6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Denis Efremov (Oracle) [ Upstream commit 66be62ee5d64b6ad1285978644798d8611add931 ] request_done() formats "request done %d" into a buffer on its stack and passes it to reschedule_timeout(), which keeps the pointer in timeout_message. show_floppy() prints timeout_message long after request_done() has returned, e.g. from result() in the interrupt handler, and reads a dead stack frame: BUG: KASAN: stack-out-of-bounds in string+0x39c/0x3d0 lib/vsprintf.c:720 Read of size 1 at addr ffffc900003cfc70 by task swapper/3/0 Call Trace: ... show_floppy+0xb1/0x45f drivers/block/floppy.c:1838 result.cold+0x2b/0x30 drivers/block/floppy.c:1183 floppy_interrupt+0x191/0x340 drivers/block/floppy.c:1755 floppy_hardint+0x1a7/0x200 arch/x86/include/asm/floppy.h:66 uptodate is either 0 or 1, so pass one of two string literals instead. Cc: stable@vger.kernel.org Fixes: 73507e6cd8dc ("drivers/block/floppy.c: remove unnecessary argument from [__]reschedule_timeout") Reported-by: syzbot+874c2707f97fac24b090@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=874c2707f97fac24b090 Link: https://patch.msgid.link/20260924094839.3239569-1-efremov@linux.com Signed-off-by: Denis Efremov (Oracle) Signed-off-by: Sasha Levin --- drivers/block/floppy.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index c28786e0fe1c8..3ec5453672c15 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -2278,11 +2278,10 @@ static void request_done(int uptodate) { struct request *req = current_req; int block; - char msg[sizeof("request done ") + sizeof(int) * 3]; probing = 0; - snprintf(msg, sizeof(msg), "request done %d", uptodate); - reschedule_timeout(MAXTIMEOUT, msg); + reschedule_timeout(MAXTIMEOUT, + uptodate ? "request done 1" : "request done 0"); if (!req) { pr_info("floppy.c: no request in request_done\n"); -- 2.53.0