Date:   Thu, 26 Jan 2023 08:14:24 -0500
From:   "Liam R. Howlett" <Liam.Howlett@Oracle.com>
To:     syzbot <syzbot+7170d66493145b71afd4@syzkaller.appspotmail.com>
Cc:     brauner@kernel.org, dan.carpenter@oracle.com, dvyukov@google.com,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        syzkaller-bugs@googlegroups.com, torvalds@linux-foundation.org,
        viro@zeniv.linux.org.uk, wanjiabing@vivo.com, willy@infradead.org
Subject: Re: [syzbot] KASAN: use-after-free Read in mas_next_nentry
Message-ID: <20230126131424.ufk6zspn6fyzw5l6@revolver>
References: <0000000000009ecbf205dda227bd@google.com>
 <0000000000004dc42605f31dd05c@google.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <0000000000004dc42605f31dd05c@google.com>
User-Agent: NeoMutt/20220429
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2imZSwc8DrLDlvj7+vhICpsb3x/dXqIDf/z+JloV/OFS0ceweavVKSRhYKBt?=
 =?us-ascii?Q?qtsY3EeEQny10W4Ce9/CeVtldmK3tAXOdrTiem6snemRovrdNMpO881Lzcg5?=
 =?us-ascii?Q?9Rz0QdsfdCYZsft/UBIMbDl23dNb9jhteG3OemQBNKpFf4/IPd0Bn4QEGvpz?=
 =?us-ascii?Q?fx3/DctifCCKMl2SdLKvLgYGqR0o2DoP0BeRol+aX3CNtHKcWMwAWODOaNMj?=
 =?us-ascii?Q?/1IuphYugBgyml8/kKcxCNYBhCatJD6+dfUK9cVG9r2Wskhd6AByIpCkICHQ?=
 =?us-ascii?Q?8KB8thRYyGIK48qfGMpnV3OmUubdOGHFpKVLyQr+gD6jEtwzs6E7Sp8ZDENw?=
 =?us-ascii?Q?yB5jOiYMCAVPVmKPUlbc+HjeCmYRaX/RdLOqyCS8+XdQnQdGvoyA8IefMmdk?=
 =?us-ascii?Q?CYjW69lbDGnmlAYYIo/OOyHdjW+KsT61Cnir96jlu1qmaVMV27xnprC/44a8?=
 =?us-ascii?Q?zZYkRM2VGpCzM9b58SLWpXVpdW6D9/pmqn2lVefhfBq8bluKTSXj4Xy5Sgfo?=
 =?us-ascii?Q?aDUUTxdejjfXiuPS8pDR1g6PiBAVf8rj8kE3T6R8Omk4kNfofOtXlYLblopX?=
 =?us-ascii?Q?/q+xnmpZSPmv2Mjib/9biNQRR7qvKOG0ZWcMKQewavLUqk2f/P6S2NbJVkC6?=
 =?us-ascii?Q?X/L79iJFYyNfyZ0Iwnwk6g5ivINTwNaa50ioYFz7S8C5de85EsWlQlzL746W?=
 =?us-ascii?Q?9TvdtDoAQDEp65024KMsjZBiyCjD9F0xM4G/cbKhGImmZ48FCaTl2esVU1aU?=
 =?us-ascii?Q?QqLRMyETY7/hVHTbCHK4uGpg7WwEFR92Uhqpxl05LOF9YLuBkOtHM8La0XBl?=
 =?us-ascii?Q?6a8Ul+FGkeDjHWmexmkfE3bPpP+tS2ib9ehe8BTX4BrAZI1w9ze/+2LdI5EN?=
 =?us-ascii?Q?MuJV83RF8w+UB1Zom5OCiL+gAYrCyyHdttkxJXc+KpvTGOpGykr89mukk5D6?=
 =?us-ascii?Q?IjoAH3WGQctjm8IqNBYjA3xCx8o+EJV7kVZJJ8SWwIYZoCGooBpCQGCMv4YD?=
 =?us-ascii?Q?VEeZ70YvxmwoiyrnazE1FVVjwc7KqQc5IFYOlkksvoMIAdRIdUSHncQsXdiL?=
 =?us-ascii?Q?82mDMv11MSQaa0emDW8PpozkfkV6iet7Fm3WxtcAriRdT2BQrLZk9SDdbpQj?=
 =?us-ascii?Q?zaamWw8XhnmkTHk8qNk9MA7lcdQQGWDxCvUybJiCTh+TYaFNr5IC/Qep9EnI?=
 =?us-ascii?Q?HYgRRZ/LUSRMSjKtA+jJHC96cCWc6wyhfVi7PSfly9xjPO1uiFYI0V5aQzvG?=
 =?us-ascii?Q?GDrupmnTNIOMOIrD5nPbrmYcrJUtSCaDricc/FaYfX4tEesp38bBaTfYofma?=
 =?us-ascii?Q?UYwhcArEk6zG3yF16kyRF1oEzoocpwTiE8fIoLtLKkRvRji1xIXojtxIzN60?=
 =?us-ascii?Q?9g3xQWdV9/5yQUZPT79fj4hb9Vvd766859Ovowj9DxAMlfdUbC9OT2EbNt8L?=
 =?us-ascii?Q?6c7rJkb39Jpjn+SGOz8O+s0hpj2JCsIBL5P/pkBGueEjcCQsEEptOztliyYA?=
 =?us-ascii?Q?Ls4DOlYIiPC5rGZVmDspcnML0VDdyYKAC8DEg1oO9mMtnsWOwaXsMvUwylpi?=
 =?us-ascii?Q?nWBdl3iXjHFQZvFDHKySKrYN2orC6t9r42XeDZQ7cMbpZP6rrLmdDYulhNcE?=
 =?us-ascii?Q?1g=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?JTQe/YCihmhldaTZQlUOi7TE65f4h4LD+mnpW6ropFMptlBMfaU08+UzDo+Y?=
 =?us-ascii?Q?Yw3jqLjvxHVJl26xeolv6CZ34o1kTADUIx67nwT6E+NTMNMgxxDC00IiBfZM?=
 =?us-ascii?Q?R+0KWOCfpHYxMedoVIWkJIEZtlYUf8QMQe3VyMIzNE4M+yzmwkfqf1FT/3+p?=
 =?us-ascii?Q?awTcmoKrYap1SI4PM7sq3M7YmS1g7OhiVcwIRIcMLWORWE6UGB5HX1CeIBFI?=
 =?us-ascii?Q?aN/eltgvcWDnEY7JyN1Atq90/867eWlaZrYuKuFwVRNHAU+X1c0pDzyLIjHO?=
 =?us-ascii?Q?xEPj76fkCkuJUlls4BvlmEyDRRCffcIipHON53eqalnkW6438bOkmA7YBkvq?=
 =?us-ascii?Q?QnCRZTGVovPzURX8I9orBYx0DdnA4A4Z+LriD6M98GrMk50epjAcfj3bePXy?=
 =?us-ascii?Q?MLNBxS4fg646BmAwVYyLaRYBf5MpmMD2zf5AOgsN4vCuih+xf46Y9gW1KQQ3?=
 =?us-ascii?Q?JkGV7rN+PeOp5j8sygOhBcTnkgZ0qMZJZA7evtHW43fEqOW3ux2wY9FEt4hi?=
 =?us-ascii?Q?CiQX94znirGl6k9xJM4VSMcUdgYDRToPEkwXf5LdGboBJLQbgX1DFS8eLZhP?=
 =?us-ascii?Q?w/lhHzaPYpkbseTu6Wrx9kgEmOTGun6yuzIh+Z/AN9gWzHw3mUPqR55gAkRa?=
 =?us-ascii?Q?pbfXtN2PP4Ytfxe8Gp3ZriCAtlVoS651Zj0CMFN3kG5yKmIUxzBY+IFCxFYj?=
 =?us-ascii?Q?42VOmHCwNkPSRAeTGNjTcRz3vS7fvciz2kyC27b7tLApND9Y1/Ly6km2mNxO?=
 =?us-ascii?Q?+RpPmIcL0NcgOd7uGDfxXc+JD66ioFONYdY74ULLU8KYQEB+M24HLr7Vkul6?=
 =?us-ascii?Q?AxGFtH/RwatTwVEH4iKOxQ9ttYMTnBaMt3Mu9Vbxcva+Lk9QDxNpIBe/X+8b?=
 =?us-ascii?Q?W2liYSRxo3iqMjvpnqMPWbYFR8BG5jFjk4fR495gjVHki87XLVJULhEA/TxT?=
 =?us-ascii?Q?1vx/PrwXCPz0iJNwpkQGwhE4MKzlI1CdPVx1SHemU5yHXEupTlNnKnotM7aF?=
 =?us-ascii?Q?Cr3VMFuzWuPtSDJR8ZKlLWwL+4XRAruxJGYA3+7e1IawyGGCB72kuYdOL3z0?=
 =?us-ascii?Q?bWyxLzJehUQMpNgQVCbM1I2drR3tnH1taOhtrJ3u4bGdkX3Xv8A=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 408b0762-59ce-4dd6-8c8f-08daff9f405c
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2023 13:14:27.1973
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Nkcr/4scvh/rZmAnkbqaahs+8PXQUrX5WDVNMY3w+jGweuLfD3Zh41NgBsCJNeYsqZqAFqNy+slIo06KvqoG2g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB7249
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.122.1
 definitions=2023-01-26_05,2023-01-25_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxlogscore=790
 malwarescore=0 mlxscore=0 bulkscore=0 adultscore=0 phishscore=0
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2212070000 definitions=main-2301260128
X-Proofpoint-GUID: s9wbDEGO1dFoewpa4ayczzk2WZfp4e5F
X-Proofpoint-ORIG-GUID: s9wbDEGO1dFoewpa4ayczzk2WZfp4e5F
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

syz fix: fs/userfaultfd: Fix maple tree iterator in userfaultfd_unregister() 

* syzbot <syzbot+7170d66493145b71afd4@syzkaller.appspotmail.com> [230125 17:04]:
> syzbot suspects this issue was fixed by commit:
> 
> commit 59f2f4b8a757412fce372f6d0767bdb55da127a8
> Author: Liam Howlett <liam.howlett@oracle.com>
> Date:   Mon Nov 7 20:11:42 2022 +0000
> 
>     fs/userfaultfd: Fix maple tree iterator in userfaultfd_unregister()
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=129e8afe480000
> start commit:   b229b6ca5abb Merge tag 'perf-tools-fixes-for-v6.1-2022-10-..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a66c6c673fb555e8
> dashboard link: https://syzkaller.appspot.com/bug?extid=7170d66493145b71afd4
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11bfb2a9880000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10b1d319880000
> 
> If the result looks correct, please mark the issue as fixed by replying with:
> 
> #syz fix: fs/userfaultfd: Fix maple tree iterator in userfaultfd_unregister()
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection