KASAN: slab-out-of-bounds Read in fb_pad_unaligned

Kernel	Title	Rank 🛈	Count	Last	Reported	Patched	Status
upstream	KASAN: slab-out-of-bounds Read in fb_pad_unaligned_buffer (3) fbdev	17	1	146d	142d	0/29	auto-obsoleted due to no activity on 2025/06/13 19:08
upstream	KASAN: slab-out-of-bounds Read in fb_pad_unaligned_buffer (2) fbdev	17	2	251d	270d	0/29	auto-obsoleted due to no activity on 2025/03/10 18:04
upstream	KASAN: slab-out-of-bounds Read in fb_pad_unaligned_buffer fbdev	17	1	470d	466d	0/29	auto-obsoleted due to no activity on 2024/07/24 15:18

UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_register_driver returned -16
netlink: 165 bytes leftover after parsing attributes in process `syz.4.717'.
==================================================================
BUG: KASAN: slab-out-of-bounds in fb_pad_unaligned_buffer+0x412/0x440 drivers/video/fbdev/core/fbmem.c:118
Read of size 1 at addr ffff888056eadd10 by task syz.4.717/8869

CPU: 0 UID: 0 PID: 8869 Comm: syz.4.717 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x610 mm/kasan/report.c:480
 kasan_report+0xe0/0x110 mm/kasan/report.c:593
 fb_pad_unaligned_buffer+0x412/0x440 drivers/video/fbdev/core/fbmem.c:118
 bit_putcs_unaligned drivers/video/fbdev/core/bitblit.c:129 [inline]
 bit_putcs+0x870/0xde0 drivers/video/fbdev/core/bitblit.c:187
 fbcon_putcs+0x380/0x4a0 drivers/video/fbdev/core/fbcon.c:1314
 do_update_region+0x1fb/0x3f0 drivers/tty/vt/vt.c:617
 update_region+0xc1/0x160 drivers/tty/vt/vt.c:641
 vcs_write+0x7c7/0xdb0 drivers/tty/vt/vc_screen.c:698
 do_loop_readv_writev fs/read_write.c:850 [inline]
 do_loop_readv_writev fs/read_write.c:835 [inline]
 vfs_writev+0x5df/0xde0 fs/read_write.c:1059
 do_writev+0x132/0x340 fs/read_write.c:1103
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f386e18e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f386efc8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f386e3b5fa0 RCX: 00007f386e18e929
RDX: 000000000000000e RSI: 0000200000000c40 RDI: 000000000000000a
RBP: 00007f386e210b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f386e3b5fa0 R15: 00007fff86b5e928
 </TASK>

Allocated by task 6643:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4328 [inline]
 __kmalloc_noprof+0x223/0x510 mm/slub.c:4340
 kmalloc_noprof include/linux/slab.h:909 [inline]
 fbcon_set_font+0x434/0xb80 drivers/video/fbdev/core/fbcon.c:2522
 con_font_set drivers/tty/vt/vt.c:4887 [inline]
 con_font_op+0x7fe/0xf50 drivers/tty/vt/vt.c:4934
 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline]
 vt_ioctl+0x48f/0x30a0 drivers/tty/vt/vt_ioctl.c:751
 tty_ioctl+0x65e/0x1640 drivers/tty/tty_io.c:2792
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888056eadc00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes to the right of
 allocated 272-byte region [ffff888056eadc00, ffff888056eadd10)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56eac
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b841c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b841c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea00015bab01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5829, tgid 5829 (syz-executor), ts 64265400540, free_ts 15231282973
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
 prep_new_page mm/page_alloc.c:1712 [inline]
 get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
 __alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
 alloc_slab_page mm/slub.c:2451 [inline]
 allocate_slab mm/slub.c:2619 [inline]
 new_slab+0x23b/0x330 mm/slub.c:2673
 ___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
 __slab_alloc_node mm/slub.c:4024 [inline]
 slab_alloc_node mm/slub.c:4185 [inline]
 __do_kmalloc_node mm/slub.c:4327 [inline]
 __kmalloc_noprof+0x2f2/0x510 mm/slub.c:4340
 kmalloc_noprof include/linux/slab.h:909 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 fib6_info_alloc+0x40/0x160 net/ipv6/ip6_fib.c:155
 ip6_route_info_create+0x14c/0x870 net/ipv6/route.c:3811
 addrconf_f6i_alloc+0x2da/0x660 net/ipv6/route.c:4679
 ipv6_add_addr+0x531/0x1fe0 net/ipv6/addrconf.c:1121
 add_addr+0xde/0x350 net/ipv6/addrconf.c:3200
 add_v4_addrs+0x64b/0x990 net/ipv6/addrconf.c:3262
 addrconf_sit_config net/ipv6/addrconf.c:3514 [inline]
 addrconf_init_auto_addrs+0x547/0x880 net/ipv6/addrconf.c:3552
 addrconf_notify+0xe93/0x19e0 net/ipv6/addrconf.c:3739
page last free pid 1 tgid 1 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 __free_pages mm/page_alloc.c:5071 [inline]
 free_contig_range+0x183/0x4b0 mm/page_alloc.c:6927
 destroy_args+0x7f6/0xa60 mm/debug_vm_pgtable.c:1009
 debug_vm_pgtable+0x13b8/0x2d00 mm/debug_vm_pgtable.c:1389
 do_one_initcall+0x120/0x6e0 init/main.c:1274
 do_initcall_level init/main.c:1336 [inline]
 do_initcalls init/main.c:1352 [inline]
 do_basic_setup init/main.c:1371 [inline]
 kernel_init_freeable+0x5c2/0x900 init/main.c:1584
 kernel_init+0x1c/0x2b0 init/main.c:1474
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff888056eadc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888056eadc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888056eadd00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                         ^
 ffff888056eadd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888056eade00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/07/13 19:50	upstream	3f31a806a62e	3cda49cf	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	KASAN: slab-out-of-bounds Read in fb_pad_unaligned_buffer
2025/06/28 04:45	linux-next	2aeda9592360	803ce19b	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-rust-kasan-gce	KASAN: slab-out-of-bounds Read in fb_pad_unaligned_buffer