syzbot


KASAN: wild-memory-access Read in get_futex_key

Status: upstream: reported C repro on 2025/05/27 13:36
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+9afaf6749e3a7aa1bdf3@syzkaller.appspotmail.com
First crash: 3d01h, last: 4h47m
Discussions (2)
Title Replies (including bot) Last reply
[PATCH 3/3] futex: Handle invalid node numbers supplied by user 1 (1) 2025/05/28 08:55
[syzbot] [kernel?] KASAN: wild-memory-access Read in get_futex_key 3 (4) 2025/05/27 15:39

Sample crash report:
==================================================================
BUG: KASAN: wild-memory-access in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: wild-memory-access in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: wild-memory-access in node_state include/linux/nodemask.h:429 [inline]
BUG: KASAN: wild-memory-access in get_futex_key+0x595/0x1540 kernel/futex/core.c:587
Read of size 8 at addr 1fffffff818b9088 by task syz-executor931/5831

CPU: 0 UID: 0 PID: 5831 Comm: syz-executor931 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 node_state include/linux/nodemask.h:429 [inline]
 get_futex_key+0x595/0x1540 kernel/futex/core.c:587
 futex_wake+0xea/0x530 kernel/futex/waitwake.c:165
 __do_sys_futex_wake kernel/futex/syscalls.c:354 [inline]
 __se_sys_futex_wake kernel/futex/syscalls.c:338 [inline]
 __x64_sys_futex_wake+0x23d/0x2b0 kernel/futex/syscalls.c:338
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fec9a512429
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe390e0498 EFLAGS: 00000246 ORIG_RAX: 00000000000001c6
RAX: ffffffffffffffda RBX: 00007ffe390e0678 RCX: 00007fec9a512429
RDX: 0000000000000006 RSI: 0000000000000008 RDI: 0000200000000140
RBP: 00007fec9a585610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe390e0668 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/27 13:30 upstream 785cdec46e92 874a1386 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
2025/05/27 12:17 upstream 785cdec46e92 874a1386 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
2025/05/27 10:58 upstream 785cdec46e92 874a1386 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
2025/05/27 09:42 upstream 785cdec46e92 874a1386 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
2025/05/30 05:28 upstream e0797d3b91de 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
2025/05/28 13:10 upstream c89756bcf406 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
2025/05/27 11:19 upstream 785cdec46e92 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
2025/05/27 08:22 upstream 785cdec46e92 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: wild-memory-access Read in get_futex_key
* Struck through repros no longer work on HEAD.