linux-kernel - Re: [syzbot] [xfs?] KASAN: slab-use-after-free Read in xfs_buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <696ddf5a.050a0220.3390f1.003b.GAE@google.com>
Date: Sun, 18 Jan 2026 23:38:02 -0800
From: syzbot <syzbot+0391d34e801643e2809b@...kaller.appspotmail.com>
To: hch@...radead.org, linux-kernel@...r.kernel.org, linux-xfs@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [xfs?] KASAN: slab-use-after-free Read in xfs_buf_rele (4)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: MAX_LOCKDEP_CHAINS too low!

BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 1610 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Workqueue: xfs_iwalk-13497 xfs_pwork_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 add_chain_cache kernel/locking/lockdep.c:-1 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3855 [inline]
 validate_chain kernel/locking/lockdep.c:3876 [inline]
 __lock_acquire+0xf9c/0x30a4 kernel/locking/lockdep.c:5237
 lock_acquire+0x140/0x2e0 kernel/locking/lockdep.c:5868
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
 debug_object_activate+0x7c/0x460 lib/debugobjects.c:818
 debug_timer_activate kernel/time/timer.c:793 [inline]
 __mod_timer+0x8c4/0xd00 kernel/time/timer.c:1124
 add_timer_global+0x88/0xc0 kernel/time/timer.c:1283
 __queue_delayed_work+0x218/0x2c8 kernel/workqueue.c:2520
 queue_delayed_work_on+0xe4/0x194 kernel/workqueue.c:2555
 queue_delayed_work include/linux/workqueue.h:684 [inline]
 xfs_reclaim_work_queue+0x154/0x244 fs/xfs/xfs_icache.c:211
 xfs_perag_set_inode_tag+0x19c/0x4bc fs/xfs/xfs_icache.c:263
 xfs_inodegc_set_reclaimable+0x1e0/0x444 fs/xfs/xfs_icache.c:1917
 xfs_inode_mark_reclaimable+0x2c8/0x10f8 fs/xfs/xfs_icache.c:2252
 xfs_fs_destroy_inode+0x2fc/0x618 fs/xfs/xfs_super.c:712
 destroy_inode fs/inode.c:396 [inline]
 evict+0x7cc/0xa74 fs/inode.c:861
 iput_final fs/inode.c:1954 [inline]
 iput+0xc54/0xfdc fs/inode.c:2006
 xfs_irele+0xd0/0x2ac fs/xfs/xfs_inode.c:2662
 xfs_qm_dqusage_adjust+0x4f4/0x5b0 fs/xfs/xfs_qm.c:1411
 xfs_iwalk_ag_recs+0x404/0x7c8 fs/xfs/xfs_iwalk.c:209
 xfs_iwalk_run_callbacks+0x1c0/0x3e8 fs/xfs/xfs_iwalk.c:370
 xfs_iwalk_ag+0x6ac/0x82c fs/xfs/xfs_iwalk.c:473
 xfs_iwalk_ag_work+0xf8/0x1a0 fs/xfs/xfs_iwalk.c:620
 xfs_pwork_work+0x80/0x1a4 fs/xfs/xfs_pwork.c:47
 process_one_work+0x7c0/0x1558 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x958/0xed8 kernel/workqueue.c:3421
 kthread+0x5fc/0x75c kernel/kthread.c:463
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844

Tested on:

commit:         855e81db xfs: switch (back) to a per-buftarg buffer hash
git tree:       git://git.infradead.org/users/hch/xfs.git xfs-buf-hash
console output: https://syzkaller.appspot.com/x/log.txt?x=162bb63a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1707867b02964a26
dashboard link: https://syzkaller.appspot.com/bug?extid=0391d34e801643e2809b
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

Note: no patches were applied.