[lkml]   [2020]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectKASAN: slab-out-of-bounds Read in ovl_check_fb_len

syzbot found the following crash on:

HEAD commit: b85051e7 Merge tag 'fixes-for-5.7-rc6' of git://git.kernel..
git tree: upstream
console output:
kernel config:
dashboard link:
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:

The bug was bisected to:

commit cbe7fba8edfc8cb8e621599e376f8ac5c224fa72
Author: Amir Goldstein <>
Date: Fri Nov 15 11:33:03 2019 +0000

ovl: make sure that real fid is 32bit aligned in memory

bisection log:
final crash:
console output:

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Fixes: cbe7fba8edfc ("ovl: make sure that real fid is 32bit aligned in memory")

BUG: KASAN: slab-out-of-bounds in ovl_check_fb_len+0x171/0x1a0 fs/overlayfs/namei.c:89
Read of size 1 at addr ffff88809727834d by task syz-executor.4/8488

CPU: 0 PID: 8488 Comm: syz-executor.4 Not tainted 5.7.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382
__kasan_report.cold+0x20/0x38 mm/kasan/report.c:511
kasan_report+0x33/0x50 mm/kasan/common.c:625
ovl_check_fb_len+0x171/0x1a0 fs/overlayfs/namei.c:89
ovl_check_fh_len fs/overlayfs/overlayfs.h:358 [inline]
ovl_fh_to_dentry+0x1ab/0x814 fs/overlayfs/export.c:812
exportfs_decode_fh+0x11f/0x717 fs/exportfs/expfs.c:434

This bug is generated by a bot. It may contain errors.
See for more information about syzbot.
syzbot engineers can be reached at

syzbot will keep track of this bug report. See: for how to communicate with syzbot.
For information about bisection process see:
syzbot can test patches for this bug, for details see:

 \ /
  Last update: 2020-05-23 00:24    [W:0.055 / U:5.876 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site