include/asm-generic/atomic-instrumented.h:27 [inline]
atomic_long_read include/asm-generic/atomic-long.h:47 [inline]
__mutex_unlock_slowpath+0x9b/0x6b0 kernel/locking/mutex.c:1206
mutex_unlock+0xd/0x10 kernel/locking/mutex.c:713
blkdev_get+0x5a4/0x990 fs/block_dev.c:1671
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic64_read include/asm-generic/atomic-instrumented.h:27 [inline]
atomic_long_read include/asm-generic/atomic-long.h:47 [inline]
__mutex_unlock_slowpath+0x9b/0x6b0 kernel/locking/mutex.c:1206
mutex_unlock+0xd/0x10 kernel/locking/mutex.c:713
blkdev_get_by_dev+0x42/0x80 fs/block_dev.c:1750
lock_rdev+0xa0/0x160 drivers/md/md.c:2307
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc2c/0x1ab3 block/ioctl.c:601
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
block_ioctl+0xee/0x130 fs/block_dev.c:1894
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x44ad89
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: e8 7c e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fba13f00ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006e7a08 RCX: 000000000044ad89
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000005
RBP: 00000000006e7a00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e7a0c
R13: 00007ffe7b20a92f R14: 00007fba13f019c0 R15: 0000000000000000
Allocated by task 3049:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559
bdev_alloc_inode+0x1c/0x50 fs/block_dev.c:744
alloc_inode+0x64/0x190 fs/inode.c:210
iget5_locked fs/inode.c:1130 [inline]
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559
bdev_alloc_inode+0x1c/0x50 fs/block_dev.c:744
alloc_inode+0x64/0x190 fs/inode.c:210
iget5_locked+0x63/0xe0 fs/inode.c:1123
bdget+0x97/0x550 fs/block_dev.c:885
blkdev_get_by_dev+0x27/0x80 fs/block_dev.c:1746
lock_rdev+0xa0/0x160 drivers/md/md.c:2307
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
blkdev_ioctl+0xc2c/0x1ab3 block/ioctl.c:601
md_import_device+0x221/0x520 drivers/md/md.c:3488
add_new_disk+0x593/0x18c0 drivers/md/md.c:6347
md_ioctl+0x45d4/0x5980 drivers/md/md.c:7365
__blkdev_driver_ioctl block/ioctl.c:303 [inline]
block_ioctl+0xee/0x130 fs/block_dev.c:1894
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3054:
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3765
bdev_i_callback+0x20/0x30 fs/block_dev.c:755
__rcu_reclaim kernel/rcu/rcu.h:236 [inline]
rcu_do_batch kernel/rcu/tree.c:2584 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
__do_softirq+0x25c/0x921 kernel/softirq.c:292
The buggy address belongs to the object at ffff888068bd4800
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3765
bdev_i_callback+0x20/0x30 fs/block_dev.c:755
__rcu_reclaim kernel/rcu/rcu.h:236 [inline]
rcu_do_batch kernel/rcu/tree.c:2584 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
__do_softirq+0x25c/0x921 kernel/softirq.c:292
which belongs to the cache bdev_cache(33:syz3) of size 1344
The buggy address is located 24 bytes inside of
1344-byte region [ffff888068bd4800, ffff888068bd4d40)
The buggy address belongs to the page:
page:ffffea0001a2f500 count:1 mapcount:0 mapping:ffff88809f983080 index:0xffff888068bd4ffe
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea0001a152c8 ffff888098a3be48 ffff88809f983080
raw: ffff888068bd4ffe ffff888068bd4240 0000000100000002 ffff8880a1378580
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8880a1378580
Memory state around the buggy address:
ffff888068bd4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888068bd4800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888068bd4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888068bd4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syzbot
Feb 19, 2020, 2:16:14 PM2/19/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 98db2bf2 Linux 4.14.171
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a16265e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=365f8162d5a0794b
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+59a29b...@syzkaller.appspotmail.com
CPU: 1 PID: 1595 Comm: syz-executor.2 Not tainted 4.14.171-syzkaller #0
RSP: 002b:00007f87255bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f87255c06d4 RCX: 000000000045c449
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000004
RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 000000000000021e R14: 00000000004c4025 R15: 000000000076bf2c
Allocated by task 1595:
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff888099ad91c0 ffff888099ad9ffe 0000000100000002
raw: ffffea00025d5460 ffffea00025d5560 ffff88821f8b5980 0000000000000000
ffff888099ad9700: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888099ad9780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff888099ad9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888099ad9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: 98db2bf2 Linux 4.14.171
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a16265e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=365f8162d5a0794b
dashboard link: https://syzkaller.appspot.com/bug?extid=59a29b27d3a7b378dadd
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=104faa7ee00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+59a29b...@syzkaller.appspotmail.com
md: could not open unknown-block(8,3).
md: md_import_device returned -6
md: could not open unknown-block(8,3).
md: md_import_device returned -6
md: md_import_device returned -6
md: could not open unknown-block(8,3).
md: md_import_device returned -6
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183 [inline]
BUG: KASAN: use-after-free in atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x656/0x800 kernel/locking/mutex.c:1027
Read of size 8 at addr ffff888099ad97d8 by task syz-executor.2/1595
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183 [inline]
BUG: KASAN: use-after-free in atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x656/0x800 kernel/locking/mutex.c:1027
CPU: 1 PID: 1595 Comm: syz-executor.2 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
__read_once_size include/linux/compiler.h:183 [inline]
atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
__mutex_unlock_slowpath+0x656/0x800 kernel/locking/mutex.c:1027
mutex_unlock+0xd/0x10 kernel/locking/mutex.c:614
blkdev_get+0x555/0x8e0 fs/block_dev.c:1655
blkdev_get_by_dev+0x42/0x80 fs/block_dev.c:1734
lock_rdev+0x83/0x110 drivers/md/md.c:2293
md_import_device+0x1cd/0x450 drivers/md/md.c:3466
add_new_disk+0x4e2/0x15f0 drivers/md/md.c:6320
md_ioctl+0x38d0/0x4bd0 drivers/md/md.c:7338
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x95f/0x1850 block/ioctl.c:594
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x142/0x197 lib/dump_stack.c:58
print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
__read_once_size include/linux/compiler.h:183 [inline]
atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
atomic_long_read include/asm-generic/atomic-long.h:45 [inline]
__mutex_unlock_slowpath+0x656/0x800 kernel/locking/mutex.c:1027
mutex_unlock+0xd/0x10 kernel/locking/mutex.c:614
blkdev_get+0x555/0x8e0 fs/block_dev.c:1655
blkdev_get_by_dev+0x42/0x80 fs/block_dev.c:1734
lock_rdev+0x83/0x110 drivers/md/md.c:2293
md_import_device+0x1cd/0x450 drivers/md/md.c:3466
add_new_disk+0x4e2/0x15f0 drivers/md/md.c:6320
md_ioctl+0x38d0/0x4bd0 drivers/md/md.c:7338
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45c449
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RSP: 002b:00007f87255bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f87255c06d4 RCX: 000000000045c449
RDX: 0000000020001200 RSI: 0000000040140921 RDI: 0000000000000004
RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 000000000000021e R14: 00000000004c4025 R15: 000000000076bf2c
Allocated by task 1595:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:489
kmem_cache_alloc+0x12e/0x780 mm/slab.c:3552
bdev_alloc_inode+0x1c/0x50 fs/block_dev.c:754
alloc_inode+0x64/0x180 fs/inode.c:209
iget5_locked+0x170/0x460 fs/inode.c:1049
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:489
kmem_cache_alloc+0x12e/0x780 mm/slab.c:3552
bdev_alloc_inode+0x1c/0x50 fs/block_dev.c:754
alloc_inode+0x64/0x180 fs/inode.c:209
bdget+0x82/0x4e0 fs/block_dev.c:895
blkdev_get_by_dev+0x27/0x80 fs/block_dev.c:1730
lock_rdev+0x83/0x110 drivers/md/md.c:2293
md_import_device+0x1cd/0x450 drivers/md/md.c:3466
add_new_disk+0x4e2/0x15f0 drivers/md/md.c:6320
md_ioctl+0x38d0/0x4bd0 drivers/md/md.c:7338
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
blkdev_ioctl+0x95f/0x1850 block/ioctl.c:594
blkdev_get_by_dev+0x27/0x80 fs/block_dev.c:1730
lock_rdev+0x83/0x110 drivers/md/md.c:2293
md_import_device+0x1cd/0x450 drivers/md/md.c:3466
add_new_disk+0x4e2/0x15f0 drivers/md/md.c:6320
md_ioctl+0x38d0/0x4bd0 drivers/md/md.c:7338
__blkdev_driver_ioctl block/ioctl.c:297 [inline]
block_ioctl+0xde/0x120 fs/block_dev.c:1881
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Freed by task 7486:
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kmem_cache_free+0x83/0x2b0 mm/slab.c:3758
bdev_i_callback+0x20/0x30 fs/block_dev.c:765
__rcu_reclaim kernel/rcu/rcu.h:195 [inline]
rcu_do_batch kernel/rcu/tree.c:2699 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
rcu_process_callbacks+0x7b8/0x12b0 kernel/rcu/tree.c:2946
__do_softirq+0x244/0x9a0 kernel/softirq.c:288
The buggy address belongs to the object at ffff888099ad97c0
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kmem_cache_free+0x83/0x2b0 mm/slab.c:3758
bdev_i_callback+0x20/0x30 fs/block_dev.c:765
__rcu_reclaim kernel/rcu/rcu.h:195 [inline]
rcu_do_batch kernel/rcu/tree.c:2699 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
rcu_process_callbacks+0x7b8/0x12b0 kernel/rcu/tree.c:2946
__do_softirq+0x244/0x9a0 kernel/softirq.c:288
which belongs to the cache bdev_cache of size 1352
The buggy address is located 24 bytes inside of
1352-byte region [ffff888099ad97c0, ffff888099ad9d08)
The buggy address is located 24 bytes inside of
The buggy address belongs to the page:
page:ffffea000266b640 count:1 mapcount:0 mapping:ffff888099ad91c0 index:0xffff888099ad9ffe
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff888099ad91c0 ffff888099ad9ffe 0000000100000002
raw: ffffea00025d5460 ffffea00025d5560 ffff88821f8b5980 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888099ad9680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff888099ad9700: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888099ad9780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff888099ad9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888099ad9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syzbot
Aug 27, 2022, 4:20:21 AM8/27/22
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages