KASAN: stack-out-of-bounds Read in unwind_next_frame (6)

Status: moderation: reported on 2026/09/07 01:44
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+26de5b9817f739b2ba99@syzkaller.appspotmail.com
First crash: 33d, last: 7d12h
▶ ▼ ✨ AI Jobs (7)
ID Workflow Result Correct Bug Created Started Finished Revision
c8747141 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/22 00:46 2026/09/22 00:46 2026/09/22 01:56 853b104b
b006327e assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/13 00:59 2026/09/13 00:59 2026/09/13 00:59 70a60e12
413ca5d9 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/08 01:10 2026/09/08 01:10 2026/09/08 01:10 680aa3e1
fe544d6a repro-c Reproduced: ✅ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/07 14:12 2026/09/07 14:12 2026/09/07 14:38 680aa3e1
a1da9526 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/06 00:45 2026/09/06 00:45 2026/09/06 00:45 4f7b22a0
078034e2 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/04 12:34 2026/09/04 12:34 2026/09/04 12:34 801f0966
382999af repro-c Reproduced: ✅ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/03 15:14 2026/09/03 15:14 2026/09/03 17:33 d2e5fb95
▶ ▼ Similar bugs (13)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (4) ntfs3 17 syz error 5 420d 431d 0/29 auto-obsoleted due to no activity on 2025/11/20 02:13
linux-4.14 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 1039 1316d 2575d 0/1 upstream: reported C repro on 2019/09/18 00:47
android-54 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 49 1923d 2426d 0/2 auto-obsoleted due to no activity on 2023/04/20 07:24
android-49 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 5 2982d 3217d 0/3 auto-closed as invalid on 2019/02/22 14:33
android-54 KASAN: out-of-bounds Read in unwind_next_frame (2) 17 syz, C 8 519d 604d 0/2 upstream: reported C repro on 2025/02/08 17:02
linux-4.19 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C error 525 1328d 2413d 0/1 upstream: reported C repro on 2020/02/26 18:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (3) fs 17 1 639d 635d 0/29 auto-obsoleted due to no activity on 2025/04/04 17:08
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame kernel 17 syz, C 929 1293d 3030d 0/29 closed as dup on 2018/06/20 07:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (2) kernel 17 1 836d 832d 0/29 auto-obsoleted due to no activity on 2024/08/21 14:38
android-414 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 2192 2498d 2735d 0/1 public: reported C repro on 2019/04/11 00:00
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (5) fs 17 1 307d 303d 0/29 auto-obsoleted due to no activity on 2026/03/02 17:44
android-54 KASAN: out-of-bounds Read in unwind_next_frame 17 16 1847d 2353d 0/2 auto-closed as invalid on 2022/01/13 05:16
android-5-10 KASAN: out-of-bounds Read in unwind_next_frame 17 syz 1 15d 15d 0/2 premoderation: reported syz repro on 2026/09/21 11:41
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/09/07 14:39 12m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git df2908090cda368b01ff43709f51890076c56157 no crash job log log
2026/09/03 19:36 14m nogikh@google.com git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8ab1afb2eb246ab15b301cd255b5943d208a93c1 no crash job log log

Sample crash report:
==================================================================
BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline]
BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
Read of size 2 at addr ffffc90006817b40 by task iou-wrk-18470/18471

CPU: 3 UID: 0 PID: 18471 Comm: iou-wrk-18470 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 user_mode arch/x86/include/asm/ptrace.h:214 [inline]
 unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save_tsk+0x16d/0x210 kernel/stacktrace.c:150
 proc_pid_stack+0x16e/0x2b0 fs/proc/base.c:490
 proc_single_show+0x124/0x1f0 fs/proc/base.c:793
 seq_read_iter+0x32f/0x1270 fs/seq_file.c:231
 seq_read+0x344/0x4d0 fs/seq_file.c:163
 loop_rw_iter+0x305/0x6a0 io_uring/rw.c:730
 io_iter_do_read io_uring/rw.c:837 [inline]
 io_iter_do_read io_uring/rw.c:830 [inline]
 __io_read+0x1084/0x1470 io_uring/rw.c:953
 io_read+0x8d/0x230 io_uring/rw.c:1032
 __io_issue_sqe+0xe8/0x7a0 io_uring/io_uring.c:1386
 io_issue_sqe+0x88/0x1540 io_uring/io_uring.c:1409
 io_wq_submit_work+0x3b6/0xf70 io_uring/io_uring.c:1525
 io_worker_handle_work+0x60a/0x15e0 io_uring/io-wq.c:659
 io_wq_worker+0x33e/0xe60 io_uring/io-wq.c:714
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90006810000 allocated at kernel_clone+0x176/0x9d0 kernel/fork.c:2771
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x70f3f
memcg:ffff888029966282
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: ffffffffffffffff 0000000000000000 00000001ffffffff ffff888029966282
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 13699, tgid 13699 (syz-executor), ts 750294440238
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_pages_mpol+0x201/0x550 mm/mempolicy.c:2486
 alloc_pages_noprof+0x1a/0x160 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3689 [inline]
 __vmalloc_area_node mm/vmalloc.c:3914 [inline]
 __vmalloc_node_range_noprof+0x833/0x1420 mm/vmalloc.c:4104
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct kernel/fork.c:930 [inline]
 copy_process+0x803/0x8380 kernel/fork.c:2134
 kernel_clone+0x176/0x9d0 kernel/fork.c:2771
 __do_compat_sys_ia32_clone+0xd4/0x120 arch/x86/kernel/sys_ia32.c:255
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
page last free pid 5721 tgid 5721 ts 750290827256 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
 __folio_put+0x3b4/0x5f0 mm/folio.c:106
 folio_put include/linux/mm.h:2160 [inline]
 put_page include/linux/mm.h:2229 [inline]
 put_netmem include/net/netmem.h:394 [inline]
 skb_page_unref include/linux/skbuff_ref.h:43 [inline]
 __skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
 skb_release_data+0x5dd/0x860 net/core/skbuff.c:1116
 skb_release_all net/core/skbuff.c:1197 [inline]
 __kfree_skb+0x4f/0x70 net/core/skbuff.c:1211
 tcp_wmem_free_skb include/net/tcp.h:334 [inline]
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:2325 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3698 [inline]
 tcp_ack+0x2079/0x7650 net/ipv4/tcp_input.c:4400
 tcp_rcv_established+0x11bd/0x39f0 net/ipv4/tcp_input.c:6590
 tcp_v4_do_rcv+0xbb6/0x1260 net/ipv4/tcp_ipv4.c:1854
 sk_backlog_rcv include/net/sock.h:1190 [inline]
 __release_sock+0x35a/0x440 net/core/sock.c:3270
 release_sock+0x1e5/0x280 net/core/sock.c:3869
 tcp_sendmsg+0x38/0x50 net/ipv4/tcp.c:1452
 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:865
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 sock_write_iter+0x4ea/0x5b0 net/socket.c:1266
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687
 ksys_write+0x1f8/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffffc90006817a00: f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 00
 ffffc90006817a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90006817b00: 00 f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00
                                           ^
 ffffc90006817b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90006817c00: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/29 03:13 upstream 72d3fcf802c4 58f15308 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/27 06:30 upstream fd179f8a05be a3c7249d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/07 18:28 upstream df2908090cda 5e4626f5 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/03 01:39 upstream 940de590b839 6a988719 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
* Struck through repros no longer work on HEAD.