syzbot
KASAN: slab-out-of-bounds Read in el0t_64_sync
Status:
moderation: reported on 2026/08/23 05:56
Subsystems:
kernel
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+1f615e2c09943df051c3@syzkaller.appspotmail.com
First crash: 10d, last: 10d
▶
▼
Last patch testing requests (2)
Sample crash report:
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
==================================================================
BUG: KASAN: slab-out-of-bounds in string_nocheck+0xd8/0x140 lib/vsprintf.c:648
Read of size 1 at addr ffff0000f12bb55c by task syz.4.3723/19789
CPU: 0 UID: 0 PID: 19789 Comm: syz.4.3723 Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
dump_backtrace(regs = 0000000000000000 tsk = 0000000000000000)
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
__asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
string_nocheck+0xd8/0x140 lib/vsprintf.c:648
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Allocated by task 19789:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
The buggy address belongs to the object at ffff0000f12bb540
which belongs to the cache kmalloc-32 of size 32
>ffff0000f12bb500: fa fb fb fb fc fc fc fc 00 00 00 04 fc fc fc fc
^
ffff0000f12bb580: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
llcp: llcp_sock_bind: sk 00000000a7963005 addr 0000000003004b63 family 39
loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117
EXT4-fs error (device loop4): ext4_orphan_get:1404: comm syz.4.3723: couldn't read orphan inode 15 (err -117)
loop4: lost filesystem error report for type 5 error -117
kobject: 'loop4' (00000000b30f5c0f): kobject_add_internal: parent: 'ext4', set: '<NULL>'
EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
llcp: llcp_sock_release: 00000000a7963005
llcp: llcp_sock_destruct: 00000000a7963005
Struck through repros no longer work on HEAD.