On Mon 12-09-22 22:33:48, Haichi Wang wrote: > Dear Linux maintainers and reviewers: > We would like to report a linux kernel bug, found by a modified version of syzkaller. > May affected file: fs/jbd2/transaction.c > Kernel Version: 7e57714cd0ad2d5bb90e50b5096a0e671dec1ef3 (v5.17-rc6) > Kernel Config: see attach, linux.config > Syzkaller Version: 3666edfeb55080ebe138d77417fa96fe2555d6bb > reproducing program: see attach, reproducing.txt. > > To use the reproducing program, please follow > https://github.com/google/syzkaller/blob/master/docs/reproducing_crashes.md > for more details. > > Feel free to email us if any other infomations are needed. Hope the > provided materials will help finding and fixing the bug. > > The full log crash log are as follows:(also in the attach, crash.report) > --------- > warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow > ================================================================== > BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] > BUG: KASAN: use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] > BUG: KASAN: use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:82 [inline] > BUG: KASAN: use-after-free in do_raw_spin_lock include/linux/spinlock.h:185 [inline] > BUG: KASAN: use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline] > BUG: KASAN: use-after-free in _raw_spin_lock+0x73/0xd0 kernel/locking/spinlock.c:154 > Write of size 4 at addr ffff88803359c1a0 by task syz-executor.1/3650 > > CPU: 1 PID: 3650 Comm: syz-executor.1 Tainted: G S 5.17.0-rc6 #7 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x4d/0x66 lib/dump_stack.c:106 > print_address_description.constprop.0+0x21/0x150 mm/kasan/report.c:255 > __kasan_report mm/kasan/report.c:442 [inline] > kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459 > check_region_inline mm/kasan/generic.c:183 [inline] > kasan_check_range+0x14d/0x1d0 mm/kasan/generic.c:189 > instrument_atomic_read_write include/linux/instrumented.h:101 [inline] > atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] > queued_spin_lock include/asm-generic/qspinlock.h:82 [inline] > do_raw_spin_lock include/linux/spinlock.h:185 [inline] > __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline] > _raw_spin_lock+0x73/0xd0 kernel/locking/spinlock.c:154 > spin_lock include/linux/spinlock.h:349 [inline] > jbd2_journal_wait_updates+0x1f1/0x280 fs/jbd2/transaction.c:861 Ah, this one. Should be fixed by commit f7f497cb7024 ("jbd2: kill t_handle_lock transaction spinlock") which got merged to 5.18-rc1. Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
