KASAN: out-of-bounds Read in update_stack_state

Status: premoderation: reported syz repro on 2026/09/17 21:07
Bug presence: origin:lts
[Documentation on labels]
Reported-by: syzbot+c50ea337748bec592dee@syzkaller.appspotmail.com
First crash: 48d, last: 26d
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2026/09/19 lts (merge base) ff43460784b7 syz [report] KASAN: out-of-bounds Read in update_stack_state
2026/09/19 upstream (ToT) 40288c9206c1 syz Didn't crash
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 KASAN: out-of-bounds Read in update_stack_state 17 syz, C 2 8d15h 9d06h 0/2 upstream: reported C repro on 2026/10/27 09:59
upstream KASAN: out-of-bounds Read in update_stack_state (2) fs 17 1 2550d 2549d 0/29 auto-closed as invalid on 2020/02/10 13:24
upstream KASAN: out-of-bounds Read in update_stack_state fs 17 3 2840d 2962d 0/29 auto-closed as invalid on 2019/07/25 10:51
android-54 KASAN: out-of-bounds Read in update_stack_state 17 1 2458d 2458d 0/2 auto-closed as invalid on 2020/06/10 17:42
android-5-10 KASAN: stack-out-of-bounds Read in update_stack_state 17 1 1007d 1007d 0/2 auto-obsoleted due to no activity on 2024/05/02 04:08
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/09 19:58 22m retest repro android16-6.12 report job log log

Sample crash report:
==================================================================
BUG: KASAN: out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline]
BUG: KASAN: out-of-bounds in update_stack_state+0x4b0/0x4d0 arch/x86/kernel/unwind_frame.c:248
Read of size 2 at addr ffffc90003cef420 by task syz.3.1153/4064

CPU: 1 UID: 0 PID: 4064 Comm: syz.3.1153 Not tainted syzkaller #0 59fd58dbf897e2c8ba33f91efbb53ce34092dff9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 print_address_description+0x71/0x210 mm/kasan/report.c:377
 print_report+0x4a/0x70 mm/kasan/report.c:481
 kasan_report+0x162/0x1a0 mm/kasan/report.c:594
 __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379
 user_mode arch/x86/include/asm/ptrace.h:214 [inline]
 update_stack_state+0x4b0/0x4d0 arch/x86/kernel/unwind_frame.c:248
 unwind_next_frame+0x39e/0x6b0 arch/x86/kernel/unwind_frame.c:315
 arch_stack_walk+0x138/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save_tsk+0x171/0x210 kernel/stacktrace.c:150
 proc_pid_stack+0x136/0x2c0 fs/proc/base.c:508
 proc_single_show+0x11a/0x1b0 fs/proc/base.c:828
 traverse+0x21b/0x700 fs/seq_file.c:111
 seq_read_iter+0xdbd/0xf30 fs/seq_file.c:195
 seq_read+0x368/0x490 fs/seq_file.c:162
 vfs_read+0x288/0xc70 fs/read_write.c:568
 ksys_pread64+0x170/0x270 fs/read_write.c:776
 __do_sys_pread64 fs/read_write.c:786 [inline]
 __se_sys_pread64 fs/read_write.c:783 [inline]
 __x64_sys_pread64+0x9f/0xb0 fs/read_write.c:783
 x64_sys_call+0x2a34/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:18
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f276079e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f27615d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
RAX: ffffffffffffffda RBX: 00007f2760a25fa0 RCX: 00007f276079e159
RDX: 000000000000000f RSI: 0000200000000140 RDI: 0000000000000003
RBP: 00007f276083506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2760a26038 R14: 00007f2760a25fa0 R15: 00007ffd7dbc61c8
 </TASK>

The buggy address belongs to a vmalloc virtual mapping
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88810232d080 pfn:0x10232d
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff88810232d080 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 3793, tgid 3793 (syz.3.1073), ts 74635236954, free_ts 74631290036
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook+0x37d/0x3b0 mm/page_alloc.c:1863
 prep_new_page+0x2d/0x180 mm/page_alloc.c:1871
 get_page_from_freelist+0x4aea/0x4ba0 mm/page_alloc.c:3948
 __alloc_pages_noprof+0x35a/0x7e0 mm/page_alloc.c:5315
 vm_area_alloc_pages mm/vmalloc.c:-1 [inline]
 __vmalloc_area_node mm/vmalloc.c:3696 [inline]
 __vmalloc_node_range_noprof+0x8e5/0x1300 mm/vmalloc.c:3878
 alloc_thread_stack_node kernel/fork.c:325 [inline]
 dup_task_struct+0x5d6/0xd80 kernel/fork.c:1124
 copy_process+0x57c/0x3350 kernel/fork.c:2249
 kernel_clone+0x233/0x810 kernel/fork.c:2851
 __do_sys_clone3 kernel/fork.c:3157 [inline]
 __se_sys_clone3+0x33e/0x360 kernel/fork.c:3136
 __x64_sys_clone3+0x5f/0x80 kernel/fork.c:3136
 x64_sys_call+0x28fc/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:436
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
page last free pid 20 tgid 20 stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1390 [inline]
 free_unref_page+0xbb8/0xf70 mm/page_alloc.c:2876
 __free_pages+0x6b/0x3b0 mm/page_alloc.c:5402
 pagetable_free include/linux/mm.h:3084 [inline]
 pagetable_dtor_free include/linux/mm.h:3174 [inline]
 __tlb_remove_table include/asm-generic/tlb.h:217 [inline]
 __tlb_remove_table_free mm/mmu_gather.c:228 [inline]
 tlb_remove_table_rcu+0x2b2/0x3d0 mm/mmu_gather.c:283
 rcu_do_batch+0x56a/0xcb0 kernel/rcu/tree.c:2575
 nocb_cb_wait kernel/rcu/tree_nocb.h:923 [inline]
 rcu_nocb_cb_kthread+0x533/0xb60 kernel/rcu/tree_nocb.h:957
 kthread+0x2c4/0x360 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
 ffffc90003cef300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90003cef380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90003cef400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                  ^
 ffffc90003cef480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90003cef500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/17 21:06 android16-6.12 e79b240621d0 8d7d05f1 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust KASAN: out-of-bounds Read in update_stack_state
* Struck through repros no longer work on HEAD.