From: syzbot <syzbot+422b07c3add2219bc947@syzkaller.appspotmail.com>
To: dakr@kernel.org, gregkh@linuxfoundation.org,
linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
luiz.dentz@gmail.com, marcel@holtmann.org, rafael@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in full_proxy_write
Date: Sat, 01 Feb 2025 12:07:20 -0800 [thread overview]
Message-ID: <679e7ef8.050a0220.163cdc.0025.GAE@google.com> (raw)
In-Reply-To: <6770d05c.050a0220.2f3838.04a0.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 60c828cf80c0 Merge tag 'for-linus-hexagon-6.14-rc1' of git..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=147d55f8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6e51aa3d0038bbe1
dashboard link: https://syzkaller.appspot.com/bug?extid=422b07c3add2219bc947
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16decb24580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=133f8eb0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/409123921db5/disk-60c828cf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a0ca4f206436/vmlinux-60c828cf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/643b9310a68b/bzImage-60c828cf.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+422b07c3add2219bc947@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in full_proxy_write+0x101/0x3f0 fs/debugfs/file.c:394
full_proxy_write+0x101/0x3f0 fs/debugfs/file.c:394
vfs_write+0x48a/0x1540 fs/read_write.c:677
ksys_write+0x240/0x4b0 fs/read_write.c:731
__do_sys_write fs/read_write.c:742 [inline]
__se_sys_write fs/read_write.c:739 [inline]
__x64_sys_write+0x93/0xe0 fs/read_write.c:739
x64_sys_call+0x3161/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
__debugfs_file_get+0xe59/0xef0 fs/debugfs/file.c:120
full_proxy_open_regular+0x67/0xa00 fs/debugfs/file.c:447
do_dentry_open+0x1bdd/0x26b0 fs/open.c:955
vfs_open+0x53/0x5b0 fs/open.c:1085
do_open fs/namei.c:3830 [inline]
path_openat+0x56a1/0x6250 fs/namei.c:3989
do_filp_open+0x268/0x600 fs/namei.c:4016
do_sys_openat2+0x1bf/0x2f0 fs/open.c:1427
do_sys_open fs/open.c:1442 [inline]
__do_sys_openat fs/open.c:1458 [inline]
__se_sys_openat fs/open.c:1453 [inline]
__x64_sys_openat+0x2a1/0x310 fs/open.c:1453
x64_sys_call+0x36f5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
__debugfs_file_get+0xdff/0xef0 fs/debugfs/file.c:118
full_proxy_open_regular+0x67/0xa00 fs/debugfs/file.c:447
do_dentry_open+0x1bdd/0x26b0 fs/open.c:955
vfs_open+0x53/0x5b0 fs/open.c:1085
do_open fs/namei.c:3830 [inline]
path_openat+0x56a1/0x6250 fs/namei.c:3989
do_filp_open+0x268/0x600 fs/namei.c:4016
do_sys_openat2+0x1bf/0x2f0 fs/open.c:1427
do_sys_open fs/open.c:1442 [inline]
__do_sys_openat fs/open.c:1458 [inline]
__se_sys_openat fs/open.c:1453 [inline]
__x64_sys_openat+0x2a1/0x310 fs/open.c:1453
x64_sys_call+0x36f5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4121 [inline]
slab_alloc_node mm/slub.c:4164 [inline]
__kmalloc_cache_noprof+0x8e3/0xdf0 mm/slub.c:4320
kmalloc_noprof include/linux/slab.h:901 [inline]
__debugfs_file_get+0x31d/0xef0 fs/debugfs/file.c:101
full_proxy_open_regular+0x67/0xa00 fs/debugfs/file.c:447
do_dentry_open+0x1bdd/0x26b0 fs/open.c:955
vfs_open+0x53/0x5b0 fs/open.c:1085
do_open fs/namei.c:3830 [inline]
path_openat+0x56a1/0x6250 fs/namei.c:3989
do_filp_open+0x268/0x600 fs/namei.c:4016
do_sys_openat2+0x1bf/0x2f0 fs/open.c:1427
do_sys_open fs/open.c:1442 [inline]
__do_sys_openat fs/open.c:1458 [inline]
__se_sys_openat fs/open.c:1453 [inline]
__x64_sys_openat+0x2a1/0x310 fs/open.c:1453
x64_sys_call+0x36f5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 1 UID: 0 PID: 5782 Comm: syz-executor269 Not tainted 6.13.0-syzkaller-09950-g60c828cf80c0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2025-02-01 20:07 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-29 4:30 syzbot
2025-02-01 20:07 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=679e7ef8.050a0220.163cdc.0025.GAE@google.com \
--to=syzbot+422b07c3add2219bc947@syzkaller.appspotmail.com \
--cc=dakr@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
--cc=rafael@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®