From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0CB5C43334 for ; Mon, 13 Jun 2022 19:43:47 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 51D0B6B02F8; Mon, 13 Jun 2022 15:43:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4CCFD8D01C0; Mon, 13 Jun 2022 15:43:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 36D038D01BF; Mon, 13 Jun 2022 15:43:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 275A46B02F8 for ; Mon, 13 Jun 2022 15:43:47 -0400 (EDT) Received: from smtpin31.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay11.hostedemail.com (Postfix) with ESMTP id F401980E33 for ; Mon, 13 Jun 2022 19:43:46 +0000 (UTC) X-FDA: 79574237694.31.9F1DE56 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by imf27.hostedemail.com (Postfix) with ESMTP id 72F3440086 for ; Mon, 13 Jun 2022 19:43:46 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id CA43221AFC; Mon, 13 Jun 2022 19:43:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1655149424; h=from:from:reply-to:reply-to:date:date:message-id:message-id:to:to: cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=tDlIv8k4YI9AeL8zTuC9Y9jHBJ5RQWlcpO0WYfw29GM=; b=QYlBWgzCJ6lCxWp3gQ2Z3SxBRp998NEKsWzmGenXDPEfVxBop57Ws1nlUFD0NTb9nj2J1U XFqvWHen/BxLTqci0hMrUCQAEuxeP+1O5zGCtE8sHpo8OzFa4m5PB0GRMkfkadYEfZOtJ4 mcIcxneT88NF/XRo8y5WU9xxDHnnFz0= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1655149424; h=from:from:reply-to:reply-to:date:date:message-id:message-id:to:to: cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=tDlIv8k4YI9AeL8zTuC9Y9jHBJ5RQWlcpO0WYfw29GM=; b=WxJzS6RsJwIE+51FIvF7osXGjc2WqiShjDo+rq6ZX5YPlk22LSRsagEVL8ljguIQVAH0D+ IrM0Uph/jbzMNSCA== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 8279413443; Mon, 13 Jun 2022 19:43:44 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id FbzTHnCTp2I1NAAAMHmgww (envelope-from ); Mon, 13 Jun 2022 19:43:44 +0000 Date: Mon, 13 Jun 2022 21:39:12 +0200 From: David Sterba To: syzbot Cc: akpm@linux-foundation.org, clm@fb.com, dsterba@suse.com, hch@lst.de, josef@toxicpanda.com, linux-btrfs@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com, willy@infradead.org Subject: Re: [syzbot] KASAN: use-after-free Read in copy_page_from_iter_atomic (2) Message-ID: <20220613193912.GI20633@twin.jikos.cz> Reply-To: dsterba@suse.cz Mail-Followup-To: dsterba@suse.cz, syzbot , akpm@linux-foundation.org, clm@fb.com, dsterba@suse.com, hch@lst.de, josef@toxicpanda.com, linux-btrfs@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com, willy@infradead.org References: <0000000000003ce9d105e0db53c8@google.com> <00000000000085068105e112a117@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <00000000000085068105e112a117@google.com> User-Agent: Mutt/1.5.23.1-rc1 (2014-03-12) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1655149426; h=from:from:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=tDlIv8k4YI9AeL8zTuC9Y9jHBJ5RQWlcpO0WYfw29GM=; b=iB+Csc9OZBCFDJsyI+M2cDvQ2DhLv5HtfcJFQh+EYrNI8lHdD9N+n9N8Nc/sv6QXEiIA7g vCB1bOIEE0TTyFsdhRuhk4wy0dxaLYY3UMWxGEP5RYHqOMMIUScLpSQc7hhIHYPMZn1aG5 C3X+eNvDCMgGMjn1LznUmayMApvnMaY= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=QYlBWgzC; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=WxJzS6Rs; dmarc=none; spf=pass (imf27.hostedemail.com: domain of dsterba@suse.cz designates 195.135.220.28 as permitted sender) smtp.mailfrom=dsterba@suse.cz ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1655149426; a=rsa-sha256; cv=none; b=cJQ9eIYnctdGQRT7oIdjBZ44LwjxRsniX5O5753eJ0Lek/IrnZHSKqpCpz1MOSsmhpjHho kwX+Z5tvdjboAjuY7yjNaVv9c9oduNmXjzOUZRFHSa+MdqZ2jCCqsjZI6O3x0CTFOdOwRD LUQK/qbI2C9Dk3FZQ3fp4JlbWWOne2U= X-Stat-Signature: e9857xaef3y47qxe39wcr4f6cwowd774 X-Rspamd-Queue-Id: 72F3440086 X-Rspam-User: X-Rspamd-Server: rspam05 Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=QYlBWgzC; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=WxJzS6Rs; dmarc=none; spf=pass (imf27.hostedemail.com: domain of dsterba@suse.cz designates 195.135.220.28 as permitted sender) smtp.mailfrom=dsterba@suse.cz X-HE-Tag: 1655149426-336067 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Jun 10, 2022 at 12:10:19AM -0700, syzbot wrote: > syzbot has bisected this issue to: > > commit 4cd4aed63125ccd4efc35162627827491c2a7be7 > Author: Christoph Hellwig > Date: Fri May 27 08:43:20 2022 +0000 > > btrfs: fold repair_io_failure into btrfs_repair_eb_io_failure Josef also reported a crash and found a bug in the patch, now added as fixup that'll be in for-next: diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 89a319e65197..5eac9ffb7499 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -2260,7 +2260,7 @@ int btrfs_repair_eb_io_failure(const struct extent_buffer *eb, int mirror_num) __bio_add_page(&bio, p, PAGE_SIZE, start - page_offset(p)); ret = btrfs_map_repair_bio(fs_info, &bio, mirror_num); bio_uninit(&bio); - + start += PAGE_SIZE; if (ret) return ret; } ---