syzbot

 sign-in | mailing list | source | docs
🐞 Open [1388]
≡ Subsystems
🐞 Fixed [7014]
🐞 Invalid [18305]
⬇ Missing Backports [223]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

KASAN: slab-use-after-free Read in gfs2_ail_drain

Status: moderation: reported on 2026/02/02 06:10
Subsystems: gfs2
[Documentation on labels]
Reported-by: syzbot+a4753e5bf9d4267c966a@syzkaller.appspotmail.com
First crash: 54d, last: 20d
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
6a5040ad-39b4-4edb-bc3d-26483b55f98c repro ❓ KASAN: slab-use-after-free Read in gfs2_ail_drain 2026/03/07 13:07 2026/03/07 13:07 2026/03/07 13:17 31e9c887f7dc24e04b3ca70d0d54fc34141844b0
2b286aba-f6cd-4212-9056-8e39f04e3e00 moderation Actionable: ✅  Confident: ✅  ❓ KASAN: slab-use-after-free Read in gfs2_ail_drain 2026/02/06 07:04 2026/02/06 08:33 2026/02/06 08:48 9b618abc0cd923b36c7a5ebc58a21174112d8f70

Sample crash report:
gfs2: fsid=syz:syz.0: fatal: invalid metadata block - bh = 9386 (bad magic number), function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 496
==================================================================
BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x92/0x190 lib/list_debug.c:62
Read of size 8 at addr ffff88801265fb30 by task kworker/0:4/1238

CPU: 0 UID: 0 PID: 1238 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events gfs2_withdraw_func
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xba/0x230 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 __list_del_entry_valid_or_report+0x92/0x190 lib/list_debug.c:62
 __list_del_entry_valid include/linux/list.h:132 [inline]
 __list_del_entry include/linux/list.h:223 [inline]
 list_del_init include/linux/list.h:295 [inline]
 gfs2_remove_from_ail fs/gfs2/log.c:79 [inline]
 gfs2_ail_empty_tr fs/gfs2/log.c:287 [inline]
 gfs2_ail_drain+0x1b7/0xaf0 fs/gfs2/log.c:945
 do_withdraw+0x115/0x2f0 fs/gfs2/util.c:128
 gfs2_withdraw_func+0x2f3/0x430 fs/gfs2/util.c:-1
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5319:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4515 [inline]
 slab_alloc_node mm/slub.c:4844 [inline]
 kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4851
 gfs2_glock_get+0x27b/0xf40 fs/gfs2/glock.c:1098
 gfs2_inode_lookup+0x29f/0xc50 fs/gfs2/inode.c:149
 gfs2_dir_search+0x168/0x220 fs/gfs2/dir.c:1665
 gfs2_lookupi+0x45b/0x640 fs/gfs2/inode.c:354
 __gfs2_lookup+0xac/0x2a0 fs/gfs2/inode.c:990
 __lookup_slow+0x2b7/0x410 fs/namei.c:1916
 lookup_slow+0x53/0x70 fs/namei.c:1933
 walk_component fs/namei.c:2279 [inline]
 lookup_last fs/namei.c:2780 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2804
 filename_lookup+0x256/0x5d0 fs/namei.c:2833
 filename_linkat+0x11a/0x600 fs/namei.c:5794
 __do_sys_link fs/namei.c:5847 [inline]
 __se_sys_link+0x55/0x2c0 fs/namei.c:5843
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 4694:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2692 [inline]
 slab_free mm/slub.c:6143 [inline]
 kmem_cache_free+0x187/0x630 mm/slub.c:6273
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 do_softirq+0x76/0xd0 kernel/softirq.c:523
 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 crypto_acomp_unlock_stream_bh include/crypto/internal/acompress.h:201 [inline]
 scomp_acomp_comp_decomp+0x73a/0xa00 crypto/scompress.c:257
 crypto_acomp_decompress+0x4b3/0xbe0 crypto/acompress.c:301
 zswap_decompress+0x43c/0x890 mm/zswap.c:953
 zswap_load+0x2f1/0x4c0 mm/zswap.c:1615
 swap_read_folio+0x6a3/0x25d0 mm/page_io.c:637
 swap_cluster_readahead+0x38b/0x690 mm/swap_state.c:755
 swapin_readahead+0x196/0xc50 mm/swap_state.c:924
 do_swap_page+0x54f/0x58d0 mm/memory.c:4801
 handle_pte_fault mm/memory.c:6319 [inline]
 __handle_mm_fault mm/memory.c:6454 [inline]
 handle_mm_fault+0x12d2/0x3310 mm/memory.c:6623
 do_user_addr_fault+0xa73/0x1340 arch/x86/mm/fault.c:1334
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
 __call_rcu_common kernel/rcu/tree.c:3131 [inline]
 call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
 gfs2_glock_free+0x3c/0xa0 fs/gfs2/glock.c:152
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Second to last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
 insert_work+0x3d/0x330 kernel/workqueue.c:2199
 __queue_work+0xd03/0x1020 kernel/workqueue.c:2354
 queue_delayed_work_on+0x11a/0x1e0 kernel/workqueue.c:2574
 queue_delayed_work include/linux/workqueue.h:684 [inline]
 gfs2_glock_queue_work fs/gfs2/glock.c:224 [inline]
 do_xmote+0x515/0x760 fs/gfs2/glock.c:745
 glock_work_func+0x2a8/0x580 fs/gfs2/glock.c:1011
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88801265fa18
 which belongs to the cache gfs2_glock(aspace) of size 1224
The buggy address is located 280 bytes inside of
 freed 1224-byte region [ffff88801265fa18, ffff88801265fee0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1265c
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff8880312f3640 dead000000000122 0000000000000000
raw: 0000000000000000 00000008000c000c 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff8880312f3640 dead000000000122 0000000000000000
head: 0000000000000000 00000008000c000c 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea0000499701 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5319, tgid 5318 (syz.0.0), ts 96424553581, free_ts 96207760786
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
 alloc_slab_page mm/slub.c:3269 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3458
 new_slab mm/slub.c:3516 [inline]
 refill_objects+0x331/0x3c0 mm/slub.c:7153
 refill_sheaf mm/slub.c:2818 [inline]
 __pcs_replace_empty_main+0x2b9/0x620 mm/slub.c:4592
 alloc_from_pcs mm/slub.c:4695 [inline]
 slab_alloc_node mm/slub.c:4829 [inline]
 kmem_cache_alloc_noprof+0x37d/0x650 mm/slub.c:4851
 gfs2_glock_get+0x27b/0xf40 fs/gfs2/glock.c:1098
 gfs2_inode_lookup+0x29f/0xc50 fs/gfs2/inode.c:149
 gfs2_dir_search+0x168/0x220 fs/gfs2/dir.c:1665
 gfs2_lookupi+0x45b/0x640 fs/gfs2/inode.c:354
 __gfs2_lookup+0xac/0x2a0 fs/gfs2/inode.c:990
 __lookup_slow+0x2b7/0x410 fs/namei.c:1916
 lookup_slow+0x53/0x70 fs/namei.c:1933
 walk_component fs/namei.c:2279 [inline]
 lookup_last fs/namei.c:2780 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2804
 filename_lookup+0x256/0x5d0 fs/namei.c:2833
page last free pid 1238 tgid 1238 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
 __slab_free+0x263/0x2b0 mm/slub.c:5551
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4515 [inline]
 slab_alloc_node mm/slub.c:4844 [inline]
 __kmalloc_cache_noprof+0x2ba/0x660 mm/slub.c:5353
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 nsim_fib6_rt_create drivers/net/netdevsim/fib.c:547 [inline]
 nsim_fib6_rt_insert drivers/net/netdevsim/fib.c:752 [inline]
 nsim_fib6_event drivers/net/netdevsim/fib.c:856 [inline]
 nsim_fib_event+0xf3c/0xa410 drivers/net/netdevsim/fib.c:889
 nsim_fib_event_work+0x254/0x3d0 drivers/net/netdevsim/fib.c:1493
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff88801265fa00: fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801265fa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801265fb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff88801265fb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801265fc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/03 20:30 upstream af4e9ef3d784 4180d919 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in gfs2_ail_drain
2026/02/03 11:45 upstream 6bd9ed02871f 6df4c87a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in gfs2_ail_drain
2026/01/29 06:04 upstream 8dfce8991b95 0adc945e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Read in gfs2_ail_drain
* Struck through repros no longer work on HEAD.