syzbot

 sign-in | mailing list | source | docs
🐞 Open [1641]
≡ Subsystems
🐞 Fixed [6108]
🐞 Invalid [15307]
⬇ Missing Backports [171]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: global-out-of-bounds Read in bit_putcs (3)

Status: upstream: reported C repro on 2024/07/31 11:38
Subsystems: fbdev
[Documentation on labels]
Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
First crash: 244d, last: 8d20h
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[syzbot] Monthly fbdev report (Mar 2025) 0 (1) 2025/03/09 12:42
[syzbot] [fbdev?] KASAN: global-out-of-bounds Read in bit_putcs (3) 0 (2) 2025/02/28 20:37
[syzbot] Monthly fbdev report (Dec 2024) 0 (1) 2024/12/02 12:47
▶ ▼ Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: global-out-of-bounds Read in bit_putcs (2) fbdev 13 1627d 1643d 0/28 auto-closed as invalid on 2021/02/09 16:38
linux-4.14 KASAN: global-out-of-bounds Read in bit_putcs C error 241 927d 1937d 0/1 upstream: reported C repro on 2019/12/07 16:26
linux-6.1 KASAN: global-out-of-bounds Read in bit_putcs 1 137d 137d 0/3 auto-obsoleted due to no activity on 2025/02/19 05:01
upstream KASAN: global-out-of-bounds Read in bit_putcs fbdev C done 262 1646d 1939d 15/28 fixed on 2020/09/25 01:17
linux-4.19 KASAN: global-out-of-bounds Read in bit_putcs C done 214 1403d 1940d 1/1 fixed on 2021/06/24 08:01
linux-6.1 BUG: unable to handle kernel paging request in bit_putcs C done 4 389d 585d 3/3 fixed on 2024/04/03 01:55
linux-4.14 KASAN: slab-out-of-bounds Read in bit_putcs C error 95 929d 1941d 0/1 upstream: reported C repro on 2019/12/03 16:38
upstream general protection fault in bit_putcs fbdev C 5 386d 540d 0/28 auto-obsoleted due to no activity on 2024/06/14 11:38
linux-4.19 KASAN: slab-out-of-bounds Read in bit_putcs C inconclusive 138 1407d 1941d 0/1 upstream: reported C repro on 2019/12/03 12:47

Sample crash report:
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
==================================================================
BUG: KASAN: global-out-of-bounds in __fb_pad_aligned_buffer include/linux/fb.h:644 [inline]
BUG: KASAN: global-out-of-bounds in bit_putcs_aligned drivers/video/fbdev/core/bitblit.c:96 [inline]
BUG: KASAN: global-out-of-bounds in bit_putcs+0x9b8/0xe30 drivers/video/fbdev/core/bitblit.c:185
Read of size 1 at addr ffff80008be20810 by task syz-executor101/6448

CPU: 1 UID: 0 PID: 6448 Comm: syz-executor101 Not tainted 6.14.0-rc4-syzkaller-g017f704fbfb1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0x198/0x550 mm/kasan/report.c:521
 kasan_report+0xd8/0x138 mm/kasan/report.c:634
 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
 __fb_pad_aligned_buffer include/linux/fb.h:644 [inline]
 bit_putcs_aligned drivers/video/fbdev/core/bitblit.c:96 [inline]
 bit_putcs+0x9b8/0xe30 drivers/video/fbdev/core/bitblit.c:185
 fbcon_putcs+0x390/0x5a0 drivers/video/fbdev/core/fbcon.c:1308
 do_update_region+0x1e8/0x3d0 drivers/tty/vt/vt.c:609
 update_region+0x1e0/0x478 drivers/tty/vt/vt.c:633
 vcs_write+0x9e8/0x1180 drivers/tty/vt/vc_screen.c:698
 do_loop_readv_writev fs/read_write.c:843 [inline]
 vfs_writev+0x494/0x92c fs/read_write.c:1052
 do_writev+0x178/0x304 fs/read_write.c:1096
 __do_sys_writev fs/read_write.c:1164 [inline]
 __se_sys_writev fs/read_write.c:1161 [inline]
 __arm64_sys_writev+0x80/0x94 fs/read_write.c:1161
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

The buggy address belongs to the variable:
 fontdata_8x16+0x1010/0x1480

The buggy address belongs to the virtual mapping at
 [ffff80008b810000, ffff80008f6b0000) created by:
 declare_kernel_vmas+0x58/0xb8 arch/arm64/mm/mmu.c:771

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a1820
flags: 0x5ffc00000002000(reserved|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000002000 fffffdffc5860808 fffffdffc5860808 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff80008be20700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff80008be20780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff80008be20800: 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
                         ^
 ffff80008be20880: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffff80008be20900: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
==================================================================

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/28 20:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 017f704fbfb1 1e7a43e1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: global-out-of-bounds Read in bit_putcs
2025/03/19 10:53 upstream 81e4f8d68c66 8d0a2921 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: global-out-of-bounds Read in bit_putcs
2025/03/09 09:19 upstream b7c90e3e717a 163f510d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: global-out-of-bounds Read in bit_putcs
2025/02/13 17:35 upstream 4dc1d1bec898 2afad16e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: global-out-of-bounds Read in bit_putcs
2024/12/27 18:52 upstream d6ef8b40d075 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: global-out-of-bounds Read in bit_putcs
2024/12/27 12:40 upstream d6ef8b40d075 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: global-out-of-bounds Read in bit_putcs
2024/10/30 11:48 upstream c1e939a21eb1 66aeb999 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: global-out-of-bounds Read in bit_putcs
2024/09/01 12:00 upstream 431c1646e1f8 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: global-out-of-bounds Read in bit_putcs
2024/10/23 09:18 upstream c2ee9f594da8 15fa2979 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: global-out-of-bounds Read in bit_putcs
2024/08/04 04:45 upstream d3426a6ed9d8 1786a2a8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: global-out-of-bounds Read in bit_putcs
2025/03/05 06:15 upstream 48a5eed9ad58 c3901742 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: global-out-of-bounds Read in bit_putcs
2025/02/14 04:25 upstream ab68d7eb7b1a d9a046cf .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: global-out-of-bounds Read in bit_putcs
2024/11/25 00:41 upstream 28eb75e178d3 4dfba277 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 KASAN: global-out-of-bounds Read in bit_putcs
2024/09/18 05:10 upstream a430d95c5efa c673ca06 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: global-out-of-bounds Read in bit_putcs
2025/02/28 19:04 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 017f704fbfb1 1e7a43e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: global-out-of-bounds Read in bit_putcs
2024/07/27 05:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c912bf709078 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: global-out-of-bounds Read in bit_putcs
* Struck through repros no longer work on HEAD.