KASAN: null-ptr-deref Read in drop_buffers

Status: upstream: reported on 2026/06/03 12:36
Reported-by: syzbot+838f9bf5573c02c8592a@syzkaller.appspotmail.com
First crash: 73d, last: 73d
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Read in drop_buffers (5) prio:high fs 11 14 62d 278d 0/29 upstream: reported on 2025/11/10 12:38
upstream KASAN: null-ptr-deref Read in drop_buffers (2) jfs 11 syz, C error 252 899d 1110d 0/29 auto-obsoleted due to no activity on 2024/05/08 22:28
upstream KASAN: null-ptr-deref Read in drop_buffers kernfs 11 5 1385d 1385d 0/29 auto-obsoleted due to no activity on 2023/02/27 02:04
upstream KASAN: null-ptr-deref Read in drop_buffers (4) fs 17 228 354d 362d 0/29 auto-obsoleted due to no activity on 2025/10/15 13:15
upstream KASAN: null-ptr-deref Read in drop_buffers (3) fs 17 syz, C 98 517d 682d 0/29 auto-obsoleted due to no activity on 2025/06/08 23:43
linux-6.1 KASAN: slab-out-of-bounds Read in drop_buffers 17 1 561d 561d 0/3 auto-obsoleted due to no activity on 2025/05/11 23:03
linux-6.1 KASAN: slab-out-of-bounds Read in drop_buffers (2) origin:lts-only 17 syz, C inconclusive 18 129d 330d 3/3 fixed on 2026/04/11 13:11

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:72 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2784 [inline]
BUG: KASAN: null-ptr-deref in drop_buffers+0x65/0x6a0 fs/buffer.c:2796
Read of size 4 at addr 0000000000000060 by task kswapd0/83

CPU: 0 PID: 83 Comm: kswapd0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x235/0x290 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:72 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
 buffer_busy fs/buffer.c:2784 [inline]
 drop_buffers+0x65/0x6a0 fs/buffer.c:2796
 try_to_free_buffers+0x230/0x560 fs/buffer.c:2830
 shrink_folio_list+0x2127/0x7aa0 mm/vmscan.c:2003
 evict_folios+0xa80/0x22a0 mm/vmscan.c:5046
 lru_gen_shrink_lruvec mm/vmscan.c:5229 [inline]
 shrink_lruvec+0xc90/0x3d50 mm/vmscan.c:5924
 shrink_node_memcgs mm/vmscan.c:6145 [inline]
 shrink_node+0x680/0x28d0 mm/vmscan.c:6176
 kswapd_shrink_node mm/vmscan.c:6968 [inline]
 balance_pgdat mm/vmscan.c:7158 [inline]
 kswapd+0x1c3e/0x3360 mm/vmscan.c:7418
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
==================================================================
Kernel panic - not syncing: KASAN: panic_on_warn set ...
CPU: 0 PID: 83 Comm: kswapd0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 panic+0x2e5/0x730 kernel/panic.c:339
 check_panic_on_warn+0x80/0xa0 kernel/panic.c:235
 end_report+0x66/0x110 mm/kasan/report.c:200
 kasan_report+0x118/0x140 mm/kasan/report.c:526
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x235/0x290 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:72 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
 buffer_busy fs/buffer.c:2784 [inline]
 drop_buffers+0x65/0x6a0 fs/buffer.c:2796
 try_to_free_buffers+0x230/0x560 fs/buffer.c:2830
 shrink_folio_list+0x2127/0x7aa0 mm/vmscan.c:2003
 evict_folios+0xa80/0x22a0 mm/vmscan.c:5046
 lru_gen_shrink_lruvec mm/vmscan.c:5229 [inline]
 shrink_lruvec+0xc90/0x3d50 mm/vmscan.c:5924
 shrink_node_memcgs mm/vmscan.c:6145 [inline]
 shrink_node+0x680/0x28d0 mm/vmscan.c:6176
 kswapd_shrink_node mm/vmscan.c:6968 [inline]
 balance_pgdat mm/vmscan.c:7158 [inline]
 kswapd+0x1c3e/0x3360 mm/vmscan.c:7418
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Kernel Offset: disabled

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/03 12:35 linux-6.1.y 228da13e907e 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: null-ptr-deref Read in drop_buffers
* Struck through repros no longer work on HEAD.