KASAN: out-of-bounds Read in unwind_next_frame

Status: premoderation: reported syz repro on 2026/09/21 11:41
Reported-by: syzbot+31aa3aa851bdeae1ee1f@syzkaller.appspotmail.com
First crash: 21h40m, last: 21h40m
▶ ▼ Similar bugs (18)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: out-of-bounds Read in unwind_next_frame 17 syz, C error 14 2217d 2552d 0/1 upstream: reported C repro on 2019/09/26 21:20
upstream KASAN: out-of-bounds Read in unwind_next_frame fs 17 syz error error 12 2550d 2814d 0/29 auto-obsoleted due to no activity on 2022/09/07 09:08
linux-4.19 KASAN: out-of-bounds Read in unwind_next_frame 17 1 2497d 2497d 0/1 auto-closed as invalid on 2020/03/19 23:00
android-54 KASAN: out-of-bounds Read in unwind_next_frame (2) 17 syz, C 8 505d 590d 0/2 upstream: reported C repro on 2025/02/08 17:02
linux-4.19 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C error 525 1314d 2399d 0/1 upstream: reported C repro on 2020/02/26 18:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame kernel 17 syz, C 929 1279d 3016d 0/29 closed as dup on 2018/06/20 07:51
android-49 KASAN: out-of-bounds Read in unwind_next_frame 17 syz, C 14 2903d 2719d 0/3 public: reported C repro on 2019/04/13 00:00
android-54 KASAN: out-of-bounds Read in unwind_next_frame 17 16 1833d 2339d 0/2 auto-closed as invalid on 2022/01/13 05:16
linux-4.19 KASAN: out-of-bounds Read in unwind_next_frame (2) 17 1 2086d 2086d 0/1 auto-closed as invalid on 2021/05/04 22:57
android-414 KASAN: out-of-bounds Read in unwind_next_frame (2) 17 syz, C 5 2492d 2598d 0/1 public: reported C repro on 2019/08/11 14:38
android-414 KASAN: out-of-bounds Read in unwind_next_frame 17 1 2895d 2718d 0/1 auto-closed as invalid on 2019/04/28 00:03
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (4) ntfs3 17 syz error 5 406d 417d 0/29 auto-obsoleted due to no activity on 2025/11/20 02:13
linux-4.14 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 1039 1302d 2561d 0/1 upstream: reported C repro on 2019/09/18 00:47
android-54 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 49 1909d 2412d 0/2 auto-obsoleted due to no activity on 2023/04/20 07:24
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (3) fs 17 1 625d 621d 0/29 auto-obsoleted due to no activity on 2025/04/04 17:08
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (2) kernel 17 1 821d 817d 0/29 auto-obsoleted due to no activity on 2024/08/21 14:38
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (5) fs 17 1 293d 289d 0/29 auto-obsoleted due to no activity on 2026/03/02 17:44
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (6) fs 17 2 14d 15d 0/29 moderation: reported on 2026/09/07 01:44

Sample crash report:
==================================================================
BUG: KASAN: out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:136 [inline]
BUG: KASAN: out-of-bounds in unwind_next_frame+0x82/0x670 arch/x86/kernel/unwind_frame.c:274
Read of size 8 at addr ffffc90000e37ce0 by task syz.2.6396/3342

CPU: 1 PID: 3342 Comm: syz.2.6396 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
 user_mode arch/x86/include/asm/ptrace.h:136 [inline]
 unwind_next_frame+0x82/0x670 arch/x86/kernel/unwind_frame.c:274
 arch_stack_walk+0x108/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save_tsk+0x16d/0x210 kernel/stacktrace.c:149
 proc_pid_stack+0x133/0x1f0 fs/proc/base.c:490
 proc_single_show+0xf8/0x190 fs/proc/base.c:792
 traverse+0x1f2/0x590 fs/seq_file.c:111
 seq_read_iter+0xbcd/0xce0 fs/seq_file.c:195
 seq_read+0x3d9/0x4f0 fs/seq_file.c:162
 vfs_read+0x209/0xa50 fs/read_write.c:494
 ksys_pread64 fs/read_write.c:686 [inline]
 __do_sys_pread64 fs/read_write.c:696 [inline]
 __se_sys_pread64 fs/read_write.c:693 [inline]
 __x64_sys_pread64+0x194/0x220 fs/read_write.c:693
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f420d75f159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f420d5c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
RAX: ffffffffffffffda RBX: 00007f420d9e6fa0 RCX: 00007f420d75f159
RDX: 000000000000000f RSI: 0000200000000140 RDI: 0000000000000003
RBP: 00007f420d7f606b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f420d9e7038 R14: 00007f420d9e6fa0 R15: 00007ffdcfe74858


Memory state around the buggy address:
 ffffc90000e37b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90000e37c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f8 f3 f3
>ffffc90000e37c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                       ^
 ffffc90000e37d00: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 f3 f3
 ffffc90000e37d80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/21 11:40 android13-5.10-lts 452567d1985b 853b104b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: out-of-bounds Read in unwind_next_frame
* Struck through repros no longer work on HEAD.