KASAN: vmalloc-out-of-bounds Write in imageblit

Status: upstream: reported C repro on 2026/08/06 13:30
Reported-by: syzbot+23839731b8735c36866b@syzkaller.appspotmail.com
First crash: 99d, last: now
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: vmalloc-out-of-bounds Write in imageblit fbdev 21 syz, C 104 1843d 2137d 20/29 fixed on 2021/11/10 00:50
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (6) prio:high fbdev 21 syz, C 12334 36m 375d 0/29 upstream: reported C repro on 2025/11/02 21:10
linux-6.1 KASAN: vmalloc-out-of-bounds Write in imageblit origin:lts-only 21 syz, C 274 5h54m 98d 0/3 upstream: reported C repro on 2026/08/07 05:50
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (5) fbdev 21 syz, C 1075 379d 430d 29/29 fixed on 2025/10/29 21:02
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (4) fbdev 21 syz, C 3869 434d 814d 29/29 fixed on 2025/09/04 16:57
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (3) fbdev 21 2 1207d 1203d 0/29 auto-obsoleted due to no activity on 2023/10/23 10:50
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (2) fbdev 21 syz, C done 701 1532d 1820d 22/29 fixed on 2023/02/24 13:50
linux-6.6 KASAN: vmalloc-out-of-bounds Write in imageblit 21 syz, C 96 5h56m 99d 0/2 upstream: reported C repro on 2026/08/05 13:55
upstream KASAN: vmalloc-out-of-bounds Write in sys_imageblit fbdev 21 syz, C 91 2162d 2529d 0/29 auto-obsoleted due to no activity on 2022/12/09 01:09
upstream BUG: unable to handle kernel paging request in sys_imageblit fbdev 8 syz 16 2159d 2529d 0/29 auto-obsoleted due to no activity on 2022/08/31 01:46

Sample crash report:
RSP: 002b:00007fff6916b748 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff1ba586fa0 RCX: 00007ff1ba2ff559
RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000003
RBP: 00007fff6916b7b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ff1ba586fac R14: 00007ff1ba586fa0 R15: 00007ff1ba586fa0
 </TASK>
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline]
BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1ba8/0x25d0 drivers/video/fbdev/core/sysimgblt.c:323
Write of size 4 at addr ffffc90004c91fc0 by task syz.0.17/4559

CPU: 0 PID: 4559 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline]
 sys_imageblit+0x1ba8/0x25d0 drivers/video/fbdev/core/sysimgblt.c:323
 drm_fb_helper_sys_imageblit+0x2e/0x510 drivers/gpu/drm/drm_fb_helper.c:793
 cw_putcs_aligned drivers/video/fbdev/core/fbcon_cw.c:110 [inline]
 cw_putcs+0x15ef/0x18a0 drivers/video/fbdev/core/fbcon_cw.c:158
 fbcon_putcs+0x2c8/0x450 drivers/video/fbdev/core/fbcon.c:1265
 do_update_region+0x4e5/0x640 drivers/tty/vt/vt.c:676
 redraw_screen+0xa2c/0x1000 drivers/tty/vt/vt.c:1035
 fbcon_rotate drivers/video/fbdev/core/fbcon.c:216 [inline]
 store_rotate+0x28f/0x420 drivers/video/fbdev/core/fbcon.c:3181
 kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:2179 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x748/0xd70 fs/read_write.c:594
 ksys_write+0x153/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7ff1ba2ff559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff6916b748 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff1ba586fa0 RCX: 00007ff1ba2ff559
RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000003
RBP: 00007fff6916b7b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ff1ba586fac R14: 00007ff1ba586fa0 R15: 00007ff1ba586fa0
 </TASK>


Memory state around the buggy address:
 ffffc90004c91e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90004c91f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90004c91f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                                           ^
 ffffc90004c92000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90004c92080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (110):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/18 20:01 linux-5.15.y 792fbe1537d8 432c0077 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/13 12:32 linux-5.15.y 29c6cdaac04a be5d1971 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/10 16:07 linux-5.15.y 29c6cdaac04a d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/09 14:59 linux-5.15.y 29c6cdaac04a 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/09 14:23 linux-5.15.y 29c6cdaac04a 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/06 17:34 linux-5.15.y 700e62ea909a 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/05 22:41 linux-5.15.y 700e62ea909a 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/04 08:06 linux-5.15.y 700e62ea909a 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/31 13:05 linux-5.15.y 700e62ea909a 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/29 23:44 linux-5.15.y 792fbe1537d8 b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/28 16:27 linux-5.15.y 792fbe1537d8 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/28 00:21 linux-5.15.y 792fbe1537d8 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/27 21:40 linux-5.15.y 792fbe1537d8 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/26 17:43 linux-5.15.y 792fbe1537d8 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/25 13:08 linux-5.15.y 792fbe1537d8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/25 06:10 linux-5.15.y 792fbe1537d8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/18 19:28 linux-5.15.y 792fbe1537d8 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/13 09:26 linux-5.15.y a051a4bf909f 5a1eeac4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/09 00:43 linux-5.15.y a051a4bf909f b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/08 19:11 linux-5.15.y a051a4bf909f b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/05 16:11 linux-5.15.y a051a4bf909f af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/05 02:44 linux-5.15.y a051a4bf909f 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/03 03:13 linux-5.15.y 0248c33e835e 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/10/02 23:08 linux-5.15.y 0248c33e835e 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/30 13:37 linux-5.15.y 0248c33e835e 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/25 18:17 linux-5.15.y 0248c33e835e f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/25 15:23 linux-5.15.y 0248c33e835e f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/23 16:02 linux-5.15.y 0248c33e835e abce1216 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/23 01:35 linux-5.15.y 0248c33e835e 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/22 07:00 linux-5.15.y 0248c33e835e e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/14 15:41 linux-5.15.y 0248c33e835e 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/14 13:24 linux-5.15.y 0248c33e835e 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/08/06 13:29 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/11/13 13:48 linux-5.15.y 29c6cdaac04a be5d1971 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/11/09 12:01 linux-5.15.y 29c6cdaac04a 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/11/05 09:28 linux-5.15.y 700e62ea909a 2ee8459f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/11/01 06:23 linux-5.15.y 700e62ea909a 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/31 14:17 linux-5.15.y 700e62ea909a 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/29 15:16 linux-5.15.y 792fbe1537d8 b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/25 12:16 linux-5.15.y 792fbe1537d8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/22 16:16 linux-5.15.y 792fbe1537d8 b55fad29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/21 15:52 linux-5.15.y 792fbe1537d8 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/08 07:43 linux-5.15.y a051a4bf909f 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/01 16:41 linux-5.15.y 0248c33e835e f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/10/01 16:41 linux-5.15.y 0248c33e835e f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/30 23:04 linux-5.15.y 0248c33e835e 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/21 17:19 linux-5.15.y 0248c33e835e 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/16 00:36 linux-5.15.y 0248c33e835e 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: unable to handle kernel paging request in imageblit
* Struck through repros no longer work on HEAD.