KASAN: slab-out-of-bounds Read in copy_from_sockptr

Status: upstream: reported syz repro on 2026/08/03 04:18
Reported-by: syzbot+3fe274c1ae4fad0ec84a@syzkaller.appspotmail.com
First crash: 53d, last: 37d
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2026/09/22 upstream (ToT) f0100363d8c3 syz Didn't crash
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-out-of-bounds Read in copy_from_sockptr prio:high net 17 syz 25 46d 52d 29/29 fixed on 2026/09/14 10:32

Sample crash report:
x_tables: unsorted entry at hook 4
==================================================================
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr+0x44/0x1a8 include/linux/sockptr.h:59
Read of size 84 at addr ffff0000d327db00 by task syz.1.1281/8147

CPU: 0 PID: 8147 Comm: syz.1.1281 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memcpy+0x48/0x90 mm/kasan/shadow.c:65
 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
 copy_from_sockptr+0x44/0x1a8 include/linux/sockptr.h:59
 vcc_setsockopt+0x17c/0x694 net/atm/common.c:775
 pvc_setsockopt+0x84/0xb0 net/atm/pvc.c:72
 __sys_setsockopt+0x2fc/0x50c net/socket.c:2288
 __do_sys_setsockopt net/socket.c:2299 [inline]
 __se_sys_setsockopt net/socket.c:2296 [inline]
 __arm64_sys_setsockopt+0xc0/0xdc net/socket.c:2296
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 8147:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc+0xd8/0x180 mm/slab_common.c:949
 kmalloc include/linux/slab.h:568 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 sockopt_alloc_buf kernel/bpf/cgroup.c:1781 [inline]
 __cgroup_bpf_run_filter_setsockopt+0x1e4/0xbe0 kernel/bpf/cgroup.c:1822
 __sys_setsockopt+0x4c0/0x50c net/socket.c:2271
 __do_sys_setsockopt net/socket.c:2299 [inline]
 __se_sys_setsockopt net/socket.c:2296 [inline]
 __arm64_sys_setsockopt+0xc0/0xdc net/socket.c:2296
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Last potentially related work creation:
 kasan_save_stack+0x40/0x70 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
 kvfree_call_rcu+0xb4/0x6f0 kernel/rcu/tree.c:3405
 sctp_bind_addr_clean net/sctp/bind_addr.c:131 [inline]
 sctp_bind_addr_free+0x11c/0x168 net/sctp/bind_addr.c:140
 sctp_association_free+0x234/0x708 net/sctp/associola.c:359
 sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:944 [inline]
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1331 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
 sctp_do_sm+0x2d58/0x4970 net/sctp/sm_sideeffect.c:1170
 sctp_assoc_bh_rcv+0x384/0x6a4 net/sctp/associola.c:1054
 sctp_inq_push+0x190/0x1b4 net/sctp/inqueue.c:88
 sctp_backlog_rcv+0x138/0x348 net/sctp/input.c:346
 sk_backlog_rcv include/net/sock.h:1138 [inline]
 __release_sock+0x1b0/0x3b0 net/core/sock.c:2954
 release_sock+0x60/0x1bc net/core/sock.c:3520
 sctp_wait_for_connect+0x2c8/0x564 net/sctp/socket.c:9379
 sctp_sendmsg_to_asoc+0x1260/0x1384 net/sctp/socket.c:1882
 sctp_sendmsg+0x13bc/0x20f4 net/sctp/socket.c:2037
 inet_sendmsg+0x154/0x27c net/ipv4/af_inet.c:841
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x324/0x440 net/socket.c:2153
 __do_sys_sendto net/socket.c:2165 [inline]
 __se_sys_sendto net/socket.c:2161 [inline]
 __arm64_sys_sendto+0xe4/0x104 net/socket.c:2161
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Second to last potentially related work creation:
 kasan_save_stack+0x40/0x70 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
 kvfree_call_rcu+0xb4/0x6f0 kernel/rcu/tree.c:3405
 kernfs_unlink_open_file+0x370/0x41c fs/kernfs/file.c:653
 kernfs_fop_release+0x128/0x194 fs/kernfs/file.c:825
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000d327db00
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
 128-byte region [ffff0000d327db00, ffff0000d327db80)

The buggy address belongs to the physical page:
page:00000000cbd4e04f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11327d
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 fffffc0003d7c7c0 dead000000000002 ffff0000c0002300
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d327da00: 06 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000d327da80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000d327db00: 00 00 00 00 00 00 05 fc fc fc fc fc fc fc fc fc
                                     ^
 ffff0000d327db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000d327dc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/19 08:14 linux-6.1.y e4f7d8be268e 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/19 07:03 linux-6.1.y e4f7d8be268e 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/19 04:47 linux-6.1.y e4f7d8be268e 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/16 22:09 linux-6.1.y e4f7d8be268e 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/14 04:42 linux-6.1.y e4f7d8be268e b13552fe .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/14 04:16 linux-6.1.y e4f7d8be268e b13552fe .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/14 03:50 linux-6.1.y e4f7d8be268e b13552fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/14 03:48 linux-6.1.y e4f7d8be268e b13552fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/10 07:47 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/10 06:32 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/03 09:19 linux-6.1.y fb28aa725e05 e611ffe1 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/03 08:33 linux-6.1.y fb28aa725e05 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
2026/08/03 04:18 linux-6.1.y fb28aa725e05 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in copy_from_sockptr
* Struck through repros no longer work on HEAD.