From: syzbot <syzbot+1e3df0852e82c21ca418@syzkaller.appspotmail.com>
To: davem@davemloft.net, david@ixit.cz, edumazet@google.com,
horms@kernel.org, krzk@kernel.org, kuba@kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
oe-linux-nfc@lists.linux.dev, pabeni@redhat.com,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [net?] [nfc?] KASAN: slab-out-of-bounds Read in __dynamic_pr_debug
Date: Tue, 18 Aug 2026 22:22:43 -0700 [thread overview]
Message-ID: <6a853da3.ae6ddae5.3da009.0006.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 21d6ac051080 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=13653679580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d1128bc53f2ef7f3
dashboard link: https://syzkaller.appspot.com/bug?extid=1e3df0852e82c21ca418
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/88380e2ddcb9/disk-21d6ac05.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5dba5c2896b7/vmlinux-21d6ac05.xz
kernel image: https://storage.googleapis.com/syzbot-assets/52ac739e37e0/Image-21d6ac05.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1e3df0852e82c21ca418@syzkaller.appspotmail.com
dvmrp0: entered allmulticast mode
==================================================================
BUG: KASAN: slab-out-of-bounds in string_nocheck+0xd8/0x140 lib/vsprintf.c:648
Read of size 1 at addr ffff0000c2554ae1 by task syz.2.798/8384
CPU: 1 UID: 0 PID: 8384 Comm: syz.2.798 Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
__asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
string_nocheck+0xd8/0x140 lib/vsprintf.c:648
string+0x8c/0xc8 lib/vsprintf.c:730
vsnprintf+0x880/0xd10 lib/vsprintf.c:2945
va_format lib/vsprintf.c:1725 [inline]
pointer+0x5e8/0x6b4 lib/vsprintf.c:2573
vsnprintf+0x618/0xd10 lib/vsprintf.c:2949
vprintk_store+0x344/0xb94 kernel/printk/printk.c:2307
vprintk_emit+0x1bc/0x514 kernel/printk/printk.c:2455
vprintk_default+0x54/0x80 kernel/printk/printk.c:2494
vprintk+0x9c/0x114 kernel/printk/printk_safe.c:82
_printk+0xe0/0x130 kernel/printk/printk.c:2504
__dynamic_pr_debug+0x148/0x1e4 lib/dynamic_debug.c:879
nfc_llcp_wks_sap net/nfc/llcp_core.c:344 [inline]
nfc_llcp_get_sdp_ssap+0x350/0x3fc net/nfc/llcp_core.c:420
llcp_sock_bind+0x2e0/0x58c net/nfc/llcp_sock.c:114
__sys_bind_socket net/socket.c:1920 [inline]
__sys_bind+0x1c4/0x268 net/socket.c:1951
__do_sys_bind net/socket.c:1956 [inline]
__se_sys_bind net/socket.c:1954 [inline]
__arm64_sys_bind+0x84/0x9c net/socket.c:1954
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Allocated by task 8384:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_node_track_caller_noprof+0x434/0x6d4 mm/slub.c:5471
kmemdup_noprof+0x44/0x8c mm/util.c:138
kmemdup_noprof include/linux/fortify-string.h:715 [inline]
llcp_sock_bind+0x2b0/0x58c net/nfc/llcp_sock.c:107
__sys_bind_socket net/socket.c:1920 [inline]
__sys_bind+0x1c4/0x268 net/socket.c:1951
__do_sys_bind net/socket.c:1956 [inline]
__se_sys_bind net/socket.c:1954 [inline]
__arm64_sys_bind+0x84/0x9c net/socket.c:1954
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
The buggy address belongs to the object at ffff0000c2554ae0
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes to the right of
allocated 1-byte region [ffff0000c2554ae0, ffff0000c2554ae1)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000c2554a80 pfn:0x102554
flags: 0x5ffc00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000200 ffff0000c0001500 fffffdffc318aa10 fffffdffc30937d0
raw: ffff0000c2554a80 0000000800800069 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c2554980: 00 fc fc fc 07 fc fc fc fa fc fc fc 07 fc fc fc
ffff0000c2554a00: fa fc fc fc fa fc fc fc fa fc fc fc 07 fc fc fc
>ffff0000c2554a80: fa fc fc fc 05 fc fc fc 05 fc fc fc 01 fc fc fc
^
ffff0000c2554b00: fa fc fc fc 05 fc fc fc 00 fc fc fc 00 fc fc fc
ffff0000c2554b80: 00 fc fc fc 00 fc fc fc fa fc fc fc 00 fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-08-19 5:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a853da3.ae6ddae5.3da009.0006.GAE@google.com \
--to=syzbot+1e3df0852e82c21ca418@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=david@ixit.cz \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=krzk@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=oe-linux-nfc@lists.linux.dev \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.