On Sun, Jun 10, 2018 at 10:45:02PM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: 3ca24ce9ff76 Merge branch 'proc-cmdline' > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=15ed37d7800000 > kernel config: https://syzkaller.appspot.com/x/.config?x=314f2150f36c16ca > dashboard link: https://syzkaller.appspot.com/bug?extid=abf707d7ccbb3244f34e > compiler: gcc (GCC) 8.0.1 20180413 (experimental) > > Unfortunately, I don't have any reproducer for this crash yet. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+abf707d7ccbb3244f34e@xxxxxxxxxxxxxxxxxxxxxxxxx > > ================================================================== > BUG: KASAN: use-after-free in memcpy include/linux/string.h:345 [inline] > BUG: KASAN: use-after-free in getname_kernel+0x123/0x370 fs/namei.c:241 > Read of size 11 at addr ffff8801d8053310 by task syz-executor5/15925 > > CPU: 0 PID: 15925 Comm: syz-executor5 Not tainted 4.17.0+ #94 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1b9/0x294 lib/dump_stack.c:113 > print_address_description+0x6c/0x20b mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 > check_memory_region_inline mm/kasan/kasan.c:260 [inline] > check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 > memcpy+0x23/0x50 mm/kasan/kasan.c:302 > memcpy include/linux/string.h:345 [inline] > getname_kernel+0x123/0x370 fs/namei.c:241 > kern_path+0x1e/0x40 fs/namei.c:2410 > lookup_bdev+0xfa/0x240 fs/block_dev.c:2084 > blkdev_get_by_path+0x1f/0xe0 fs/block_dev.c:1687 > btrfs_get_bdev_and_sb+0x38/0x300 fs/btrfs/volumes.c:392 > btrfs_open_one_device fs/btrfs/volumes.c:695 [inline] > open_fs_devices+0x6a5/0xc60 fs/btrfs/volumes.c:1112 > btrfs_open_devices+0xc0/0xd0 fs/btrfs/volumes.c:1155 I think it's another manifestation of the bug syzbot reported against btrfs_open_devices https://lkml.kernel.org/r/000000000000832e70056df8fb38@xxxxxxxxxx Currently proposed fix is to revert 542c5908abfe84f7b4c1717492ecc92ea0ea328d, that's going to be merged post rc1.
