* KASAN: stack-out-of-bounds Write in end_buffer_read_sync
@ 2024-08-19 12:50 Hui Guo
2024-08-19 13:22 ` Matthew Wilcox
2024-08-19 13:28 ` Aleksandr Nogikh
0 siblings, 2 replies; 4+ messages in thread
From: Hui Guo @ 2024-08-19 12:50 UTC (permalink / raw)
To: Andrew Morton, Alexander Potapenko, Marco Elver, linux-kernel,
Mark Rutland, Ingo Molnar, Peter Zijlstra (Intel),
Paul E. McKenney, Uros Bizjak, Carlos Llamas,
Matthew Wilcox (Oracle),
Jens Axboe, Pankaj Raghav, Ryusuke Konishi, Al Viro,
Christian Brauner, Jan Kara, linux-fsdevel
Cc: syzkaller-bugs
Hi Kernel Maintainers,
Our tool found the following kernel bug "KASAN: stack-out-of-bounds
Write in end_buffer_read_sync" on:
HEAD Commit: 6b0f8db921abf0520081d779876d3a41069dab95 Merge tag
'execve-v6.11-rc4' of
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
kernel config: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/.config
repro log: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/d41d191102504ccfea2e8408a29f03973e4ccc81/repro.log
syz repro: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/d41d191102504ccfea2e8408a29f03973e4ccc81/repro.prog
Please let me know if there is anything I can help.
Best,
HuiGuo
====================================[cut
here]===========================================
BUG: KASAN: stack-out-of-bounds in instrument_atomic_read_write
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/instrumented.h:96
[inline]
BUG: KASAN: stack-out-of-bounds in atomic_dec
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/atomic/atomic-instrumented.h:592
[inline]
BUG: KASAN: stack-out-of-bounds in put_bh
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/buffer_head.h:303
[inline]
BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0x93/0xe0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/fs/buffer.c:161
Write of size 4 at addr ffffc90009c9f828 by task ksoftirqd/0/16
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted
6.11.0-rc3-00013-g6b0f8db921ab #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
__dump_stack data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/lib/dump_stack.c:93
[inline]
dump_stack_lvl+0x116/0x1b0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/lib/dump_stack.c:119
print_address_description
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/report.c:377
[inline]
print_report+0xc0/0x5e0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/report.c:488
kasan_report+0xbd/0xf0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/report.c:601
check_region_inline
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/generic.c:183
[inline]
kasan_check_range+0xf4/0x1a0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/generic.c:189
instrument_atomic_read_write
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/instrumented.h:96
[inline]
atomic_dec data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/atomic/atomic-instrumented.h:592
[inline]
put_bh data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/buffer_head.h:303
[inline]
end_buffer_read_sync+0x93/0xe0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/fs/buffer.c:161
end_bio_bh_io_sync+0xe7/0x140
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/fs/buffer.c:2776
bio_endio+0x6d4/0x810
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/bio.c:1646
blk_update_request+0x5cb/0x1780
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/blk-mq.c:925
blk_mq_end_request+0x5d/0x610
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/blk-mq.c:1053
lo_complete_rq+0x235/0x300
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/drivers/block/loop.c:386
blk_complete_reqs+0xb2/0xf0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/blk-mq.c:1128
handle_softirqs+0x1d7/0x870
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:554
run_ksoftirqd data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:928
[inline]
run_ksoftirqd+0x3a/0x60
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:920
smpboot_thread_fn+0x63f/0x9f0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/smpboot.c:164
kthread+0x2ca/0x3b0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/kthread.c:389
ret_from_fork+0x48/0x80
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/entry_64.S:244
</TASK>
The buggy address belongs to the virtual mapping at
[ffffc90009c98000, ffffc90009ca1000) created by:
kernel_clone+0xeb/0x910
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:2781
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x51cc1
memcg:ffff888000798d02
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000001 0000000000000000 00000001ffffffff ffff888000798d02
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask
0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 30926, tgid 30926
(syz-executor.10), ts 987852775054, free_ts 987008041304
set_page_owner
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/page_owner.h:32
[inline]
post_alloc_hook+0x2e7/0x350
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:1493
prep_new_page data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:1501
[inline]
get_page_from_freelist+0xbf3/0x2850
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:3442
__alloc_pages_noprof+0x214/0x21e0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:4700
alloc_pages_mpol_noprof+0x262/0x610
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/mempolicy.c:2263
vm_area_alloc_pages
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/vmalloc.c:3584
[inline]
__vmalloc_area_node
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/vmalloc.c:3660
[inline]
__vmalloc_node_range_noprof+0xd32/0x1410
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/vmalloc.c:3841
alloc_thread_stack_node
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:313
[inline]
dup_task_struct
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:1113
[inline]
copy_process+0x304d/0x6f20
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:2204
kernel_clone+0xeb/0x910
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:2781
__do_sys_clone3+0x1d7/0x250
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:3085
do_syscall_x64
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/common.c:52
[inline]
do_syscall_64+0xcb/0x250
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 16 tgid 16 stack trace:
reset_page_owner
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/page_owner.h:25
[inline]
free_pages_prepare
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:1094
[inline]
free_unref_page+0x655/0xe40
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:2612
rcu_do_batch data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/rcu/tree.c:2569
[inline]
rcu_core+0x829/0x16d0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/rcu/tree.c:2843
handle_softirqs+0x1d7/0x870
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:554
run_ksoftirqd data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:928
[inline]
run_ksoftirqd+0x3a/0x60
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:920
smpboot_thread_fn+0x63f/0x9f0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/smpboot.c:164
kthread+0x2ca/0x3b0
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/kthread.c:389
ret_from_fork+0x48/0x80
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30
data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffffc90009c9f700: f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00
ffffc90009c9f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90009c9f800: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 01 f2 00 f2 f2
^
ffffc90009c9f880: f2 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00
ffffc90009c9f900: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3
==========================================================================================
This report is generated by reproducing the syz repro. It may contain errors.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
2024-08-19 12:50 KASAN: stack-out-of-bounds Write in end_buffer_read_sync Hui Guo
@ 2024-08-19 13:22 ` Matthew Wilcox
2024-08-19 13:28 ` Aleksandr Nogikh
1 sibling, 0 replies; 4+ messages in thread
From: Matthew Wilcox @ 2024-08-19 13:22 UTC (permalink / raw)
To: Hui Guo
Cc: Andrew Morton, Alexander Potapenko, Marco Elver, linux-kernel,
Mark Rutland, Ingo Molnar, Peter Zijlstra (Intel),
Paul E. McKenney, Uros Bizjak, Carlos Llamas, Jens Axboe,
Pankaj Raghav, Ryusuke Konishi, Al Viro, Christian Brauner,
Jan Kara, linux-fsdevel, syzkaller-bugs
On Mon, Aug 19, 2024 at 08:50:48PM +0800, Hui Guo wrote:
> Hi Kernel Maintainers,
> Our tool found the following kernel bug "KASAN: stack-out-of-bounds
> Write in end_buffer_read_sync" on:
> HEAD Commit: 6b0f8db921abf0520081d779876d3a41069dab95 Merge tag
> 'execve-v6.11-rc4' of
> git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
> kernel config: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/.config
> repro log: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/d41d191102504ccfea2e8408a29f03973e4ccc81/repro.log
> syz repro: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/d41d191102504ccfea2e8408a29f03973e4ccc81/repro.prog
>
> Please let me know if there is anything I can help.
You could bisect it to the commit that introduced the problem
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
2024-08-19 12:50 KASAN: stack-out-of-bounds Write in end_buffer_read_sync Hui Guo
2024-08-19 13:22 ` Matthew Wilcox
@ 2024-08-19 13:28 ` Aleksandr Nogikh
2024-08-20 4:04 ` Matthew Wilcox
1 sibling, 1 reply; 4+ messages in thread
From: Aleksandr Nogikh @ 2024-08-19 13:28 UTC (permalink / raw)
To: Hui Guo
Cc: Andrew Morton, Alexander Potapenko, Marco Elver, linux-kernel,
Mark Rutland, Ingo Molnar, Peter Zijlstra (Intel),
Paul E. McKenney, Uros Bizjak, Carlos Llamas,
Matthew Wilcox (Oracle),
Jens Axboe, Pankaj Raghav, Ryusuke Konishi, Al Viro,
Christian Brauner, Jan Kara, linux-fsdevel, syzkaller-bugs
On Mon, Aug 19, 2024 at 2:54 PM Hui Guo <guohui.study@gmail.com> wrote:
>
> Hi Kernel Maintainers,
> Our tool found the following kernel bug "KASAN: stack-out-of-bounds
> Write in end_buffer_read_sync" on:
Please note that the bug was already reported by syzbot in 2022:
https://syzkaller.appspot.com/bug?extid=3f7f291a3d327486073c
https://lore.kernel.org/all/0000000000005b04fa05dd71e0e0@google.com/T/
--
Aleksandr
> HEAD Commit: 6b0f8db921abf0520081d779876d3a41069dab95 Merge tag
> 'execve-v6.11-rc4' of
> git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
> kernel config: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/.config
> repro log: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/d41d191102504ccfea2e8408a29f03973e4ccc81/repro.log
> syz repro: https://github.com/androidAppGuard/KernelBugs/blob/main/6b0f8db921abf0520081d779876d3a41069dab95/d41d191102504ccfea2e8408a29f03973e4ccc81/repro.prog
>
> Please let me know if there is anything I can help.
>
> Best,
> HuiGuo
>
> ====================================[cut
> here]===========================================
> BUG: KASAN: stack-out-of-bounds in instrument_atomic_read_write
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/instrumented.h:96
> [inline]
> BUG: KASAN: stack-out-of-bounds in atomic_dec
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/atomic/atomic-instrumented.h:592
> [inline]
> BUG: KASAN: stack-out-of-bounds in put_bh
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/buffer_head.h:303
> [inline]
> BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0x93/0xe0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/fs/buffer.c:161
> Write of size 4 at addr ffffc90009c9f828 by task ksoftirqd/0/16
>
> CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted
> 6.11.0-rc3-00013-g6b0f8db921ab #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
> <TASK>
> __dump_stack data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/lib/dump_stack.c:93
> [inline]
> dump_stack_lvl+0x116/0x1b0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/lib/dump_stack.c:119
> print_address_description
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/report.c:377
> [inline]
> print_report+0xc0/0x5e0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/report.c:488
> kasan_report+0xbd/0xf0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/report.c:601
> check_region_inline
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/generic.c:183
> [inline]
> kasan_check_range+0xf4/0x1a0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/kasan/generic.c:189
> instrument_atomic_read_write
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/instrumented.h:96
> [inline]
> atomic_dec data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/atomic/atomic-instrumented.h:592
> [inline]
> put_bh data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/buffer_head.h:303
> [inline]
> end_buffer_read_sync+0x93/0xe0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/fs/buffer.c:161
> end_bio_bh_io_sync+0xe7/0x140
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/fs/buffer.c:2776
> bio_endio+0x6d4/0x810
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/bio.c:1646
> blk_update_request+0x5cb/0x1780
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/blk-mq.c:925
> blk_mq_end_request+0x5d/0x610
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/blk-mq.c:1053
> lo_complete_rq+0x235/0x300
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/drivers/block/loop.c:386
> blk_complete_reqs+0xb2/0xf0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/block/blk-mq.c:1128
> handle_softirqs+0x1d7/0x870
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:554
> run_ksoftirqd data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:928
> [inline]
> run_ksoftirqd+0x3a/0x60
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:920
> smpboot_thread_fn+0x63f/0x9f0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/smpboot.c:164
> kthread+0x2ca/0x3b0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/kthread.c:389
> ret_from_fork+0x48/0x80
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/entry_64.S:244
> </TASK>
>
> The buggy address belongs to the virtual mapping at
> [ffffc90009c98000, ffffc90009ca1000) created by:
> kernel_clone+0xeb/0x910
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:2781
>
> The buggy address belongs to the physical page:
> page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x51cc1
> memcg:ffff888000798d02
> flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000
> raw: 0000000000000001 0000000000000000 00000001ffffffff ffff888000798d02
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask
> 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 30926, tgid 30926
> (syz-executor.10), ts 987852775054, free_ts 987008041304
> set_page_owner
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/page_owner.h:32
> [inline]
> post_alloc_hook+0x2e7/0x350
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:1493
> prep_new_page data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:1501
> [inline]
> get_page_from_freelist+0xbf3/0x2850
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:3442
> __alloc_pages_noprof+0x214/0x21e0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:4700
> alloc_pages_mpol_noprof+0x262/0x610
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/mempolicy.c:2263
> vm_area_alloc_pages
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/vmalloc.c:3584
> [inline]
> __vmalloc_area_node
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/vmalloc.c:3660
> [inline]
> __vmalloc_node_range_noprof+0xd32/0x1410
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/vmalloc.c:3841
> alloc_thread_stack_node
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:313
> [inline]
> dup_task_struct
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:1113
> [inline]
> copy_process+0x304d/0x6f20
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:2204
> kernel_clone+0xeb/0x910
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:2781
> __do_sys_clone3+0x1d7/0x250
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/fork.c:3085
> do_syscall_x64
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/common.c:52
> [inline]
> do_syscall_64+0xcb/0x250
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> page last free pid 16 tgid 16 stack trace:
> reset_page_owner
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/./include/linux/page_owner.h:25
> [inline]
> free_pages_prepare
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:1094
> [inline]
> free_unref_page+0x655/0xe40
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/mm/page_alloc.c:2612
> rcu_do_batch data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/rcu/tree.c:2569
> [inline]
> rcu_core+0x829/0x16d0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/rcu/tree.c:2843
> handle_softirqs+0x1d7/0x870
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:554
> run_ksoftirqd data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:928
> [inline]
> run_ksoftirqd+0x3a/0x60
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/softirq.c:920
> smpboot_thread_fn+0x63f/0x9f0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/smpboot.c:164
> kthread+0x2ca/0x3b0
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/kernel/kthread.c:389
> ret_from_fork+0x48/0x80
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30
> data/ghui/docker_data/linux_kernel/upstream/6b0f8db921abf0520081d779876d3a41069dab95/arch/x86/entry/entry_64.S:244
>
> Memory state around the buggy address:
> ffffc90009c9f700: f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00
> ffffc90009c9f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> >ffffc90009c9f800: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 01 f2 00 f2 f2
> ^
> ffffc90009c9f880: f2 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00
> ffffc90009c9f900: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3
> ==========================================================================================
> This report is generated by reproducing the syz repro. It may contain errors.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CAHOo4gJyho_xXKRJB52qTJuCrrq9L-RL59XYyo_oS5%2BvN7Osiw%40mail.gmail.com.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: KASAN: stack-out-of-bounds Write in end_buffer_read_sync
2024-08-19 13:28 ` Aleksandr Nogikh
@ 2024-08-20 4:04 ` Matthew Wilcox
0 siblings, 0 replies; 4+ messages in thread
From: Matthew Wilcox @ 2024-08-20 4:04 UTC (permalink / raw)
To: Aleksandr Nogikh
Cc: Hui Guo, Andrew Morton, Alexander Potapenko, Marco Elver,
linux-kernel, Mark Rutland, Ingo Molnar, Peter Zijlstra (Intel),
Paul E. McKenney, Uros Bizjak, Carlos Llamas, Jens Axboe,
Pankaj Raghav, Ryusuke Konishi, Al Viro, Christian Brauner,
Jan Kara, linux-fsdevel, syzkaller-bugs
On Mon, Aug 19, 2024 at 03:28:13PM +0200, Aleksandr Nogikh wrote:
> On Mon, Aug 19, 2024 at 2:54 PM Hui Guo <guohui.study@gmail.com> wrote:
> >
> > Hi Kernel Maintainers,
> > Our tool found the following kernel bug "KASAN: stack-out-of-bounds
> > Write in end_buffer_read_sync" on:
>
> Please note that the bug was already reported by syzbot in 2022:
> https://syzkaller.appspot.com/bug?extid=3f7f291a3d327486073c
> https://lore.kernel.org/all/0000000000005b04fa05dd71e0e0@google.com/T/
Oh, syzbot was more useful than Hui Guo. It pointed out that it's
an NTFS problem, so nobody cared. I'll go back to not caring.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-08-20 4:04 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-08-19 12:50 KASAN: stack-out-of-bounds Write in end_buffer_read_sync Hui Guo
2024-08-19 13:22 ` Matthew Wilcox
2024-08-19 13:28 ` Aleksandr Nogikh
2024-08-20 4:04 ` Matthew Wilcox
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®