KASAN: slab-use-after-free Read in ntfs_iget5

Status: upstream: reported on 2025/08/19 13:23
Reported-by: syzbot+6d08037c33272de1e5a0@syzkaller.appspotmail.com
First crash: 437d, last: 15d
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-use-after-free Read in ntfs_iget5 actionable prio:high ntfs3 19 9 148d 213d 0/29 auto-obsoleted due to no activity on 2026/09/12 05:37
upstream KASAN: slab-out-of-bounds Read in ntfs_iget5 ntfs3 19 syz, C done done 3633 1017d 1652d 25/29 fixed on 2024/03/20 11:33
upstream BUG: unable to handle kernel paging request in ntfs_iget5 ntfs3 8 1 900d 896d 0/29 auto-obsoleted due to no activity on 2024/08/10 16:42
linux-6.1 KASAN: use-after-free Read in ntfs_iget5 19 7 1078d 1324d 0/3 auto-obsoleted due to no activity on 2024/02/25 08:58
linux-5.15 KASAN: use-after-free Read in ntfs_iget5 19 5 1145d 1286d 0/3 auto-obsoleted due to no activity on 2023/12/20 11:31
linux-5.15 KASAN: slab-out-of-bounds Read in ntfs_iget5 19 31 434d 696d 0/3 auto-obsoleted due to no activity on 2025/11/29 13:33
linux-5.15 KASAN: use-after-free Read in ntfs_iget5 (2) 19 5 842d 941d 0/3 auto-obsoleted due to no activity on 2024/10/18 06:28
linux-5.15 KASAN: use-after-free Read in ntfs_iget5 (3) origin:lts-only 19 syz done 23 23d 290d 0/3 upstream: reported syz repro on 2026/01/12 20:01
linux-6.1 KASAN: use-after-free Read in ntfs_iget5 (2) origin:upstream 19 syz, C error 58 19h24m 945d 0/3 upstream: reported C repro on 2024/03/29 09:18

Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in ntfs_iget5+0x332e/0x37f0 fs/ntfs3/inode.c:536
Read of size 2 at addr ffff88805dc1e84e by task syz.4.1493/10043

CPU: 0 PID: 10043 Comm: syz.4.1493 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 ntfs_iget5+0x332e/0x37f0 fs/ntfs3/inode.c:536
 ni_write_parents+0x26b/0x430 fs/ntfs3/frecord.c:3203
 ntfs_file_fsync+0x161/0x260 fs/ntfs3/file.c:1245
 generic_write_sync include/linux/fs.h:2669 [inline]
 ntfs_file_write_iter+0x5e2/0x700 fs/ntfs3/file.c:1131
 do_iter_readv_writev fs/read_write.c:-1 [inline]
 do_iter_write+0x747/0xc50 fs/read_write.c:860
 iter_file_splice_write+0x6b6/0xcf0 fs/splice.c:736
 do_splice_from fs/splice.c:933 [inline]
 direct_splice_actor+0xe8/0x130 fs/splice.c:1142
 splice_direct_to_actor+0x30b/0x8e0 fs/splice.c:1088
 do_splice_direct+0x1d5/0x2f0 fs/splice.c:1194
 do_sendfile+0x52b/0xe80 fs/read_write.c:1254
 __do_sys_sendfile64 fs/read_write.c:1322 [inline]
 __se_sys_sendfile64+0x145/0x1a0 fs/read_write.c:1308
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f6b7dd9e559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6b7ed20028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f6b7e026090 RCX: 00007f6b7dd9e559
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f6b7de358b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000fffe82 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6b7e026128 R14: 00007f6b7e026090 R15: 00007ffe18ace1d8
 </TASK>

Allocated by task 10036:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc+0xb7/0x240 mm/slab_common.c:1020
 kmalloc include/linux/slab.h:604 [inline]
 mi_init fs/ntfs3/record.c:105 [inline]
 mi_format_new+0xe9/0x600 fs/ntfs3/record.c:450
 ni_add_subrecord+0xd9/0x460 fs/ntfs3/frecord.c:376
 ntfs_look_free_mft+0x4e3/0xd90 fs/ntfs3/fsntfs.c:715
 ni_create_attr_list+0x9e9/0x1480 fs/ntfs3/frecord.c:895
 ni_ins_attr_ext+0x2e9/0xa30 fs/ntfs3/frecord.c:993
 ni_insert_attr fs/ntfs3/frecord.c:1160 [inline]
 ni_insert_resident fs/ntfs3/frecord.c:1544 [inline]
 ni_add_name+0x6e0/0xc90 fs/ntfs3/frecord.c:3091
 ntfs_link_inode+0x134/0x150 fs/ntfs3/inode.c:1779
 ntfs_link+0x118/0x2a0 fs/ntfs3/namei.c:156
 vfs_link+0x4c7/0x660 fs/namei.c:4652
 do_linkat+0x295/0x5a0 fs/namei.c:4723
 __do_sys_link fs/namei.c:4757 [inline]
 __se_sys_link fs/namei.c:4755 [inline]
 __x64_sys_link+0x86/0x90 fs/namei.c:4755
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 10036:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
 mi_clear fs/ntfs3/ntfs_fs.h:1118 [inline]
 mi_put+0x10f/0x180 fs/ntfs3/record.c:97
 ni_ins_attr_ext+0x7ff/0xa30 fs/ntfs3/frecord.c:1089
 ni_insert_attr fs/ntfs3/frecord.c:1160 [inline]
 ni_insert_resident fs/ntfs3/frecord.c:1544 [inline]
 ni_add_name+0x6e0/0xc90 fs/ntfs3/frecord.c:3091
 ni_rename+0x4b/0x100 fs/ntfs3/frecord.c:3130
 ntfs_rename+0x6a0/0xac0 fs/ntfs3/namei.c:332
 vfs_rename+0xb36/0xe60 fs/namei.c:4927
 do_renameat2+0x8b0/0xc80 fs/namei.c:5080
 __do_sys_rename fs/namei.c:5126 [inline]
 __se_sys_rename fs/namei.c:5124 [inline]
 __x64_sys_rename+0x86/0x90 fs/namei.c:5124
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
 kvfree_call_rcu+0xee/0x780 kernel/rcu/tree.c:3452
 batadv_hardif_release net/batman-adv/hard-interface.c:56 [inline]
 kref_put include/linux/kref.h:65 [inline]
 batadv_hardif_put net/batman-adv/hard-interface.h:96 [inline]
 batadv_hard_if_event+0x7e0/0x1570 net/batman-adv/hard-interface.c:1020
 notifier_call_chain+0x18f/0x380 kernel/notifier.c:93
 call_netdevice_notifiers_extack net/core/dev.c:2077 [inline]
 call_netdevice_notifiers net/core/dev.c:2091 [inline]
 unregister_netdevice_many_notify+0x1037/0x1910 net/core/dev.c:11180
 unregister_netdevice_many net/core/dev.c:11236 [inline]
 default_device_exit_batch+0x962/0xa00 net/core/dev.c:11802
 ops_exit_list net/core/net_namespace.c:178 [inline]
 cleanup_net+0x785/0xb00 net/core/net_namespace.c:656
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

The buggy address belongs to the object at ffff88805dc1e800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 78 bytes inside of
 freed 1024-byte region [ffff88805dc1e800, ffff88805dc1ec00)

The buggy address belongs to the physical page:
page:ffffea0001770600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5dc18
head:ffffea0001770600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888018841dc0 ffffea0001f2cc00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5773, tgid 5773 (syz-executor), ts 79900460398, free_ts 25830582258
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
 prep_new_page mm/page_alloc.c:1589 [inline]
 get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
 alloc_slab_page+0x5d/0x180 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2081
 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 __kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
 kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098
 kmalloc include/linux/slab.h:600 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 batadv_hardif_add_interface net/batman-adv/hard-interface.c:882 [inline]
 batadv_hard_if_event+0xdb1/0x1570 net/batman-adv/hard-interface.c:970
 notifier_call_chain+0x18f/0x380 kernel/notifier.c:93
 call_netdevice_notifiers_extack net/core/dev.c:2077 [inline]
 call_netdevice_notifiers net/core/dev.c:2091 [inline]
 register_netdevice+0x1670/0x1ba0 net/core/dev.c:10375
 veth_newlink+0x807/0xc70 drivers/net/veth.c:1916
 rtnl_newlink_create net/core/rtnetlink.c:3529 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3749 [inline]
 rtnl_newlink+0x15a0/0x2170 net/core/rtnetlink.c:3762
 rtnetlink_rcv_msg+0x843/0xf90 net/core/rtnetlink.c:6484
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1182 [inline]
 free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459
 free_contig_range+0xa1/0x150 mm/page_alloc.c:6421
 destroy_args+0x7d/0x840 mm/debug_vm_pgtable.c:1015
 debug_vm_pgtable+0x411/0x440 mm/debug_vm_pgtable.c:1400
 do_one_initcall+0x242/0x790 init/main.c:1210
 do_initcall_level+0x13d/0x1f0 init/main.c:1272
 do_initcalls+0x69/0xd0 init/main.c:1288
 kernel_init_freeable+0x3d9/0x560 init/main.c:1525
 kernel_init+0x1d/0x1c0 init/main.c:1415
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

Memory state around the buggy address:
 ffff88805dc1e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88805dc1e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805dc1e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88805dc1e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88805dc1e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/14 14:54 linux-6.6.y a91a6aa9253c 1a71827b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/07/11 04:53 linux-6.6.y da47cbc25466 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/06/01 20:36 linux-6.6.y 924b4a879cbb 1095583b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/05/04 20:00 linux-6.6.y 258cf62a6dfd a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/04/29 20:46 linux-6.6.y 142cd8382222 005438fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/04/28 20:35 linux-6.6.y 142cd8382222 95008c03 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/04/21 03:56 linux-6.6.y 9760bf04666d 3f2e655b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/04/17 14:49 linux-6.6.y 8cee53b8eaeb 24ecfc1e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/03/28 02:27 linux-6.6.y c09fbcd31ae6 356bdfc9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/03/20 15:16 linux-6.6.y 4fc00fe35d46 ac6f1dff .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/03/06 00:10 linux-6.6.y 4fc00fe35d46 31e9c887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/02/19 18:32 linux-6.6.y 7a137e9bfa0e c8d8c52d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/01/30 10:48 linux-6.6.y 2cf6f68313dc bfa73b7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/01/23 09:44 linux-6.6.y cbb31f77b879 e2b1b6e6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/01/19 22:15 linux-6.6.y cbb31f77b879 572effc1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2025/11/25 01:18 linux-6.6.y 1e89a1be4fe9 64219f15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2025/10/06 10:51 linux-6.6.y e617101e5626 91305dbe .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2025/10/01 23:43 linux-6.6.y 147338df3487 267f56c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2025/08/20 02:21 linux-6.6.y bb9c90ab9c5a 79512909 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2025/08/19 13:22 linux-6.6.y bb9c90ab9c5a 254a27c1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in ntfs_iget5
2026/03/24 13:01 linux-6.6.y 4fc00fe35d46 74e70d19 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-out-of-bounds Read in ntfs_iget5
2026/03/17 20:06 linux-6.6.y 4fc00fe35d46 c8810548 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-out-of-bounds Read in ntfs_iget5
2026/01/25 21:09 linux-6.6.y cbb31f77b879 55756628 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in ntfs_iget5
* Struck through repros no longer work on HEAD.