Hello, The following program triggers GPF in logfs_alloc_inode: https://gist.githubusercontent.com/dvyukov/64a2113e4cb484d9b7e0ef4ff8a522d0/raw/fffdfb8b781ec758563e08765a258da71e6ff2a1/gistfile1.txt general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 2 PID: 6602 Comm: a.out Not tainted 4.9.0-rc5+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88003604c400 task.stack: ffff880035380000 RIP: 0010:[<ffffffff82514115>] [< inline >] i_uid_write ./include/linux/fs.h:1469 RIP: 0010:[<ffffffff82514115>] [<ffffffff82514115>] logfs_init_inode.isra.5+0x155/0x480 fs/logfs/inode.c:212 RSP: 0018:ffff880035387838 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8800640af9e0 RCX: 0000000000000000 RDX: 000000000000011b RSI: ffffffff8995e940 RDI: 00000000000008d8 RBP: ffff8800353878c0 R08: 00000000000004d0 R09: 0000000000000000 R10: 0000000000000006 R11: 0000000000000000 R12: ffff8800640afe00 R13: 1ffff10006a70f07 R14: 0000000000000000 R15: ffff88006b563700 FS: 0000000001b3b940(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8526a449de CR3: 0000000034106000 CR4: 00000000000006e0 Stack: 0000000041b58ab3 ffffffff894c4c0b ffffffff82513fc0 000000000000aa81 ffffffff819efe35 ffff88006a63a7ff 1ffff1000d4c7500 ffffe8ffffc18490 00000001819effad 0000000000000003 ffff88000000000c 0000000000000282 Call Trace: [<ffffffff82514475>] logfs_alloc_inode+0x35/0x40 fs/logfs/inode.c:234 [<ffffffff81ade226>] alloc_inode+0x66/0x180 fs/inode.c:207 [<ffffffff81ae57de>] new_inode_pseudo+0x6e/0x190 fs/inode.c:889 [<ffffffff81ae5921>] new_inode+0x21/0x50 fs/inode.c:918 [<ffffffff82514986>] logfs_new_meta_inode+0x26/0x120 fs/logfs/inode.c:267 [<ffffffff82533f97>] logfs_init_mapping+0x47/0x160 fs/logfs/segment.c:912 [< inline >] logfs_read_sb fs/logfs/super.c:446 [< inline >] logfs_get_sb_device fs/logfs/super.c:546 [<ffffffff825375f0>] logfs_mount+0x690/0x1e50 fs/logfs/super.c:600 [<ffffffff81a7d62c>] mount_fs+0x9c/0x2e0 fs/super.c:1177 [<ffffffff81af4e9c>] vfs_kern_mount.part.22+0x6c/0x2f0 fs/namespace.c:954 [< inline >] vfs_kern_mount fs/namespace.c:2433 [< inline >] do_new_mount fs/namespace.c:2436 [<ffffffff81afe3dd>] do_mount+0x41d/0x2db0 fs/namespace.c:2758 [< inline >] SYSC_mount fs/namespace.c:2974 [<ffffffff81b016d0>] SyS_mount+0xb0/0x120 fs/namespace.c:2951 [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6 arch/x86/entry/entry_64.S:209 Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 13 03 00 00 4c 8b 73 28 48 b8 00 00 00 00 00 fc ff df 49 8d be d8 08 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e3 02 00 00 48 8d 7b 04 48 b8 00 00 00 00 00 RIP [< inline >] i_uid_write ./include/linux/fs.h:1469 RIP [<ffffffff82514115>] logfs_init_inode.isra.5+0x155/0x480 fs/logfs/inode.c:212 RSP <ffff880035387838> ---[ end trace a44003de9322a2bc ]--- LogFS: Start mount 1 ================================================================== BUG: KASAN: use-after-free in __rwsem_down_write_failed_common+0xde7/0xf90 at addr ffff88003604c430 Read of size 4 by task a.out/6605 CPU: 1 PID: 6605 Comm: a.out Tainted: G B D 4.9.0-rc5+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffff88003cf6f130 ffffffff834c2a59 ffffffff00000001 1ffff100079eddb9 ffffed00079eddb1 0000000041b58ab3 ffffffff895758d0 ffffffff834c276b ffffffff894f179e ffffffff815774c0 ffff88003cf6eff0 dffffc0000000000 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff834c2a59>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51 [<ffffffff819f09f1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:159 [< inline >] print_address_description mm/kasan/report.c:197 [< inline >] kasan_report_error mm/kasan/report.c:286 [<ffffffff819f0cdb>] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306 [<ffffffff819f1009>] __asan_report_load4_noabort+0x19/0x20 mm/kasan/report.c:331 [< inline >] rwsem_optimistic_spin kernel/locking/rwsem-xadd.c:339 [<ffffffff8157a567>] __rwsem_down_write_failed_common+0xde7/0xf90 kernel/locking/rwsem-xadd.c:470 [<ffffffff881426f3>] rwsem_down_write_failed+0x13/0x20 kernel/locking/rwsem-xadd.c:555 [<ffffffff83504657>] call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105 [< inline >] __down_write ./arch/x86/include/asm/rwsem.h:125 [<ffffffff88140a4c>] down_write+0xac/0x120 kernel/locking/rwsem.c:54 [<ffffffff81a79bc8>] grab_super+0xa8/0x290 fs/super.c:364 [<ffffffff81a7ab58>] sget_userns+0x1f8/0xd40 fs/super.c:491 [<ffffffff81a7b764>] sget+0xc4/0x100 fs/super.c:548 [< inline >] logfs_get_sb_device fs/logfs/super.c:522 [<ffffffff825372ee>] logfs_mount+0x38e/0x1e50 fs/logfs/super.c:600 [<ffffffff81a7d62c>] mount_fs+0x9c/0x2e0 fs/super.c:1177 [<ffffffff81af4e9c>] vfs_kern_mount.part.22+0x6c/0x2f0 fs/namespace.c:954 [< inline >] vfs_kern_mount fs/namespace.c:2433 [< inline >] do_new_mount fs/namespace.c:2436 [<ffffffff81afe3dd>] do_mount+0x41d/0x2db0 fs/namespace.c:2758 [< inline >] SYSC_mount fs/namespace.c:2974 [<ffffffff81b016d0>] SyS_mount+0xb0/0x120 fs/namespace.c:2951 [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6 arch/x86/entry/entry_64.S:209 Object at ffff88003604c400, in cache task_struct size: 5632 Allocated: PID = 6598 [ 204.878017] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20 [ 204.878017] [<ffffffff819efce3>] save_stack+0x43/0xd0 [ 204.878017] [<ffffffff819effad>] kasan_kmalloc+0xad/0xe0 [ 204.878017] [<ffffffff819f0582>] kasan_slab_alloc+0x12/0x20 [ 204.878017] [<ffffffff819e9b48>] kmem_cache_alloc_node+0x138/0x740 [ 204.878017] [<ffffffff813f63a5>] copy_process.part.38+0x1995/0x4920 [ 204.878017] [<ffffffff813f9825>] _do_fork+0x205/0x1070 [ 204.878017] [<ffffffff813fa76c>] SyS_clone+0x3c/0x50 [ 204.878017] [<ffffffff81009a24>] do_syscall_64+0x2f4/0x940 [ 204.878017] [<ffffffff88147a4d>] return_from_SYSCALL_64+0x0/0x7a Freed: PID = 0 [ 204.878017] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20 [ 204.878017] [<ffffffff819efce3>] save_stack+0x43/0xd0 [ 204.878017] [<ffffffff819f0602>] kasan_slab_free+0x72/0xc0 [ 204.878017] [<ffffffff819ed5ab>] kmem_cache_free+0x7b/0x2f0 [ 204.878017] [<ffffffff813f3504>] free_task+0x114/0x190 [ 204.878017] [<ffffffff813f37d8>] __put_task_struct+0x258/0x610 [ 204.878017] [<ffffffff8140a024>] delayed_put_task_struct+0xe4/0x4b0 [ 204.878017] [<ffffffff815cbced>] rcu_do_batch.isra.70+0x9ed/0xe20 [ 204.878017] [<ffffffff815cc5ac>] rcu_process_callbacks+0x48c/0xd70 [ 204.878017] [<ffffffff8814b0fb>] __do_softirq+0x32b/0xca8 Memory state around the buggy address: ffff88003604c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88003604c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88003604c400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88003604c480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88003604c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5). -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
