KASAN: slab-out-of-bounds Read in reiserfs_xattr

Kernel	Title	Rank 🛈	Count	Last	Reported	Patched	Status
linux-6.1	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get	17	1	410d	410d	0/3	auto-obsoleted due to no activity on 2025/03/30 06:16
linux-6.6	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get	17	2	104d	131d	0/2	auto-obsoleted due to no activity on 2026/01/30 03:22
linux-5.15	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get	17	3	293d	366d	0/3	auto-obsoleted due to no activity on 2025/07/24 22:48
upstream	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get (2) fs	17	1	736d	732d	0/29	auto-obsoleted due to no activity on 2024/05/07 19:35
upstream	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get fs	19	106	870d	1757d	0/29	auto-obsoleted due to no activity on 2023/12/25 15:39

loop4: detected capacity change from 0 to 128
==================================================================
BUG: KASAN: slab-out-of-bounds in reiserfs_xattr_get+0xfa/0x5a0 fs/reiserfs/xattr.c:674
Read of size 8 at addr ffff888056797598 by task syz.4.8083/22873

CPU: 0 PID: 22873 Comm: syz.4.8083 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 reiserfs_xattr_get+0xfa/0x5a0 fs/reiserfs/xattr.c:674
 reiserfs_get_acl+0x7a/0x680 fs/reiserfs/xattr_acl.c:214
 get_acl+0x154/0x250 fs/posix_acl.c:153
 check_acl+0x3a/0x150 fs/namei.c:309
 acl_permission_check fs/namei.c:354 [inline]
 generic_permission+0x3bf/0x510 fs/namei.c:407
 do_inode_permission fs/namei.c:461 [inline]
 inode_permission+0x239/0x480 fs/namei.c:528
 may_open+0x262/0x400 fs/namei.c:3262
 do_open fs/namei.c:3632 [inline]
 path_openat+0x24d0/0x2ee0 fs/namei.c:3791
 do_filp_open+0x1f1/0x430 fs/namei.c:3818
 do_sys_openat2+0x150/0x4b0 fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1347
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9a9435b58e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f9a9522cda8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f9a9522d6c0 RCX: 00007f9a9435b58e
RDX: 0000000000010000 RSI: 00002000000001c0 RDI: ffffffffffffff9c
RBP: 0000200000000200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007f9a9522cea0 R14: 0000000000009e9b R15: 0000200000000100
 </TASK>

Allocated by task 9:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 batadv_forw_packet_alloc+0x1e5/0x380 net/batman-adv/send.c:519
 batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:562 [inline]
 batadv_iv_ogm_queue_add+0x77b/0xcf0 net/batman-adv/bat_iv_ogm.c:670
 batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:833 [inline]
 batadv_iv_ogm_schedule+0x81c/0xf10 net/batman-adv/bat_iv_ogm.c:868
 batadv_iv_send_outstanding_bat_ogm_packet+0x72f/0x840 net/batman-adv/bat_iv_ogm.c:1712
 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
 call_rcu+0x14f/0x990 kernel/rcu/tree.c:2849
 sctp_destroy_sock+0x1e8/0x330 net/sctp/socket.c:5107
 sk_common_release+0x6b/0x310 net/core/sock.c:3698
 sctp_close+0x7a3/0x910 net/sctp/socket.c:1549
 inet_release+0x139/0x180 net/ipv4/af_inet.c:430
 __sock_release net/socket.c:654 [inline]
 sock_close+0xd5/0x240 net/socket.c:1399
 __fput+0x22c/0x920 fs/file_table.c:320
 task_work_run+0x1d0/0x260 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Second to last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
 insert_work+0x54/0x3c0 kernel/workqueue.c:1361
 __queue_work+0xba3/0xfb0 kernel/workqueue.c:1520
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1747 [inline]
 __run_timers+0x569/0x800 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691

The buggy address belongs to the object at ffff888056797400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 408 bytes inside of
 512-byte region [ffff888056797400, ffff888056797600)

The buggy address belongs to the physical page:
page:ffffea000159e500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56794
head:ffffea000159e500 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017441c80
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4269, tgid 4269 (syz-executor), ts 83409714247, free_ts 83390310424
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x1a1e/0x1ab0 mm/page_alloc.c:4328
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5614
 alloc_slab_page+0x5d/0x160 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2c0 mm/slub.c:1997
 ___slab_alloc+0xbc6/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x1a0/0x260 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc+0xa0/0x240 mm/slab_common.c:949
 kmalloc include/linux/slab.h:568 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 fib6_info_alloc+0x2e/0xe0 net/ipv6/ip6_fib.c:156
 ip6_route_info_create+0x44f/0x1210 net/ipv6/route.c:3794
 addrconf_f6i_alloc+0x1ec/0x430 net/ipv6/route.c:4621
 ipv6_add_addr+0x461/0xfc0 net/ipv6/addrconf.c:1121
 inet6_addr_add+0x43b/0x9b0 net/ipv6/addrconf.c:3013
 inet6_rtm_newaddr+0x673/0x900 net/ipv6/addrconf.c:4973
 rtnetlink_rcv_msg+0x87c/0xfc0 net/core/rtnetlink.c:6150
 netlink_rcv_skb+0x1fb/0x450 net/netlink/af_netlink.c:2511
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3479
 __stack_depot_save+0x435/0x460 lib/stackdepot.c:506
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_set_track+0x60/0x70 mm/kasan/common.c:53
 __kasan_slab_alloc+0x6b/0x80 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x4b/0x480 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x123/0x2f0 mm/slub.c:3383
 kmem_cache_zalloc include/linux/slab.h:689 [inline]
 lsm_inode_alloc security/security.c:596 [inline]
 security_inode_alloc+0x30/0x110 security/security.c:1040
 inode_init_always+0x8f8/0xc90 fs/inode.c:232
 alloc_inode fs/inode.c:268 [inline]
 new_inode_pseudo+0x91/0x1c0 fs/inode.c:1063
 new_inode+0x25/0x1c0 fs/inode.c:1091
 debugfs_get_inode fs/debugfs/inode.c:72 [inline]
 __debugfs_create_file+0x148/0x510 fs/debugfs/inode.c:432
 debugfs_hw_add+0xed/0x3a0 net/mac80211/debugfs.c:653
 ieee80211_register_hw+0x2d20/0x39f0 net/mac80211/main.c:1396
 mac80211_hwsim_new_radio+0x28c2/0x4c40 drivers/net/wireless/mac80211_hwsim.c:4587
 hwsim_new_radio_nl+0xafa/0xce0 drivers/net/wireless/mac80211_hwsim.c:5181

Memory state around the buggy address:
 ffff888056797480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888056797500: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888056797580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                            ^
 ffff888056797600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888056797680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Assets (help?)	Manager	Title
2026/01/21 16:46	linux-6.1.y	cd9b81672742	8fc37797	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-6-1-kasan	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get
2025/10/17 21:57	linux-6.1.y	c2fda4b3f577	1c8c8cd8	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-6-1-kasan	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get
2025/09/26 18:56	linux-6.1.y	7b34dc04e4ff	001c9061	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-6-1-kasan	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get
2025/08/15 02:35	linux-6.1.y	3594f306da12	1804e95e	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-linux-6-1-kasan	KASAN: slab-out-of-bounds Read in reiserfs_xattr_get