From: syzbot <syzbot+8debf4b3f7c7391cd8eb@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [xfs?] KASAN: use-after-free Read in hpfs_bplus_lookup
Date: Fri, 16 Jan 2026 20:56:01 -0800 [thread overview]
Message-ID: <696b1661.a70a0220.34546f.00a3.GAE@google.com> (raw)
In-Reply-To: <20260117043835.1250276-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in hpfs_bplus_lookup
=== CRASH WILL HAPPEN ON NEXT LINE IF UAF ===
=== external[120]: about to access ffff8880545bffe0 ===
=== CRASH WILL HAPPEN ON NEXT LINE IF UAF ===
=== external[121]: about to access ffff8880545bffec ===
=== CRASH WILL HAPPEN ON NEXT LINE IF UAF ===
=== external[122]: about to access ffff8880545bfff8 ===
=== CRASH WILL HAPPEN ON NEXT LINE IF UAF ===
=== external[123]: about to access ffff8880545c0004 ===
=== CRASH WILL HAPPEN ON NEXT LINE IF UAF ===
==================================================================
BUG: KASAN: use-after-free in hpfs_bplus_lookup+0x7d5/0xbd0 fs/hpfs/anode.c:68
Read of size 4 at addr ffff8880545c0004 by task syz.0.21/6731
CPU: 1 UID: 0 PID: 6731 Comm: syz.0.21 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
hpfs_bplus_lookup+0x7d5/0xbd0 fs/hpfs/anode.c:68
hpfs_bmap+0x230/0x4e0 fs/hpfs/file.c:54
hpfs_get_block+0xa8/0x6e0 fs/hpfs/file.c:87
do_mpage_readpage+0x801/0x1980 fs/mpage.c:222
mpage_readahead+0x407/0x830 fs/mpage.c:371
read_pages+0x193/0x5a0 mm/readahead.c:163
page_cache_ra_unbounded+0x68a/0x8c0 mm/readahead.c:302
filemap_get_pages+0x47c/0x1e60 mm/filemap.c:2690
filemap_read+0x44a/0x1240 mm/filemap.c:2800
__kernel_read+0x50d/0x9c0 fs/read_write.c:530
integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:480 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
ima_calc_file_hash+0x12cf/0x1800 security/integrity/ima/ima_crypto.c:568
ima_collect_measurement+0x491/0x930 security/integrity/ima/ima_api.c:293
process_measurement+0x12ec/0x1cc0 security/integrity/ima/ima_main.c:406
ima_file_check+0xdf/0x130 security/integrity/ima/ima_main.c:663
security_file_post_open+0xb3/0x260 security/security.c:2652
do_open fs/namei.c:4639 [inline]
path_openat+0x350e/0x3e70 fs/namei.c:4796
do_filp_open+0x22d/0x490 fs/namei.c:4823
do_sys_openat2+0x12f/0x220 fs/open.c:1430
do_sys_open fs/open.c:1436 [inline]
__do_sys_openat fs/open.c:1452 [inline]
__se_sys_openat fs/open.c:1447 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1447
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb1639aef9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb159fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007feb16605fa0 RCX: 00007feb1639aef9
RDX: 0000000000000000 RSI: 0000200000004280 RDI: ffffffffffffff9c
RBP: 00007feb1642fee0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb16606038 R14: 00007feb16605fa0 R15: 00007fff6450b218
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xb10 pfn:0x545c0
flags: 0x80000000000000(node=0|zone=1)
page_type: f0(buddy)
raw: 0080000000000000 ffff88813fffc380 ffffea0001525008 0000000000000000
raw: 0000000000000b10 0000000000000006 00000000f0000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 6731, tgid 6730 (syz.0.21), ts 168496747643, free_ts 169044969619
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0x28bb/0x2950 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5240
alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2486
folio_alloc_mpol_noprof+0x39/0xe0 mm/mempolicy.c:2505
shmem_alloc_folio mm/shmem.c:1890 [inline]
shmem_alloc_and_add_folio mm/shmem.c:1932 [inline]
shmem_get_folio_gfp+0x644/0x1a80 mm/shmem.c:2556
shmem_get_folio mm/shmem.c:2662 [inline]
shmem_write_begin+0x166/0x320 mm/shmem.c:3315
generic_perform_write+0x2af/0x8b0 mm/filemap.c:4314
shmem_file_write_iter+0xfb/0x120 mm/shmem.c:3490
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:686
ksys_write+0x156/0x270 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6731 tgid 6730 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
free_unref_folios+0xc13/0x17f0 mm/page_alloc.c:3030
folios_put_refs+0x56f/0x680 mm/swap.c:1002
folio_batch_release include/linux/pagevec.h:101 [inline]
shmem_undo_range+0x529/0x1570 mm/shmem.c:1137
shmem_truncate_range mm/shmem.c:1249 [inline]
shmem_evict_inode+0x240/0x9e0 mm/shmem.c:1379
evict+0x61e/0xb10 fs/inode.c:837
__dentry_kill+0x209/0x660 fs/dcache.c:670
finish_dput+0xc9/0x480 fs/dcache.c:879
__fput+0x6a0/0xa80 fs/file_table.c:476
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2b7/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8880545bff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880545bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880545c0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8880545c0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8880545c0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Tested on:
commit: 39d33893 Merge tag 'drm-fixes-2026-01-16' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13f523fa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c33bf4a3a0c7a4f1
dashboard link: https://syzkaller.appspot.com/bug?extid=8debf4b3f7c7391cd8eb
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1365239a580000
next parent reply other threads:[~2026-01-17 4:56 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260117043835.1250276-1-kartikey406@gmail.com>
2026-01-17 4:56 ` syzbot [this message]
[not found] <20260117050511.1252254-1-kartikey406@gmail.com>
2026-01-17 5:35 ` [syzbot] [xfs?] KASAN: use-after-free Read in hpfs_bplus_lookup syzbot
[not found] <20260117034524.1247313-1-kartikey406@gmail.com>
2026-01-17 4:14 ` syzbot
[not found] <20260117023214.1246218-1-kartikey406@gmail.com>
2026-01-17 2:40 ` syzbot
2026-01-16 21:04 syzbot
2026-01-19 6:36 ` Christoph Hellwig
2026-01-19 8:35 ` Aleksandr Nogikh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=696b1661.a70a0220.34546f.00a3.GAE@google.com \
--to=syzbot+8debf4b3f7c7391cd8eb@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.