syzbot

 sign-in | mailing list | source | docs
🐞 Open [1490]
≡ Subsystems
🐞 Fixed [6693]
🐞 Invalid [17166]
⬇ Missing Backports [216]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: global-out-of-bounds Read in io_uring_show_fdinfo

Status: upstream: reported C repro on 2025/10/30 22:34
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+b883b008a0b1067d5833@syzkaller.appspotmail.com
First crash: 1d23h, last: 1d20h
Cause bisection: introduced by (bisect log) :
commit 101e596e7404d07a85b38358a392009503aad797
Author: Jens Axboe <axboe@kernel.dk>
Date: Tue Oct 28 01:09:28 2025 +0000

  io_uring/fdinfo: cap SQ iteration at max SQ entries

Crash: KASAN: global-out-of-bounds Read in io_uring_show_fdinfo (log)
Repro: C syz .config
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [io-uring?] KASAN: global-out-of-bounds Read in io_uring_show_fdinfo 2 (4) 2025/10/30 23:56
[PATCH] io_uring/fdinfo: validate opcode before checking if it's an 128b one 1 (1) 2025/10/30 23:10
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in io_uring_show_fdinfo (4) io-uring 2 C done 28 8d15h 7d23h 0/29 closed as invalid on 2025/10/24 00:49
upstream general protection fault in io_uring_show_fdinfo (2) io-uring 2 C done 19 365d 364d 28/29 fixed on 2024/12/16 10:37
upstream general protection fault in io_uring_show_fdinfo (3) io-uring 2 C 9 9d13h 9d04h 0/29 closed as invalid on 2025/10/22 16:57
upstream KASAN: slab-out-of-bounds Read in io_uring_show_fdinfo io-uring 19 C done 5 1111d 1117d 22/29 fixed on 2023/02/24 13:50
upstream general protection fault in io_uring_show_fdinfo io-uring 2 C done 17 782d 791d 23/29 fixed on 2023/10/12 12:48
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2025/10/30 23:12 24m axboe@kernel.dk https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git for-next OK log

Sample crash report:
==================================================================
BUG: KASAN: global-out-of-bounds in __io_uring_show_fdinfo io_uring/fdinfo.c:111 [inline]
BUG: KASAN: global-out-of-bounds in io_uring_show_fdinfo+0x86d/0x1830 io_uring/fdinfo.c:257
Read of size 2 at addr ffffffff8bbe27f0 by task syz.0.17/6005

CPU: 0 UID: 0 PID: 6005 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 __io_uring_show_fdinfo io_uring/fdinfo.c:111 [inline]
 io_uring_show_fdinfo+0x86d/0x1830 io_uring/fdinfo.c:257
 seq_show+0x5bc/0x730 fs/proc/fd.c:68
 traverse+0x1ee/0x580 fs/seq_file.c:111
 seq_read_iter+0xd08/0xe20 fs/seq_file.c:195
 seq_read+0x369/0x480 fs/seq_file.c:162
 do_loop_readv_writev fs/read_write.c:847 [inline]
 vfs_readv+0x5aa/0x850 fs/read_write.c:1020
 do_preadv fs/read_write.c:1132 [inline]
 __do_sys_preadv fs/read_write.c:1179 [inline]
 __se_sys_preadv fs/read_write.c:1174 [inline]
 __x64_sys_preadv+0x197/0x2a0 fs/read_write.c:1174
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f32f7f8efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdf8569278 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00007f32f81e5fa0 RCX: 00007f32f7f8efc9
RDX: 0000000000000001 RSI: 00002000000005c0 RDI: 0000000000000004
RBP: 00007f32f8011f91 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f32f81e5fa0 R14: 00007f32f81e5fa0 R15: 0000000000000005
 </TASK>

The buggy address belongs to the variable:
 .str.15+0x10/0x20

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbbe2
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00002ef888 ffffea00002ef888 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff8bbe2680: 00 03 f9 f9 00 04 f9 f9 00 01 f9 f9 00 04 f9 f9
 ffffffff8bbe2700: 00 00 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9
>ffffffff8bbe2780: 00 07 f9 f9 07 f9 f9 f9 00 05 f9 f9 00 05 f9 f9
                                                             ^
 ffffffff8bbe2800: 00 f9 f9 f9 00 02 f9 f9 07 f9 f9 f9 06 f9 f9 f9
 ffffffff8bbe2880: 00 05 f9 f9 06 f9 f9 f9 05 f9 f9 f9 06 f9 f9 f9
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/30 00:41 linux-next f9ba12abc528 fd2207e7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: global-out-of-bounds Read in io_uring_show_fdinfo
2025/10/30 00:01 linux-next f9ba12abc528 fd2207e7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: global-out-of-bounds Read in io_uring_show_fdinfo
2025/10/29 23:24 linux-next f9ba12abc528 fd2207e7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: global-out-of-bounds Read in io_uring_show_fdinfo
2025/10/29 21:51 linux-next f9ba12abc528 fd2207e7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: global-out-of-bounds Read in io_uring_show_fdinfo
2025/10/29 21:51 linux-next f9ba12abc528 fd2207e7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: global-out-of-bounds Read in io_uring_show_fdinfo
* Struck through repros no longer work on HEAD.