syzbot

 sign-in | mailing list | source | docs
🐞 Open [899]
🐞 Fixed [143]
🐞 Invalid [1073]
⬇ Missing Backports [73]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in reiserfs_release_objectid (2)

Status: upstream: reported C repro on 2025/01/08 08:59
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+8b37105f98b0cda6bbcd@syzkaller.appspotmail.com
First crash: 464d, last: 1d03h
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/01/08 linux-6.1.y (ToT) 7dc732d24ff7 C [report] KASAN: use-after-free Read in reiserfs_release_objectid
2025/01/08 upstream (ToT) eea6e4b4dfb8 C Didn't crash
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in reiserfs_release_objectid 19 C 1 1143d 1230d 0/1 upstream: reported C repro on 2022/12/04 21:28
linux-6.1 KASAN: use-after-free Read in reiserfs_release_objectid 19 1 1104d 1104d 0/3 auto-obsoleted due to no activity on 2023/08/07 07:31
upstream KASAN: use-after-free Read in reiserfs_release_objectid fs 19 C error done 6 834d 1235d 0/29 auto-obsoleted due to no activity on 2024/05/25 08:15
linux-5.15 KASAN: use-after-free Read in reiserfs_release_objectid missing-backport origin:lts-only 19 C error 141 11d 632d 0/3 upstream: reported C repro on 2024/07/24 14:44
linux-4.19 KASAN: use-after-free Read in reiserfs_release_objectid reiserfs 19 C error 2 1160d 1236d 0/1 upstream: reported C repro on 2022/11/28 17:34
linux-6.6 KASAN: use-after-free Read in reiserfs_release_objectid origin:lts-only 19 C error 25 10d 138d 0/2 upstream: reported C repro on 2025/11/30 15:46
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2025/11/08 02:07 1h51m fix candidate upstream OK (0) job log
2025/03/23 11:07 17m fix candidate upstream error job log

Sample crash report:
REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 UNKNOWN] (nlink == 1) not found (pos 2)
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP
==================================================================
BUG: KASAN: use-after-free in reiserfs_release_objectid+0x430/0x614 fs/reiserfs/objectid.c:165
Read of size 8188 at addr ffff0000f3203050 by task syz-executor/4657

CPU: 0 PID: 4657 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memmove+0x48/0x90 mm/kasan/shadow.c:54
 reiserfs_release_objectid+0x430/0x614 fs/reiserfs/objectid.c:165
 remove_save_link+0x234/0x350 fs/reiserfs/super.c:542
 reiserfs_evict_inode+0x308/0x408 fs/reiserfs/inode.c:91
 evict+0x3e0/0x828 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x754/0x7e4 fs/inode.c:1860
 d_delete_notify include/linux/fsnotify.h:267 [inline]
 vfs_rmdir+0x32c/0x438 fs/namei.c:4212
 do_rmdir+0x244/0x524 fs/namei.c:4260
 __do_sys_unlinkat fs/namei.c:4440 [inline]
 __se_sys_unlinkat fs/namei.c:4434 [inline]
 __arm64_sys_unlinkat+0xcc/0xfc fs/namei.c:4434
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:00000000ede9aa13 refcount:2 mapcount:0 mapping:000000001621dfb8 index:0x10 pfn:0x133203
memcg:ffff0000c35d0000
aops:def_blk_aops ino:700002
flags: 0x5ffd60000022056(referenced|uptodate|lru|workingset|private|mappedtodisk|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffd60000022056 fffffc0003cc8088 fffffc0003cc8108 ffff0000c049e010
raw: 0000000000000010 ffff0000e1f25740 00000002ffffffff ffff0000c35d0000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f3204f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000f3204f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000f3205000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff0000f3205080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000f3205100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
REISERFS warning: green-16003 errcatch_is_left_mergeable: Invalid item type observed, run fsck ASAP

Crashes (443):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/16 19:47 linux-6.1.y 8e8fc038cad5 4743f87d .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/21 10:14 linux-6.1.y f2ddafa93a25 5b92003d .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/12/02 04:58 linux-6.1.y f6e38ae624cf d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/12/02 03:08 linux-6.1.y f6e38ae624cf d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/08/27 15:57 linux-6.1.y 0bc96de781b4 e12e5ba4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/08/27 14:36 linux-6.1.y 0bc96de781b4 e12e5ba4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/08/27 12:39 linux-6.1.y 0bc96de781b4 e12e5ba4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/08/27 11:19 linux-6.1.y 0bc96de781b4 e12e5ba4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/08/27 08:59 linux-6.1.y 0bc96de781b4 e12e5ba4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/08/27 07:17 linux-6.1.y 0bc96de781b4 e12e5ba4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/08/11 08:19 linux-6.1.y 3594f306da12 32a0e5ed .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/04/28 06:40 linux-6.1.y 535ec20c5027 c6b4fb39 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/01/08 14:11 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/01/08 12:52 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/01/08 11:45 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/01/08 10:11 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/01/13 15:39 linux-6.1.y bec0e10ee67e d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/07 04:03 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/17 02:22 linux-6.1.y 8e8fc038cad5 de0a551d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/16 01:49 linux-6.1.y 8e8fc038cad5 df15c5f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/16 01:47 linux-6.1.y 8e8fc038cad5 df15c5f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/15 13:49 linux-6.1.y 8e8fc038cad5 c441f497 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/15 01:58 linux-6.1.y 8e8fc038cad5 e2e976a8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/14 14:00 linux-6.1.y 8e8fc038cad5 362d1323 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/13 13:10 linux-6.1.y 8e8fc038cad5 9530ccf9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/12 03:42 linux-6.1.y 8e8fc038cad5 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/11 19:31 linux-6.1.y 8e8fc038cad5 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/11 06:26 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/11 04:45 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/09 03:57 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/09 03:55 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/08 15:31 linux-6.1.y 1989cd3d56e2 d9b7f621 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/08 01:41 linux-6.1.y 1989cd3d56e2 2c961e87 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/07 14:22 linux-6.1.y 1989cd3d56e2 628666c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/07 09:02 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/07 02:29 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/06 06:17 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/06 03:25 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/05 19:59 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/05 17:02 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/04 04:04 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/04 00:11 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/03 22:47 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/02 01:01 linux-6.1.y 1989cd3d56e2 0cb124d5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/01 00:38 linux-6.1.y 1989cd3d56e2 fb8b2c26 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/31 01:09 linux-6.1.y 1989cd3d56e2 d0af506e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/30 23:57 linux-6.1.y 1989cd3d56e2 d0af506e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/30 11:41 linux-6.1.y 1989cd3d56e2 dcaebc52 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/30 00:57 linux-6.1.y 1989cd3d56e2 b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/28 16:09 linux-6.1.y 1989cd3d56e2 b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/27 03:09 linux-6.1.y 1989cd3d56e2 766b6434 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/26 16:53 linux-6.1.y 1989cd3d56e2 766b6434 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/26 00:57 linux-6.1.y 1989cd3d56e2 c6143aac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/25 14:31 linux-6.1.y 1989cd3d56e2 8ee77f7d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/25 14:31 linux-6.1.y 1989cd3d56e2 8ee77f7d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/25 03:14 linux-6.1.y f2ddafa93a25 74e70d19 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/24 11:25 linux-6.1.y f2ddafa93a25 baf8bf12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/23 15:33 linux-6.1.y f2ddafa93a25 4933dba2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/23 02:49 linux-6.1.y f2ddafa93a25 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/03/22 16:04 linux-6.1.y f2ddafa93a25 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2025/01/08 08:58 linux-6.1.y 7dc732d24ff7 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in reiserfs_release_objectid
2026/04/08 02:49 linux-6.1.y 1989cd3d56e2 2c961e87 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in reiserfs_release_objectid
2026/04/06 10:58 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in reiserfs_release_objectid
2026/03/24 16:56 linux-6.1.y f2ddafa93a25 74e70d19 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: out-of-bounds Read in reiserfs_release_objectid
* Struck through repros no longer work on HEAD.