Re: inconsistent lock state in fs_reclaim_acquire (2)

2018-05-09 Thread Dmitry Vyukov
On Thu, May 10, 2018 at 7:57 AM, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:036db8bd9637 Merge branch 'for-4.17-fixes' of git://git.ke.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=146dab5b80 > kernel config:

Re: [PATCH] loop: add recursion validation to LOOP_CHANGE_FD

2018-05-14 Thread Dmitry Vyukov
On Wed, May 9, 2018 at 4:02 PM, Theodore Y. Ts'o wrote: > On Wed, May 09, 2018 at 10:49:54AM +0200, Dmitry Vyukov wrote: >> Hi Ted, >> >> Did you follow all instructions (commit, config, compiler, etc)? >> syzbot does not have any special magic, it just executes

Re: INFO: task hung in blk_queue_enter

2018-05-16 Thread Dmitry Vyukov
On Wed, May 16, 2018 at 4:56 PM, Bart Van Assche wrote: > On Wed, 2018-05-16 at 22:05 +0900, Tetsuo Handa wrote: >> One ore more threads are waiting for q->mq_freeze_depth to become 0. But the >> thread who incremented q->mq_freeze_depth at blk_freeze_queue_start(q) from >> blk_freeze_queue() is w

Re: mainline boot is broken: KASAN: use-after-free in blk_flush_complete_seq

2018-06-11 Thread Dmitry Vyukov
On Sat, Jun 9, 2018 at 2:33 PM, Jens Axboe wrote: > On 6/9/18 3:34 AM, Dmitry Vyukov wrote: >> Hi, >> >> Boot of mainline kernel is currently broken. >> On commit 7d3bf613e99abbd96ac7b90ee3694a246c975021. >> Config: >> https://gist.githubusercontent.com/d

Re: upstream boot error: can't ssh into the instance (2)

2019-01-27 Thread Dmitry Vyukov
On Sun, Jan 27, 2019 at 9:01 AM syzbot wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit:7930851ef10c Merge tag 'scsi-fixes' of git://git.kernel.or.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=1002c77f40 > kernel config:

Re: INFO: task hung in lo_release

2018-11-02 Thread Dmitry Vyukov
On Wed, Jul 18, 2018 at 4:28 PM, Tetsuo Handa wrote: > On 2018/07/18 21:46, syzbot wrote: >> Showing all locks held in the system: >> 1 lock held by khungtaskd/902: >> #0: 4f60bbd2 (rcu_read_lock){}, at: >> debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4461 >> 1 lock held

Re: kobject lifetime issues in blk-mq

2018-11-20 Thread Dmitry Vyukov
On Thu, Nov 15, 2018 at 1:56 AM, Greg Kroah-Hartman wrote: > On Thu, Nov 15, 2018 at 08:36:17AM +0800, Ming Lei wrote: >> > So even if you think the kernel is not going to do this, remember, you >> > have no control over it. Reference counted objects are done this way >> > for a reason, you reall

Re: kobject lifetime issues in blk-mq

2018-11-20 Thread Dmitry Vyukov
On Tue, Nov 20, 2018 at 1:05 PM, Greg Kroah-Hartman wrote: > On Tue, Nov 20, 2018 at 12:34:40PM +0100, Dmitry Vyukov wrote: >> On Thu, Nov 15, 2018 at 1:56 AM, Greg Kroah-Hartman >> wrote: >> > On Thu, Nov 15, 2018 at 08:36:17AM +0800, Ming Lei wrote: >> >>

Re: [Bug 201949] New: KASAN: use-after-free Read in __handle_mm_fault

2018-12-11 Thread Dmitry Vyukov
On Tue, Dec 11, 2018 at 12:45 AM Andrew Morton wrote: > > (switched to email. Please respond via emailed reply-to-all, not via the > bugzilla web interface). Looking at the reproducer this looks like a bug in sg ioctl. +block/scsi_ioctl.c maintainers > On Mon, 10 Dec 2018 10:56:31 + bugzill

scsi: use-after-free in bio_copy_from_iter

2016-11-25 Thread Dmitry Vyukov
Hello, The following program triggers use-after-free in bio_copy_from_iter: https://gist.githubusercontent.com/dvyukov/80cd94b4e4c288f16ee4c787d404118b/raw/10536069562444da51b758bb39655b514ff93b45/gistfile1.txt == BUG: KASAN: use-af

Re: scsi: use-after-free in bio_copy_from_iter

2016-12-02 Thread Dmitry Vyukov
On Fri, Nov 25, 2016 at 8:08 PM, Dmitry Vyukov wrote: > Hello, > > The following program triggers use-after-free in bio_copy_from_iter: > https://gist.githubusercontent.com/dvyukov/80cd94b4e4c288f16ee4c787d404118b/raw/10536069562444da51b758bb39655b514ff93b45/g

Re: scsi: use-after-free in bio_copy_from_iter

2016-12-03 Thread Dmitry Vyukov
On Sat, Dec 3, 2016 at 11:38 AM, Johannes Thumshirn wrote: > On Fri, Dec 02, 2016 at 05:50:39PM +0100, Dmitry Vyukov wrote: >> On Fri, Nov 25, 2016 at 8:08 PM, Dmitry Vyukov wrote: > > [...] > >> >> +David did some debugging of a similar case. His 0x400 at location

Re: scsi: use-after-free in bio_copy_from_iter

2016-12-05 Thread Dmitry Vyukov
On Sat, Dec 3, 2016 at 7:19 PM, Johannes Thumshirn wrote: > On Sat, Dec 03, 2016 at 04:22:39PM +0100, Dmitry Vyukov wrote: >> On Sat, Dec 3, 2016 at 11:38 AM, Johannes Thumshirn >> wrote: >> > On Fri, Dec 02, 2016 at 05:50:39PM +0100, Dmitry Vyukov wrote: >> >

Re: scsi: use-after-free in bio_copy_from_iter

2016-12-06 Thread Dmitry Vyukov
On Tue, Dec 6, 2016 at 10:32 AM, Johannes Thumshirn wrote: > On Mon, Dec 05, 2016 at 07:03:39PM +, Al Viro wrote: >> On Mon, Dec 05, 2016 at 04:17:53PM +0100, Johannes Thumshirn wrote: >> > 633 hp = &srp->header; >> > [...] >> > 646 hp->dxferp = (char __user *)buf + cmd

Re: scsi: use-after-free in bio_copy_from_iter

2016-12-06 Thread Dmitry Vyukov
On Tue, Dec 6, 2016 at 4:38 PM, Johannes Thumshirn wrote: > On Tue, Dec 06, 2016 at 10:43:57AM +0100, Dmitry Vyukov wrote: >> On Tue, Dec 6, 2016 at 10:32 AM, Johannes Thumshirn >> wrote: >> > On Mon, Dec 05, 2016 at 07:03:39PM +, Al Viro wrote: >> >>

Re: possible deadlock in blkdev_reread_part

2017-11-01 Thread Dmitry Vyukov
On Wed, Nov 1, 2017 at 10:01 PM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > e19b205be43d11bff638cad4487008c48d21c103 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is a

Re: WARNING in kmalloc_slab (3)

2017-12-04 Thread Dmitry Vyukov
On Mon, Dec 4, 2017 at 9:14 AM, Dan Carpenter wrote: > On Sun, Dec 03, 2017 at 12:16:08PM -0800, Eric Biggers wrote: >> Looks like BLKTRACESETUP doesn't limit the '.buf_nr' parameter, allowing >> anyone >> who can open a block device to cause an extremely large kmalloc. Here's a >> simplified re

Re: WARNING in kmalloc_slab (3)

2017-12-12 Thread Dmitry Vyukov
On Mon, Dec 4, 2017 at 10:26 AM, Dan Carpenter wrote: > On Mon, Dec 04, 2017 at 09:18:05AM +0100, Dmitry Vyukov wrote: >> On Mon, Dec 4, 2017 at 9:14 AM, Dan Carpenter >> wrote: >> > On Sun, Dec 03, 2017 at 12:16:08PM -0800, Eric Biggers wrote: >> >> Looks

scsi: memory leak in sg_start_req

2018-01-09 Thread Dmitry Vyukov
Hello, syzkaller has found the following memory leak: unreferenced object 0x88004c19 (size 8328): comm "syz-executor", pid 4627, jiffies 4294749150 (age 45.507s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 22 01 00 0

Re: scsi: memory leak in sg_start_req

2018-01-11 Thread Dmitry Vyukov
On Thu, Jan 11, 2018 at 7:04 AM, Douglas Gilbert wrote: > On 2018-01-09 11:05 AM, Dmitry Vyukov wrote: >> >> Hello, >> >> syzkaller has found the following memory leak: >> >> unreferenced object 0x88004c19 (size 8328): >>comm "syz-ex

Re: [PATCH v2 1/2] fault-inject: Restore support for task-independent fault injection

2017-08-22 Thread Dmitry Vyukov
the new local. If one needs global injection, he/she just enables the global one. We don't seem to need the global flag on fault attributes. >> References: commit e41d58185f14 ("fault-inject: support systematic fault >> injection") >> Signed-off-by: Bart Van Ass

Re: WARNING in kmalloc_slab (3)

2018-02-06 Thread Dmitry Vyukov
On Tue, Dec 12, 2017 at 10:22 PM, Eric Biggers wrote: > On Mon, Dec 04, 2017 at 12:26:32PM +0300, Dan Carpenter wrote: >> On Mon, Dec 04, 2017 at 09:18:05AM +0100, Dmitry Vyukov wrote: >> > On Mon, Dec 4, 2017 at 9:14 AM, Dan Carpenter >> > wrote: >> > > O

Re: INFO: task hung in blk_freeze_queue

2018-02-14 Thread Dmitry Vyukov
On Wed, Feb 7, 2018 at 8:46 AM, syzbot wrote: > Hello, > > syzbot hit the following crash on upstream commit > e237f98a9c134c3d600353f21e07db915516875b (Mon Feb 5 21:35:56 2018 +) > Merge tag 'xfs-4.16-merge-5' of > git://git.kernel.org/pub/scm/fs/xfs/xfs-linux > > So far this crash happened 2

Re: WARNING: lock held when returning to user space!

2018-04-06 Thread Dmitry Vyukov
On Fri, Apr 6, 2018 at 4:27 PM, Jens Axboe wrote: > On 4/6/18 7:02 AM, syzbot wrote: >> Hello, >> >> syzbot hit the following crash on upstream commit >> 38c23685b273cfb4ccf31a199feccce3bdcb5d83 (Fri Apr 6 04:29:35 2018 +) >> Merge tag 'armsoc-drivers' of >> git://git.kernel.org/pub/scm/linux/

Re: [PATCH] loop: fix LOOP_GET_STATUS lock imbalance

2018-04-07 Thread Dmitry Vyukov
On Sat, Apr 7, 2018 at 9:27 AM, Tetsuo Handa wrote: > Omar Sandoval wrote: >> From: Omar Sandoval >> >> Commit 2d1d4c1e591f made loop_get_status() drop lo_ctx_mutex before >> returning, but the loop_get_status_old(), loop_get_status64(), and >> loop_get_status_compat() wrappers don't call loop_ge

Re: general protection fault in lo_ioctl (2)

2018-05-02 Thread Dmitry Vyukov
On Wed, May 2, 2018 at 9:33 AM, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:fff75eb2a08c Merge tag 'errseq-v4.17' of > git://git.kernel.o... > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?id=5301511529693184 > kernel con

Re: [PATCH] loop: add recursion validation to LOOP_CHANGE_FD

2018-05-09 Thread Dmitry Vyukov
On Tue, May 8, 2018 at 5:56 AM, Theodore Y. Ts'o wrote: > On Tue, May 08, 2018 at 09:28:17AM +0900, Tetsuo Handa wrote: >> The thread I mean is: >> >> general protection fault in lo_ioctl (2) >> >> https://syzkaller.appspot.com/bug?id=f3cfe26e785d85f9ee259f385515291d21bd80a3 >> >> Are you sur

Re: [PATCH 0/2] bcache: two emergent fixes for Linux v5.2-rc5 (use-after-scope)

2019-06-16 Thread Dmitry Vyukov
Hi, This is regarding the subj patch: https://bugzilla.kernel.org/show_bug.cgi?id=203573 https://www.spinics.net/lists/linux-bcache/msg07474.html (don't see a way to reply to the patch) This looks like a serious bug that would have been caught by use-after-scope mode in KASAN given any coverage o