KASAN: stack-out-of-bounds Read in unwind_next_frame (6)

Status: moderation: reported on 2026/09/07 01:44
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+26de5b9817f739b2ba99@syzkaller.appspotmail.com
First crash: 4d04h, last: 4d04h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
a1da9526 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/06 00:45 2026/09/06 00:45 2026/09/06 00:45 4f7b22a0
078034e2 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/04 12:34 2026/09/04 12:34 2026/09/04 12:34 801f0966
382999af repro-c Reproduced: ✅ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/03 15:14 2026/09/03 15:14 2026/09/03 17:33 d2e5fb95
▶ ▼ Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (4) ntfs3 17 syz error 5 391d 402d 0/29 auto-obsoleted due to no activity on 2025/11/20 02:13
linux-4.14 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 1039 1287d 2546d 0/1 upstream: reported C repro on 2019/09/18 00:47
android-54 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 49 1894d 2397d 0/2 auto-obsoleted due to no activity on 2023/04/20 07:24
android-49 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 5 2952d 3188d 0/3 auto-closed as invalid on 2019/02/22 14:33
android-54 KASAN: out-of-bounds Read in unwind_next_frame (2) 17 syz, C 8 490d 575d 0/2 upstream: reported C repro on 2025/02/08 17:02
linux-4.19 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C error 525 1298d 2384d 0/1 upstream: reported C repro on 2020/02/26 18:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (3) fs 17 1 610d 606d 0/29 auto-obsoleted due to no activity on 2025/04/04 17:08
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame kernel 17 syz, C 929 1264d 3000d 0/29 closed as dup on 2018/06/20 07:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (2) kernel 17 1 806d 802d 0/29 auto-obsoleted due to no activity on 2024/08/21 14:38
android-414 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 2192 2468d 2706d 0/1 public: reported C repro on 2019/04/11 00:00
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (5) fs 17 1 278d 274d 0/29 auto-obsoleted due to no activity on 2026/03/02 17:44
android-54 KASAN: out-of-bounds Read in unwind_next_frame 17 16 1818d 2324d 0/2 auto-closed as invalid on 2022/01/13 05:16
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/03 19:36 14m nogikh@google.com git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8ab1afb2eb246ab15b301cd255b5943d208a93c1 no crash job log log

Sample crash report:
==================================================================
BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline]
BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
Read of size 2 at addr ffffc900032bf6c0 by task iou-wrk-14196/14202

CPU: 0 UID: 0 PID: 14202 Comm: iou-wrk-14196 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 user_mode arch/x86/include/asm/ptrace.h:214 [inline]
 unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save_tsk+0x16d/0x210 kernel/stacktrace.c:150
 proc_pid_stack+0x16e/0x2b0 fs/proc/base.c:490
 proc_single_show+0x124/0x1f0 fs/proc/base.c:793
 seq_read_iter+0x32f/0x1270 fs/seq_file.c:231
 seq_read+0x344/0x4d0 fs/seq_file.c:163
 loop_rw_iter+0x305/0x6a0 io_uring/rw.c:721
 io_iter_do_read io_uring/rw.c:828 [inline]
 io_iter_do_read io_uring/rw.c:821 [inline]
 __io_read+0x1084/0x1470 io_uring/rw.c:943
 io_read+0x8d/0x230 io_uring/rw.c:1022
 __io_issue_sqe+0xe8/0x7a0 io_uring/io_uring.c:1386
 io_issue_sqe+0x88/0x1540 io_uring/io_uring.c:1409
 io_wq_submit_work+0x3b6/0xf70 io_uring/io_uring.c:1525
 io_worker_handle_work+0x60a/0x15e0 io_uring/io-wq.c:659
 io_wq_worker+0x33e/0xe60 io_uring/io-wq.c:714
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a vmalloc virtual mapping
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x51ddf
memcg:ffff88806c1fb402
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: ffffffffffffffff 0000000000000000 00000001ffffffff ffff88806c1fb402
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 7051, tgid 7051 (syz-executor), ts 810378653525
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_pages_slowpath mm/page_alloc.c:4884 [inline]
 __alloc_frozen_pages_noprof+0x936/0x3300 mm/page_alloc.c:5449
 alloc_pages_mpol+0x201/0x550 mm/mempolicy.c:2486
 alloc_pages_noprof+0x1a/0x160 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3689 [inline]
 __vmalloc_area_node mm/vmalloc.c:3914 [inline]
 __vmalloc_node_range_noprof+0x833/0x1420 mm/vmalloc.c:4104
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct kernel/fork.c:930 [inline]
 copy_process+0x803/0x8370 kernel/fork.c:2133
 kernel_clone+0x176/0x9d0 kernel/fork.c:2766
 __do_compat_sys_ia32_clone+0xd4/0x120 arch/x86/kernel/sys_ia32.c:255
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
page last free pid 5824 tgid 5824 ts 810141815741 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_pages_prepare+0x586/0xe00 mm/page_alloc.c:1463
 __free_contig_range_common+0x14f/0x250 mm/page_alloc.c:7072
 __free_contig_range mm/page_alloc.c:7117 [inline]
 free_pages_bulk+0x12a/0x200 mm/page_alloc.c:5322
 vm_area_free_pages+0xb2/0x2a0 mm/vmalloc.c:3461
 vfree mm/vmalloc.c:3510 [inline]
 vfree+0xf7/0x6d0 mm/vmalloc.c:3484
 delayed_vfree_work+0x56/0x80 mm/vmalloc.c:3414
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffffc900032bf580: f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 00 f2 f2
 ffffc900032bf600: f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
>ffffc900032bf680: 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00
                                           ^
 ffffc900032bf700: 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 00
 ffffc900032bf780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/03 01:39 upstream 940de590b839 6a988719 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
* Struck through repros no longer work on HEAD.