KASAN: slab-out-of-bounds Read in bcmp

Status: premoderation: reported on 2026/10/26 05:09
Reported-by: syzbot+360c502bf03e75902cf0@syzkaller.appspotmail.com
First crash: 2d10h, last: 2d10h
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in bcmp net 19 syz, C error done 907 1378d 2699d 22/29 fixed on 2023/02/24 13:50
android-5-15 KASAN: use-after-free Read in bcmp 19 syz, C 8 9d12h 12d 0/2 upstream: reported C repro on 2026/10/16 04:26
android-6-12 KASAN: slab-use-after-free Read in bcmp 19 syz, C 30 6d23h 15d 0/1 premoderation: reported C repro on 2026/10/12 20:33
upstream KMSAN: uninit-value in bcmp (3) ntfs3 19 syz, C error 625 327d 807d 29/29 fixed on 2026/01/07 12:29
upstream KASAN: use-after-free Read in bcmp ntfs3 19 syz, C done 289 1045d 1204d 25/29 fixed on 2023/12/21 03:45
upstream KMSAN: uninit-value in bcmp (2) sound 7 syz, C 7 996d 1018d 25/29 fixed on 2024/04/10 03:59

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in memcmp lib/string.c:942 [inline]
BUG: KASAN: slab-out-of-bounds in bcmp+0xad/0xd0 lib/string.c:964
Read of size 1 at addr ffff8881196c2b5a by task kworker/1:21/537

CPU: 1 PID: 537 Comm: kworker/1:21 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306
 memcmp lib/string.c:942 [inline]
 bcmp+0xad/0xd0 lib/string.c:964
 sony_check_add_dev_list drivers/hid/hid-sony.c:2403 [inline]
 sony_check_add drivers/hid/hid-sony.c:2534 [inline]
 sony_input_configured+0x6a0/0x3980 drivers/hid/hid-sony.c:2613
 hidinput_connect+0x1e7b/0x2bf0 drivers/hid/hid-input.c:1983
 hid_connect+0x479/0xe30 drivers/hid/hid-core.c:2021
 hid_hw_start+0xaa/0x130 drivers/hid/hid-core.c:2128
 sony_probe+0x20a/0x330 drivers/hid/hid-sony.c:2885
 hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2363
 really_probe+0x373/0xa60 drivers/base/dd.c:558
 driver_probe_device+0xe1/0x190 drivers/base/dd.c:752
 __device_attach_driver+0x282/0x3f0 drivers/base/dd.c:863
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:433
 __device_attach+0x2a8/0x410 drivers/base/dd.c:932
 device_initial_probe+0x1a/0x20 drivers/base/dd.c:981
 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:493
 device_add+0x8ce/0xc00 drivers/base/core.c:3273
 hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2515
 usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1436
 usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:397
 really_probe+0x3bf/0xa60 drivers/base/dd.c:562
 driver_probe_device+0xe1/0x190 drivers/base/dd.c:752
 __device_attach_driver+0x282/0x3f0 drivers/base/dd.c:863
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:433
 __device_attach+0x2a8/0x410 drivers/base/dd.c:932
 device_initial_probe+0x1a/0x20 drivers/base/dd.c:981
 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:493
 device_add+0x8ce/0xc00 drivers/base/core.c:3273
 usb_set_configuration+0x1a76/0x1fe0 drivers/usb/core/message.c:2219
 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:294
 really_probe+0x3bf/0xa60 drivers/base/dd.c:562
 driver_probe_device+0xe1/0x190 drivers/base/dd.c:752
 __device_attach_driver+0x282/0x3f0 drivers/base/dd.c:863
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:433
 __device_attach+0x2a8/0x410 drivers/base/dd.c:932
 device_initial_probe+0x1a/0x20 drivers/base/dd.c:981
 bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:493
 device_add+0x8ce/0xc00 drivers/base/core.c:3273
 usb_new_device+0x9ba/0x1460 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5504 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5644 [inline]
 port_event drivers/usb/core/hub.c:5810 [inline]
 hub_event+0x2790/0x4220 drivers/usb/core/hub.c:5892
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Allocated by task 1326:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 __kmalloc_node include/linux/slab.h:421 [inline]
 kmalloc_node include/linux/slab.h:578 [inline]
 kvmalloc_node+0x88/0x130 mm/util.c:612
 kvmalloc include/linux/mm.h:833 [inline]
 kvzalloc include/linux/mm.h:841 [inline]
 netif_alloc_rx_queues net/core/dev.c:9856 [inline]
 alloc_netdev_mqs+0x857/0xca0 net/core/dev.c:10594
 __ip_tunnel_create+0x20e/0x390 net/ipv4/ip_tunnel.c:254
 ip_tunnel_init_net+0x2be/0x730 net/ipv4/ip_tunnel.c:1069
 vti_init_net+0x2f/0x140 net/ipv4/ip_vti.c:501
 ops_init+0x2c0/0x470 net/core/net_namespace.c:144
 setup_net+0x34f/0xae0 net/core/net_namespace.c:345
 copy_net_ns+0x314/0x520 net/core/net_namespace.c:486
 create_new_namespaces+0x3a8/0x650 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x120/0x170 kernel/nsproxy.c:231
 ksys_unshare+0x4fa/0x820 kernel/fork.c:3156
 __do_sys_unshare kernel/fork.c:3224 [inline]
 __se_sys_unshare kernel/fork.c:3222 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:3222
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff8881196c2a00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 90 bytes to the right of
 256-byte region [ffff8881196c2a00, ffff8881196c2b00)
The buggy address belongs to the page:
page:ffffea000465b080 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1196c2
head:ffffea000465b080 order:1 compound_mapcount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 ffffea0004b40080 0000000a0000000a ffff888100043200
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 578, ts 33695247823, free_ts 33565441235
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x1a8/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 device_private_init drivers/base/core.c:3115 [inline]
 device_add+0xb9/0xc00 drivers/base/core.c:3165
 device_register+0x1d/0x20 drivers/base/core.c:3347
 usb_create_ep_devs+0x148/0x270 drivers/usb/core/endpoint.c:169
 create_intf_ep_devs drivers/usb/core/message.c:1304 [inline]
 usb_set_configuration+0x1bb9/0x1fe0 drivers/usb/core/message.c:2225
 usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:294
 really_probe+0x3bf/0xa60 drivers/base/dd.c:562
 driver_probe_device+0xe1/0x190 drivers/base/dd.c:752
 __device_attach_driver+0x282/0x3f0 drivers/base/dd.c:863
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965
 kmem_cache_alloc_node include/linux/slab.h:426 [inline]
 __alloc_skb+0x9e/0x520 net/core/skbuff.c:200
 alloc_skb include/linux/skbuff.h:1126 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1178 [inline]
 netlink_sendmsg+0x693/0xb70 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg net/socket.c:664 [inline]
 ____sys_sendmsg+0x5be/0x8f0 net/socket.c:2377

Memory state around the buggy address:
 ffff8881196c2a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881196c2a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881196c2b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                    ^
 ffff8881196c2b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881196c2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/26 05:08 android13-5.10-lts f61a392235e0 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in bcmp
* Struck through repros no longer work on HEAD.