KASAN: use-after-free Read in dtSplitRoot

Status: upstream: reported C repro on 2026/09/12 19:29
Reported-by: syzbot+7d4c1df72c26ee9ceec5@syzkaller.appspotmail.com
First crash: 1d11h, last: 1d08h
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 UBSAN: array-index-out-of-bounds in dtSplitRoot origin:lts-only 19 syz, C error 10 402d 603d 0/3 auto-obsoleted due to no activity on 2026/05/19 04:54
linux-4.19 KASAN: slab-out-of-bounds Read in dtSplitRoot 17 syz, C error 1 1430d 1430d 0/1 upstream: reported C repro on 2022/10/14 11:28
linux-4.14 KASAN: slab-out-of-bounds Read in dtSplitRoot 17 syz, C 1 1295d 1429d 0/1 upstream: reported C repro on 2022/10/15 22:33
upstream UBSAN: array-index-out-of-bounds in dtSplitRoot jfs 15 syz, C error inconclusive 2 1101d 1429d 25/29 fixed on 2024/01/30 15:47
upstream UBSAN: array-index-out-of-bounds in dtSplitRoot (2) prio:high jfs 15 syz, C error error 184 156d 654d 0/29 upstream: reported C repro on 2024/11/28 23:22

Sample crash report:
loop0: detected capacity change from 0 to 32768
==================================================================
BUG: KASAN: use-after-free in dtSplitRoot+0x7e0/0x11b8 fs/jfs/jfs_dtree.c:1999
Read of size 4 at addr ffff0000eb3f94fc by task syz.0.18/4494

CPU: 0 PID: 4494 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
 dtSplitRoot+0x7e0/0x11b8 fs/jfs/jfs_dtree.c:1999
 dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
 dtInsert+0xb10/0x5710 fs/jfs/jfs_dtree.c:871
 jfs_symlink+0x6cc/0xe08 fs/jfs/namei.c:1019
 vfs_symlink+0x238/0x3b0 fs/namei.c:4522
 do_symlinkat+0x178/0x35c fs/namei.c:4551
 __do_sys_symlinkat fs/namei.c:4568 [inline]
 __se_sys_symlinkat fs/namei.c:4565 [inline]
 __arm64_sys_symlinkat+0xa4/0xbc fs/namei.c:4565
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:00000000520ce423 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12b3f9
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffc0003acfe08 fffffc0003379f88 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000eb3f9380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000eb3f9400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000eb3f9480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff0000eb3f9500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000eb3f9580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
find_entry called with index = 0
find_entry called with index = 0
find_entry called with index = 0
find_entry called with index >= next_index

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/12 23:12 linux-6.1.y cf82dcca9634 70a60e12 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in dtSplitRoot
2026/09/12 21:40 linux-6.1.y cf82dcca9634 70a60e12 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 20:30 linux-6.1.y cf82dcca9634 70a60e12 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 19:53 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in dtSplitRoot
2026/09/12 19:36 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in dtSplitRoot
2026/09/12 19:34 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in dtSplitRoot
2026/09/12 19:28 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in dtSplitRoot
2026/09/12 19:51 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 19:49 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 19:48 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 19:46 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 19:44 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 19:33 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
2026/09/12 19:31 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in dtSplitRoot
* Struck through repros no longer work on HEAD.