================================================================== BUG: KASAN: slab-out-of-bounds in __fb_pad_aligned_buffer include/linux/fb.h:655 [inline] BUG: KASAN: slab-out-of-bounds in bit_putcs_aligned drivers/video/fbdev/core/bitblit.c:96 [inline] BUG: KASAN: slab-out-of-bounds in bit_putcs+0x132a/0x1bf0 drivers/video/fbdev/core/bitblit.c:185 Read of size 1 at addr ffff8880a81ce230 by task syz-executor983/6875 CPU: 1 PID: 6875 Comm: syz-executor983 Not tainted 5.8.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1f0/0x31e lib/dump_stack.c:118 print_address_description+0x66/0x5a0 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report+0x132/0x1d0 mm/kasan/report.c:530 __fb_pad_aligned_buffer include/linux/fb.h:655 [inline] bit_putcs_aligned drivers/video/fbdev/core/bitblit.c:96 [inline] bit_putcs+0x132a/0x1bf0 drivers/video/fbdev/core/bitblit.c:185 fbcon_putcs+0x790/0xaf0 drivers/video/fbdev/core/fbcon.c:1362 do_update_region+0x462/0x620 drivers/tty/vt/vt.c:683 redraw_screen+0xc30/0x16f0 drivers/tty/vt/vt.c:1029 vc_do_resize+0x1541/0x1ce0 drivers/tty/vt/vt.c:1314 vt_ioctl+0x3185/0x3ec0 drivers/tty/vt/vt_ioctl.c:901 tty_ioctl+0xee4/0x15c0 drivers/tty/tty_io.c:2656 vfs_ioctl fs/ioctl.c:48 [inline] ksys_ioctl fs/ioctl.c:753 [inline] __do_sys_ioctl fs/ioctl.c:762 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:760 do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4403a9 Code: Bad RIP value. RSP: 002b:00007fff9bff6948 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403a9 RDX: 0000000020000080 RSI: 000000000000560a RDI: 0000000000000004 RBP: 00000000006ca018 R08: 000000000000000d R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401c10 R13: 0000000000401ca0 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 6875: save_stack mm/kasan/common.c:48 [inline] set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc+0x103/0x140 mm/kasan/common.c:494 __do_kmalloc mm/slab.c:3656 [inline] __kmalloc+0x24b/0x330 mm/slab.c:3665 kmalloc include/linux/slab.h:560 [inline] fbcon_set_font+0x2c4/0x970 drivers/video/fbdev/core/fbcon.c:2673 con_font_set drivers/tty/vt/vt.c:4571 [inline] con_font_op+0xebc/0x1630 drivers/tty/vt/vt.c:4636 vt_ioctl+0x179d/0x3ec0 drivers/tty/vt/vt_ioctl.c:265 tty_ioctl+0xee4/0x15c0 drivers/tty/tty_io.c:2656 vfs_ioctl fs/ioctl.c:48 [inline] ksys_ioctl fs/ioctl.c:753 [inline] __do_sys_ioctl fs/ioctl.c:762 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:760 do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 6840: save_stack mm/kasan/common.c:48 [inline] set_track mm/kasan/common.c:56 [inline] kasan_set_free_info mm/kasan/common.c:316 [inline] __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x220 mm/slab.c:3757 skb_release_all net/core/skbuff.c:664 [inline] _kfree_skb_defer net/core/skbuff.c:872 [inline] napi_consume_skb+0x137/0x300 net/core/skbuff.c:917 free_old_xmit_skbs+0xb8/0x200 drivers/net/virtio_net.c:1389 virtnet_poll_cleantx drivers/net/virtio_net.c:1432 [inline] virtnet_poll+0x284/0xc80 drivers/net/virtio_net.c:1449 napi_poll net/core/dev.c:6684 [inline] net_rx_action+0x615/0x10e0 net/core/dev.c:6752 __do_softirq+0x268/0x80c kernel/softirq.c:292 The buggy address belongs to the object at ffff8880a81ce000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 560 bytes inside of 1024-byte region [ffff8880a81ce000, ffff8880a81ce400) The buggy address belongs to the page: page:ffffea0002a07380 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00029a5948 ffffea0002a14708 ffff8880aa400c40 raw: 0000000000000000 ffff8880a81ce000 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a81ce100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880a81ce180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880a81ce200: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8880a81ce280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a81ce300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================