syzbot

 sign-in | mailing list | source | docs
🐞 Open [115]
🐞 Fixed [23]
🐞 Invalid [356]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: out-of-bounds Read in __show_regs

Status: premoderation: reported on 2026/01/16 22:48
Reported-by: syzbot+2b3db463d136b587c9c9@syzkaller.appspotmail.com
First crash: 16d, last: 16d
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in __show_regs (2) kernel 17 C error 2412 482d 597d 0/29 auto-obsoleted due to no activity on 2024/12/17 01:51
android-5-10 KASAN: out-of-bounds Read in __show_regs 17 1 420d 420d 0/2 auto-obsoleted due to no activity on 2025/03/08 21:46
upstream KASAN: stack-out-of-bounds Read in __show_regs (3) kernel 17 1 306d 302d 0/29 auto-obsoleted due to no activity on 2025/07/01 16:03
android-5-15 KASAN: stack-out-of-bounds Read in __show_regs 17 1 943d 943d 0/2 auto-obsoleted due to no activity on 2023/10/03 16:34
android-5-10 KASAN: stack-out-of-bounds Read in __show_regs 17 1 527d 527d 0/2 auto-obsoleted due to no activity on 2024/11/22 17:27
upstream BUG: unable to handle kernel NULL pointer dereference in exc_page_fault kernel 10 5 523d 531d 0/29 closed as invalid on 2024/09/13 11:13
upstream KASAN: stack-out-of-bounds Read in __show_regs kernel 17 C unreliable unreliable 517 1188d 1691d 0/29 auto-obsoleted due to no activity on 2023/05/14 10:00

Sample crash report:
 vlan_get_protocol_and_depth include/linux/if_vlan.h:658 [inline]
 skb_network_protocol+0x51d/0x770 net/core/dev.c:3379
RIP: 37a1c780:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 841681e0:ffffc90001377448 EFLAGS: 00000000
==================================================================
BUG: KASAN: out-of-bounds in __show_regs+0x46/0x500 arch/x86/kernel/process_64.c:76
Read of size 8 at addr ffffc90001377398 by task rcub/0/15

CPU: 0 PID: 15 Comm: rcub/0 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0xf1/0x140 mm/kasan/report.c:444
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
 __show_regs+0x46/0x500 arch/x86/kernel/process_64.c:76
 show_regs_if_on_stack arch/x86/kernel/dumpstack.c:173 [inline]
 show_trace_log_lvl+0x2f6/0x410 arch/x86/kernel/dumpstack.c:300
 show_stack+0x37/0x40 arch/x86/kernel/dumpstack.c:320
 sched_show_task+0x38c/0x550 kernel/sched/core.c:8824
 rcu_print_detail_task_stall_rnp kernel/rcu/tree_stall.h:233 [inline]
 print_other_cpu_stall+0xcc1/0x1010 kernel/rcu/tree_stall.h:573
 check_cpu_stall kernel/rcu/tree_stall.h:745 [inline]
 rcu_pending kernel/rcu/tree.c:3972 [inline]
 rcu_sched_clock_irq+0x8b2/0x12c0 kernel/rcu/tree.c:2619
 update_process_times+0x198/0x200 kernel/time/timer.c:1824
 tick_sched_handle kernel/time/tick-sched.c:257 [inline]
 tick_sched_timer+0x17c/0x240 kernel/time/tick-sched.c:1478
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x3b9/0x9f0 kernel/time/hrtimer.c:1753
 hrtimer_interrupt+0x3c7/0x8c0 kernel/time/hrtimer.c:1815
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
 __sysvec_apic_timer_interrupt+0xfa/0x3e0 arch/x86/kernel/apic/apic.c:1114
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:rtmutex_spin_on_owner kernel/locking/rtmutex.c:1426 [inline]
RIP: 0010:rt_mutex_slowlock_block+0x2ef/0x5e0 kernel/locking/rtmutex.c:1560
Code: ff ff 48 89 55 b8 48 c1 ea 03 48 89 95 58 ff ff ff eb 10 48 8b 02 48 83 e0 fe 49 39 c7 0f 85 46 01 00 00 48 8b 85 50 ff ff ff <42> 0f b6 04 28 84 c0 0f 85 ee 00 00 00 48 8b 45 b0 83 38 00 0f 84
RSP: 0000:ffffc900000f7bf8 EFLAGS: 00000246
RAX: 1ffff1103e804006 RBX: ffffffff867a93f8 RCX: ffffffff84b34da6
RDX: ffffffff867a9410 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc900000f7cb0 R08: ffff8881002f8007 R09: 1ffff1102005f000
R10: dffffc0000000000 R11: ffffed102005f001 R12: ffffc900000f7d00
R13: dffffc0000000000 R14: ffff8881002f8000 R15: ffff8881f4020000
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1629 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1662 [inline]
 rt_mutex_slowlock+0x186/0x2d0 kernel/locking/rtmutex.c:1691
 __rt_mutex_lock kernel/locking/rtmutex.c:1703 [inline]
 __rt_mutex_lock_common kernel/locking/rtmutex_api.c:30 [inline]
 rt_mutex_lock+0x113/0x1c0 kernel/locking/rtmutex_api.c:66
 rcu_boost kernel/rcu/tree_plugin.h:1066 [inline]
 rcu_boost_kthread+0x239/0x650 kernel/rcu/tree_plugin.h:1091
 kthread+0x411/0x500 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>


Memory state around the buggy address:
 ffffc90001377280: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 01 f2
 ffffc90001377300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90001377380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                               ^
 ffffc90001377400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90001377480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
 ORIG_RAX: 0000000000000000
RAX: 0000004000000004 RBX: ffffffff84165ab9 RCX: ffff8881356a08c0
RDX: ffffc90001377f10 RSI: ffffc90001377338 RDI: ffffffff84ae040c
RBP: ffffc900013773b8 R08: ffff888135527ad8 R09: 625d979483480100
R10: 1ffff11026aa9ade R11: 1ffff11026aa9ae3 R12: 0000000000000000
R13: ffffffff812c5686 R14: ffffc900013772d8 R15: ffffc90001377370
 </TASK>
rcu: rcu_preempt kthread starved for 633 jiffies! g161025 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28640 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5178 [inline]
 __schedule+0xb6e/0x14c0 kernel/sched/core.c:6538
 schedule+0x11e/0x1e0 kernel/sched/core.c:6621
 schedule_timeout+0x159/0x340 kernel/time/timer.c:1920
 rcu_gp_fqs_loop+0x2ae/0xf80 kernel/rcu/tree.c:1972
 rcu_gp_kthread+0x9b/0x360 kernel/rcu/tree.c:2145
 kthread+0x411/0x500 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 15 Comm: rcub/0 Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x20 lib/dump_stack.c:113
 nmi_cpu_backtrace+0x2af/0x2c0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x138/0x240 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x10/0x20 arch/x86/kernel/apic/hw_nmi.c:39
 trigger_single_cpu_backtrace include/linux/nmi.h:166 [inline]
 rcu_check_gp_kthread_starvation+0x1e0/0x260 kernel/rcu/tree_stall.h:487
 print_other_cpu_stall+0xe33/0x1010 kernel/rcu/tree_stall.h:592
 check_cpu_stall kernel/rcu/tree_stall.h:745 [inline]
 rcu_pending kernel/rcu/tree.c:3972 [inline]
 rcu_sched_clock_irq+0x8b2/0x12c0 kernel/rcu/tree.c:2619
 update_process_times+0x198/0x200 kernel/time/timer.c:1824
 tick_sched_handle kernel/time/tick-sched.c:257 [inline]
 tick_sched_timer+0x17c/0x240 kernel/time/tick-sched.c:1478
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x3b9/0x9f0 kernel/time/hrtimer.c:1753
 hrtimer_interrupt+0x3c7/0x8c0 kernel/time/hrtimer.c:1815
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
 __sysvec_apic_timer_interrupt+0xfa/0x3e0 arch/x86/kernel/apic/apic.c:1114
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:rtmutex_spin_on_owner kernel/locking/rtmutex.c:1426 [inline]
RIP: 0010:rt_mutex_slowlock_block+0x2ef/0x5e0 kernel/locking/rtmutex.c:1560
Code: ff ff 48 89 55 b8 48 c1 ea 03 48 89 95 58 ff ff ff eb 10 48 8b 02 48 83 e0 fe 49 39 c7 0f 85 46 01 00 00 48 8b 85 50 ff ff ff <42> 0f b6 04 28 84 c0 0f 85 ee 00 00 00 48 8b 45 b0 83 38 00 0f 84
RSP: 0000:ffffc900000f7bf8 EFLAGS: 00000246
RAX: 1ffff1103e804006 RBX: ffffffff867a93f8 RCX: ffffffff84b34da6
RDX: ffffffff867a9410 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc900000f7cb0 R08: ffff8881002f8007 R09: 1ffff1102005f000
R10: dffffc0000000000 R11: ffffed102005f001 R12: ffffc900000f7d00
R13: dffffc0000000000 R14: ffff8881002f8000 R15: ffff8881f4020000
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1629 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1662 [inline]
 rt_mutex_slowlock+0x186/0x2d0 kernel/locking/rtmutex.c:1691
 __rt_mutex_lock kernel/locking/rtmutex.c:1703 [inline]
 __rt_mutex_lock_common kernel/locking/rtmutex_api.c:30 [inline]
 rt_mutex_lock+0x113/0x1c0 kernel/locking/rtmutex_api.c:66
 rcu_boost kernel/rcu/tree_plugin.h:1066 [inline]
 rcu_boost_kthread+0x239/0x650 kernel/rcu/tree_plugin.h:1091
 kthread+0x411/0x500 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	ff 48 89             	decl   -0x77(%rax)
   3:	55                   	push   %rbp
   4:	b8 48 c1 ea 03       	mov    $0x3eac148,%eax
   9:	48 89 95 58 ff ff ff 	mov    %rdx,-0xa8(%rbp)
  10:	eb 10                	jmp    0x22
  12:	48 8b 02             	mov    (%rdx),%rax
  15:	48 83 e0 fe          	and    $0xfffffffffffffffe,%rax
  19:	49 39 c7             	cmp    %rax,%r15
  1c:	0f 85 46 01 00 00    	jne    0x168
  22:	48 8b 85 50 ff ff ff 	mov    -0xb0(%rbp),%rax
* 29:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 ee 00 00 00    	jne    0x124
  36:	48 8b 45 b0          	mov    -0x50(%rbp),%rax
  3a:	83 38 00             	cmpl   $0x0,(%rax)
  3d:	0f                   	.byte 0xf
  3e:	84                   	.byte 0x84

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/16 22:48 android13-5.15-lts 050dc55b0457 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15 KASAN: out-of-bounds Read in __show_regs
* Struck through repros no longer work on HEAD.