syzbot


KASAN: stack-out-of-bounds Read in gfs2_dump_glock

Status: upstream: reported C repro on 2024/05/04 22:05
Subsystems: gfs2
[Documentation on labels]
Reported-by: syzbot+7efd59a5a532c57037e6@syzkaller.appspotmail.com
First crash: 522d, last: 1d19h
Cause bisection: failed (error log, bisect log)
  
Discussions (12)
Title Replies (including bot) Last reply
[syzbot] Monthly gfs2 report (Sep 2025) 0 (1) 2025/09/15 06:54
[syzbot] Monthly gfs2 report (Aug 2025) 0 (1) 2025/08/14 12:42
[syzbot] Monthly gfs2 report (Jul 2025) 0 (1) 2025/07/14 07:23
[syzbot] Monthly gfs2 report (Mar 2025) 0 (1) 2025/03/08 22:16
[syzbot] Monthly gfs2 report (Feb 2025) 0 (1) 2025/02/05 12:43
[syzbot] Monthly gfs2 report (Jan 2025) 0 (1) 2025/01/06 10:01
[syzbot] Monthly gfs2 report (Dec 2024) 0 (1) 2024/12/05 09:04
[syzbot] Monthly gfs2 report (Nov 2024) 0 (1) 2024/11/04 11:34
[syzbot] Monthly gfs2 report (Oct 2024) 0 (1) 2024/10/03 09:03
[syzbot] Monthly gfs2 report (Sep 2024) 0 (1) 2024/09/02 08:16
[syzbot] Monthly gfs2 report (Aug 2024) 0 (1) 2024/08/02 07:26
[syzbot] [gfs2?] KASAN: stack-out-of-bounds Read in gfs2_dump_glock 0 (2) 2024/07/04 11:04
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: stack-out-of-bounds Read in gfs2_dump_glock origin:upstream 17 C error 45 164d 886d 0/3 upstream: reported C repro on 2023/05/02 11:39
upstream general protection fault in gfs2_dump_glock gfs2 17 C 25 955d 1356d 22/29 fixed on 2023/02/24 13:50
upstream general protection fault in gfs2_dump_glock (2) gfs2 17 C done done 48 635d 943d 0/29 auto-obsoleted due to no activity on 2024/04/08 04:28
linux-6.6 KASAN: vmalloc-out-of-bounds Read in gfs2_dump_glock origin:upstream 17 C 5 21d 74d 0/2 upstream: reported C repro on 2025/07/23 07:10
Last patch testing requests (10)
Created Duration User Patch Repo Result
2025/09/28 03:07 17m retest repro linux-next report log
2025/09/28 03:07 18m retest repro linux-next report log
2025/09/28 03:07 16m retest repro linux-next report log
2025/09/28 03:07 17m retest repro linux-next report log
2025/09/28 03:07 1h10m retest repro linux-next report log
2025/09/28 01:40 21m retest repro upstream OK log
2025/09/28 01:40 20m retest repro upstream OK log
2025/09/05 01:29 44m retest repro linux-next report log
2025/07/08 09:16 17m retest repro linux-next report log
2025/07/08 09:16 16m retest repro linux-next report log

Sample crash report:
Oops: general protection fault, probably for non-canonical address 0xdffffc0014a19ab9: 0000 [#1] SMP KASAN PTI
KASAN: probably user-memory-access in range [0x00000000a50cd5c8-0x00000000a50cd5cf]
CPU: 1 UID: 0 PID: 6041 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:pid_is_meaningful fs/gfs2/glock.c:1470 [inline]
RIP: 0010:dump_holder fs/gfs2/glock.c:2278 [inline]
RIP: 0010:gfs2_dump_glock+0xfbb/0x1bc0 fs/gfs2/glock.c:2398
Code: c0 a6 f0 8b be 4b 03 00 00 48 c7 c2 00 a7 f0 8b e8 aa 92 a5 fd 49 8d 5d 20 49 89 de 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 28 06 00 00 48 89 5c 24 28 0f b7 1b 89
RSP: 0018:ffffc90003097700 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 00000000a50cd5cc RCX: ffff888031748000
RDX: 0000000000000000 RSI: ffffffff8c036ee0 RDI: ffffffff8c036ea0
RBP: ffffc900030979f0 R08: 0000000000000000 R09: ffffffff83f7f39b
R10: dffffc0000000000 R11: fffffbfff1f87e67 R12: ffffffff83f7f39b
R13: 00000000a50cd5ac R14: 0000000014a19ab9 R15: 0000000000000000
FS:  00007feb518776c0(0000) GS:ffff888125ae8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe60c05000 CR3: 00000000275d8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 gfs2_consist_inode_i+0xf5/0x110 fs/gfs2/util.c:446
 gfs2_dirent_scan+0x545/0x690 fs/gfs2/dir.c:-1
 gfs2_dir_read+0x804/0x16f0 fs/gfs2/dir.c:1600
 gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
 iterate_dir+0x399/0x570 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:410 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb5098eba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb51877038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007feb50bd6090 RCX: 00007feb5098eba9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007feb50a11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb50bd6128 R14: 00007feb50bd6090 R15: 00007fffecbbade8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:pid_is_meaningful fs/gfs2/glock.c:1470 [inline]
RIP: 0010:dump_holder fs/gfs2/glock.c:2278 [inline]
RIP: 0010:gfs2_dump_glock+0xfbb/0x1bc0 fs/gfs2/glock.c:2398
Code: c0 a6 f0 8b be 4b 03 00 00 48 c7 c2 00 a7 f0 8b e8 aa 92 a5 fd 49 8d 5d 20 49 89 de 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 28 06 00 00 48 89 5c 24 28 0f b7 1b 89
RSP: 0018:ffffc90003097700 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 00000000a50cd5cc RCX: ffff888031748000
RDX: 0000000000000000 RSI: ffffffff8c036ee0 RDI: ffffffff8c036ea0
RBP: ffffc900030979f0 R08: 0000000000000000 R09: ffffffff83f7f39b
R10: dffffc0000000000 R11: fffffbfff1f87e67 R12: ffffffff83f7f39b
R13: 00000000a50cd5ac R14: 0000000014a19ab9 R15: 0000000000000000
FS:  00007feb518776c0(0000) GS:ffff888125ae8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe60c05000 CR3: 00000000275d8000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	c0 a6 f0 8b be 4b 03 	shlb   $0x3,0x4bbe8bf0(%rsi)
   7:	00 00                	add    %al,(%rax)
   9:	48 c7 c2 00 a7 f0 8b 	mov    $0xffffffff8bf0a700,%rdx
  10:	e8 aa 92 a5 fd       	call   0xfda592bf
  15:	49 8d 5d 20          	lea    0x20(%r13),%rbx
  19:	49 89 de             	mov    %rbx,%r14
  1c:	49 c1 ee 03          	shr    $0x3,%r14
  20:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  27:	fc ff df
* 2a:	41 0f b6 04 06       	movzbl (%r14,%rax,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 28 06 00 00    	jne    0x65f
  37:	48 89 5c 24 28       	mov    %rbx,0x28(%rsp)
  3c:	0f b7 1b             	movzwl (%rbx),%ebx
  3f:	89                   	.byte 0x89

Crashes (376):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/14 01:26 linux-next 590b221ed425 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/09/14 00:16 linux-next 590b221ed425 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/09/13 20:54 linux-next 590b221ed425 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/06/24 09:12 linux-next f817b6dd2b62 1a7fb460 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/06/24 08:04 linux-next f817b6dd2b62 1a7fb460 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/06/24 06:47 linux-next f817b6dd2b62 1a7fb460 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/10/19 04:33 linux-next 15e7d45e786a cd6fc0a3 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/13 03:24 upstream 150b567e0d57 3547e30f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: stack-out-of-bounds Read in gfs2_dump_glock
2024/07/04 11:03 upstream 795c58e4c7fc 3f2748a3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs KASAN: stack-out-of-bounds Read in gfs2_dump_glock
2024/04/30 21:56 upstream 98369dccd2f8 3cb29304 .config console log report syz [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-qemu-upstream KASAN: stack-out-of-bounds Read in gfs2_dump_glock
2024/12/18 10:21 linux-next 7fa366f1b6e3 a0626d3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: stack-out-of-bounds Read in gfs2_dump_glock
2024/12/10 03:47 linux-next af2ea8ab7a54 cfc402b4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: stack-out-of-bounds Read in gfs2_dump_glock
2024/12/08 09:33 linux-next af2ea8ab7a54 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: stack-out-of-bounds Read in gfs2_dump_glock
2025/07/23 10:51 upstream 89be9a83ccf1 e1dd4f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in gfs2_dump_glock
2025/07/23 10:50 upstream 89be9a83ccf1 e1dd4f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/29 05:49 upstream 059dd502b263 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in gfs2_dump_glock
2024/12/17 00:30 upstream f44d154d6e3d f93b2b55 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: global-out-of-bounds Read in gfs2_dump_glock
2024/12/12 23:39 upstream 150b567e0d57 941924eb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in gfs2_dump_glock
2024/12/12 08:17 upstream 231825b2e1ff ff949d25 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/08 23:00 upstream 62b5a46999c7 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in gfs2_dump_glock
2024/11/05 16:59 upstream 2e1b3cc9d7f7 509da429 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in gfs2_dump_glock
2024/09/09 20:28 upstream da3ea35007d0 073f8be2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: slab-out-of-bounds Read in gfs2_dump_glock
2024/09/07 08:49 upstream b31c44928842 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: vmalloc-out-of-bounds Read in gfs2_dump_glock
2024/08/28 05:45 upstream 3ec3f5fc4a91 6c853ff9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: out-of-bounds Read in gfs2_dump_glock
2024/07/04 11:06 upstream 795c58e4c7fc 3f2748a3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs general protection fault in gfs2_dump_glock
2025/10/03 11:53 upstream f79e772258df 49379ee0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/08/20 22:19 upstream 41cd3fd15263 bd178e57 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/08/20 15:45 upstream b19a97d57c15 bd178e57 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/08/16 16:31 upstream dfd4b508c8c6 dcc075fb .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/08/15 21:48 upstream 8d084337a32f dcc075fb .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/08/02 05:27 upstream a6923c06a3b2 7368264b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/07/31 22:02 upstream d6084bb815c4 3526e777 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/07/30 21:18 upstream 4b290aae788e f8f2b4da .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/07/30 12:26 upstream 14bed9bc81ba f8f2b4da .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/07/29 20:43 upstream 86aa72182095 ba28e0a8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/05/28 10:50 upstream c89756bcf406 874a1386 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/04/12 05:28 upstream e618ee89561b 0bd6db41 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/04/11 17:06 upstream 900241a5cc15 12ba9c21 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/04/11 15:27 upstream 900241a5cc15 12ba9c21 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/03/24 20:06 upstream 38fec10eb60d 875573af .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/03/17 10:48 upstream 4701f33a1070 948c34e4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/03/15 00:03 upstream 83158b21ae9a e2826670 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/03/12 10:28 upstream 0b46b049d6ec ee70e6db .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/02/28 20:26 upstream 76544811c850 1e7a43e1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/02/18 16:00 upstream 2408a807bfc3 c37c7249 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in gfs2_dump_glock
2025/01/20 09:38 upstream ffd294d346d1 f2cb035c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/01/17 19:52 upstream 9bffa1ad25b8 bb91bdd4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in gfs2_dump_glock
2025/09/28 10:22 linux-next 262858079afd 001c9061 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/07/22 03:18 linux-next d086c886ceb9 0b3788a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/01/09 19:18 linux-next 7b4b9bf203da 40f46913 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/01/09 19:16 linux-next 7b4b9bf203da 40f46913 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/01/07 09:37 linux-next 7b4b9bf203da f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/01/05 15:28 linux-next 8155b4ef3466 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/01/04 16:17 linux-next 8155b4ef3466 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/01/03 15:34 linux-next 8155b4ef3466 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2025/01/03 08:46 linux-next 8155b4ef3466 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in gfs2_dump_glock
2025/01/01 11:31 linux-next 8155b4ef3466 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/31 20:43 linux-next 8155b4ef3466 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/28 19:54 linux-next 8155b4ef3466 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in gfs2_dump_glock
2024/12/20 08:29 linux-next 8155b4ef3466 1d58202c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/19 14:55 linux-next 8503810115fb 1d58202c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/18 08:04 linux-next 7fa366f1b6e3 a0626d3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/11 00:22 linux-next af2ea8ab7a54 cfc402b4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
2024/12/08 17:38 linux-next af2ea8ab7a54 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in gfs2_dump_glock
* Struck through repros no longer work on HEAD.