KASAN: slab-out-of-bounds Read in md5_block

Status: upstream: reported C repro on 2026/10/01 20:09
Subsystems: ecryptfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+03c68e42ce4b33f7ce9b@syzkaller.appspotmail.com
First crash: 12d, last: 1d04h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
07afb42c repro-c Reproduced: ✅ ❓ KASAN: slab-out-of-bounds Read in md5_block 2026/10/01 05:08 2026/10/01 05:08 2026/10/01 06:26 38f7f0d1
5331704b assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: slab-out-of-bounds Read in md5_block 2026/09/30 00:00 2026/09/30 00:00 2026/09/30 01:08 69537153
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH v2] ecryptfs: validate auth tok payload size 1 (1) 2026/10/04 12:37
[PATCH] ecryptfs: validate auth tok payload size 3 (3) 2026/10/04 12:31
[syzbot] [ecryptfs?] KASAN: slab-out-of-bounds Read in md5_block 0 (2) 2026/10/01 20:45
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/10/01 20:45 15m adrianox@gmail.com patch upstream OK job log log
2026/10/01 06:27 14m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 551c722f40809618230001baccf219193e22fc5a report job log log

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in md5_block+0x95/0x8d0 lib/crypto/md5.c:40
Read of size 64 at addr ffff8880368ab4e0 by task syz.0.17/5920

CPU: 2 UID: 0 PID: 5920 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:186 [inline]
 kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
 md5_block+0x95/0x8d0 lib/crypto/md5.c:40
 md5_blocks lib/crypto/md5.c:126 [inline]
 md5_update+0xf7/0x210 lib/crypto/md5.c:161
 md5+0xc7/0x120 lib/crypto/md5.c:202
 ecryptfs_write_tag_70_packet+0x880/0x1410 fs/ecryptfs/keystore.c:741
 ecryptfs_encrypt_filename fs/ecryptfs/crypto.c:1378 [inline]
 ecryptfs_encrypt_and_encode_filename+0x428/0xa60 fs/ecryptfs/crypto.c:1789
 ecryptfs_lookup+0x1f7/0x830 fs/ecryptfs/inode.c:402
 lookup_open+0xa79/0x1990 fs/namei.c:4528
 open_last_lookups fs/namei.c:4767 [inline]
 path_openat+0xa2c/0x2440 fs/namei.c:4997
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f272ab9e199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc040e72d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f272ae25fa0 RCX: 00007f272ab9e199
RDX: 0000000000101042 RSI: 0000200000000580 RDI: ffffffffffffff9c
RBP: 00007f272ac358e0 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000009d R11: 0000000000000246 R12: 0000000000000000
R13: 00007f272ae25fac R14: 00007f272ae25fa0 R15: 00007f272ae25fa0
 </TASK>

Allocated by task 5920:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_flags_noprof+0x370/0x8e0 mm/slub.c:5602
 _kmalloc_flags_noprof mm/slab.h:55 [inline]
 __alloc_empty_sheaf mm/slub.c:2822 [inline]
 alloc_empty_sheaf mm/slub.c:2842 [inline]
 __pcs_replace_empty_main+0x3fa/0x650 mm/slub.c:4769
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 kmem_cache_alloc_noprof+0x4c4/0x6a0 mm/slub.c:5010
 key_alloc+0x3c5/0x1310 security/keys/key.c:277
 keyring_alloc+0x44/0xc0 security/keys/keyring.c:528
 install_session_keyring_to_cred+0x190/0x230 security/keys/process_keys.c:330
 join_session_keyring+0x1bc/0x350 security/keys/process_keys.c:851
 lookup_user_key+0xbf9/0x1300 security/keys/process_keys.c:674
 __do_sys_add_key+0x2a6/0x460 security/keys/keyctl.c:126
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880368ab400
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 224 bytes inside of
 allocated 256-byte region [ffff8880368ab400, ffff8880368ab500)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x368aa
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5808, tgid 5808 (syz-executor), ts 51117923184
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7418
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_flags_noprof+0x6a9/0x8e0 mm/slub.c:5602
 _kmalloc_flags_noprof mm/slab.h:55 [inline]
 alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186
 __memcg_slab_post_alloc_hook+0x3fc/0x10c0 mm/memcontrol.c:3649
 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline]
 slab_post_alloc_hook mm/slub.c:4702 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kvmalloc_node_noprof+0x750/0x9b0 mm/slub.c:7015
 simple_xattr_alloc+0x6c/0xd0 fs/xattr.c:1271
 class_simple_xattr_constructor include/linux/xattr.h:166 [inline]
 shmem_initxattrs+0x16a/0x650 mm/shmem.c:4228
 security_inode_init_security+0x242/0x370 security/security.c:1370
 shmem_symlink+0x163/0xbf0 mm/shmem.c:4071
 vfs_symlink fs/namei.c:5794 [inline]
 vfs_symlink+0x178/0x4d0 fs/namei.c:5773
 filename_symlinkat+0x2a6/0x560 fs/namei.c:5819
page last free pid 5099 tgid 5099 ts 50790925463 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 __kmalloc_cache_noprof+0x278/0x6d0 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:663 [inline]
 netdevice_event+0x308/0x9a0 drivers/infiniband/core/roce_gid_mgmt.c:822
 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers+0x7c/0xb0 net/core/dev.c:2327
 vlan_dev_inherit_address net/8021q/vlan_dev.c:264 [inline]
 vlan_dev_inherit_address net/8021q/vlan_dev.c:257 [inline]
 vlan_dev_open+0x542/0x6d0 net/8021q/vlan_dev.c:282
 __dev_open+0x3ad/0x8f0 net/core/dev.c:1724
 __dev_change_flags+0x596/0x850 net/core/dev.c:9855
 netif_change_flags+0x8d/0x160 net/core/dev.c:9920
 vlan_dev_work+0x58d/0x5e0 net/8021q/vlan_dev.c:1040
 netdev_work_run net/core/netdev_work.c:127 [inline]
 netdev_work_proc+0x5e9/0x880 net/core/netdev_work.c:171
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396

Memory state around the buggy address:
 ffff8880368ab400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880368ab480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880368ab500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff8880368ab580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880368ab600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (18):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/06 12:10 upstream 2c3418fffa9d f7710056 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/06 11:37 upstream 2c3418fffa9d f7710056 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/01 06:42 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 551c722f4080 15fb8e5e .config console log report C ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/09 04:40 upstream 6c377d19d4a5 b2734a59 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/07 00:46 upstream 69f80fef3153 f7710056 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/06 18:22 upstream 69f80fef3153 f7710056 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/06 11:35 upstream 2c3418fffa9d f7710056 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/05 20:35 upstream 67f0943b394d 1995e6c7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/05 20:35 upstream 67f0943b394d 1995e6c7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/10/03 13:45 upstream e767a4ea70a3 57bbd979 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/30 21:39 upstream 551c722f4080 15fb8e5e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/30 16:10 upstream 551c722f4080 7808aef4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/30 14:45 upstream 551c722f4080 7808aef4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/30 09:26 upstream 551c722f4080 7808aef4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/30 04:06 upstream 6f8319e3e9a4 328436b3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/30 04:06 upstream 6f8319e3e9a4 328436b3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/28 05:42 upstream d266640c6c76 a3c7249d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in md5_block
2026/09/30 21:34 upstream 551c722f4080 15fb8e5e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-out-of-bounds Read in md5_block
* Struck through repros no longer work on HEAD.