Re: [syzbot] [fbdev?] KASAN: slab-out-of-bounds Read in fbcon_prepare_logo

[syzbot <syzbot+0c815b25cdb3678e7083@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

m: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[    6.879936][    T1] NET: Registered PF_INET protocol family
[    6.888856][    T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[    6.916004][    T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 7, 294912 bytes, vmalloc)
[    6.927673][    T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[    6.939720][    T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[    6.963382][    T1] TCP bind hash table entries: 65536 (order: 12, 9437184 bytes, vmalloc hugepage)
[    6.984847][    T1] TCP: Hash tables configured (established 65536 bind 65536)
[    6.996181][    T1] MPTCP token hash table entries: 8192 (order: 8, 720896 bytes, vmalloc)
[    7.007388][    T1] UDP hash table entries: 4096 (order: 8, 1048576 bytes, vmalloc)
[    7.018480][    T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    7.033043][    T1] RPC: Registered named UNIX socket transport module.
[    7.041029][    T1] RPC: Registered udp transport module.
[    7.047194][    T1] RPC: Registered tcp transport module.
[    7.053345][    T1] RPC: Registered tcp-with-tls transport module.
[    7.061092][    T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    7.077293][    T1] NET: Registered PF_XDP protocol family
[    7.084555][    T1] pci_bus 0000:00: resource 4 [io  0x0000-0x0cf7 window]
[    7.093175][    T1] pci_bus 0000:00: resource 5 [io  0x0d00-0x0fff window]
[    7.102036][    T1] pci_bus 0000:00: resource 6 [io  0xc000-0xffff window]
[    7.109968][    T1] pci_bus 0000:00: resource 7 [io  0xa000-0xbfff window]
[    7.117419][    T1] pci_bus 0000:00: resource 8 [mem 0x000a0000-0x000bffff window]
[    7.126097][    T1] pci_bus 0000:00: resource 9 [mem 0xc0000000-0xfebfefff window]
[    7.138760][    T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[    7.148541][    T1] PCI: CLS 0 bytes, default 64
[    7.155068][    T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[    7.163648][    T1] software IO TLB: mapped [mem 0x00000000b4400000-0x00000000b8400000] (64MB)
[    7.179099][    T1] ACPI: bus type thunderbolt registered
[    7.206819][   T59] kworker/u8:3 (59) used greatest stack depth: 28312 bytes left
[    7.217723][   T60] kworker/u8:3 (60) used greatest stack depth: 27864 bytes left
[    7.218365][    T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[    7.274157][    T1] kvm_amd: CPU 0 isn't AMD or Hygon
[    7.281406][    T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb63109b96, max_idle_ns: 440795265316 ns
[    7.295305][    T1] clocksource: Switched to clocksource tsc
[    7.324198][   T67] kworker/u8:3 (67) used greatest stack depth: 27640 bytes left
[    7.367239][    T1] Initialise system trusted keyrings
[    7.379339][    T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0)
[    7.400907][    T1] DLM installed
[    7.415403][    T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    7.436873][    T1] NFS: Registering the id_resolver key type
[    7.445672][    T1] Key type id_resolver registered
[    7.454593][    T1] Key type id_legacy registered
[    7.461477][    T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[    7.473026][    T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[    7.498411][    T1] smbdirect: subsystem loading...
[    7.521052][    T1] smbdirect: subsystem loaded
[    7.549191][    T1] Key type cifs.spnego registered
[    7.556231][    T1] Key type cifs.idmap registered
[    7.570058][    T1] ntfs3: Enabled Linux POSIX ACLs support
[    7.576365][    T1] ntfs3: Read-only LZX/Xpress compression included
[    7.585189][    T1] jffs2: version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
[    7.597775][    T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[    7.605637][    T1] QNX4 filesystem 0.2.3 registered.
[    7.613980][    T1] qnx6: QNX6 filesystem 1.0.0 registered.
[    7.625824][    T1] fuse: init (API version 7.45)
[    7.639652][    T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[    7.654508][    T1] orangefs_init: module version upstream loaded
[    7.671168][    T1] JFS: nTxBlock = 8192, nTxLock = 65536
[    7.707677][    T1] SGI XFS with ACLs, security attributes, realtime, quota, no debug enabled
[    7.740342][    T1] 9p: Installing v9fs 9p2000 file system support
[    7.750197][    T1] NILFS version 2 loaded
[    7.762930][    T1] befs: version: 0.9.3
[    7.775363][    T1] ocfs2: Registered cluster interface o2cb
[    7.790702][    T1] ocfs2: Registered cluster interface user
[    7.802858][    T1] OCFS2 User DLM kernel interface loaded
[    7.858898][    T1] gfs2: GFS2 installed
[    7.890449][    T1] ceph: loaded (mds proto 32)
[    7.928515][    T1] cryptd: max_cpu_qlen set to 1000
[    8.022954][    T1] NET: Registered PF_ALG protocol family
[    8.034264][    T1] async_tx: api initialized (async)
[    8.044395][    T1] Key type asymmetric registered
[    8.053579][    T1] Asymmetric key parser 'x509' registered
[    8.070465][    T1] Asymmetric key parser 'pkcs8' registered
[    8.083813][    T1] Key type pkcs7_test registered
[    8.094104][    T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[    8.112958][    T1] io scheduler mq-deadline registered
[    8.121114][    T1] io scheduler kyber registered
[    8.130620][    T1] io scheduler bfq registered
[    8.143874][  T134] kworker/u8:3 (134) used greatest stack depth: 27576 bytes left
[    8.181566][  T150] kworker/u8:4 (150) used greatest stack depth: 27512 bytes left
[    8.199268][    T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[    8.222725][    T1] ACPI: button: Power Button [PWRF]
[    8.246747][    T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1
[    8.272025][    T1] ACPI: button: Sleep Button [SLPF]
[    8.312574][    T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[    8.384985][   T10] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[    8.394668][   T10] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[    8.466063][   T10] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[    8.473348][   T10] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[    8.542587][   T10] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[    8.552444][   T10] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[    8.611589][   T10] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[    9.238437][  T488] kworker/u8:6 (488) used greatest stack depth: 26904 bytes left
[    9.614789][    T1] N_HDLC line discipline registered with maxframe=4096
[    9.626210][    T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    9.650014][    T1] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[    9.683528][    T1] 00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[    9.717283][    T1] 00:04: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[    9.748101][    T1] 00:05: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[    9.803137][    T1] Non-volatile memory driver v1.3
[    9.872050][    T1] usbcore: registered new interface driver xillyusb
[    9.882756][    T1] ACPI: bus type drm_connector registered
[    9.903775][    T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[    9.918970][    T1] ------------[ cut here ]------------
[    9.924668][    T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup
[    9.924702][    T1] WARNING: drivers/gpu/drm/drm_mode_config.c:872 at drm_mode_config_validate+0xfb4/0x1be0, CPU#0: swapper/0/1
[    9.950604][    T1] Modules linked in:
[    9.956032][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
[    9.968456][    T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[    9.980319][    T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[    9.987862][    T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d fc 4e 2f 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 41 e3 60 fc 48 8d
[   10.011007][    T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246
[   10.017721][    T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   10.026974][    T1] RDX: ffff888025f58ea0 RSI: 0000000000000023 RDI: ffffffff90d71bb0
[   10.035665][    T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[   10.045086][    T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004c93c23
[   10.054115][    T1] R13: ffffed1004c93c24 R14: 0000000000000001 R15: ffff88802649e028
[   10.062412][    T1] FS:  0000000000000000(0000) GS:ffff88812440a000(0000) knlGS:0000000000000000
[   10.077158][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   10.084105][    T1] CR2: ffff88823ffff000 CR3: 000000000e586000 CR4: 00000000003526f0
[   10.093478][    T1] Call Trace:
[   10.097566][    T1]  <TASK>
[   10.101718][    T1]  drm_dev_register+0x56e/0x7b0
[   10.107158][    T1]  vkms_create+0x491/0x5b0
[   10.111916][    T1]  ? __pfx_vkms_init+0x10/0x10
[   10.117488][    T1]  vkms_init+0x98/0xe0
[   10.122162][    T1]  do_one_initcall+0x11c/0x6f0
[   10.127726][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[   10.134615][    T1]  ? kernel_init_freeable+0x4ca/0x7b0
[   10.141204][    T1]  kernel_init_freeable+0x6ea/0x7b0
[   10.151156][    T1]  ? __pfx_kernel_init+0x10/0x10
[   10.162306][    T1]  kernel_init+0x21/0x1e0
[   10.168336][    T1]  ? __pfx_kernel_init+0x10/0x10
[   10.177012][    T1]  ret_from_fork+0x730/0xd60
[   10.182722][    T1]  ? __pfx_ret_from_fork+0x10/0x10
[   10.194824][    T1]  ? __switch_to+0x800/0x10f0
[   10.200466][    T1]  ? __switch_to_asm+0x39/0x70
[   10.206138][    T1]  ? __pfx_kernel_init+0x10/0x10
[   10.212710][    T1]  ret_from_fork_asm+0x1a/0x30
[   10.218506][    T1]  </TASK>
[   10.222298][    T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   10.228437][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
[   10.228437][    T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[   10.228437][    T1] Call Trace:
[   10.228437][    T1]  <TASK>
[   10.228437][    T1]  dump_stack_lvl+0x100/0x190
[   10.228437][    T1]  vpanic+0x553/0x970
[   10.228437][    T1]  ? __pfx_vpanic+0x10/0x10
[   10.274204][    T1]  panic+0xd1/0xe0
[   10.274204][    T1]  ? __pfx_panic+0x10/0x10
[   10.274204][    T1]  check_panic_on_warn.cold+0x19/0x34
[   10.274204][    T1]  ? drm_mode_config_validate+0xfb4/0x1be0
[   10.274204][    T1]  __warn.cold+0x191/0x318
[   10.274204][    T1]  __report_bug+0x30f/0x440
[   10.274204][    T1]  ? drm_mode_config_validate+0xfb4/0x1be0
[   10.274204][    T1]  ? __pfx___report_bug+0x10/0x10
[   10.274204][    T1]  ? __lock_acquire+0x4c5/0x1ec0
[   10.274204][    T1]  report_bug_entry+0xe2/0x290
[   10.274204][    T1]  ? drm_mode_config_validate+0xfbb/0x1be0
[   10.274204][    T1]  handle_bug+0x1cd/0x2a0
[   10.274204][    T1]  exc_invalid_op+0x17/0x50
[   10.274204][    T1]  asm_exc_invalid_op+0x1a/0x20
[   10.274204][    T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[   10.274204][    T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d fc 4e 2f 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 41 e3 60 fc 48 8d
[   10.374312][    T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246
[   10.374312][    T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   10.374312][    T1] RDX: ffff888025f58ea0 RSI: 0000000000000023 RDI: ffffffff90d71bb0
[   10.374312][    T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[   10.374312][    T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004c93c23
[   10.374312][    T1] R13: ffffed1004c93c24 R14: 0000000000000001 R15: ffff88802649e028
[   10.374312][    T1]  ? drm_mode_config_validate+0xf76/0x1be0
[   10.374312][    T1]  drm_dev_register+0x56e/0x7b0
[   10.374312][    T1]  vkms_create+0x491/0x5b0
[   10.374312][    T1]  ? __pfx_vkms_init+0x10/0x10
[   10.374312][    T1]  vkms_init+0x98/0xe0
[   10.374312][    T1]  do_one_initcall+0x11c/0x6f0
[   10.374312][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[   10.474281][    T1]  ? kernel_init_freeable+0x4ca/0x7b0
[   10.474281][    T1]  kernel_init_freeable+0x6ea/0x7b0
[   10.474281][    T1]  ? __pfx_kernel_init+0x10/0x10
[   10.474281][    T1]  kernel_init+0x21/0x1e0
[   10.474281][    T1]  ? __pfx_kernel_init+0x10/0x10
[   10.474281][    T1]  ret_from_fork+0x730/0xd60
[   10.474281][    T1]  ? __pfx_ret_from_fork+0x10/0x10
[   10.474281][    T1]  ? __switch_to+0x800/0x10f0
[   10.474281][    T1]  ? __switch_to_asm+0x39/0x70
[   10.474281][    T1]  ? __pfx_kernel_init+0x10/0x10
[   10.474281][    T1]  ret_from_fork_asm+0x1a/0x30
[   10.474281][    T1]  </TASK>
[   10.474281][    T1] Kernel Offset: disabled
[   10.474281][    T1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2227337947=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at f8f2b4da0e6
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=f8f2b4da0e6eaaf0aeed6f6d613d86d599aafcd3 -X github.com/google/syzkaller/prog.gitRevisionDate=20250729-133428"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"f8f2b4da0e6eaaf0aeed6f6d613d86d599aafcd3\"
/usr/bin/ld: /tmp/ccoS8z5G.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12708625580000


Tested on:

commit:         26260251 Merge tag 'livepatching-for-7.3' of git://git..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=7e3366b2d3e49f2d
dashboard link: https://syzkaller.appspot.com/bug?extid=0c815b25cdb3678e7083
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10a8a179580000