KASAN: stack-out-of-bounds Read in unwind_next_frame (6)

Status: moderation: reported on 2026/09/07 01:44
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+26de5b9817f739b2ba99@syzkaller.appspotmail.com
First crash: 4d16h, last: now
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
fe544d6a repro-c Reproduced: ✅ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/07 14:12 2026/09/07 14:12 2026/09/07 14:38 680aa3e1
a1da9526 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/06 00:45 2026/09/06 00:45 2026/09/06 00:45 4f7b22a0
078034e2 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/04 12:34 2026/09/04 12:34 2026/09/04 12:34 801f0966
382999af repro-c Reproduced: ✅ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/03 15:14 2026/09/03 15:14 2026/09/03 17:33 d2e5fb95
▶ ▼ Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (4) ntfs3 17 syz error 5 391d 402d 0/29 auto-obsoleted due to no activity on 2025/11/20 02:13
linux-4.14 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 1039 1287d 2546d 0/1 upstream: reported C repro on 2019/09/18 00:47
android-54 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 49 1894d 2398d 0/2 auto-obsoleted due to no activity on 2023/04/20 07:24
android-49 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 5 2953d 3188d 0/3 auto-closed as invalid on 2019/02/22 14:33
android-54 KASAN: out-of-bounds Read in unwind_next_frame (2) 17 syz, C 8 491d 576d 0/2 upstream: reported C repro on 2025/02/08 17:02
linux-4.19 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C error 525 1299d 2384d 0/1 upstream: reported C repro on 2020/02/26 18:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (3) fs 17 1 611d 607d 0/29 auto-obsoleted due to no activity on 2025/04/04 17:08
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame kernel 17 syz, C 929 1264d 3001d 0/29 closed as dup on 2018/06/20 07:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (2) kernel 17 1 807d 803d 0/29 auto-obsoleted due to no activity on 2024/08/21 14:38
android-414 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 2192 2469d 2706d 0/1 public: reported C repro on 2019/04/11 00:00
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (5) fs 17 1 279d 275d 0/29 auto-obsoleted due to no activity on 2026/03/02 17:44
android-54 KASAN: out-of-bounds Read in unwind_next_frame 17 16 1818d 2324d 0/2 auto-closed as invalid on 2022/01/13 05:16
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/09/07 14:39 12m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git df2908090cda368b01ff43709f51890076c56157 no crash job log log
2026/09/03 19:36 14m nogikh@google.com git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8ab1afb2eb246ab15b301cd255b5943d208a93c1 no crash job log log

Sample crash report:
==================================================================
BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline]
BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
Read of size 2 at addr ffffc90028887d40 by task iou-wrk-6343/6344

CPU: 2 UID: 0 PID: 6344 Comm: iou-wrk-6343 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 user_mode arch/x86/include/asm/ptrace.h:214 [inline]
 unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save_tsk+0x16d/0x210 kernel/stacktrace.c:150
 proc_pid_stack+0x16e/0x2b0 fs/proc/base.c:490
 proc_single_show+0x124/0x1f0 fs/proc/base.c:793
 seq_read_iter+0x32f/0x1270 fs/seq_file.c:231
 seq_read+0x344/0x4d0 fs/seq_file.c:163
 loop_rw_iter+0x305/0x6a0 io_uring/rw.c:721
 io_iter_do_read io_uring/rw.c:828 [inline]
 io_iter_do_read io_uring/rw.c:821 [inline]
 __io_read+0x1084/0x1470 io_uring/rw.c:943
 io_read+0x8d/0x230 io_uring/rw.c:1022
 __io_issue_sqe+0xe8/0x7a0 io_uring/io_uring.c:1386
 io_issue_sqe+0x88/0x1540 io_uring/io_uring.c:1409
 io_wq_submit_work+0x3b6/0xf70 io_uring/io_uring.c:1525
 io_worker_handle_work+0x60a/0x15e0 io_uring/io-wq.c:659
 io_wq_worker+0x33e/0xe60 io_uring/io-wq.c:714
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90028880000 allocated at kernel_clone+0x176/0x9d0 kernel/fork.c:2766
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61117
memcg:ffff88806cc1ca02
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88806cc1ca02
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 5737, tgid 5737 (syz-executor), ts 59364112368
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_pages_mpol+0x201/0x550 mm/mempolicy.c:2486
 alloc_pages_noprof+0x1a/0x160 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3689 [inline]
 __vmalloc_area_node mm/vmalloc.c:3914 [inline]
 __vmalloc_node_range_noprof+0x833/0x1420 mm/vmalloc.c:4104
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct kernel/fork.c:930 [inline]
 copy_process+0x803/0x8370 kernel/fork.c:2133
 kernel_clone+0x176/0x9d0 kernel/fork.c:2766
 __do_compat_sys_ia32_clone+0xd4/0x120 arch/x86/kernel/sys_ia32.c:255
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
page last free pid 5812 tgid 5812 ts 59353126332 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
 __folio_put+0x3b4/0x5f0 mm/folio.c:105
 folio_put include/linux/mm.h:2160 [inline]
 put_page include/linux/mm.h:2229 [inline]
 put_netmem include/net/netmem.h:394 [inline]
 skb_page_unref include/linux/skbuff_ref.h:43 [inline]
 __skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
 skb_release_data+0x649/0x8e0 net/core/skbuff.c:1116
 skb_release_all net/core/skbuff.c:1197 [inline]
 __kfree_skb net/core/skbuff.c:1211 [inline]
 napi_consume_skb+0x2c0/0x320 net/core/skbuff.c:1545
 skb_defer_free_flush+0x1f1/0x290 net/core/dev.c:6920
 net_rx_action+0x3ca/0xf20 net/core/dev.c:7988
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 do_softirq kernel/softirq.c:546 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:533
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0xa27/0x4970 net/core/dev.c:4961
 dev_queue_xmit include/linux/netdevice.h:3461 [inline]
 batadv_send_skb_packet+0x53a/0x6e0 net/batman-adv/send.c:100
 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:466 [inline]
 batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:491 [inline]
 batadv_iv_send_outstanding_bat_ogm_packet+0x6a2/0x7d0 net/batman-adv/bat_iv_ogm.c:1912
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158

Memory state around the buggy address:
 ffffc90028887c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90028887c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90028887d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                           ^
 ffffc90028887d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90028887e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/07 18:28 upstream df2908090cda 5e4626f5 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/03 01:39 upstream 940de590b839 6a988719 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
* Struck through repros no longer work on HEAD.