KASAN: slab-out-of-bounds Read in poly1305_update_arch

Status: fixed on 2025/09/04 16:57
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+9375e47164f8e9588f17@syzkaller.appspotmail.com
Fix commit: d89a34b14df5 bcachefs: Move bset size check before csum check
First crash: 812d, last: 420d
Cause bisection: introduced by (bisect log) :
commit 03ef80b469d5d83530ce1ce15be78a40e5300f9b
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Sat Sep 23 22:41:51 2023 +0000

  bcachefs: Ignore unknown mount options

Crash: KASAN: slab-out-of-bounds Read in poly1305_update_arch (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit d89a34b14df5c205de698c23c3950b2b947cdb97
Author: Alan Huang <mmpgouride@gmail.com>
Date: Sat Jun 14 09:18:07 2025 +0000

  bcachefs: Move bset size check before csum check

  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [crypto?] KASAN: slab-out-of-bounds Read in poly1305_update_arch 1 (3) 2025/07/19 21:57
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2025/07/19 12:16 20m retest repro upstream OK log
2025/07/19 12:16 19m retest repro upstream OK log
2025/06/24 21:06 16m retest repro upstream report log
2025/05/28 00:43 18m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report log
2025/05/10 07:46 12m retest repro upstream report log
2025/05/10 07:46 13m retest repro upstream report log
2025/02/28 05:29 13m retest repro upstream report log
2025/02/28 05:29 14m retest repro upstream report log
2025/02/28 04:44 17m retest repro upstream report log
2024/12/09 05:52 15m retest repro upstream report log
▶ ▼ Fix bisection attempts (7)
Created Duration User Patch Repo Result
2025/07/01 11:16 5h50m bisect fix upstream OK (1) job log
2025/04/15 12:24 1h59m bisect fix upstream OK (0) job log log
2025/03/16 07:40 3h07m bisect fix upstream OK (0) job log log
2024/10/16 01:57 2h44m bisect fix upstream OK (0) job log log
2024/09/15 22:51 2h01m bisect fix upstream OK (0) job log log
2024/08/16 15:22 3h53m bisect fix upstream OK (0) job log log
2024/07/14 01:10 2h00m bisect fix upstream OK (0) job log log

Sample crash report:
  node offset 16/40 bset u64s 30: checksum error, type chacha20_poly1305_128: got 29c49b2fdd8d9048e17ac38271cc7e07 should be d4669159f868458f2b4c55fc2a69f1aa, fixing
==================================================================
BUG: KASAN: use-after-free in poly1305_update_arch+0x2a0/0x3f0 arch/arm64/crypto/poly1305-glue.c:165
Read of size 8 at addr ffff0000e225b070 by task syz-executor418/6487

CPU: 0 UID: 0 PID: 6487 Comm: syz-executor418 Not tainted 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x254 mm/kasan/report.c:408
 print_report+0x68/0x84 mm/kasan/report.c:521
 kasan_report+0xb0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 poly1305_update_arch+0x2a0/0x3f0 arch/arm64/crypto/poly1305-glue.c:165
 poly1305_update include/crypto/poly1305.h:83 [inline]
 bch2_checksum+0x1d4/0x4ac fs/bcachefs/checksum.c:157
 bch2_btree_node_read_done+0xd20/0x4328 fs/bcachefs/btree_io.c:1132
 btree_node_read_work+0x414/0xc64 fs/bcachefs/btree_io.c:1366
 bch2_btree_node_read+0x1c88/0x228c fs/bcachefs/btree_io.c:-1
 __bch2_btree_root_read fs/bcachefs/btree_io.c:1797 [inline]
 bch2_btree_root_read+0x274/0x3b0 fs/bcachefs/btree_io.c:1819
 read_btree_roots+0x220/0x6c0 fs/bcachefs/recovery.c:582
 bch2_fs_recovery+0x1a60/0x2d30 fs/bcachefs/recovery.c:929
 bch2_fs_start+0x5b0/0x908 fs/bcachefs/super.c:1091
 bch2_fs_get_tree+0xa0c/0xf30 fs/bcachefs/fs.c:2570
 vfs_get_tree+0x90/0x28c fs/super.c:1759
 do_new_mount+0x228/0x814 fs/namespace.c:3884
 path_mount+0x5b4/0xde0 fs/namespace.c:4211
 do_mount fs/namespace.c:4224 [inline]
 __do_sys_mount fs/namespace.c:4435 [inline]
 __se_sys_mount fs/namespace.c:4412 [inline]
 __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4412
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12225b
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 fffffdffc38896c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000e225af00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000e225af80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000e225b000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                             ^
 ffff0000e225b080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000e225b100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0
  u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
  node offset 24/40 bset u64s 61450: checksum error, type chacha20_poly1305_128: got cc4708a18a79d18b0e29d148f3f534b5 should be eca0b87f8a1bd5d855d98c80b1d5305e, fixing
bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0
  u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
  node offset 24/40 bset u64s 61450: bset past end of btree node (offset 24 len 968 but written 40), fixing
bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0
  u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
  node offset 24/40 bset u64s 0: empty bset, fixing
bcachefs (loop0): invalid bkey in btree_node btree=alloc level=0: u64s 11 type alloc_v4 0:22:0 len 0 ver 0: 
    gen 0 oldest_gen 0 data_type sb
    journal_seq_nonempty 1
    journal_seq_empty    0
    need_discard         1
    need_inc_gen         1
    dirty_sectors        256
    stripe_sectors       0
    cached_sectors       0
    stripe               0
    stripe_redundancy    0
    io_time[READ]        1
    io_time[WRITE]       1
    fragmentation     0
    bp_start          8
  
  bad val size (14 > 6), deleting
bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error
  btree=alloc level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree freespace level 0/0
  u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq b6c44d07df4e9bb7 written 48 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0
  node offset 8/48 bset u64s 35: checksum error, type chacha20_poly1305_128: got 9a0c7e4fba9774736fd5fe399afe0fd4 should be 696606121d98d113a1b1dc69c6e72339, fixing
bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error
  btree=freespace level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq b6c44d07df4e9bb7 written 48 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0
bcachefs (loop0): accounting_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): snapshots_read... done
bcachefs (loop0): check_allocations...
bcachefs (loop0): bucket 0:28 data type btree ptr gen 0 missing in alloc btree
  while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 93dda84068e88b3f written 16 min_key POS_MIN durability: 1 ptr: 0:28:0 gen 0, fixing
bcachefs (loop0): bucket 0:36 data type btree ptr gen 0 missing in alloc btree
  while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3b468546fb27822d written 24 min_key POS_MIN durability: 1 ptr: 0:36:0 gen 0, fixing
bcachefs (loop0): bucket 0:40 data type btree ptr gen 0 missing in alloc btree
  while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 82036bda63714c10 written 8 min_key POS_MIN durability: 1 ptr: 0:40:0 gen 0, fixing
bcachefs (loop0): bucket 0:22 gen 0 has wrong data_type: got free, should be sb, fixing
bcachefs (loop0): bucket 0:22 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
bcachefs (loop0): bucket 0:28 gen 0 has wrong data_type: got free, should be btree, fixing
bcachefs (loop0): bucket 0:28 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
bcachefs (loop0): bucket 0:36 gen 0 has wrong data_type: got free, should be btree, fixing
bcachefs (loop0): bucket 0:36 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
bcachefs (loop0): bucket 0:40 gen 0 has wrong data_type: got free, should be btree, fixing
bcachefs (loop0): bucket 0:40 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
 done
bcachefs (loop0): going read-write
bcachefs (loop0): journal_replay... done
bcachefs (loop0): check_extents_to_backpointers...
bcachefs (loop0): scanning for missing backpointers in 2/128 buckets
 done
bcachefs (loop0): check_snapshots...
bcachefs (loop0): snapshot points to missing/incorrect tree:
  u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent          0 children          0          0 subvol 1 tree 0, fixing
 done
bcachefs (loop0): check_subvols... done
bcachefs (loop0): check_inodes...
bcachefs (loop0): inode points to missing dirent
  inum: 4099:4294967295 
    mode=100755
    flags=(15300000)
    journal_seq=5
    hash_seed=ab878b4c5ab7c89e
    hash_type=siphash
    bi_size=1050
    bi_sectors=8
    bi_version=0
    bi_atime=1997793410
    bi_ctime=1997793410
    bi_mtime=1997793410
    bi_otime=1997793410
    bi_uid=0
    bi_gid=0
    bi_nlink=0
    bi_generation=0
    bi_dev=0
    bi_data_checksum=0
    bi_compression=0
    bi_project=0
    bi_background_compression=0
    bi_data_replicas=0
    bi_promote_target=0
    bi_foreground_target=0
    bi_background_target=0
    bi_erasure_code=0
    bi_fields_set=0
    bi_dir=4098
    bi_dir_offset=2566586984702133180
    bi_subvol=0
    bi_parent_subvol=0
    bi_nocow=0
    bi_depth=0
    bi_inodes_32bit=0
    bi_casefold=0, fixing
bcachefs (loop0): inode journal seq in future (currently at 21)
  inum: 1073741825:4294967295 
    mode=100755
    flags=(15300000)
    journal_seq=10300415144517173253
    hash_seed=259b6b0d0abf3ed4
    hash_type=siphash
    bi_size=9000
    bi_sectors=24
    bi_version=0
    bi_atime=2007793514
    bi_ctime=2007793514
    bi_mtime=2007793514
    bi_otime=2007793514
    bi_uid=0
    bi_gid=0
    bi_nlink=1
    bi_generation=0
    bi_dev=0
    bi_data_checksum=0
    bi_compression=0
    bi_project=0
    bi_background_compression=0
    bi_data_replicas=0
    bi_promote_target=0
    bi_foreground_target=0
    bi_background_target=0
    bi_erasure_code=0
    bi_fields_set=0
    bi_dir=4096
    bi_dir_offset=3784119180373593407
    bi_subvol=0
    bi_parent_subvol=0
    bi_nocow=0
    bi_depth=0
    bi_inodes_32bit=0
    bi_casefold=0, fixing
 done
bcachefs (loop0): check_dirents...
bcachefs (loop0): dirent points to missing inode:
  u64s 8 type dirent 4096:1859603997870691834:U32_MAX len 0 ver 0: lost+found -> 4097 type dir, fixing
bcachefs (loop0): key in missing snapshot dirents u64s 7 type dirent 4098:2566587684781802388:1895552767 len 0 ver 0: file0 -> 4099 type reg, deleting
bcachefs (loop0): dirent points to missing inode:
  u64s 7 type dirent 4098:4600437421902197670:U32_MAX len 0 ver 0: file1 -> 4100 type lnk, fixing
 done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean
bcachefs (loop0): check_extents_to_backpointers... done
bcachefs (loop0): check_snapshots... done
bcachefs (loop0): check_subvols... done
bcachefs (loop0): check_inodes... done
bcachefs (loop0): check_dirents...
bcachefs (loop0): key in missing snapshot dirents u64s 7 type dirent 4098:2566587684781802388:1895552767 len 0 ver 0: file0 -> 4099 type reg, deleting
bcachefs (loop0): directory 4096:4294967295 with wrong i_nlink: got 2, should be 1, fixing
 done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): Second fsck run was not clean
bcachefs (loop0): reading quotas
bcachefs (loop0): quotas done
bcachefs (loop0): done starting filesystem

Crashes (29):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/14 00:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c32f8dc5aaf9 7344edeb .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 KASAN: use-after-free Read in poly1305_update_arch
2024/06/10 02:26 upstream 771ed66105de 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in poly1305_update_arch
2024/05/05 01:01 upstream 7367539ad4b0 610f2a54 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: slab-out-of-bounds Read in poly1305_update_arch
2024/05/04 21:40 upstream 7367539ad4b0 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in poly1305_update_arch
2024/11/09 16:57 upstream da4373fbcf00 6b856513 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: use-after-free Read in poly1305_update_arch
2024/07/16 06:07 upstream 5e0497553643 e8709b21 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: use-after-free Read in poly1305_update_arch
2024/05/25 03:50 upstream 02c438bbfffe a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in poly1305_update_arch
2024/05/23 04:08 upstream b6394d6f7159 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-use-after-free Read in poly1305_update_arch
2024/05/04 22:19 upstream 7367539ad4b0 610f2a54 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root KASAN: use-after-free Read in poly1305_update_arch
2025/02/14 02:51 upstream ab68d7eb7b1a d9a046cf .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2025/02/03 09:36 upstream 69e858e0b8b2 568559e4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2025/01/30 11:12 upstream 805ba04cb7cc afe4eff5 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2025/01/22 23:53 upstream df60eac9efe8 25e17fd3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2025/01/18 01:15 upstream ad26fc09dabf f2cb035c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2025/01/11 18:53 upstream 77a903cd8e5a 6dbc6a9b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2025/01/04 22:26 upstream ab75170520d4 f3558dbf .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2025/01/03 09:46 upstream 0bc21e701a6f d3ccff63 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/12/26 09:23 upstream 9b2ffa6148b1 444551c4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/12/13 17:48 upstream f932fb9b4074 7d3b55db .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/11/25 03:00 upstream 9f16d5e6f220 68da6d95 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/11/24 01:23 upstream 228a1157fb9f 68da6d95 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/11/13 08:03 upstream 3022e9d00ebe 62026c85 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/11/09 22:14 upstream da4373fbcf00 6b856513 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/10/31 00:27 upstream 4236f913808c fb888278 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/10/26 03:10 upstream c71f8fb4dc91 65e8686b .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/10/26 02:56 upstream c71f8fb4dc91 65e8686b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: use-after-free Read in poly1305_update_arch
2024/05/09 05:39 linux-next e7b4ef8fffac 20bf80e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in poly1305_update_arch
2025/06/01 10:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in poly1305_update_arch
2025/05/14 00:04 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c32f8dc5aaf9 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: use-after-free Read in poly1305_update_arch
* Struck through repros no longer work on HEAD.