From: syzbot <syzbot+6102f1c3a0ea8073fd64@syzkaller.appspotmail.com>
To: dakr@kernel.org, driver-core@lists.linux.dev,
gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
rafael@kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [kernel?] WARNING in __dynamic_dev_dbg
Date: Sat, 26 Sep 2026 05:35:36 -0700 [thread overview]
Message-ID: <6ab7bc18.e548f532.1ca396.002d.GAE@google.com> (raw)
In-Reply-To: <6a85402f.ae6ddae5.3da009.0007.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: e8e60d3ddd25 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13f66a05580000
kernel config: https://syzkaller.appspot.com/x/.config?x=375776a45e10c065
dashboard link: https://syzkaller.appspot.com/bug?extid=6102f1c3a0ea8073fd64
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149b92c9580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6102f1c3a0ea8073fd64@syzkaller.appspotmail.com
------------[ cut here ]------------
field width 1163001896 out of range
WARNING: lib/vsprintf.c:2654 at set_field_width lib/vsprintf.c:2654 [inline], CPU#1: syz-executor257/5017
WARNING: lib/vsprintf.c:2654 at vsnprintf+0xb9c/0xd10 lib/vsprintf.c:2918, CPU#1: syz-executor257/5017
Modules linked in:
CPU: 1 UID: 0 PID: 5017 Comm: syz-executor257 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : set_field_width lib/vsprintf.c:2654 [inline]
pc : vsnprintf+0xb9c/0xd10 lib/vsprintf.c:2918
lr : set_field_width lib/vsprintf.c:2654 [inline]
lr : vsnprintf+0xb9c/0xd10 lib/vsprintf.c:2918
sp : ffff8000950d6b10
x29: ffff8000950d6b60 x28: 00000000007fffff x27: ffff8000873d6422
x26: 0000000045520028 x25: ffff8000950d6bd8 x24: 0000000000000402
x23: ffff8000950d6f18 x22: ffff800087abd600 x21: ffff8000950d6bf0
x20: ffff8000950d6ecb x19: dfff800000000000 x18: 0000000000000000
x17: ffff8000839f990c x16: ffff800083a13a68 x15: 0000fffff4c1bf60
x14: 0000000000000747 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000002 x9 : a322e52aa42a7400
x8 : a322e52aa42a7400 x7 : ffff8000804823d8 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff8000802f3e90
x2 : 0000000100000000 x1 : ffff0000d38bd880 x0 : 0000000000000000
Call trace:
set_field_width lib/vsprintf.c:2654 [inline] (P)
vsnprintf+0xb9c/0xd10 lib/vsprintf.c:2918 (P)
va_format lib/vsprintf.c:1725 [inline]
pointer+0x5e8/0x6b4 lib/vsprintf.c:2577
vsnprintf+0x618/0xd10 lib/vsprintf.c:2953
vprintk_store+0x344/0xb94 kernel/printk/printk.c:2307
vprintk_emit+0x1bc/0x514 kernel/printk/printk.c:2455
dev_vprintk_emit+0x2ec/0x3b4 drivers/base/core.c:5000
dev_printk_emit+0xe0/0x130 drivers/base/core.c:5011
__dynamic_dev_dbg+0x1b4/0x254 lib/dynamic_debug.c:904
dtv_property_process_get+0x26bc/0x2838 drivers/media/dvb-core/dvb_frontend.c:1595
dvb_get_property drivers/media/dvb-core/dvb_frontend.c:2397 [inline]
dvb_frontend_handle_ioctl+0x1644/0x2424 drivers/media/dvb-core/dvb_frontend.c:2478
dvb_frontend_do_ioctl+0x124/0x278 drivers/media/dvb-core/dvb_frontend.c:2101
dvb_usercopy+0x2a4/0x4d4 drivers/media/dvb-core/dvbdev.c:996
dvb_frontend_ioctl+0x68/0x8c drivers/media/dvb-core/dvb_frontend.c:2115
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 7442
hardirqs last enabled at (7441): [<ffff80008688206c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (7441): [<ffff80008688206c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (7442): [<ffff800080485188>] vprintk_store+0x13c/0xb94 kernel/printk/printk.c:2287
softirqs last enabled at (7400): [<ffff8000801382ec>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last enabled at (7400): [<ffff8000801382ec>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last enabled at (7400): [<ffff8000801382ec>] do_sve_acc+0x32c/0x4b8 arch/arm64/kernel/fpsimd.c:1332
softirqs last disabled at (7398): [<ffff8000801380cc>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (7398): [<ffff8000801380cc>] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline]
softirqs last disabled at (7398): [<ffff8000801380cc>] do_sve_acc+0x10c/0x4b8 arch/arm64/kernel/fpsimd.c:1308
---[ end trace 0000000000000000 ]---
==================================================================
BUG: KASAN: slab-out-of-bounds in hex_st
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-09-26 12:35 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-19 5:33 [syzbot] [kernel?] WARNING in __dynamic_dev_dbg syzbot
2026-09-26 12:35 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ab7bc18.e548f532.1ca396.002d.GAE@google.com \
--to=syzbot+6102f1c3a0ea8073fd64@syzkaller.appspotmail.com \
--cc=dakr@kernel.org \
--cc=driver-core@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.