KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr

Status: upstream: reported C repro on 2026/08/14 09:05
Subsystems: netfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+62b392c7348147ad767d@syzkaller.appspotmail.com
First crash: 53d, last: 14d
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
91003057 repro-c Reproduced: ✅ ❓ KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr 2026/08/13 20:02 2026/08/13 21:31 2026/08/13 23:08 0165196a
e6c8d8cd assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr 2026/08/02 01:21 2026/08/02 01:21 2026/08/02 02:12 e611ffe1
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] cachefiles: Fix OOB access in coherency trace 1 (1) 2026/08/16 18:55
[syzbot] [netfs?] KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr 0 (1) 2026/08/14 09:05
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/09/22 13:58 13m retest repro upstream no crash job log log
2026/08/14 08:23 14m nogikh@google.com upstream report job log log

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in __swab64p include/uapi/linux/swab.h:202 [inline]
BUG: KASAN: slab-out-of-bounds in __be64_to_cpup include/uapi/linux/byteorder/little_endian.h:75 [inline]
BUG: KASAN: slab-out-of-bounds in cachefiles_set_object_xattr+0x410/0x700 fs/cachefiles/xattr.c:89
Read of size 8 at addr ffff8880130d9652 by task kworker/u4:4/53

CPU: 0 UID: 0 PID: 53 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: fscache fscache_cookie_worker
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 __swab64p include/uapi/linux/swab.h:202 [inline]
 __be64_to_cpup include/uapi/linux/byteorder/little_endian.h:75 [inline]
 cachefiles_set_object_xattr+0x410/0x700 fs/cachefiles/xattr.c:89
 cachefiles_commit_object fs/cachefiles/interface.c:313 [inline]
 cachefiles_clean_up_object fs/cachefiles/interface.c:338 [inline]
 cachefiles_withdraw_cookie+0x50a/0x8d0 fs/cachefiles/interface.c:373
 fscache_cookie_state_machine fs/netfs/fscache_cookie.c:780 [inline]
 fscache_cookie_worker+0x38e/0x1170 fs/netfs/fscache_cookie.c:835
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 53:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_noprof+0x36b/0x720 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 cachefiles_set_object_xattr+0xb7/0x700 fs/cachefiles/xattr.c:53
 cachefiles_commit_object fs/cachefiles/interface.c:313 [inline]
 cachefiles_clean_up_object fs/cachefiles/interface.c:338 [inline]
 cachefiles_withdraw_cookie+0x50a/0x8d0 fs/cachefiles/interface.c:373
 fscache_cookie_state_machine fs/netfs/fscache_cookie.c:780 [inline]
 fscache_cookie_worker+0x38e/0x1170 fs/netfs/fscache_cookie.c:835
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880130d9640
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 18 bytes inside of
 allocated 22-byte region [ffff8880130d9640, ffff8880130d9656)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880130d9680 pfn:0x130d9
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88801b041780 ffffea0000009550 ffffea00004c5810
raw: ffff8880130d9680 000000000040003e 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4660, tgid 4660 (mkdir), ts 58923381398
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x39b/0x600 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 slab_free_hook mm/slub.c:2700 [inline]
 slab_free mm/slub.c:6499 [inline]
 kmem_cache_free+0x156/0x650 mm/slub.c:6626
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x73a/0x2360 kernel/exit.c:1008
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1151
 __do_sys_exit_group kernel/exit.c:1162 [inline]
 __se_sys_exit_group kernel/exit.c:1160 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1160
 x64_sys_call+0x18c6/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 4660 tgid 4660 ts 58921380102 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962
 tlb_batch_list_free mm/mmu_gather.c:161 [inline]
 tlb_finish_mmu+0x13e/0x220 mm/mmu_gather.c:552
 exit_mmap+0x4b2/0x9f0 mm/mmap.c:1328
 __mmput+0x118/0x420 kernel/fork.c:1193
 exit_mm+0x221/0x2d0 kernel/exit.c:614
 do_exit+0x6cd/0x2360 kernel/exit.c:996
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1151
 __do_sys_exit_group kernel/exit.c:1162 [inline]
 __se_sys_exit_group kernel/exit.c:1160 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1160
 x64_sys_call+0x18c6/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880130d9500: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
 ffff8880130d9580: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
>ffff8880130d9600: 00 00 03 fc fc fc fc fc 00 00 06 fc fc fc fc fc
                                                 ^
 ffff8880130d9680: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc
 ffff8880130d9700: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/08 13:39 upstream 28924df2a08f 351387c4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/09/08 06:23 upstream 28924df2a08f 680aa3e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/09/05 02:45 upstream 654ae5d73c05 4f7b22a0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/09/03 09:53 upstream 940de590b839 6a988719 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/08/31 03:50 upstream a23cbb05744b 2f52988a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/08/30 15:38 upstream 08dbfad3f504 2f52988a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/08/22 12:27 upstream 818bebeb63dd 1e72964b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/08/14 09:04 upstream 2f1baf1fc892 7664cf44 .config console log report C ci-qemu-upstream KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/07/31 20:11 upstream 8ba098e6b6ff 7664cf44 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
2026/09/06 09:21 upstream 9f0346dcbea3 4f7b22a0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-out-of-bounds Read in cachefiles_set_object_xattr
* Struck through repros no longer work on HEAD.