syzbot
WARNING in iomap_read_inline_data (2)
Status:
upstream: reported C repro on 2026/09/15 03:40
Subsystems:
iomap
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+079e16bc964fb91acb4a@syzkaller.appspotmail.com
First crash: 5d19h, last: now
▶
▼
Last patch testing requests (1)
Sample crash report:
------------[ cut here ]------------
size > iomap->length
WARNING: fs/iomap/buffered-io.c:431 at iomap_read_inline_data+0x901/0xc10 fs/iomap/buffered-io.c:431, CPU#1: syz-executor183/6038
Modules linked in:
CPU: 1 UID: 0 PID: 6038 Comm: syz-executor183 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:iomap_read_inline_data+0x901/0xc10 fs/iomap/buffered-io.c:431
Code: ff ff ff e8 31 37 51 ff 48 c7 c6 20 6b 0a 8c 48 89 ef e8 52 d9 a4 ff 90 0f 0b e8 4a 7a c4 ff e9 46 f7 ff ff e8 10 37 51 ff 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c
RSP: 0000:ffffc90003357538 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffc90003357790 RCX: 0000000000000000
RDX: ffff888029fa4b00 RSI: ffffffff82bae840 RDI: ffff888029fa4b00
RBP: ffffea0001030f80 R08: 0000000000000006 R09: 0000000000000005
R10: 0000000000000014 R11: 0000000000000000 R12: 0000000000000014
R13: ffffc900033577b8 R14: ffffc900033577e8 R15: ffffc900033577c0
FS: 00007f4d0baf66c0(0000) GS:ffff8880d5c59000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d0a2f1000 CR3: 0000000059e5c000 CR4: 0000000000352ef0
Call Trace:
<TASK>
iomap_read_folio_iter+0xc35/0xfd0 fs/iomap/buffered-io.c:571
iomap_read_folio+0x392/0x980 fs/iomap/buffered-io.c:676
ntfs_read_folio+0x298/0x4b0 fs/ntfs3/inode.c:856
filemap_read_folio+0xfc/0x3b0 mm/filemap.c:2520
filemap_fault+0x24b8/0x3130 mm/filemap.c:3689
__do_fault+0x10b/0x440 mm/memory.c:5565
do_read_fault mm/memory.c:6000 [inline]
do_fault+0xb3f/0x1830 mm/memory.c:6134
do_pte_missing mm/memory.c:4700 [inline]
handle_pte_fault mm/memory.c:6558 [inline]
__handle_mm_fault+0x150b/0x2f60 mm/memory.c:6707
handle_mm_fault+0x363/0xa20 mm/memory.c:6876
do_user_addr_fault+0x59c/0x12f0 arch/x86/mm/fault.c:1343
handle_page_fault arch/x86/mm/fault.c:1483 [inline]
exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1536
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7f4d0cb0af39
Code: 00 ba 04 00 00 00 be 00 10 00 00 48 89 df e8 7e 3e 02 00 8b 3d e0 4b 0c 00 b9 04 00 00 00 31 f6 ba 00 10 00 00 e8 87 34 02 00 <0f> b6 03 88 44 24 0f 8b 05 be 4b 0c 00 85 c0 74 c6 be 00 10 00 00
RSP: 002b:00007f4d0baf6200 EFLAGS: 00010207
RAX: 0000000000000000 RBX: 00007f4d0a2f1000 RCX: 00007f4d0cb2e3ca
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000021 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000002 R14: 00007ffe1da2f580 R15: 00007ffe1da2f668
</TASK>
* Struck through repros no longer work on HEAD.