Message-ID: <CAKHoSAtC3NzC6c-uA=Ruzn81psVTAX-60Fw51OscpnpeJ2S29g@mail.gmail.com>
Date: Thu, 14 Mar 2024 22:23:54 +0800
From: cheung wall <zzqq0103.hey@...il.com>
To: Andrew Morton <akpm@...ux-foundation.org>, linux-kernel@...r.kernel.org
Subject: WARNING in __kthread_create_on_node

Hello,

when using Healer to fuzz the latest Linux Kernel, the following crash

was triggered on:


HEAD commit: e8f897f4afef0031fe618a8e94127a0934896aba  (tag: v6.8)

git tree: upstream

console output: https://pastebin.com/raw/4dqjbmVn

kernel config: https://pastebin.com/raw/enVJCL3u

C reproducer: https://pastebin.com/raw/wdKP6g0V

Syzlang reproducer: https://pastebin.com/raw/wfptradq

If you fix this issue, please add the following tag to the commit:

Reported-by: Qiang Zhang <zzqq0103.hey@...il.com>

----------------------------------------------------------

------------[ cut here ]------------
different return values (11 and 6) from vsnprintf("kmmpd-%.*s", ...)
WARNING: CPU: 0 PID: 18743 at lib/kasprintf.c:30
kvasprintf+0x14e/0x160 lib/kasprintf.c:30
Modules linked in:
CPU: 0 PID: 18743 Comm: syz-executor.0 Not tainted 6.8.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:kvasprintf+0x14e/0x160 lib/kasprintf.c:30
Code: 5b 5d 41 5c 41 5d 41 5e 41 5f e9 e8 2f 2d 02 e8 08 54 43 ff 90
48 c7 c7 40 62 fe a1 4c 89 e9 44 89 e2 89 ee e8 d3 62 13 ff 90 <0f> 0b
90 90 eb 99 e8 27 96 12 02 0f 1f 80 00 00 00 00 90 90 90 90
RSP: 0018:ffff88810485f760 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 1ffff1102090beec RCX: ffffffff9eb67582
RDX: ffff888104dfe600 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 000000000000000b R08: 0000000000000001 R09: ffffed10235c5121
R10: 0000000000000000 R11: 000000002d2d2d2d R12: 0000000000000006
R13: ffffffffa1f42a20 R14: ffff888100b62900 R15: 000000000000000c
FS:  00007f8db8f7e640(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
loop2: detected capacity change from 0 to 512
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcd493ab98 CR3: 00000001063fe004 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <TASK>
loop3: detected capacity change from 0 to 512
 __kthread_create_on_node+0x17f/0x3c0 kernel/kthread.c:444
 kthread_create_on_node+0xbf/0x100 kernel/kthread.c:512
loop1: detected capacity change from 0 to 512
 ext4_multi_mount_protect+0x953/0xb10 fs/ext4/mmp.c:392
 __ext4_fill_super fs/ext4/super.c:5363 [inline]
 ext4_fill_super+0xa76d/0xc290 fs/ext4/super.c:5703
 get_tree_bdev+0x35a/0x5d0 fs/super.c:1614
 vfs_get_tree+0x8c/0x320 fs/super.c:1779
 do_new_mount fs/namespace.c:3352 [inline]
 path_mount+0x6b3/0x1db0 fs/namespace.c:3679
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount fs/namespace.c:3875 [inline]
 __x64_sys_mount+0x286/0x310 fs/namespace.c:3875
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xb3/0x1b0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f8db9410dfe
Code: 48 c7 c0 ff ff ff ff eb aa e8 be 0d 00 00 66 2e 0f 1f 84 00 00
00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8db8f7de38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000000004b4 RCX: 00007f8db9410dfe
RDX: 0000000020000040 RSI: 0000000020000500 RDI: 00007f8db8f7de90
RBP: 00007f8db8f7ded0 R08: 00007f8db8f7ded0 R09: 0000000000004500
R10: 0000000000004500 R11: 0000000000000246 R12: 0000000020000040
R13: 0000000020000500 R14: 00007f8db8f7de90 R15: 0000000020000540
 </TASK>
---[ end trace 0000000000000000 ]---

Powered by blists - more mailing lists