From: syzbot <syzbot+1e3df0852e82c21ca418@syzkaller.appspotmail.com>
To: davem@davemloft.net, david@ixit.cz, edumazet@google.com,
horms@kernel.org, krzk@kernel.org, kuba@kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
oe-linux-nfc@lists.linux.dev, pabeni@redhat.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] [nfc?] KASAN: slab-out-of-bounds Read in __dynamic_pr_debug
Date: Fri, 21 Aug 2026 06:17:38 -0700 [thread overview]
Message-ID: <6a884ff2.ae6ddae5.3da009.0037.GAE@google.com> (raw)
In-Reply-To: <6a853da3.ae6ddae5.3da009.0006.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 21d6ac051080 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=17d30179580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d1128bc53f2ef7f3
dashboard link: https://syzkaller.appspot.com/bug?extid=1e3df0852e82c21ca418
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13d43e79580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1746fa25580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/88380e2ddcb9/disk-21d6ac05.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5dba5c2896b7/vmlinux-21d6ac05.xz
kernel image: https://storage.googleapis.com/syzbot-assets/52ac739e37e0/Image-21d6ac05.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1e3df0852e82c21ca418@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in string_nocheck+0xd8/0x140 lib/vsprintf.c:648
Read of size 1 at addr ffff0000d0cf899c by task syz.0.17/4947
CPU: 1 UID: 0 PID: 4947 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
__asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
string_nocheck+0xd8/0x140 lib/vsprintf.c:648
string+0x8c/0xc8 lib/vsprintf.c:730
vsnprintf+0x880/0xd10 lib/vsprintf.c:2945
va_format lib/vsprintf.c:1725 [inline]
pointer+0x5e8/0x6b4 lib/vsprintf.c:2573
vsnprintf+0x618/0xd10 lib/vsprintf.c:2949
vprintk_store+0x344/0xb94 kernel/printk/printk.c:2307
vprintk_emit+0x1bc/0x514 kernel/printk/printk.c:2455
vprintk_default+0x54/0x80 kernel/printk/printk.c:2494
vprintk+0x9c/0x114 kernel/printk/printk_safe.c:82
_printk+0xe0/0x130 kernel/printk/printk.c:2504
__dynamic_pr_debug+0x148/0x1e4 lib/dynamic_debug.c:879
nfc_llcp_wks_sap net/nfc/llcp_core.c:344 [inline]
nfc_llcp_get_sdp_ssap+0x350/0x3fc net/nfc/llcp_core.c:420
llcp_sock_bind+0x2e0/0x58c net/nfc/llcp_sock.c:114
__sys_bind_socket net/socket.c:1920 [inline]
__sys_bind+0x1c4/0x268 net/socket.c:1951
__do_sys_bind net/socket.c:1956 [inline]
__se_sys_bind net/socket.c:1954 [inline]
__arm64_sys_bind+0x84/0x9c net/socket.c:1954
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Allocated by task 4947:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_node_track_caller_noprof+0x434/0x6d4 mm/slub.c:5471
kmemdup_noprof+0x44/0x8c mm/util.c:138
kmemdup_noprof include/linux/fortify-string.h:715 [inline]
llcp_sock_bind+0x2b0/0x58c net/nfc/llcp_sock.c:107
__sys_bind_socket net/socket.c:1920 [inline]
__sys_bind+0x1c4/0x268 net/socket.c:1951
__do_sys_bind net/socket.c:1956 [inline]
__se_sys_bind net/socket.c:1954 [inline]
__arm64_sys_bind+0x84/0x9c net/socket.c:1954
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
The buggy address belongs to the object at ffff0000d0cf8980
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes to the right of
allocated 28-byte region [ffff0000d0cf8980, ffff0000d0cf899c)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110cf8
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000000 ffff0000c0001780 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d0cf8880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
ffff0000d0cf8900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
>ffff0000d0cf8980: 00 00 00 04 fc fc fc fc 00 00 00 fc fc fc fc fc
^
ffff0000d0cf8a00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
ffff0000d0cf8a80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-08-21 13:17 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-19 5:22 [syzbot] [net?] [nfc?] KASAN: slab-out-of-bounds Read in __dynamic_pr_debug syzbot
2026-08-21 13:17 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a884ff2.ae6ddae5.3da009.0037.GAE@google.com \
--to=syzbot+1e3df0852e82c21ca418@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=david@ixit.cz \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=krzk@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=oe-linux-nfc@lists.linux.dev \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.