syzbot

 sign-in | mailing list | source | docs
🐞 Open [895]
🐞 Fixed [141]
🐞 Invalid [1044]
⬇ Missing Backports [73]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: slab-out-of-bounds Write in diWrite

Status: upstream: reported C repro on 2025/02/08 22:36
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+9761806032c56262cd65@syzkaller.appspotmail.com
First crash: 408d, last: 1d05h
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/03/24 upstream (ToT) 586de92313fc C [report] KASAN: slab-use-after-free Write in diWrite
2026/03/09 upstream (ToT) 1f318b96cc84 C Failed due to an error; will retry later
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-out-of-bounds Write in diWrite jfs 22 C inconclusive 51 3d05h 697d 0/29 upstream: reported C repro on 2024/04/25 21:10
linux-4.19 KASAN: use-after-free Write in diWrite 22 syz error 2 1252d 1252d 0/1 upstream: reported syz repro on 2022/10/19 03:08
linux-5.15 KASAN: use-after-free Write in diWrite origin:upstream 22 C done 22 237d 549d 3/3 fixed on 2025/09/09 18:30
upstream UBSAN: array-index-out-of-bounds in diWrite jfs 15 C error done 13 830d 1250d 25/29 fixed on 2024/01/30 15:47
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2025/03/25 09:54 13m purvayeshi550@gmail.com patch linux-6.1.y report log
2025/03/25 08:06 13m purvayeshi550@gmail.com patch linux-6.1.y report log
2025/03/25 07:33 6m purvayeshi550@gmail.com patch linux-6.1.y error

Sample crash report:
loop0: detected capacity change from 0 to 32768
==================================================================
BUG: KASAN: slab-out-of-bounds in diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:753
Write of size 32 at addr ffff0000cb90a0c0 by task syz-executor209/4292

CPU: 1 PID: 4292 Comm: syz-executor209 Not tainted 6.1.128-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0x174/0x4c0 mm/kasan/report.c:427
 kasan_report+0xd4/0x130 mm/kasan/report.c:531
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189
 memcpy+0x60/0x90 mm/kasan/shadow.c:66
 diWrite+0xb48/0x15cc fs/jfs/jfs_imap.c:753
 txCommit+0x750/0x5574 fs/jfs/jfs_txnmgr.c:1255
 add_missing_indices+0x760/0xa8c fs/jfs/jfs_dtree.c:2663
 jfs_readdir+0x18ac/0x3030 fs/jfs/jfs_dtree.c:3019
 iterate_dir+0x1f4/0x4ec
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x1c4/0x4a0 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4291:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x458 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x230/0x37c mm/slub.c:3422
 vm_area_alloc+0x2c/0xe0 kernel/fork.c:459
 __mmap_region mm/mmap.c:2741 [inline]
 mmap_region+0x1118/0x2208 mm/mmap.c:2904
 do_mmap+0x9ac/0x110c mm/mmap.c:1424
 vm_mmap_pgoff+0x1a4/0x2b4 mm/util.c:520
 vm_mmap+0x90/0xbc mm/util.c:539
 elf_map+0xec/0x220 fs/binfmt_elf.c:390
 load_elf_binary+0xc98/0x1d98 fs/binfmt_elf.c:1167
 search_binary_handler fs/exec.c:1741 [inline]
 exec_binprm fs/exec.c:1782 [inline]
 bprm_execve+0x818/0x162c fs/exec.c:1851
 do_execveat_common+0x668/0x814 fs/exec.c:1956
 do_execve fs/exec.c:2030 [inline]
 __do_sys_execve fs/exec.c:2106 [inline]
 __se_sys_execve fs/exec.c:2101 [inline]
 __arm64_sys_execve+0x98/0xb0 fs/exec.c:2101
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Freed by task 4291:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
 ____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0x2f0/0x588 mm/slub.c:3683
 vm_area_free+0x58/0x12c kernel/fork.c:486
 remove_vma mm/mmap.c:143 [inline]
 exit_mmap+0x40c/0xa0c mm/mmap.c:3260
 __mmput+0xec/0x39c kernel/fork.c:1200
 mmput+0x70/0xac kernel/fork.c:1222
 exec_mmap+0x404/0x484 fs/exec.c:1040
 begin_new_exec+0x6c8/0xf04 fs/exec.c:1299
 load_elf_binary+0x748/0x1d98 fs/binfmt_elf.c:1002
 search_binary_handler fs/exec.c:1741 [inline]
 exec_binprm fs/exec.c:1782 [inline]
 bprm_execve+0x818/0x162c fs/exec.c:1851
 do_execveat_common+0x668/0x814 fs/exec.c:1956
 do_execve fs/exec.c:2030 [inline]
 __do_sys_execve fs/exec.c:2106 [inline]
 __se_sys_execve fs/exec.c:2101 [inline]
 __arm64_sys_execve+0x98/0xb0 fs/exec.c:2101
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000cb90a000
 which belongs to the cache vm_area_struct of size 152
The buggy address is located 40 bytes to the right of
 152-byte region [ffff0000cb90a000, ffff0000cb90a098)

The buggy address belongs to the physical page:
page:0000000010b2216d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b90a
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c0851680
raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000cb909f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000cb90a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000cb90a080: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
                                           ^
 ffff0000cb90a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
 ffff0000cb90a180: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb
==================================================================
ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0

ERROR: (device loop0): remounting filesystem as read-only

Crashes (39):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/08 23:55 linux-6.1.y 0cbb5f65e52f ef44b750 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Write in diWrite
2025/12/22 22:21 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/12/22 05:36 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/09/06 22:53 linux-6.1.y 28c695c365e1 d291dd2d .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/02/09 00:32 linux-6.1.y 0cbb5f65e52f ef44b750 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Write in diWrite
2025/02/08 23:13 linux-6.1.y 0cbb5f65e52f ef44b750 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Write in diWrite
2025/09/15 23:03 linux-6.1.y 3db754f56897 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Write in diWrite
2025/10/15 03:51 linux-6.1.y 882efbdd9d34 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Write in diWrite
2025/02/08 22:35 linux-6.1.y 0cbb5f65e52f ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Write in diWrite
2026/03/23 11:25 linux-6.1.y f2ddafa93a25 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2026/03/23 11:24 linux-6.1.y f2ddafa93a25 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2026/03/23 11:23 linux-6.1.y f2ddafa93a25 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/12/22 21:47 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/12/22 03:49 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/11/08 02:06 linux-6.1.y f6e38ae624cf 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/10/15 07:23 linux-6.1.y 882efbdd9d34 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/09/19 00:28 linux-6.1.y 3db754f56897 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Write in diWrite
2025/08/31 22:05 linux-6.1.y f89b6e15694c 807a3b61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/07/21 05:28 linux-6.1.y 3369c6df2fae 7117feec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in diWrite
2025/07/21 05:28 linux-6.1.y 3369c6df2fae 7117feec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in diWrite
2025/06/06 18:32 linux-6.1.y 58485ff1a74f 9fa58bba .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in diWrite
2026/03/01 10:14 linux-6.1.y 779f9571ac3e 43249bac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2026/03/01 10:12 linux-6.1.y 779f9571ac3e 43249bac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2026/01/26 18:36 linux-6.1.y cd9b81672742 a4c52dd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2026/01/26 18:34 linux-6.1.y cd9b81672742 a4c52dd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in diWrite
2026/01/17 16:41 linux-6.1.y bec0e10ee67e 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2026/01/17 16:39 linux-6.1.y bec0e10ee67e 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2026/01/17 12:21 linux-6.1.y bec0e10ee67e 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/11/07 23:57 linux-6.1.y f6e38ae624cf 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/11/07 23:57 linux-6.1.y f6e38ae624cf 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/11/02 22:49 linux-6.1.y f6e38ae624cf 2c50b6a9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/10/16 03:04 linux-6.1.y c2fda4b3f577 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/09/17 23:28 linux-6.1.y 3db754f56897 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/09/06 22:30 linux-6.1.y 28c695c365e1 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/08/31 20:43 linux-6.1.y f89b6e15694c 807a3b61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/08/31 20:42 linux-6.1.y f89b6e15694c 807a3b61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/06/23 16:57 linux-6.1.y 58485ff1a74f d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/06/01 18:50 linux-6.1.y da3c5173c55f 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
2025/05/25 03:40 linux-6.1.y da3c5173c55f ed351ea7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in diWrite
* Struck through repros no longer work on HEAD.