[v5.15] KASAN: slab-out-of-bounds Read in fbcon_prepare_logo
0 views
Skip to first unread message
syzbot
Jul 31, 2026, 5:36:22 PMJul 31
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1738f5b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=af01eca8af586e44665c
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+af01ec...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in scr_memcpyw include/linux/vt_buffer.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in fbcon_prepare_logo+0x5c8/0xda0 drivers/video/fbdev/core/fbcon.c:590
Read of size 256 at addr ffff88805333ff80 by task syz.4.467/6244
CPU: 0 PID: 6244 Comm: syz.4.467 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
print_address_description+0x60/0x2d0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xdf/0x130 mm/kasan/report.c:451
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x235/0x290 mm/kasan/generic.c:189
memcpy+0x25/0x60 mm/kasan/shadow.c:65
scr_memcpyw include/linux/vt_buffer.h:49 [inline]
fbcon_prepare_logo+0x5c8/0xda0 drivers/video/fbdev/core/fbcon.c:590
fbcon_init+0x12f1/0x2310 drivers/video/fbdev/core/fbcon.c:1121
visual_init+0x2dd/0x650 drivers/tty/vt/vt.c:1074
do_bind_con_driver+0x859/0x1030 drivers/tty/vt/vt.c:3695
vt_bind drivers/tty/vt/vt.c:3851 [inline]
store_bind+0x794/0xa20 drivers/tty/vt/vt.c:3923
kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x748/0xd70 fs/read_write.c:594
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f1a10f70019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1a0f1c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1a111f7fa0 RCX: 00007f1a10f70019
RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003
RBP: 00007f1a1100700c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1a111f8038 R14: 00007f1a111f7fa0 R15: 00007ffd7126d888
</TASK>
Allocated by task 4410:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x92/0xc0 mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3225 [inline]
slab_alloc mm/slub.c:3233 [inline]
kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238
kmem_cache_zalloc include/linux/slab.h:728 [inline]
__alloc_file+0x25/0x240 fs/file_table.c:132
alloc_empty_file+0x90/0x180 fs/file_table.c:181
path_openat+0x11c/0x2fb0 fs/namei.c:3736
do_filp_open+0x1df/0x400 fs/namei.c:3777
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
Freed by task 0:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1710 [inline]
slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736
slab_free mm/slub.c:3504 [inline]
kmem_cache_free+0x8f/0x210 mm/slub.c:3520
rcu_do_batch kernel/rcu/tree.c:2523 [inline]
rcu_core+0x96e/0x1650 kernel/rcu/tree.c:2763
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
Last potentially related work creation:
kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
__call_rcu kernel/rcu/tree.c:3011 [inline]
call_rcu+0x189/0x900 kernel/rcu/tree.c:3091
task_work_run+0x125/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
Second to last potentially related work creation:
kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
task_work_add+0x2f/0x1d0 kernel/task_work.c:38
fput_many+0xde/0x1a0 fs/file_table.c:367
filp_close+0x10e/0x150 fs/open.c:1371
__do_sys_close fs/open.c:1384 [inline]
__se_sys_close fs/open.c:1382 [inline]
__x64_sys_close+0x34/0x70 fs/open.c:1382
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
The buggy address belongs to the object at ffff88805333fb80
which belongs to the cache filp of size 464
The buggy address is located 560 bytes to the right of
464-byte region [ffff88805333fb80, ffff88805333fd50)
The buggy address belongs to the page:
page:ffffea00014ccf80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5333e
head:ffffea00014ccf80 order:1 compound_mapcount:0
memcg:ffff888078397e81
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea00019a0e00 0000000700000007 ffff888016ddd8c0
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888078397e81
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4410, ts 190272869949, free_ts 190056684003
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
__alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
alloc_slab_page mm/slub.c:1780 [inline]
allocate_slab mm/slub.c:1917 [inline]
new_slab+0xc0/0x4b0 mm/slub.c:1980
___slab_alloc+0x807/0xdd0 mm/slub.c:3013
__slab_alloc mm/slub.c:3100 [inline]
slab_alloc_node mm/slub.c:3191 [inline]
slab_alloc mm/slub.c:3233 [inline]
kmem_cache_alloc+0xf0/0x280 mm/slub.c:3238
kmem_cache_zalloc include/linux/slab.h:728 [inline]
__alloc_file+0x25/0x240 fs/file_table.c:132
alloc_empty_file+0x90/0x180 fs/file_table.c:181
path_openat+0x11c/0x2fb0 fs/namei.c:3736
do_filp_open+0x1df/0x400 fs/namei.c:3777
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
free_unref_page_list+0x119/0x830 mm/page_alloc.c:3433
release_pages+0x185f/0x1bd0 mm/swap.c:963
tlb_batch_pages_flush mm/mmu_gather.c:50 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:241 [inline]
tlb_flush_mmu mm/mmu_gather.c:248 [inline]
tlb_finish_mmu+0x1b4/0x370 mm/mmu_gather.c:371
exit_mmap+0x3d0/0x640 mm/mmap.c:3218
__mmput+0x115/0x390 kernel/fork.c:1128
exit_mm+0x632/0x7b0 kernel/exit.c:557
do_exit+0x5b8/0x2110 kernel/exit.c:877
do_group_exit+0x12c/0x2f0 kernel/exit.c:1004
get_signal+0x7eb/0x12e0 kernel/signal.c:2909
arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:320
exc_page_fault+0x88/0x100 arch/x86/mm/fault.c:1499
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606
Memory state around the buggy address:
ffff88805333fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805333ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805333ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888053340000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888053340080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1738f5b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=af01eca8af586e44665c
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+af01ec...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in scr_memcpyw include/linux/vt_buffer.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in fbcon_prepare_logo+0x5c8/0xda0 drivers/video/fbdev/core/fbcon.c:590
Read of size 256 at addr ffff88805333ff80 by task syz.4.467/6244
CPU: 0 PID: 6244 Comm: syz.4.467 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
print_address_description+0x60/0x2d0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xdf/0x130 mm/kasan/report.c:451
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x235/0x290 mm/kasan/generic.c:189
memcpy+0x25/0x60 mm/kasan/shadow.c:65
scr_memcpyw include/linux/vt_buffer.h:49 [inline]
fbcon_prepare_logo+0x5c8/0xda0 drivers/video/fbdev/core/fbcon.c:590
fbcon_init+0x12f1/0x2310 drivers/video/fbdev/core/fbcon.c:1121
visual_init+0x2dd/0x650 drivers/tty/vt/vt.c:1074
do_bind_con_driver+0x859/0x1030 drivers/tty/vt/vt.c:3695
vt_bind drivers/tty/vt/vt.c:3851 [inline]
store_bind+0x794/0xa20 drivers/tty/vt/vt.c:3923
kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x748/0xd70 fs/read_write.c:594
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f1a10f70019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1a0f1c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1a111f7fa0 RCX: 00007f1a10f70019
RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003
RBP: 00007f1a1100700c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1a111f8038 R14: 00007f1a111f7fa0 R15: 00007ffd7126d888
</TASK>
Allocated by task 4410:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x92/0xc0 mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3225 [inline]
slab_alloc mm/slub.c:3233 [inline]
kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238
kmem_cache_zalloc include/linux/slab.h:728 [inline]
__alloc_file+0x25/0x240 fs/file_table.c:132
alloc_empty_file+0x90/0x180 fs/file_table.c:181
path_openat+0x11c/0x2fb0 fs/namei.c:3736
do_filp_open+0x1df/0x400 fs/namei.c:3777
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
Freed by task 0:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1710 [inline]
slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736
slab_free mm/slub.c:3504 [inline]
kmem_cache_free+0x8f/0x210 mm/slub.c:3520
rcu_do_batch kernel/rcu/tree.c:2523 [inline]
rcu_core+0x96e/0x1650 kernel/rcu/tree.c:2763
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
Last potentially related work creation:
kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
__call_rcu kernel/rcu/tree.c:3011 [inline]
call_rcu+0x189/0x900 kernel/rcu/tree.c:3091
task_work_run+0x125/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
Second to last potentially related work creation:
kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
task_work_add+0x2f/0x1d0 kernel/task_work.c:38
fput_many+0xde/0x1a0 fs/file_table.c:367
filp_close+0x10e/0x150 fs/open.c:1371
__do_sys_close fs/open.c:1384 [inline]
__se_sys_close fs/open.c:1382 [inline]
__x64_sys_close+0x34/0x70 fs/open.c:1382
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
The buggy address belongs to the object at ffff88805333fb80
which belongs to the cache filp of size 464
The buggy address is located 560 bytes to the right of
464-byte region [ffff88805333fb80, ffff88805333fd50)
The buggy address belongs to the page:
page:ffffea00014ccf80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5333e
head:ffffea00014ccf80 order:1 compound_mapcount:0
memcg:ffff888078397e81
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea00019a0e00 0000000700000007 ffff888016ddd8c0
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888078397e81
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4410, ts 190272869949, free_ts 190056684003
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
__alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
alloc_slab_page mm/slub.c:1780 [inline]
allocate_slab mm/slub.c:1917 [inline]
new_slab+0xc0/0x4b0 mm/slub.c:1980
___slab_alloc+0x807/0xdd0 mm/slub.c:3013
__slab_alloc mm/slub.c:3100 [inline]
slab_alloc_node mm/slub.c:3191 [inline]
slab_alloc mm/slub.c:3233 [inline]
kmem_cache_alloc+0xf0/0x280 mm/slub.c:3238
kmem_cache_zalloc include/linux/slab.h:728 [inline]
__alloc_file+0x25/0x240 fs/file_table.c:132
alloc_empty_file+0x90/0x180 fs/file_table.c:181
path_openat+0x11c/0x2fb0 fs/namei.c:3736
do_filp_open+0x1df/0x400 fs/namei.c:3777
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
free_unref_page_list+0x119/0x830 mm/page_alloc.c:3433
release_pages+0x185f/0x1bd0 mm/swap.c:963
tlb_batch_pages_flush mm/mmu_gather.c:50 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:241 [inline]
tlb_flush_mmu mm/mmu_gather.c:248 [inline]
tlb_finish_mmu+0x1b4/0x370 mm/mmu_gather.c:371
exit_mmap+0x3d0/0x640 mm/mmap.c:3218
__mmput+0x115/0x390 kernel/fork.c:1128
exit_mm+0x632/0x7b0 kernel/exit.c:557
do_exit+0x5b8/0x2110 kernel/exit.c:877
do_group_exit+0x12c/0x2f0 kernel/exit.c:1004
get_signal+0x7eb/0x12e0 kernel/signal.c:2909
arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:320
exc_page_fault+0x88/0x100 arch/x86/mm/fault.c:1499
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606
Memory state around the buggy address:
ffff88805333fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805333ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805333ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888053340000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888053340080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 31, 2026, 6:44:31 PMJul 31
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: a1153c0deb44 Linux 6.6.147
syzbot found the following issue on:
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12d7a5b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=d4e0b928d29b879239ae
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9f646bfa1b52/disk-a1153c0d.raw.xz
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
vmlinux: https://storage.googleapis.com/syzbot-assets/a2aec2e8f0fd/vmlinux-a1153c0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7abe1f87405/bzImage-a1153c0d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
==================================================================
BUG: KASAN: slab-out-of-bounds in scr_memcpyw include/linux/vt_buffer.h:49 [inline]
Read of size 256 at addr ffff88805bb84760 by task syz.8.1460/10893
CPU: 1 PID: 10893 Comm: syz.8.1460 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
Call Trace:
<TASK>
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:468
kasan_report+0x117/0x150 mm/kasan/report.c:581
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x241/0x290 mm/kasan/generic.c:187
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
scr_memcpyw include/linux/vt_buffer.h:49 [inline]
fbcon_prepare_logo+0x4e2/0xa70 drivers/video/fbdev/core/fbcon.c:602
fbcon_init+0x1380/0x2460 drivers/video/fbdev/core/fbcon.c:1137
visual_init+0x2dd/0x650 drivers/tty/vt/vt.c:1023
do_bind_con_driver+0x859/0x1030 drivers/tty/vt/vt.c:3645
vt_bind drivers/tty/vt/vt.c:3801 [inline]
store_bind+0x798/0xa20 drivers/tty/vt/vt.c:3873
kernfs_fop_write_iter+0x3a4/0x520 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2018 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x474/0x9a0 fs/read_write.c:584
ksys_write+0x151/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb07d79e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb07b9d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fb07da26090 RCX: 00007fb07d79e019
RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003
RBP: 00007fb07d83500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb07da26128 R14: 00007fb07da26090 R15: 00007ffe6ccafd98
</TASK>
Allocated by task 49:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc+0xb7/0x240 mm/slab_common.c:1020
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:721 [inline]
ieee802_11_parse_elems_full+0xb9/0x20c0 net/mac80211/util.c:1616
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2337 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2344 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline]
ieee80211_ibss_rx_queued_mgmt+0x4b7/0x2dc0 net/mac80211/ibss.c:1642
ieee80211_iface_process_skb net/mac80211/iface.c:1655 [inline]
ieee80211_iface_work+0x730/0xc90 net/mac80211/iface.c:1709
cfg80211_wiphy_work+0x228/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Freed by task 49:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1811 [inline]
slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
__kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
ieee80211_ibss_rx_queued_mgmt+0x1ae8/0x2dc0 net/mac80211/ibss.c:-1
ieee80211_iface_process_skb net/mac80211/iface.c:1655 [inline]
ieee80211_iface_work+0x730/0xc90 net/mac80211/iface.c:1709
cfg80211_wiphy_work+0x228/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
The buggy address belongs to the object at ffff88805bb84000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 864 bytes to the right of
allocated 1024-byte region [ffff88805bb84000, ffff88805bb84400)
The buggy address belongs to the physical page:
page:ffffea00016ee000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bb80
head:ffffea00016ee000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017c41dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 6013, tgid 6013 (kworker/u4:22), ts 115922825014, free_ts 100964285648
page_owner tracks the page as allocated
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
prep_new_page mm/page_alloc.c:1589 [inline]
get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
__alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
alloc_slab_page+0x5d/0x180 mm/slub.c:1881
allocate_slab mm/slub.c:2028 [inline]
new_slab+0x87/0x2d0 mm/slub.c:2081
___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
__slab_alloc mm/slub.c:3339 [inline]
__slab_alloc_node mm/slub.c:3392 [inline]
slab_alloc_node mm/slub.c:3485 [inline]
__kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
__do_kmalloc_node mm/slab_common.c:1006 [inline]
__kmalloc+0xa7/0x240 mm/slab_common.c:1020
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:721 [inline]
ieee802_11_parse_elems_full+0xb9/0x20c0 net/mac80211/util.c:1616
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2337 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2344 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline]
ieee80211_ibss_rx_queued_mgmt+0x4b7/0x2dc0 net/mac80211/ibss.c:1642
ieee80211_iface_process_skb net/mac80211/iface.c:1655 [inline]
ieee80211_iface_work+0x730/0xc90 net/mac80211/iface.c:1709
cfg80211_wiphy_work+0x228/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1182 [inline]
reset_page_owner include/linux/page_owner.h:24 [inline]
free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459
free_large_kmalloc+0x101/0x1b0 mm/slab_common.c:984
build_detached_freelist mm/slub.c:3890 [inline]
kmem_cache_free_bulk+0x390/0x470 mm/slub.c:3944
kfree_bulk include/linux/slab.h:517 [inline]
kvfree_rcu_bulk+0x1eb/0x470 kernel/rcu/tree.c:3032
kvfree_rcu_drain_ready kernel/rcu/tree.c:3216 [inline]
kfree_rcu_monitor+0x7d3/0xf70 kernel/rcu/tree.c:3234
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Memory state around the buggy address:
ffff88805bb84680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805bb84700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88805bb84780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805bb84800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Reply all
Reply to author
Forward
0 new messages