================================================================== BUG: KASAN: slab-out-of-bounds in scr_memcpyw include/linux/vt_buffer.h:49 [inline] BUG: KASAN: slab-out-of-bounds in fbcon_prepare_logo+0x5c8/0xda0 drivers/video/fbdev/core/fbcon.c:590 Read of size 256 at addr ffff88805333ff80 by task syz.4.467/6244 CPU: 0 PID: 6244 Comm: syz.4.467 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x235/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 scr_memcpyw include/linux/vt_buffer.h:49 [inline] fbcon_prepare_logo+0x5c8/0xda0 drivers/video/fbdev/core/fbcon.c:590 fbcon_init+0x12f1/0x2310 drivers/video/fbdev/core/fbcon.c:1121 visual_init+0x2dd/0x650 drivers/tty/vt/vt.c:1074 do_bind_con_driver+0x859/0x1030 drivers/tty/vt/vt.c:3695 vt_bind drivers/tty/vt/vt.c:3851 [inline] store_bind+0x794/0xa20 drivers/tty/vt/vt.c:3923 kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2173 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x748/0xd70 fs/read_write.c:594 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f1a10f70019 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f1a0f1c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f1a111f7fa0 RCX: 00007f1a10f70019 RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003 RBP: 00007f1a1100700c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1a111f8038 R14: 00007f1a111f7fa0 R15: 00007ffd7126d888 Allocated by task 4410: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x92/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238 kmem_cache_zalloc include/linux/slab.h:728 [inline] __alloc_file+0x25/0x240 fs/file_table.c:132 alloc_empty_file+0x90/0x180 fs/file_table.c:181 path_openat+0x11c/0x2fb0 fs/namei.c:3736 do_filp_open+0x1df/0x400 fs/namei.c:3777 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 0: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kmem_cache_free+0x8f/0x210 mm/slub.c:3520 rcu_do_batch kernel/rcu/tree.c:2523 [inline] rcu_core+0x96e/0x1650 kernel/rcu/tree.c:2763 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 Last potentially related work creation: kasan_save_stack+0x35/0x60 mm/kasan/common.c:38 kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348 __call_rcu kernel/rcu/tree.c:3011 [inline] call_rcu+0x189/0x900 kernel/rcu/tree.c:3091 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Second to last potentially related work creation: kasan_save_stack+0x35/0x60 mm/kasan/common.c:38 kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348 task_work_add+0x2f/0x1d0 kernel/task_work.c:38 fput_many+0xde/0x1a0 fs/file_table.c:367 filp_close+0x10e/0x150 fs/open.c:1371 __do_sys_close fs/open.c:1384 [inline] __se_sys_close fs/open.c:1382 [inline] __x64_sys_close+0x34/0x70 fs/open.c:1382 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88805333fb80 which belongs to the cache filp of size 464 The buggy address is located 560 bytes to the right of 464-byte region [ffff88805333fb80, ffff88805333fd50) The buggy address belongs to the page: page:ffffea00014ccf80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5333e head:ffffea00014ccf80 order:1 compound_mapcount:0 memcg:ffff888078397e81 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffffea00019a0e00 0000000700000007 ffff888016ddd8c0 raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888078397e81 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4410, ts 190272869949, free_ts 190056684003 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501 alloc_slab_page mm/slub.c:1780 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1980 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0xf0/0x280 mm/slub.c:3238 kmem_cache_zalloc include/linux/slab.h:728 [inline] __alloc_file+0x25/0x240 fs/file_table.c:132 alloc_empty_file+0x90/0x180 fs/file_table.c:181 path_openat+0x11c/0x2fb0 fs/namei.c:3736 do_filp_open+0x1df/0x400 fs/namei.c:3777 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317 free_unref_page_list+0x119/0x830 mm/page_alloc.c:3433 release_pages+0x185f/0x1bd0 mm/swap.c:963 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:241 [inline] tlb_flush_mmu mm/mmu_gather.c:248 [inline] tlb_finish_mmu+0x1b4/0x370 mm/mmu_gather.c:371 exit_mmap+0x3d0/0x640 mm/mmap.c:3218 __mmput+0x115/0x390 kernel/fork.c:1128 exit_mm+0x632/0x7b0 kernel/exit.c:557 do_exit+0x5b8/0x2110 kernel/exit.c:877 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004 get_signal+0x7eb/0x12e0 kernel/signal.c:2909 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:320 exc_page_fault+0x88/0x100 arch/x86/mm/fault.c:1499 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606 Memory state around the buggy address: ffff88805333fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88805333ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88805333ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888053340000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888053340080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================