KASAN: use-after-free Read in do_sync

Status: upstream: reported on 2025/11/09 04:56
Reported-by: syzbot+f99039e908a5ef9baaf2@syzkaller.appspotmail.com
First crash: 282d, last: 24d
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: use-after-free Read in do_sync origin:upstream 19 syz, C 108 18d 285d 0/3 upstream: reported C repro on 2025/11/05 15:12
upstream KASAN: slab-use-after-free Read in do_sync gfs2 19 2 408d 429d 0/29 auto-obsoleted due to no activity on 2025/10/04 08:28
linux-5.15 BUG: unable to handle kernel paging request in do_sync 8 3 448d 490d 0/3 auto-obsoleted due to no activity on 2025/09/03 20:25

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in __up_write kernel/locking/rwsem.c:1344 [inline]
BUG: KASAN: use-after-free in up_write+0x67/0x410 kernel/locking/rwsem.c:1604
Read of size 8 at addr ffff88805a303788 by task gfs2_quotad/6425

CPU: 1 PID: 6425 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 __up_write kernel/locking/rwsem.c:1344 [inline]
 up_write+0x67/0x410 kernel/locking/rwsem.c:1604
 inode_unlock include/linux/fs.h:792 [inline]
 do_sync+0x8ad/0xba0 fs/gfs2/quota.c:984
 gfs2_quota_sync+0x355/0x780 fs/gfs2/quota.c:1329
 quotad_check_timeo fs/gfs2/quota.c:1519 [inline]
 gfs2_quotad+0x40f/0x890 fs/gfs2/quota.c:1586
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 6414:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0x92/0xc0 mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238
 gfs2_alloc_inode+0x45/0x110 fs/gfs2/super.c:1451
 alloc_inode fs/inode.c:261 [inline]
 iget5_locked+0x9e/0x250 fs/inode.c:1263
 gfs2_iget fs/gfs2/inode.c:64 [inline]
 gfs2_inode_lookup+0x110/0xd20 fs/gfs2/inode.c:140
 gfs2_dir_search+0x165/0x220 fs/gfs2/dir.c:1666
 gfs2_lookupi+0x4a1/0x630 fs/gfs2/inode.c:332
 gfs2_lookup_simple+0xab/0x100 fs/gfs2/inode.c:273
 init_inodes+0x180/0x320 fs/gfs2/ops_fstype.c:906
 gfs2_fill_super+0x1671/0x1ea0 fs/gfs2/ops_fstype.c:1249
 get_tree_bdev+0x3e6/0x610 fs/super.c:1325
 gfs2_get_tree+0x4d/0x1e0 fs/gfs2/ops_fstype.c:1332
 vfs_get_tree+0x88/0x270 fs/super.c:1530
 do_new_mount+0x247/0xa40 fs/namespace.c:3034
 do_mount fs/namespace.c:3377 [inline]
 __do_sys_mount fs/namespace.c:3585 [inline]
 __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 6444:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1710 [inline]
 slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736
 slab_free mm/slub.c:3504 [inline]
 kmem_cache_free+0x8f/0x210 mm/slub.c:3520
 rcu_do_batch kernel/rcu/tree.c:2523 [inline]
 rcu_core+0x96e/0x1650 kernel/rcu/tree.c:2763
 handle_softirqs+0x336/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676

Last potentially related work creation:
 kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
 __call_rcu kernel/rcu/tree.c:3011 [inline]
 call_rcu+0x189/0x900 kernel/rcu/tree.c:3091
 destroy_inode fs/inode.c:316 [inline]
 evict+0x810/0x8b0 fs/inode.c:662
 gfs2_put_super+0x2fa/0x7c0 fs/gfs2/super.c:607
 generic_shutdown_super+0x130/0x300 fs/super.c:475
 kill_block_super+0x7c/0xe0 fs/super.c:1427
 deactivate_locked_super+0x93/0xf0 fs/super.c:335
 cleanup_mnt+0x426/0x4d0 fs/namespace.c:1148
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff88805a303640
 which belongs to the cache gfs2_inode of size 1608
The buggy address is located 328 bytes inside of
 1608-byte region [ffff88805a303640, ffff88805a303c88)
The buggy address belongs to the page:
page:ffffea000168c000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5a300
head:ffffea000168c000 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff888027b87a01
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88801e186b40
raw: 0000000000000000 0000000080120012 00000001ffffffff ffff888027b87a01
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 6414, ts 136395752607, free_ts 65784093483
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 alloc_slab_page mm/slub.c:1780 [inline]
 allocate_slab mm/slub.c:1917 [inline]
 new_slab+0xc0/0x4b0 mm/slub.c:1980
 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013
 __slab_alloc mm/slub.c:3100 [inline]
 slab_alloc_node mm/slub.c:3191 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc+0xf0/0x280 mm/slub.c:3238
 gfs2_alloc_inode+0x45/0x110 fs/gfs2/super.c:1451
 alloc_inode fs/inode.c:261 [inline]
 iget5_locked+0x9e/0x250 fs/inode.c:1263
 gfs2_iget fs/gfs2/inode.c:64 [inline]
 gfs2_inode_lookup+0x110/0xd20 fs/gfs2/inode.c:140
 gfs2_lookup_root fs/gfs2/ops_fstype.c:465 [inline]
 init_sb+0xa4a/0x1360 fs/gfs2/ops_fstype.c:532
 gfs2_fill_super+0x138b/0x1ea0 fs/gfs2/ops_fstype.c:1216
 get_tree_bdev+0x3e6/0x610 fs/super.c:1325
 gfs2_get_tree+0x4d/0x1e0 fs/gfs2/ops_fstype.c:1332
 vfs_get_tree+0x88/0x270 fs/super.c:1530
 do_new_mount+0x247/0xa40 fs/namespace.c:3034
 do_mount fs/namespace.c:3377 [inline]
 __do_sys_mount fs/namespace.c:3585 [inline]
 __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 __free_pages_ok+0x8b1/0x950 mm/page_alloc.c:1643
 free_nonslab_page+0xde/0x150 mm/slub.c:3540
 kmem_free fs/xfs/kmem.h:62 [inline]
 xlog_write_log_records+0x34e/0x3c0 fs/xfs/xfs_log_recover.c:1593
 xlog_clear_stale_blocks+0x242/0x420 fs/xfs/xfs_log_recover.c:1688
 xlog_find_tail+0x7c0/0xa50 fs/xfs/xfs_log_recover.c:1372
 xlog_recover+0x48/0x3e0 fs/xfs/xfs_log_recover.c:3396
 xfs_log_mount+0x375/0x690 fs/xfs/xfs_log.c:710
 xfs_mountfs+0xafc/0x1ae0 fs/xfs/xfs_mount.c:765
 xfs_fs_fill_super+0x119b/0x13e0 fs/xfs/xfs_super.c:1684
 get_tree_bdev+0x3e6/0x610 fs/super.c:1325
 vfs_get_tree+0x88/0x270 fs/super.c:1530
 do_new_mount+0x247/0xa40 fs/namespace.c:3034
 do_mount fs/namespace.c:3377 [inline]
 __do_sys_mount fs/namespace.c:3585 [inline]
 __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff88805a303680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88805a303700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88805a303780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88805a303800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88805a303880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (38):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/21 12:16 linux-5.15.y c86c4726e7f0 7c5de9c3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: use-after-free Read in do_sync
2026/05/21 23:34 linux-5.15.y 93741761e5e3 e195359d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: use-after-free Read in do_sync
2026/02/18 17:16 linux-5.15.y e45d5d41c134 77d4d919 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: use-after-free Read in do_sync
2026/01/18 05:07 linux-5.15.y 68efe5a6c16a 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: use-after-free Read in do_sync
2025/11/09 04:55 linux-5.15.y cc5ec8769306 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: use-after-free Read in do_sync
2026/07/24 16:28 linux-5.15.y 674f684f7c61 dd737a83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/07/19 16:19 linux-5.15.y c86c4726e7f0 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/07/01 19:24 linux-5.15.y eceeec79dbc6 27192279 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/06/21 14:53 linux-5.15.y eceeec79dbc6 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/06/20 22:30 linux-5.15.y eceeec79dbc6 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/06/09 05:36 linux-5.15.y dc027a595035 656e94c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/26 22:47 linux-5.15.y 241d66fa280c 2b01f00e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/25 17:37 linux-5.15.y 241d66fa280c c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/23 06:19 linux-5.15.y 93741761e5e3 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/15 13:08 linux-5.15.y de8dfb3f0278 9cd3beaa .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/15 03:15 linux-5.15.y de8dfb3f0278 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/15 02:35 linux-5.15.y de8dfb3f0278 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/14 17:21 linux-5.15.y de8dfb3f0278 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/05/02 06:10 linux-5.15.y ef251c45f1cd 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/04/24 09:53 linux-5.15.y b9d57c40a767 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/04/19 23:54 linux-5.15.y b9d57c40a767 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/04/17 16:54 linux-5.15.y 91d48252ad4b 24ecfc1e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/04/15 16:58 linux-5.15.y 91d48252ad4b c441f497 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/04/13 16:08 linux-5.15.y 91d48252ad4b 9530ccf9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/04/11 13:18 linux-5.15.y 91d48252ad4b 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/04/03 11:56 linux-5.15.y 91d48252ad4b 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/03/29 16:05 linux-5.15.y 91d48252ad4b b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/03/29 12:09 linux-5.15.y 91d48252ad4b b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/03/28 23:53 linux-5.15.y 91d48252ad4b b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/03/28 20:41 linux-5.15.y 91d48252ad4b b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/03/28 08:53 linux-5.15.y 91d48252ad4b 356bdfc9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/03/22 08:00 linux-5.15.y 91d48252ad4b 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/02/02 10:45 linux-5.15.y 9eec9a14ee10 018ebef2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/01/12 14:07 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/01/08 00:36 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2026/01/07 14:25 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2025/12/31 05:10 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
2025/11/25 19:11 linux-5.15.y cc5ec8769306 64219f15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in do_sync
* Struck through repros no longer work on HEAD.