================================================================== BUG: KFENCE: out-of-bounds read in afs_split_string fs/afs/addr_prefs.c:51 [inline] BUG: KFENCE: out-of-bounds read in afs_proc_addr_prefs_write+0x69e/0x15f0 fs/afs/addr_prefs.c:415 Out-of-bounds read at 0xffff88823be67000 (4096B right of kfence-#50): afs_split_string fs/afs/addr_prefs.c:51 [inline] afs_proc_addr_prefs_write+0x69e/0x15f0 fs/afs/addr_prefs.c:415 proc_simple_write+0x117/0x1b0 fs/proc/generic.c:825 pde_write fs/proc/inode.c:330 [inline] proc_reg_write+0x23d/0x330 fs/proc/inode.c:342 do_loop_readv_writev fs/read_write.c:850 [inline] do_loop_readv_writev fs/read_write.c:835 [inline] vfs_writev+0x5df/0xde0 fs/read_write.c:1059 do_writev+0x132/0x340 fs/read_write.c:1103 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#50: 0xffff88823be66000-0xffff88823be66b13, size=2836, cache=kmalloc-4k allocated by task 22965 on cpu 0 at 1325.406007s (0.092312s ago): memdup_user_nul+0x2b/0x120 mm/util.c:302 proc_simple_write+0xc7/0x1b0 fs/proc/generic.c:822 pde_write fs/proc/inode.c:330 [inline] proc_reg_write+0x23d/0x330 fs/proc/inode.c:342 do_loop_readv_writev fs/read_write.c:850 [inline] do_loop_readv_writev fs/read_write.c:835 [inline] vfs_writev+0x5df/0xde0 fs/read_write.c:1059 do_writev+0x132/0x340 fs/read_write.c:1103 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 22965 Comm: syz.5.3143 Tainted: G I 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) Tainted: [I]=FIRMWARE_WORKAROUND Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:afs_split_string fs/afs/addr_prefs.c:51 [inline] RIP: 0010:afs_proc_addr_prefs_write+0x69e/0x15f0 fs/afs/addr_prefs.c:415 Code: 00 00 00 e8 84 69 35 fe 48 83 c3 01 48 89 d8 48 89 da 48 c1 e8 03 83 e2 07 42 0f b6 04 38 38 d0 7f 08 84 c0 0f 85 03 0d 00 00 <44> 0f b6 2b 49 8d bd c0 32 14 8d 4d 89 ec 48 89 f8 48 89 fa 48 c1 RSP: 0018:ffffc900048a7a50 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88823be67000 RCX: ffffc90018a68000 RDX: 0000000000000000 RSI: ffffffff8385f9ec RDI: 0000000000000001 RBP: ffffc900048a7bf0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff82210dba R12: 00000000000000ad R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 00007fa9eeede6c0(0000) GS:ffff888124721000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823be67000 CR3: 000000007862c000 CR4: 00000000003526f0 Call Trace: proc_simple_write+0x117/0x1b0 fs/proc/generic.c:825 pde_write fs/proc/inode.c:330 [inline] proc_reg_write+0x23d/0x330 fs/proc/inode.c:342 do_loop_readv_writev fs/read_write.c:850 [inline] do_loop_readv_writev fs/read_write.c:835 [inline] vfs_writev+0x5df/0xde0 fs/read_write.c:1059 do_writev+0x132/0x340 fs/read_write.c:1103 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa9edf8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa9eeede038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007fa9ee1b5fa0 RCX: 00007fa9edf8e929 RDX: 0000000000000003 RSI: 0000200000000080 RDI: 0000000000000003 RBP: 00007fa9ee010b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fa9ee1b5fa0 R15: 00007fffd6c58d98 ================================================================== ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 e8 add %ch,%al 4: 84 69 35 test %ch,0x35(%rcx) 7: fe 48 83 decb -0x7d(%rax) a: c3 ret b: 01 48 89 add %ecx,-0x77(%rax) e: d8 48 89 fmuls -0x77(%rax) 11: da 48 c1 fimull -0x3f(%rax) 14: e8 03 83 e2 07 call 0x7e2831c 19: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax 1e: 38 d0 cmp %dl,%al 20: 7f 08 jg 0x2a 22: 84 c0 test %al,%al 24: 0f 85 03 0d 00 00 jne 0xd2d * 2a: 44 0f b6 2b movzbl (%rbx),%r13d <-- trapping instruction 2e: 49 8d bd c0 32 14 8d lea -0x72ebcd40(%r13),%rdi 35: 4d 89 ec mov %r13,%r12 38: 48 89 f8 mov %rdi,%rax 3b: 48 89 fa mov %rdi,%rdx 3e: 48 rex.W 3f: c1 .byte 0xc1