| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <68dc6747.050a0220.25d7ab.076a.GAE@google.com> Date: Tue, 30 Sep 2025 16:27:03 -0700 From: syzbot <syzbot+9db318d6167044609878@...kaller.appspotmail.com> To: kartikey406@...il.com, linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com Subject: Re: [syzbot] [ext4?] KASAN: use-after-free Read in ext4_ext_insert_extent Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in ext4_ext_map_blocks EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] CPU: 1 UID: 0 PID: 6473 Comm: syz.1.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:ext4_ext_map_blocks+0x2a1/0x38f0 fs/ext4/extents.c:4212 Code: 24 58 45 0f b7 3f 31 ff 44 89 fe e8 59 a6 51 ff 45 85 ff 74 29 e8 af a2 51 ff 4b 8d 1c 7f c1 e3 04 48 83 c3 20 89 d8 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 f0 10 b5 ff 48 8b 1b eb 0c e8 86 RSP: 0018:ffffc90003e8f060 EFLAGS: 00010206 RAX: 000000000000000a RBX: 0000000000000050 RCX: ffff88807cc91e40 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90003e8f270 R08: ffffffff8f5ae037 R09: 1ffffffff1eb5c06 R10: dffffc0000000000 R11: fffffbfff1eb5c07 R12: ffffc90003e8f460 R13: 1ffff920007d1e24 R14: dffffc0000000000 R15: 0000000000000001 FS: 00007f8b97f5d6c0(0000) GS:ffff8881264d6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000004000 CR3: 000000007a25c000 CR4: 00000000003526f0 Call Trace: <TASK> ext4_map_create_blocks fs/ext4/inode.c:609 [inline] ext4_map_blocks+0x860/0x1740 fs/ext4/inode.c:811 _ext4_get_block+0x200/0x4c0 fs/ext4/inode.c:910 ext4_get_block_unwritten+0x2e/0x100 fs/ext4/inode.c:943 ext4_block_write_begin+0x990/0x1710 fs/ext4/inode.c:1198 ext4_write_begin+0xc04/0x19a0 fs/ext4/ext4_jbd2.h:-1 ext4_da_write_begin+0x445/0xda0 fs/ext4/inode.c:3129 generic_perform_write+0x2c2/0x900 mm/filemap.c:4175 ext4_buffered_write_iter+0xce/0x3a0 fs/ext4/file.c:299 ext4_file_write_iter+0x298/0x1bc0 fs/ext4/file.c:-1 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_pwrite64 fs/read_write.c:793 [inline] __do_sys_pwrite64 fs/read_write.c:801 [inline] __se_sys_pwrite64 fs/read_write.c:798 [inline] __x64_sys_pwrite64+0x193/0x220 fs/read_write.c:798 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8b9718e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8b97f5d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 RAX: ffffffffffffffda RBX: 00007f8b973b5fa0 RCX: 00007f8b9718e969 RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 RBP: 00007f8b97210ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f8b973b5fa0 R15: 00007ffea2f11788 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:ext4_ext_map_blocks+0x2a1/0x38f0 fs/ext4/extents.c:4212 Code: 24 58 45 0f b7 3f 31 ff 44 89 fe e8 59 a6 51 ff 45 85 ff 74 29 e8 af a2 51 ff 4b 8d 1c 7f c1 e3 04 48 83 c3 20 89 d8 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 f0 10 b5 ff 48 8b 1b eb 0c e8 86 RSP: 0018:ffffc90003e8f060 EFLAGS: 00010206 RAX: 000000000000000a RBX: 0000000000000050 RCX: ffff88807cc91e40 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90003e8f270 R08: ffffffff8f5ae037 R09: 1ffffffff1eb5c06 R10: dffffc0000000000 R11: fffffbfff1eb5c07 R12: ffffc90003e8f460 R13: 1ffff920007d1e24 R14: dffffc0000000000 R15: 0000000000000001 FS: 00007f8b97f5d6c0(0000) GS:ffff8881263d6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555839b2c950 CR3: 000000007a25c000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 24 58 and $0x58,%al 2: 45 0f b7 3f movzwl (%r15),%r15d 6: 31 ff xor %edi,%edi 8: 44 89 fe mov %r15d,%esi b: e8 59 a6 51 ff call 0xff51a669 10: 45 85 ff test %r15d,%r15d 13: 74 29 je 0x3e 15: e8 af a2 51 ff call 0xff51a2c9 1a: 4b 8d 1c 7f lea (%r15,%r15,2),%rbx 1e: c1 e3 04 shl $0x4,%ebx 21: 48 83 c3 20 add $0x20,%rbx 25: 89 d8 mov %ebx,%eax 27: c1 e8 03 shr $0x3,%eax * 2a: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 f0 10 b5 ff call 0xffb51129 39: 48 8b 1b mov (%rbx),%rbx 3c: eb 0c jmp 0x4a 3e: e8 .byte 0xe8 3f: 86 .byte 0x86 Tested on: commit: 22bdd6e6 Merge tag 'x86_apic_for_v6.18_rc1' of git://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1664d05b980000 kernel config: https://syzkaller.appspot.com/x/.config?x=6899ea2dd30a3ed1 dashboard link: https://syzkaller.appspot.com/bug?extid=9db318d6167044609878 compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=14057c14580000
Powered by blists - more mailing lists