syzbot

 sign-in | mailing list | source | docs
🐞 Open [723]
🐞 Fixed [119]
🐞 Invalid [750]
⬇ Missing Backports [75]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: slab-out-of-bounds Read in dtSearch (2)

Status: upstream: reported C repro on 2024/12/09 07:03
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+988e368d0eba629196ed@syzkaller.appspotmail.com
First crash: 159d, last: 28d
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2024/12/09 upstream (ToT) 7cb1b4663150 C [report] KASAN: slab-out-of-bounds Read in dtSearch
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-out-of-bounds Read in dtSearch jfs C error done 33 502d 965d 25/28 fixed on 2024/02/13 12:02
linux-4.14 KASAN: slab-out-of-bounds Read in dtSearch jfs C 2 807d 966d 0/1 upstream: reported C repro on 2022/09/24 21:35
upstream KASAN: slab-use-after-free Read in dtSearch jfs C inconclusive 1351 2h15m 383d 0/28 upstream: reported C repro on 2024/04/29 00:37
linux-5.15 KASAN: slab-out-of-bounds Read in dtSearch origin:upstream C error 157 9h25m 384d 0/3 upstream: reported C repro on 2024/04/28 11:04
linux-6.1 KASAN: slab-out-of-bounds Read in dtSearch 5 264d 327d 0/3 auto-obsoleted due to no activity on 2024/12/03 23:18
linux-4.19 KASAN: slab-out-of-bounds Read in dtSearch C error 1 966d 966d 0/1 upstream: reported C repro on 2022/09/24 21:36

Sample crash report:
loop0: detected capacity change from 0 to 32768
==================================================================
BUG: KASAN: slab-out-of-bounds in dtCompare fs/jfs/jfs_dtree.c:3332 [inline]
BUG: KASAN: slab-out-of-bounds in dtSearch+0x131c/0x1f34 fs/jfs/jfs_dtree.c:649
Read of size 1 at addr ffff0000e22fc058 by task syz-executor413/4314

CPU: 1 PID: 4314 Comm: syz-executor413 Not tainted 6.1.131-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0x174/0x4c0 mm/kasan/report.c:427
 kasan_report+0xd4/0x130 mm/kasan/report.c:531
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 dtCompare fs/jfs/jfs_dtree.c:3332 [inline]
 dtSearch+0x131c/0x1f34 fs/jfs/jfs_dtree.c:649
 jfs_lookup+0x164/0x39c fs/jfs/namei.c:1459
 __lookup_slow+0x250/0x374 fs/namei.c:1690
 lookup_slow+0x60/0x84 fs/namei.c:1707
 walk_component fs/namei.c:1998 [inline]
 link_path_walk+0x830/0xcc8 fs/namei.c:2325
 path_lookupat+0x90/0x3d0 fs/namei.c:2478
 do_o_path+0xa8/0x214 fs/namei.c:3754
 path_openat+0x203c/0x2548 fs/namei.c:3776
 do_filp_open+0x1bc/0x3cc fs/namei.c:3810
 do_sys_openat2+0x128/0x3e0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1345
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4314:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x458 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc_lru+0x1ac/0x2f8 mm/slub.c:3429
 alloc_inode_sb include/linux/fs.h:3245 [inline]
 jfs_alloc_inode+0x2c/0x68 fs/jfs/super.c:105
 alloc_inode fs/inode.c:261 [inline]
 new_inode_pseudo+0x68/0x1d0 fs/inode.c:1063
 new_inode+0x38/0x174 fs/inode.c:1091
 ialloc+0x58/0x7cc fs/jfs/jfs_inode.c:48
 jfs_create+0x190/0xa1c fs/jfs/namei.c:92
 lookup_open fs/namei.c:3482 [inline]
 open_last_lookups fs/namei.c:3550 [inline]
 path_openat+0xeac/0x2548 fs/namei.c:3780
 do_filp_open+0x1bc/0x3cc fs/namei.c:3810
 do_sys_openat2+0x128/0x3e0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1345
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000e22fb780
 which belongs to the cache jfs_ip of size 2240
The buggy address is located 24 bytes to the right of
 2240-byte region [ffff0000e22fb780, ffff0000e22fc040)

The buggy address belongs to the physical page:
page:00000000e8b16421 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1222f8
head:00000000e8b16421 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c6f25e00
raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000e22fbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000e22fbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000e22fc000: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
                                                    ^
 ffff0000e22fc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000e22fc100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
ERROR: (device loop0): dtSearch: stack overrun!

ERROR: (device loop0): remounting filesystem as read-only
btstack dump:
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
jfs_lookup: dtSearch returned -5

Crashes (49):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/26 13:32 linux-6.1.y 344a09659766 89d30d73 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSearch
2024/12/09 09:16 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSearch
2024/12/09 08:28 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSearch
2024/12/09 07:38 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSearch
2025/03/25 18:39 linux-6.1.y 344a09659766 875573af .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/04/19 13:47 linux-6.1.y 420102835862 2a20f901 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSearch
2025/01/06 18:07 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSearch
2024/12/09 07:02 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSearch
2025/04/09 05:17 linux-6.1.y 3dfebb87d7eb a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/04/08 01:42 linux-6.1.y 3dfebb87d7eb a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/04/04 16:07 linux-6.1.y 8e60a714ba3b 1c4febdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/03/31 10:07 linux-6.1.y 8e60a714ba3b d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/03/31 10:07 linux-6.1.y 8e60a714ba3b d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/03/19 14:50 linux-6.1.y 344a09659766 8d0a2921 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/03/19 14:50 linux-6.1.y 344a09659766 8d0a2921 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/01/18 23:40 linux-6.1.y 60ceadf9247e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/01/18 23:38 linux-6.1.y 60ceadf9247e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/01/04 20:54 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/01/04 20:52 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/29 20:22 linux-6.1.y 563edd786f0a d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/29 20:22 linux-6.1.y 563edd786f0a d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/26 04:54 linux-6.1.y 29f02ec58a94 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/24 09:58 linux-6.1.y 29f02ec58a94 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/24 09:58 linux-6.1.y 29f02ec58a94 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/23 13:23 linux-6.1.y 29f02ec58a94 b4fbdbd4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/16 21:32 linux-6.1.y 52f863f820fd eec85da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2024/12/16 21:32 linux-6.1.y 52f863f820fd eec85da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in dtSearch
2025/04/02 20:20 linux-6.1.y 8e60a714ba3b c799dfdd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/04/02 14:46 linux-6.1.y 8e60a714ba3b c799dfdd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/04/01 13:49 linux-6.1.y 8e60a714ba3b 36d76a97 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/04/01 13:47 linux-6.1.y 8e60a714ba3b 36d76a97 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/31 06:08 linux-6.1.y 8e60a714ba3b d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/31 00:14 linux-6.1.y 8e60a714ba3b d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/27 07:49 linux-6.1.y 344a09659766 20510e88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/27 07:49 linux-6.1.y 344a09659766 20510e88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/25 17:40 linux-6.1.y 344a09659766 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/06 19:42 linux-6.1.y 3a8358583626 831e3629 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/03 05:10 linux-6.1.y 3a8358583626 c3901742 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/02 19:15 linux-6.1.y 3a8358583626 c3901742 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/03/01 14:57 linux-6.1.y 3a8358583626 67cf5345 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/02/26 09:04 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/02/23 07:54 linux-6.1.y 3a8358583626 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/02/16 12:55 linux-6.1.y 0cbb5f65e52f 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/02/16 04:04 linux-6.1.y 0cbb5f65e52f 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/01/23 05:13 linux-6.1.y f4f677285b38 a44b0418 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
2025/01/19 03:14 linux-6.1.y 60ceadf9247e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in dtSearch
* Struck through repros no longer work on HEAD.