Re: [BUG] afs: ERR_PTR dereference in afs_lookup_server() error path

[Farhad Alemi]

Hi David,

Tried it w 7.3.0-rc2-00006-g28924df2a08f:

[   43.872155][ T9500] BUG: unable to handle page fault for address:
ffffffffffffffb1
[   43.873156][ T9500] #PF: supervisor read access in kernel mode
[   43.873889][ T9500] #PF: error_code(0x0000) - not-present page
[   43.874619][ T9500] PGD e94b067 P4D e94b067 PUD e94d067 PMD 0
[   43.875371][ T9500] Oops: Oops: 0000 [#1] SMP KASAN NOPTI
[   43.876050][ T9500] CPU: 1 UID: 0 PID: 9500 Comm: repro Not tainted
7.3.0-rc2-00006-g28924df2a08f #1 PREEMPT(full)
[   43.877196][ T9500] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   43.878156][ T9500] RIP: 0010:afs_put_addrlist+0x3c/0x110
[   43.878682][ T9500] Code: aa 39 17 fe 4d 85 f6 74 7d 49 8d 7e 18 48
89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 0f
85 af 00 00 00 <41> 8b 6e 18 4d 8d 66 10 4c 89 e7 be 04 00 00 00 e8 9f
35 87 fe 41
[   43.880425][ T9500] RSP: 0018:ffffc90007b67618 EFLAGS: 00010246
[   43.880980][ T9500] RAX: 0000000000000000 RBX: 0000000000000009
RCX: dffffc0000000000
[   43.881803][ T9500] RDX: 0000000000000000 RSI: 0000000000000009
RDI: ffffffffffffffb1
[   43.882537][ T9500] RBP: 0000000000000000 R08: ffff88810ea66a87
R09: 1ffff11021d4cd50
[   43.883253][ T9500] R10: dffffc0000000000 R11: ffffed1021d4cd51
R12: ffff88810d211000
[   43.883970][ T9500] R13: ffff88810ea66800 R14: ffffffffffffff99
R15: ffffffffffffff99
[   43.884688][ T9500] FS:  000000003957f400(0000)
GS:ffff8881da58b000(0000) knlGS:0000000000000000
[   43.885493][ T9500] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.886088][ T9500] CR2: ffffffffffffffb1 CR3: 0000000113534000
CR4: 0000000000752ef0
[   43.886811][ T9500] PKRU: 55555554
[   43.887141][ T9500] Call Trace:
[   43.887456][ T9500]  <TASK>
[   43.887733][ T9500]  afs_lookup_server+0xe0a/0x1120
[   43.888196][ T9500]  ? afs_alloc_server_list+0x7da/0x1140
[   43.888704][ T9500]  afs_alloc_server_list+0x7da/0x1140
[   43.889196][ T9500]  ? __pfx_afs_alloc_server_list+0x10/0x10
[   43.889754][ T9500]  ? __raw_spin_lock_init+0x45/0x100
[   43.890262][ T9500]  ? afs_create_volume+0x96d/0x1130
[   43.890766][ T9500]  afs_create_volume+0x994/0x1130
[   43.891294][ T9500]  ? __pfx_afs_create_volume+0x10/0x10
[   43.891791][ T9500]  ? __asan_memset+0x22/0x50
[   43.892221][ T9500]  afs_cell_detect_alias+0x41d/0x1170
[   43.892719][ T9500]  ? __pfx_afs_cell_detect_alias+0x10/0x10
[   43.893249][ T9500]  ? afs_request_key+0x1c8/0x250
[   43.893708][ T9500]  ? __mutex_unlock_slowpath+0x731/0x900
[   43.894230][ T9500]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   43.894781][ T9500]  ? afs_request_key+0x13c/0x250
[   43.895235][ T9500]  afs_get_tree+0x24b/0x12b0
[   43.895665][ T9500]  vfs_get_tree+0x92/0x2a0
[   43.896077][ T9500]  do_new_mount+0x341/0xd30
[   43.896498][ T9500]  ? apparmor_capable+0x126/0x170
[   43.896960][ T9500]  ? __pfx_do_new_mount+0x10/0x10
[   43.897422][ T9500]  ? ns_capable+0x89/0xe0
[   43.897821][ T9500]  ? user_path_at+0xd4/0x160
[   43.898254][ T9500]  __se_sys_mount+0x31d/0x420
[   43.898689][ T9500]  ? __pfx___se_sys_mount+0x10/0x10
[   43.899164][ T9500]  ? __x64_sys_mount+0x20/0xc0
[   43.899606][ T9500]  do_syscall_64+0x155/0x510
[   43.900033][ T9500]  ? trace_irq_disable+0x3b/0x140
[   43.900499][ T9500]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   43.901051][ T9500]  ? clear_bhb_loop+0x30/0x80
[   43.901554][ T9500]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   43.902093][ T9500] RIP: 0033:0x426ffe
[   43.902464][ T9500] Code: 0a 00 01 00 00 00 eb 85 e8 0f 09 00 00 66
2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 a5
00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8
64 89 01 48
[   43.904183][ T9500] RSP: 002b:00007fff93751b68 EFLAGS: 00000207
ORIG_RAX: 00000000000000a5
[   43.904940][ T9500] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 0000000000426ffe
[   43.905655][ T9500] RDX: 00000000004a2103 RSI: 00000000004a20fa
RDI: 00000000004a2107
[   43.906369][ T9500] RBP: 00007fff93751b90 R08: 0000000000000000
R09: 0000000000000000
[   43.907082][ T9500] R10: 0000000000000000 R11: 0000000000000207
R12: 00007fff93751cb8
[   43.907837][ T9500] R13: 00007fff93751cc8 R14: 0000000000000002
R15: 00000000004cba40
[   43.908591][ T9500]  </TASK>
[   43.908893][ T9500] Modules linked in:
[   43.909258][ T9500] CR2: ffffffffffffffb1
[   43.909646][ T9500] ---[ end trace 0000000000000000 ]---
[   43.910172][ T9500] RIP: 0010:afs_put_addrlist+0x3c/0x110
[   43.910184][ T9500] Code: aa 39 17 fe 4d 85 f6 74 7d 49 8d 7e 18 48
89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 0f
85 af 00 00 00 <41> 8b 6e 18 4d 8d 66 10 4c 89 e7 be 04 00 00 00 e8 9f
35 87 fe 41
[   43.910190][ T9500] RSP: 0018:ffffc90007b67618 EFLAGS: 00010246
[   43.910196][ T9500] RAX: 0000000000000000 RBX: 0000000000000009
RCX: dffffc0000000000
[   43.910201][ T9500] RDX: 0000000000000000 RSI: 0000000000000009
RDI: ffffffffffffffb1
[   43.910205][ T9500] RBP: 0000000000000000 R08: ffff88810ea66a87
R09: 1ffff11021d4cd50
[   43.910210][ T9500] R10: dffffc0000000000 R11: ffffed1021d4cd51
R12: ffff88810d211000
[   43.910216][ T9500] R13: ffff88810ea66800 R14: ffffffffffffff99
R15: ffffffffffffff99
[   43.910221][ T9500] FS:  000000003957f400(0000)
GS:ffff8881da58b000(0000) knlGS:0000000000000000
[   43.910227][ T9500] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.910232][ T9500] CR2: ffffffffffffffb1 CR3: 0000000113534000
CR4: 0000000000752ef0
[   43.910238][ T9500] PKRU: 55555554
[   43.910244][ T9500] Kernel panic - not syncing: Fatal exception
[   43.919939][ T9500] Kernel Offset: disabled
[   43.920340][ T9500] Rebooting in 86400 seconds.

Reproducer attached; thanks!

On Wed, Sep 2, 2026 at 4:41 AM David Howells <dhowells@xxxxxxxxxx> wrote:
>
> Hi Farhad,
>
> > While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> > SEFCOM lab, we hit the crash below. Crash reports can be found here:
>
> Have you tried it with 7.3-rc1?
>
> >   BUG: unable to handle page fault for address: ffffffffffffff9f
> >   RIP: 0010:afs_put_addrlist+0x43/0x250 fs/afs/addr_list.c:38
> >   afs_lookup_server+0xd3f/0x1020 fs/afs/server.c:243
> >   afs_alloc_server_list+0x800/0x11a0 fs/afs/server_list.c:82
> >   afs_create_volume+0x995/0x1290 fs/afs/volume.c:227
> >   afs_get_tree+0x955/0x10b0 fs/afs/super.c:555
>
> It looks like alist is 0xffffffffffffff9f, but it's not immediately obvious
> how it could be anything other than a valid pointer at that point.
>
> > Our reproducer.c is available upon request.
>
> If I could have that, please?
>
> Thanks,
> David
>

Attachment: reproducer.c
Description: Binary data