KASAN: slab-use-after-free Read in seq_printf

Status: upstream: reported on 2026/08/25 13:48
Reported-by: syzbot+ee2d36546061d54fecdd@syzkaller.appspotmail.com
First crash: 49d, last: 21h16m
▶ ▼ Similar bugs (14)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-12 KASAN: slab-use-after-free Read in seq_printf origin:lts 19 syz, C 14 14h26m 21d 0/1 premoderation: reported C repro on 2026/09/23 06:02
upstream KASAN: slab-out-of-bounds Read in seq_printf fs 19 5 520d 625d 0/29 auto-obsoleted due to no activity on 2025/08/09 17:54
upstream KASAN: slab-use-after-free Read in seq_printf prio:high fs 19 90 1d18h 25d 0/29 upstream: reported on 2026/09/19 02:15
android-5-15 KASAN: use-after-free Read in seq_printf (2) 19 syz, C 16 1d21h 2d03h 0/2 upstream: reported C repro on 2026/10/12 05:38
upstream KMSAN: uninit-value in seq_printf (2) fs 7 syz, C 99 1581d 1848d 0/29 auto-closed as invalid on 2022/09/30 02:43
linux-5.15 KASAN: use-after-free Read in seq_printf 19 2 5d22h 20d 0/3 upstream: reported on 2026/09/23 14:29
android-6-1 KASAN: slab-out-of-bounds Read in seq_printf (2) 17 1 192d 192d 0/2 auto-obsoleted due to no activity on 2026/07/03 17:29
android-5-10 KASAN: use-after-free Read in seq_printf (3) 19 syz, C 50 12h25m 1d13h 0/2 upstream: reported C repro on 2026/10/12 19:47
android-5-10 KASAN: use-after-free Read in seq_printf 19 15 385d 492d 0/2 auto-obsoleted due to no activity on 2025/12/23 06:43
upstream KMSAN: kernel-infoleak in __skb_datagram_iter net 9 68 1113d 1218d 23/29 fixed on 2023/09/28 17:51
android-6-1 KASAN: slab-out-of-bounds Read in seq_printf 19 2 389d 393d 0/2 auto-obsoleted due to no activity on 2025/12/19 00:57
android-5-10 KASAN: use-after-free Read in seq_printf (2) 19 1 272d 272d 0/2 auto-obsoleted due to no activity on 2026/04/14 16:00
android-6-1 KASAN: use-after-free Read in seq_printf origin:lts 19 syz, C 20 9d02h 19d 0/2 upstream: reported C repro on 2026/09/24 21:21
android-5-15 KASAN: use-after-free Read in seq_printf 19 1 390d 390d 0/2 auto-obsoleted due to no activity on 2025/12/17 23:30

Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:645 [inline]
BUG: KASAN: slab-use-after-free in string+0x204/0x290 lib/vsprintf.c:727
Read of size 1 at addr ffff888021a0b730 by task syz.2.1299/11351

CPU: 1 PID: 11351 Comm: syz.2.1299 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 string_nocheck lib/vsprintf.c:645 [inline]
 string+0x204/0x290 lib/vsprintf.c:727
 vsnprintf+0xf72/0x1ba0 lib/vsprintf.c:2823
 seq_vprintf fs/seq_file.c:391 [inline]
 seq_printf+0x189/0x290 fs/seq_file.c:406
 show_interrupts+0x95e/0xb20 kernel/irq/proc.c:527
 traverse+0x1fc/0x590 fs/seq_file.c:111
 seq_lseek+0x137/0x260 fs/seq_file.c:323
 proc_reg_llseek+0x1b5/0x280 fs/proc/inode.c:289
 vfs_llseek fs/read_write.c:289 [inline]
 ksys_lseek fs/read_write.c:302 [inline]
 __do_sys_lseek fs/read_write.c:313 [inline]
 __se_sys_lseek fs/read_write.c:311 [inline]
 __x64_sys_lseek+0x15f/0x1e0 fs/read_write.c:311
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb1f119e2d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb1ef3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008
RAX: ffffffffffffffda RBX: 00007fb1f1426090 RCX: 00007fb1f119e2d9
RDX: 0000000000000000 RSI: 0000002000000008 RDI: 0000000000000009
RBP: 00007fb1f1235888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb1f1426128 R14: 00007fb1f1426090 R15: 00007ffc01e0a968
 </TASK>

Allocated by task 10926:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc_node_track_caller+0xb4/0x230 mm/slab_common.c:1027
 kmemdup_nul+0x36/0xf0 mm/util.c:175
 vfs_parse_fs_string fs/fs_context.c:182 [inline]
 vfs_parse_monolithic_sep+0x229/0x330 fs/fs_context.c:230
 nfs4_parse_monolithic fs/nfs/fs_context.c:1290 [inline]
 nfs_fs_context_parse_monolithic+0x3de/0x2730 fs/nfs/fs_context.c:1377
 do_new_mount+0x21a/0xa40 fs/namespace.c:3382
 do_mount fs/namespace.c:3726 [inline]
 __do_sys_mount fs/namespace.c:3935 [inline]
 __se_sys_mount+0x2e7/0x3d0 fs/namespace.c:3912
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888021a0b730
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 freed 8-byte region [ffff888021a0b730, ffff888021a0b738)

The buggy address belongs to the physical page:
page:ffffea00008682c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888021a0b668 pfn:0x21a0b
flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000800 ffff888018841280 ffffea000068bd90 ffffea000097fd50
raw: ffff888021a0b668 000000000066005f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 6162297935, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
 prep_new_page mm/page_alloc.c:1589 [inline]
 get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2118
 alloc_slab_page+0x5d/0x180 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2081
 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 __kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
 __do_kmalloc_node mm/slab_common.c:1006 [inline]
 __kmalloc_node_track_caller+0xa4/0x230 mm/slab_common.c:1027
 kstrdup+0x3b/0x80 mm/util.c:62
 __kernfs_new_node+0xaa/0x7f0 fs/kernfs/dir.c:620
 kernfs_new_node+0x14c/0x260 fs/kernfs/dir.c:700
 kernfs_create_link+0xa7/0x200 fs/kernfs/symlink.c:39
 sysfs_do_create_link_sd+0x83/0x110 fs/sysfs/symlink.c:44
 device_create_sys_dev_entry+0x123/0x180 drivers/base/core.c:3578
 device_add+0x7c3/0xc40 drivers/base/core.c:3722
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888021a0b600: fc fc fc 06 fc fc fc fc 06 fc fc fc fc fb fc fc
 ffff888021a0b680: fc fc fb fc fc fc fc fb fc fc fc fc fb fc fc fc
>ffff888021a0b700: fc fa fc fc fc fc fb fc fc fc fc 05 fc fc fc fc
                                     ^
 ffff888021a0b780: 00 fc fc fc fc 05 fc fc fc fc 05 fc fc fc fc 05
 ffff888021a0b800: fc fc fc fc 05 fc fc fc fc 05 fc fc fc fc 05 fc
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/13 12:06 linux-6.6.y a91a6aa9253c 5a1eeac4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in seq_printf
2026/08/25 13:47 linux-6.6.y dc6160265ffc a9a1fc32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: slab-use-after-free Read in seq_printf
* Struck through repros no longer work on HEAD.