KASAN: stack-out-of-bounds Read in unwind_next_frame (6)

Status: moderation: reported on 2026/09/07 01:44
Subsystems: fs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+26de5b9817f739b2ba99@syzkaller.appspotmail.com
First crash: 49d, last: 6d04h
▶ ▼ ✨ AI Jobs (8)
ID Workflow Result Correct Bug Created Started Finished Revision
bb0da757 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/10/08 02:50 2026/10/08 02:50 2026/10/08 03:47 f8f239cf
c8747141 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/22 00:46 2026/09/22 00:46 2026/09/22 01:56 853b104b
b006327e assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/13 00:59 2026/09/13 00:59 2026/09/13 00:59 70a60e12
413ca5d9 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/08 01:10 2026/09/08 01:10 2026/09/08 01:10 680aa3e1
fe544d6a repro-c Reproduced: ✅ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/07 14:12 2026/09/07 14:12 2026/09/07 14:38 680aa3e1
a1da9526 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/06 00:45 2026/09/06 00:45 2026/09/06 00:45 4f7b22a0
078034e2 assessment-security 💥 KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/04 12:34 2026/09/04 12:34 2026/09/04 12:34 801f0966
382999af repro-c Reproduced: ✅ ❓ KASAN: stack-out-of-bounds Read in unwind_next_frame (6) 2026/09/03 15:14 2026/09/03 15:14 2026/09/03 17:33 d2e5fb95
▶ ▼ Similar bugs (13)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (4) ntfs3 17 syz error 5 436d 447d 0/29 auto-obsoleted due to no activity on 2025/11/20 02:13
linux-4.14 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 1039 1332d 2591d 0/1 upstream: reported C repro on 2019/09/18 00:47
android-54 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 49 1939d 2442d 0/2 auto-obsoleted due to no activity on 2023/04/20 07:24
android-49 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 5 2998d 3233d 0/3 auto-closed as invalid on 2019/02/22 14:33
android-54 KASAN: out-of-bounds Read in unwind_next_frame (2) 17 syz, C 8 535d 620d 0/2 upstream: reported C repro on 2025/02/08 17:02
linux-4.19 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C error 525 1344d 2429d 0/1 upstream: reported C repro on 2020/02/26 18:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (3) fs 17 1 655d 651d 0/29 auto-obsoleted due to no activity on 2025/04/04 17:08
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame kernel 17 syz, C 929 1309d 3046d 0/29 closed as dup on 2018/06/20 07:51
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (2) kernel 17 1 851d 847d 0/29 auto-obsoleted due to no activity on 2024/08/21 14:38
android-414 KASAN: stack-out-of-bounds Read in unwind_next_frame 17 syz, C 2192 2513d 2751d 0/1 public: reported C repro on 2019/04/11 00:00
upstream KASAN: stack-out-of-bounds Read in unwind_next_frame (5) fs 17 1 323d 319d 0/29 auto-obsoleted due to no activity on 2026/03/02 17:44
android-54 KASAN: out-of-bounds Read in unwind_next_frame 17 16 1863d 2369d 0/2 auto-closed as invalid on 2022/01/13 05:16
android-5-10 KASAN: out-of-bounds Read in unwind_next_frame 17 syz 1 30d 30d 0/2 premoderation: reported syz repro on 2026/09/21 11:41
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/09/07 14:39 12m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git df2908090cda368b01ff43709f51890076c56157 no crash job log log
2026/09/03 19:36 14m nogikh@google.com git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8ab1afb2eb246ab15b301cd255b5943d208a93c1 no crash job log log

Sample crash report:
==================================================================
BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline]
BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
Read of size 2 at addr ffffc90004e2fcc0 by task iou-wrk-11833/11834

CPU: 1 UID: 0 PID: 11834 Comm: iou-wrk-11833 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 user_mode arch/x86/include/asm/ptrace.h:214 [inline]
 unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save_tsk+0x16d/0x210 kernel/stacktrace.c:150
 proc_pid_stack+0x16e/0x2b0 fs/proc/base.c:490
 proc_single_show+0x124/0x1f0 fs/proc/base.c:793
 seq_read_iter+0x32f/0x1270 fs/seq_file.c:231
 seq_read+0x344/0x4d0 fs/seq_file.c:163
 loop_rw_iter+0x305/0x6a0 io_uring/rw.c:730
 io_iter_do_read io_uring/rw.c:837 [inline]
 io_iter_do_read io_uring/rw.c:830 [inline]
 __io_read+0x1084/0x1470 io_uring/rw.c:953
 io_read+0x8d/0x230 io_uring/rw.c:1032
 __io_issue_sqe+0xe8/0x7a0 io_uring/io_uring.c:1388
 io_issue_sqe+0x88/0x1540 io_uring/io_uring.c:1411
 io_wq_submit_work+0x3b6/0xf70 io_uring/io_uring.c:1527
 io_worker_handle_work+0x60a/0x15e0 io_uring/io-wq.c:659
 io_wq_worker+0x33e/0xe60 io_uring/io-wq.c:714
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a vmalloc virtual mapping
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88805475fe00 pfn:0x5475f
memcg:ffff88806decb202
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff88805475fe00 0000000000000000 00000001ffffffff ffff88806decb202
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 5746, tgid 5746 (syz-executor), ts 489149299983
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_pages_mpol+0x201/0x550 mm/mempolicy.c:2486
 alloc_pages_noprof+0x1a/0x160 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3689 [inline]
 __vmalloc_area_node mm/vmalloc.c:3914 [inline]
 __vmalloc_node_range_noprof+0x833/0x1420 mm/vmalloc.c:4104
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct kernel/fork.c:930 [inline]
 copy_process+0x803/0x8380 kernel/fork.c:2134
 kernel_clone+0x176/0x9d0 kernel/fork.c:2771
 __do_compat_sys_ia32_clone+0xd4/0x120 arch/x86/kernel/sys_ia32.c:255
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
page last free pid 5746 tgid 5746 ts 489138505491 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010
 alloc_filename fs/namei.c:147 [inline]
 do_getname+0x35/0x390 fs/namei.c:187
 getname_flags fs/namei.c:230 [inline]
 class_filename_flags_constructor include/linux/fs.h:2589 [inline]
 user_path_at+0x26/0x60 fs/namei.c:3669
 ksys_umount fs/namespace.c:2125 [inline]
 __do_sys_umount fs/namespace.c:2133 [inline]
 __se_sys_umount fs/namespace.c:2131 [inline]
 __ia32_sys_umount+0x109/0x190 fs/namespace.c:2131
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Memory state around the buggy address:
 ffffc90004e2fb80: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00
 ffffc90004e2fc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90004e2fc80: 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00 00 00 00 00
                                           ^
 ffffc90004e2fd00: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
 ffffc90004e2fd80: 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/16 07:14 upstream 2f2f7eeef8b0 3f2522c6 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/29 03:13 upstream 72d3fcf802c4 58f15308 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/27 06:30 upstream fd179f8a05be a3c7249d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/07 18:28 upstream df2908090cda 5e4626f5 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
2026/09/03 01:39 upstream 940de590b839 6a988719 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: stack-out-of-bounds Read in unwind_next_frame
* Struck through repros no longer work on HEAD.