KASAN: null-ptr-deref Read in drop_buffers

Status: upstream: reported on 2026/08/25 13:52
Reported-by: syzbot+3e7eb0f595d4bc6fd9c9@syzkaller.appspotmail.com
First crash: 4d05h, last: 4d05h
Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Read in drop_buffers (5) prio:high fs 11 14 76d 292d 0/29 upstream: reported on 2025/11/10 12:38
upstream KASAN: null-ptr-deref Read in drop_buffers (2) jfs 11 syz, C error 252 912d 1123d 0/29 auto-obsoleted due to no activity on 2024/05/08 22:28
upstream KASAN: null-ptr-deref Read in drop_buffers kernfs 11 5 1399d 1399d 0/29 auto-obsoleted due to no activity on 2023/02/27 02:04
upstream KASAN: null-ptr-deref Read in drop_buffers (4) fs 17 228 368d 376d 0/29 auto-obsoleted due to no activity on 2025/10/15 13:15
linux-6.1 KASAN: null-ptr-deref Read in drop_buffers 11 1 87d 87d 0/3 upstream: reported on 2026/06/03 12:36
upstream KASAN: null-ptr-deref Read in drop_buffers (3) fs 17 syz, C 98 530d 696d 0/29 auto-obsoleted due to no activity on 2025/06/08 23:43
linux-6.1 KASAN: slab-out-of-bounds Read in drop_buffers 17 1 574d 574d 0/3 auto-obsoleted due to no activity on 2025/05/11 23:03
linux-6.1 KASAN: slab-out-of-bounds Read in drop_buffers (2) origin:lts-only 17 syz, C inconclusive 18 143d 344d 3/3 fixed on 2026/04/11 13:11

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2912 [inline]
BUG: KASAN: null-ptr-deref in drop_buffers+0x65/0x6d0 fs/buffer.c:2924
Read of size 4 at addr 0000000000000060 by task syz.4.9619/801

CPU: 0 PID: 801 Comm: syz.4.9619 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x241/0x290 mm/kasan/generic.c:187
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 buffer_busy fs/buffer.c:2912 [inline]
 drop_buffers+0x65/0x6d0 fs/buffer.c:2924
 try_to_free_buffers+0x22a/0x570 fs/buffer.c:2958
 shrink_folio_list+0x220a/0x7e80 mm/vmscan.c:2076
 evict_folios+0x7cc/0x2010 mm/vmscan.c:5211
 try_to_shrink_lruvec+0x8ad/0xc00 mm/vmscan.c:5412
 lru_gen_shrink_lruvec mm/vmscan.c:5556 [inline]
 shrink_lruvec+0x567/0x2940 mm/vmscan.c:6306
 shrink_node_memcgs mm/vmscan.c:6526 [inline]
 shrink_node+0x950/0x3740 mm/vmscan.c:6561
 shrink_zones mm/vmscan.c:6803 [inline]
 do_try_to_free_pages+0x67e/0x1ae0 mm/vmscan.c:6865
 try_to_free_mem_cgroup_pages+0x325/0x7e0 mm/vmscan.c:7180
 mem_cgroup_resize_max+0x2f2/0x390 mm/memcontrol.c:3545
 mem_cgroup_write+0x1e9/0x220 mm/memcontrol.c:-1
 cgroup_file_write+0x2cd/0x6a0 kernel/cgroup/cgroup.c:4090
 kernfs_fop_write_iter+0x3a4/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x474/0x9a0 fs/read_write.c:584
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f124a59e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f124b3f0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f124a825fa0 RCX: 00007f124a59e0d9
RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f124a635024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f124a826038 R14: 00007f124a825fa0 R15: 00007ffd68b721f8
 </TASK>
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/25 13:51 linux-6.6.y dc6160265ffc a9a1fc32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: null-ptr-deref Read in drop_buffers
* Struck through repros no longer work on HEAD.