================================================================== BUG: KFENCE: out-of-bounds read in afs_split_string fs/afs/addr_prefs.c:51 [inline] BUG: KFENCE: out-of-bounds read in afs_proc_addr_prefs_write+0x69e/0x15f0 fs/afs/addr_prefs.c:415 Out-of-bounds read at 0xffff88823bf73000 (8B right of kfence-#184): afs_split_string fs/afs/addr_prefs.c:51 [inline] afs_proc_addr_prefs_write+0x69e/0x15f0 fs/afs/addr_prefs.c:415 proc_simple_write+0x114/0x1b0 fs/proc/generic.c:825 pde_write fs/proc/inode.c:330 [inline] proc_reg_write+0x240/0x330 fs/proc/inode.c:342 do_loop_readv_writev fs/read_write.c:850 [inline] do_loop_readv_writev fs/read_write.c:835 [inline] vfs_writev+0x5dc/0xde0 fs/read_write.c:1059 do_writev+0x132/0x340 fs/read_write.c:1103 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#184: 0xffff88823bf72ff8-0xffff88823bf72ffe, size=7, cache=kmalloc-8 allocated by task 19417 on cpu 1 at 1108.414332s (0.075668s ago): memdup_user_nul+0x2b/0x120 mm/util.c:302 proc_simple_write+0xc7/0x1b0 fs/proc/generic.c:822 pde_write fs/proc/inode.c:330 [inline] proc_reg_write+0x240/0x330 fs/proc/inode.c:342 do_loop_readv_writev fs/read_write.c:850 [inline] do_loop_readv_writev fs/read_write.c:835 [inline] vfs_writev+0x5dc/0xde0 fs/read_write.c:1059 do_writev+0x132/0x340 fs/read_write.c:1103 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 19417 Comm: syz.1.3115 Not tainted 6.15.0-syzkaller-08486-gf66bc387efbe #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:afs_split_string fs/afs/addr_prefs.c:51 [inline] RIP: 0010:afs_proc_addr_prefs_write+0x69e/0x15f0 fs/afs/addr_prefs.c:415 Code: 00 00 00 e8 24 af 35 fe 48 83 c3 01 48 89 d8 48 89 da 48 c1 e8 03 83 e2 07 42 0f b6 04 38 38 d0 7f 08 84 c0 0f 85 03 0d 00 00 <44> 0f b6 2b 49 8d bd 80 34 f2 8c 4d 89 ec 48 89 f8 48 89 fa 48 c1 RSP: 0018:ffffc9000f807a50 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88823bf73000 RCX: ffffc90018d89000 RDX: 0000000000000000 RSI: ffffffff8385972c RDI: 0000000000000001 RBP: ffffc9000f807bf0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff8220a76a R12: 00000000000000ad R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 00007f0e98bd16c0(0000) GS:ffff888124a7f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bf73000 CR3: 0000000076114000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: proc_simple_write+0x114/0x1b0 fs/proc/generic.c:825 pde_write fs/proc/inode.c:330 [inline] proc_reg_write+0x240/0x330 fs/proc/inode.c:342 do_loop_readv_writev fs/read_write.c:850 [inline] do_loop_readv_writev fs/read_write.c:835 [inline] vfs_writev+0x5dc/0xde0 fs/read_write.c:1059 do_writev+0x132/0x340 fs/read_write.c:1103 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0e97d8e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0e98bd1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f0e97fb5fa0 RCX: 00007f0e97d8e969 RDX: 0000000000000003 RSI: 0000200000000040 RDI: 0000000000000009 RBP: 00007f0e97e10ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f0e97fb5fa0 R15: 00007ffc1332ef98 ================================================================== ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 e8 add %ch,%al 4: 24 af and $0xaf,%al 6: 35 fe 48 83 c3 xor $0xc38348fe,%eax b: 01 48 89 add %ecx,-0x77(%rax) e: d8 48 89 fmuls -0x77(%rax) 11: da 48 c1 fimull -0x3f(%rax) 14: e8 03 83 e2 07 call 0x7e2831c 19: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax 1e: 38 d0 cmp %dl,%al 20: 7f 08 jg 0x2a 22: 84 c0 test %al,%al 24: 0f 85 03 0d 00 00 jne 0xd2d * 2a: 44 0f b6 2b movzbl (%rbx),%r13d <-- trapping instruction 2e: 49 8d bd 80 34 f2 8c lea -0x730dcb80(%r13),%rdi 35: 4d 89 ec mov %r13,%r12 38: 48 89 f8 mov %rdi,%rax 3b: 48 89 fa mov %rdi,%rdx 3e: 48 rex.W 3f: c1 .byte 0xc1