* [syzbot] [dm?] KASAN: slab-use-after-free Read in dm_table_get_mode
@ 2026-09-22 15:02 syzbot
2026-09-23 10:40 ` [PATCH] dm: fix reading free memory in do_resume Mikulas Patocka
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2026-09-22 15:02 UTC (permalink / raw)
To: agk, bmarzins, dm-devel, linux-kernel, mpatocka, snitzer, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 38872197cae2 Merge branch 'for-next/fixes' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=116dd805580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=bdff1ecf726d2af66afd
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e8f805580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17efe805580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c5963fdd6790/disk-38872197.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a8c2cab00c45/vmlinux-38872197.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bde15d173380/Image-38872197.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bdff1ecf726d2af66afd@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in dm_table_get_mode+0x60/0x68 drivers/md/dm-table.c:2121
Read of size 4 at addr ffff0000d75134f4 by task syz.1.7295/2493
CPU: 0 UID: 0 PID: 2493 Comm: syz.1.7295 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
__asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380
dm_table_get_mode+0x60/0x68 drivers/md/dm-table.c:2121
do_resume drivers/md/dm-ioctl.c:1317 [inline]
dev_suspend+0x40c/0x750 drivers/md/dm-ioctl.c:1360
ctl_ioctl drivers/md/dm-ioctl.c:2213 [inline]
dm_ctl_ioctl+0x884/0xbbc drivers/md/dm-ioctl.c:2235
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Allocated by task 2493:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x2f4/0x5fc mm/slub.c:5563
_kmalloc_noprof include/linux/slab.h:991 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
dm_table_create+0x8c/0x2ac drivers/md/dm-table.c:136
table_load+0x104/0x764 drivers/md/dm-ioctl.c:1631
ctl_ioctl drivers/md/dm-ioctl.c:2213 [inline]
dm_ctl_ioctl+0x884/0xbbc drivers/md/dm-ioctl.c:2235
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Freed by task 2494:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2748 [inline]
slab_free mm/slub.c:6508 [inline]
kfree+0x188/0x698 mm/slub.c:6801
dm_table_destroy+0x32c/0x3a0 drivers/md/dm-table.c:210
do_resume drivers/md/dm-ioctl.c:1341 [inline]
dev_suspend+0x5a4/0x750 drivers/md/dm-ioctl.c:1360
ctl_ioctl drivers/md/dm-ioctl.c:2213 [inline]
dm_ctl_ioctl+0x884/0xbbc drivers/md/dm-ioctl.c:2235
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
The buggy address belongs to the object at ffff0000d7513400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 244 bytes inside of
freed 512-byte region [ffff0000d7513400, ffff0000d7513600)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d7511c00 pfn:0x117510
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000240 ffff0000c0001c80 fffffdffc3c21e10 fffffdffc35db510
raw: ffff0000d7511c00 000000000010000f 00000000f5000000 0000000000000000
head: 05ffc00000000240 ffff0000c0001c80 fffffdffc3c21e10 fffffdffc35db510
head: ffff0000d7511c00 000000000010000f 00000000f5000000 0000000000000000
head: 05ffc00000000002 fffffdffc35d4401 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d7513380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d7513400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d7513480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d7513500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d7513580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH] dm: fix reading free memory in do_resume
2026-09-22 15:02 [syzbot] [dm?] KASAN: slab-use-after-free Read in dm_table_get_mode syzbot
@ 2026-09-23 10:40 ` Mikulas Patocka
0 siblings, 0 replies; 2+ messages in thread
From: Mikulas Patocka @ 2026-09-23 10:40 UTC (permalink / raw)
To: syzbot; +Cc: agk, bmarzins, dm-devel, linux-kernel, snitzer, syzkaller-bugs
On Tue, 22 Sep 2026, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 38872197cae2 Merge branch 'for-next/fixes' into for-kernelci
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=116dd805580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
> dashboard link: https://syzkaller.appspot.com/bug?extid=bdff1ecf726d2af66afd
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> userspace arch: arm64
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e8f805580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17efe805580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c5963fdd6790/disk-38872197.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/a8c2cab00c45/vmlinux-38872197.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/bde15d173380/Image-38872197.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+bdff1ecf726d2af66afd@syzkaller.appspotmail.com
Hi
Here I'm sending a patch for this bug. Could you recheck it?
Mikulas
From: Mikulas Patocka <mpatocka@redhat.com>
When do_resume calls dm_table_get_mode(new_map), the call is done without
holding any locks (it only holds a reference to the md). It may be
possible that another concurrent ioctl on the same device will swap table
after dm_swap_table and before dm_table_get_mode. In this case,
dm_table_get_mode(new_map) reads freed memory.
This race condition was triggered by syzbot.
This commit fixes the race by reading mode of the new table before
dm_swap_table. Note that new_map is also passed to dm_ima_need_measure,
but this function doesn't attempt to dereference it, so this call should
be safe.
Note that this is not a security bug because only root can trigger it and
the commonly used tools such as lvm or cryptsetup do not call the ioctls
concurrently, so that they can't trigger it acceidentally.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: syzbot+bdff1ecf726d2af66afd@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
---
drivers/md/dm-ioctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Index: linux-2.6/drivers/md/dm-ioctl.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-ioctl.c
+++ linux-2.6/drivers/md/dm-ioctl.c
@@ -1267,6 +1267,7 @@ static int do_resume(struct dm_ioctl *pa
/* Do we need to load a new map ? */
if (new_map) {
sector_t old_size, new_size;
+ blk_mode_t new_map_mode;
dm_ima_context_table_op(md, ima_context, DM_IMA_TABLE_SAVE);
/* Suspend if it isn't already suspended */
@@ -1299,6 +1300,7 @@ static int do_resume(struct dm_ioctl *pa
}
}
+ new_map_mode = dm_table_get_mode(new_map);
old_size = dm_get_size(md);
old_map = dm_swap_table(md, new_map);
if (IS_ERR(old_map)) {
@@ -1314,7 +1316,7 @@ static int do_resume(struct dm_ioctl *pa
if (old_size && new_size && old_size != new_size)
need_resize_uevent = true;
- if (dm_table_get_mode(new_map) & BLK_OPEN_WRITE)
+ if (new_map_mode & BLK_OPEN_WRITE)
set_disk_ro(dm_disk(md), 0);
else
set_disk_ro(dm_disk(md), 1);
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-23 10:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-22 15:02 [syzbot] [dm?] KASAN: slab-use-after-free Read in dm_table_get_mode syzbot
2026-09-23 10:40 ` [PATCH] dm: fix reading free memory in do_resume Mikulas Patocka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®