KASAN: vmalloc-out-of-bounds Write in imageblit

Status: upstream: reported C repro on 2026/08/07 05:50
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+5de3002e518884f6bfb9@syzkaller.appspotmail.com
First crash: 51d, last: 6h59m
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2026/09/06 linux-6.1.y (ToT) cf82dcca9634 C [report] KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/06 upstream (ToT) b1e00ffaf91c C Didn't crash
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: vmalloc-out-of-bounds Write in imageblit fbdev 21 syz, C 104 1796d 2089d 20/29 fixed on 2021/11/10 00:50
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (6) prio:high fbdev 21 syz, C 10112 11m 328d 0/29 upstream: reported C repro on 2025/11/02 21:10
linux-5.15 KASAN: vmalloc-out-of-bounds Write in imageblit 21 57 1d15h 51d 0/3 upstream: reported on 2026/08/06 13:30
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (5) fbdev 21 syz, C 1075 332d 383d 29/29 fixed on 2025/10/29 21:02
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (4) fbdev 21 syz, C 3869 387d 766d 29/29 fixed on 2025/09/04 16:57
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (3) fbdev 21 2 1159d 1155d 0/29 auto-obsoleted due to no activity on 2023/10/23 10:50
upstream KASAN: vmalloc-out-of-bounds Write in imageblit (2) fbdev 21 syz, C done 701 1485d 1773d 22/29 fixed on 2023/02/24 13:50
linux-6.6 KASAN: vmalloc-out-of-bounds Write in imageblit 21 48 18h54m 52d 0/2 upstream: reported on 2026/08/05 13:55
upstream KASAN: vmalloc-out-of-bounds Write in sys_imageblit fbdev 21 syz, C 91 2115d 2482d 0/29 auto-obsoleted due to no activity on 2022/12/09 01:09
upstream BUG: unable to handle kernel paging request in sys_imageblit fbdev 8 syz 16 2112d 2482d 0/29 auto-obsoleted due to no activity on 2022/08/31 01:46

Sample crash report:
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline]
BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1560/0x1d10 drivers/video/fbdev/core/sysimgblt.c:323
Write of size 4 at addr ffff800024869fc0 by task syz.0.17/4542

CPU: 0 PID: 4542 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_store4_noabort+0x2c/0x38 mm/kasan/report_generic.c:355
 fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline]
 sys_imageblit+0x1560/0x1d10 drivers/video/fbdev/core/sysimgblt.c:323
 drm_fb_helper_sys_imageblit+0x40/0x464 drivers/gpu/drm/drm_fb_helper.c:864
 drm_fbdev_fb_imageblit+0x170/0x1dc drivers/gpu/drm/drm_fb_helper.c:2402
 cw_putcs_aligned drivers/video/fbdev/core/fbcon_cw.c:110 [inline]
 cw_putcs+0xab0/0xd18 drivers/video/fbdev/core/fbcon_cw.c:158
 fbcon_putcs+0x30c/0x4b8 drivers/video/fbdev/core/fbcon.c:1299
 do_update_region+0x40c/0x554 drivers/tty/vt/vt.c:676
 redraw_screen+0x78c/0xcc0 drivers/tty/vt/vt.c:1035
 fbcon_modechanged+0x914/0xf5c drivers/video/fbdev/core/fbcon.c:2730
 fbcon_rotate drivers/video/fbdev/core/fbcon.c:226 [inline]
 store_rotate+0x2f4/0x4bc drivers/video/fbdev/core/fbcon.c:3235
 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to a vmalloc virtual mapping
Memory state around the buggy address:
 ffff800024869e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffff800024869f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffff800024869f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                                           ^
 ffff80002486a000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffff80002486a080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Unable to handle kernel paging request at virtual address ffff800024869fc0
KASAN: probably user-memory-access in range [0x000000012434fe00-0x000000012434fe07]
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047
  CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000020dd3f000
[ffff800024869fc0] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000010e8a9003, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4542 Comm: syz.0.17 Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline]
pc : sys_imageblit+0x1338/0x1d10 drivers/video/fbdev/core/sysimgblt.c:323
lr : fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline]
lr : sys_imageblit+0x1560/0x1d10 drivers/video/fbdev/core/sysimgblt.c:323
sp : ffff800021197220
x29: ffff800021197370 x28: 0000000000000001 x27: ffff800024869fc0
x26: ffff0000ce76ce31 x25: 1fffe00019ced9c6 x24: ffff800024869fc0
x23: ffff800024869fc0 x22: 0000000000000000 x21: ffff8000211972e0
x20: 0000000000000000 x19: ffff0000ce76ce30 x18: 1fffe00033e7037e
x17: 3d3d3d3d3d3d3d3d x16: ffff800011b9ea98 x15: 0000000000000000
x14: 0000000000000001 x13: 1ffff00002ff216c x12: 0000000000000000
x11: dfff800000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000da289c00 x7 : 64206b636f6c2067 x6 : ffff80000831261c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008195a30
x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff800024869fc0
Call trace:
 fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline]
 sys_imageblit+0x1338/0x1d10 drivers/video/fbdev/core/sysimgblt.c:323
 drm_fb_helper_sys_imageblit+0x40/0x464 drivers/gpu/drm/drm_fb_helper.c:864
 drm_fbdev_fb_imageblit+0x170/0x1dc drivers/gpu/drm/drm_fb_helper.c:2402
 cw_putcs_aligned drivers/video/fbdev/core/fbcon_cw.c:110 [inline]
 cw_putcs+0xab0/0xd18 drivers/video/fbdev/core/fbcon_cw.c:158
 fbcon_putcs+0x30c/0x4b8 drivers/video/fbdev/core/fbcon.c:1299
 do_update_region+0x40c/0x554 drivers/tty/vt/vt.c:676
 redraw_screen+0x78c/0xcc0 drivers/tty/vt/vt.c:1035
 fbcon_modechanged+0x914/0xf5c drivers/video/fbdev/core/fbcon.c:2730
 fbcon_rotate drivers/video/fbdev/core/fbcon.c:226 [inline]
 store_rotate+0x2f4/0x4bc drivers/video/fbdev/core/fbcon.c:3235
 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 38eb6928 b86a5ab4 350010c8 8b160360 (b8004414) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	38eb6928 	ldrsb	w8, [x9, x11]
   4:	b86a5ab4 	ldr	w20, [x21, w10, uxtw #2]
   8:	350010c8 	cbnz	w8, 0x220
   c:	8b160360 	add	x0, x27, x22
* 10:	b8004414 	str	w20, [x0], #4 <-- trapping instruction

Crashes (142):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/29 17:37 linux-6.1.y d64a499eea6b 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/17 18:49 linux-6.1.y 1a8763b93150 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/17 02:39 linux-6.1.y 1a8763b93150 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/14 15:59 linux-6.1.y 1a8763b93150 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/12 09:20 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/09 22:12 linux-6.1.y cf82dcca9634 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/08 21:42 linux-6.1.y cf82dcca9634 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/07 17:16 linux-6.1.y cf82dcca9634 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/07 13:29 linux-6.1.y cf82dcca9634 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/06 13:10 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/04 10:58 linux-6.1.y cf82dcca9634 f65209a4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/03 10:07 linux-6.1.y cf82dcca9634 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/03 05:14 linux-6.1.y cf82dcca9634 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/02 14:11 linux-6.1.y d64a499eea6b 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/08/30 21:46 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/08/29 00:35 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/08/07 05:49 linux-6.1.y 03f3a99e8e93 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/27 03:06 linux-6.1.y 1a8763b93150 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/26 08:11 linux-6.1.y 1a8763b93150 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/25 08:28 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/21 17:35 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/19 07:25 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/15 16:34 linux-6.1.y 1a8763b93150 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/14 09:34 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/11 03:33 linux-6.1.y cf82dcca9634 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/08 02:25 linux-6.1.y cf82dcca9634 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/06 20:55 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/06 14:18 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/06 08:04 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/06 03:48 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/03 06:41 linux-6.1.y cf82dcca9634 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/02 05:51 linux-6.1.y d64a499eea6b 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/01 19:41 linux-6.1.y d64a499eea6b 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/08/31 12:33 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/08/29 21:21 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/08/29 17:15 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: vmalloc-out-of-bounds Write in imageblit
2026/09/25 03:30 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/22 10:19 linux-6.1.y 1a8763b93150 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/15 19:35 linux-6.1.y 1a8763b93150 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/14 18:46 linux-6.1.y 1a8763b93150 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/04 18:59 linux-6.1.y cf82dcca9634 f65209a4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: unable to handle kernel paging request in imageblit
2026/09/21 14:26 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in imageblit
2026/09/10 07:03 linux-6.1.y cf82dcca9634 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in imageblit
2026/09/10 04:16 linux-6.1.y cf82dcca9634 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in imageblit
2026/09/06 10:17 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in imageblit
2026/09/03 14:00 linux-6.1.y cf82dcca9634 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in imageblit
2026/08/31 18:26 linux-6.1.y d64a499eea6b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in imageblit
* Struck through repros no longer work on HEAD.