zram: Can't change algorithm for initialized device zram: Cannot change disksize for initialized device ================================================================== BUG: KASAN: vmalloc-out-of-bounds in ZSTD_decompressSequencesLong_body lib/zstd/decompress/zstd_decompress_block.c:-1 [inline] BUG: KASAN: vmalloc-out-of-bounds in ZSTD_decompressSequencesLong_bmi2+0x5262/0x7980 lib/zstd/decompress/zstd_decompress_block.c:1879 Read of size 64 at addr ffffc90000dc5001 by task syz.4.80/512 CPU: 0 UID: 0 PID: 512 Comm: syz.4.80 Not tainted syzkaller #0 45964a5c932d45c81e53484b258bbb49855afb35 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_address_description+0x71/0x210 mm/kasan/report.c:377 print_report+0x4a/0x70 mm/kasan/report.c:481 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __asan_memmove+0x31/0x80 mm/kasan/shadow.c:94 ZSTD_decompressSequencesLong_body lib/zstd/decompress/zstd_decompress_block.c:-1 [inline] ZSTD_decompressSequencesLong_bmi2+0x5262/0x7980 lib/zstd/decompress/zstd_decompress_block.c:1879 ZSTD_decompressSequencesLong lib/zstd/decompress/zstd_decompress_block.c:1940 [inline] ZSTD_decompressBlock_internal+0x28f/0x7a40 lib/zstd/decompress/zstd_decompress_block.c:2038 ZSTD_decompressFrame lib/zstd/decompress/zstd_decompress.c:891 [inline] ZSTD_decompressMultiFrame+0xee0/0x18a0 lib/zstd/decompress/zstd_decompress.c:981 ZSTD_decompress_usingDDict+0x46/0x70 lib/zstd/decompress/zstd_decompress.c:1493 zstd_decompress_using_ddict+0x42/0x60 lib/zstd/zstd_decompress_module.c:93 zstd_decompress+0x15d/0x240 drivers/block/zram/backend_zstd.c:210 zcomp_decompress+0x12e/0x190 drivers/block/zram/zcomp.c:150 read_from_zspool+0x223/0x2b0 drivers/block/zram/zram_drv.c:2481 zram_read_page drivers/block/zram/zram_drv.c:2498 [inline] zram_bvec_read drivers/block/zram/zram_drv.c:2543 [inline] zram_bio_read drivers/block/zram/zram_drv.c:3137 [inline] zram_submit_bio+0x131c/0x1e50 drivers/block/zram/zram_drv.c:3194 __submit_bio+0x51c/0x9b0 block/blk-core.c:644 __submit_bio_noacct block/blk-core.c:690 [inline] submit_bio_noacct_nocheck+0x5b5/0xab0 block/blk-core.c:753 submit_bio_noacct+0xc0e/0x1620 block/blk-core.c:874 submit_bio+0x424/0x5b0 block/blk-core.c:949 submit_bh_wbc+0x501/0x570 fs/buffer.c:2844 submit_bh fs/buffer.c:2849 [inline] __bh_read fs/buffer.c:3122 [inline] bh_read_nowait include/linux/buffer_head.h:450 [inline] __block_write_begin_int+0x1305/0x1710 fs/buffer.c:2175 iomap_write_begin+0x8ed/0x1870 fs/iomap/buffered-io.c:852 iomap_write_iter fs/iomap/buffered-io.c:980 [inline] iomap_file_buffered_write+0x3ca/0xc60 fs/iomap/buffered-io.c:1064 blkdev_buffered_write block/fops.c:665 [inline] blkdev_write_iter+0x555/0x750 block/fops.c:730 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x762/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f900199de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f900292e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f9001c25fa0 RCX: 00007f900199de99 RDX: 0000000000000040 RSI: 0000200000000500 RDI: 0000000000000003 RBP: 00007f9001a33eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9001c26038 R14: 00007f9001c25fa0 R15: 00007ffe6e87c668 The buggy address belongs to a vmalloc virtual mapping Memory state around the buggy address: ffffc90000dc4f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000dc4f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffffc90000dc5000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90000dc5080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000dc5100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ==================================================================