[v6.1] KASAN: use-after-free Read in reiserfs_release_objectid (2)

4 views

Skip to first unread message

syzbot

unread,

Jan 8, 2025, 3:59:24 AM1/8/25

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 7dc732d24ff7 Linux 6.1.123
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17907edf980000
kernel config: https://syzkaller.appspot.com/x/.config?x=da1827eaa51b65c3
dashboard link: https://syzkaller.appspot.com/bug?extid=8b37105f98b0cda6bbcd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b77a36eba7b4/disk-7dc732d2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f5334562da28/vmlinux-7dc732d2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f0a16f9a500c/Image-7dc732d2.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8b3710...@syzkaller.appspotmail.com

REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP
==================================================================
BUG: KASAN: use-after-free in reiserfs_release_objectid+0x454/0x63c fs/reiserfs/objectid.c:165
Read of size 8188 at addr ffff0000f5a8b050 by task syz-executor/4303

CPU: 1 PID: 4303 Comm: syz-executor Not tainted 6.1.123-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0x174/0x4c0 mm/kasan/report.c:427
kasan_report+0xd4/0x130 mm/kasan/report.c:531
kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189
memmove+0x48/0x90 mm/kasan/shadow.c:54
reiserfs_release_objectid+0x454/0x63c fs/reiserfs/objectid.c:165
remove_save_link+0x2a0/0x460 fs/reiserfs/super.c:542
reiserfs_evict_inode+0x304/0x3f0 fs/reiserfs/inode.c:91
evict+0x418/0x894 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x7c0/0x8a4 fs/inode.c:1860
d_delete_notify include/linux/fsnotify.h:267 [inline]
vfs_rmdir+0x330/0x43c fs/namei.c:4204
do_rmdir+0x2e0/0x720 fs/namei.c:4252
__do_sys_unlinkat fs/namei.c:4432 [inline]
__se_sys_unlinkat fs/namei.c:4426 [inline]
__arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4426
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:0000000001c48771 refcount:2 mapcount:0 mapping:00000000b4a63fec index:0x10 pfn:0x135a8b
memcg:ffff0000f4c24000
aops:def_blk_aops ino:700001
flags: 0x5ffd60000022056(referenced|uptodate|lru|workingset|private|mappedtodisk|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffd60000022056 fffffc00038ab748 fffffc0003d6a588 ffff0000c0544a10
raw: 0000000000000010 ffff0000e0cfad98 00000002ffffffff ffff0000f4c24000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff0000f5a8bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000f5a8bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000f5a8c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff0000f5a8c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff0000f5a8c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2)
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP
REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2)
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Jan 8, 2025, 5:12:21 AM1/8/25

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 7dc732d24ff7 Linux 6.1.123
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=169ddc18580000

kernel config: https://syzkaller.appspot.com/x/.config?x=da1827eaa51b65c3
dashboard link: https://syzkaller.appspot.com/bug?extid=8b37105f98b0cda6bbcd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b98dc4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124f5b0f980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b77a36eba7b4/disk-7dc732d2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f5334562da28/vmlinux-7dc732d2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f0a16f9a500c/Image-7dc732d2.gz.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/d357e3d3a43f/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8b3710...@syzkaller.appspotmail.com

REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2)

REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP

==================================================================
BUG: KASAN: use-after-free in reiserfs_release_objectid+0x454/0x63c fs/reiserfs/objectid.c:165

Read of size 8188 at addr ffff0000e4050050 by task syz-executor776/4289

CPU: 0 PID: 4289 Comm: syz-executor776 Not tainted 6.1.123-syzkaller #0

page:0000000055e71253 refcount:2 mapcount:0 mapping:00000000dcba509c index:0x10 pfn:0x124050
memcg:ffff0000c0940000
aops:def_blk_aops ino:700000

raw: 05ffd60000022056 fffffc00039013c8 fffffc0003901448 ffff0000c0543f10
raw: 0000000000000010 ffff0000df280828 00000002ffffffff ffff0000c0940000

page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff0000e4051f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000e4051f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000e4052000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff0000e4052080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff0000e4052100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP

REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2)

REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP

REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2)

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Reply all

Reply to author

Forward

0 new messages