[BUG] KASAN: global-out-of-bounds Read in set_frame_rate

From: Farhad Alemi

Date: Fri Sep 11 2026 - 11:54:22 EST

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[ 47.501124][ T9479] BUG: KASAN: global-out-of-bounds in
set_frame_rate+0x48d/0x5b0
[ 47.501199][ T9479] Read of size 1 at addr ffffffff8cc7f075 by task
repro/9479
[ 47.501224][ T9479]
[ 47.501261][ T9479] CPU: 0 UID: 0 PID: 9479 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 47.501318][ T9479] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 47.501350][ T9479] Call Trace:
[ 47.501367][ T9479] <TASK>
[ 47.501399][ T9479] dump_stack_lvl+0xe8/0x150
[ 47.501441][ T9479] print_address_description+0x55/0x1e0
[ 47.501476][ T9479] ? set_frame_rate+0x48d/0x5b0
[ 47.501504][ T9479] print_report+0x58/0x70
[ 47.501533][ T9479] kasan_report+0x117/0x150
[ 47.501580][ T9479] ? set_frame_rate+0x48d/0x5b0
[ 47.501614][ T9479] set_frame_rate+0x48d/0x5b0
[ 47.501646][ T9479] sd_start+0x6c9/0x1140
[ 47.501700][ T9479] gspca_init_transfer+0x2470/0x3060
[ 47.501761][ T9479] ? __pfx_gspca_init_transfer+0x10/0x10
[ 47.501796][ T9479] ? add_lock_to_list+0xc7/0x100
[ 47.501845][ T9479] ? __lock_acquire+0x74c/0x2db0
[ 47.501903][ T9479] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 47.501940][ T9479] ? __pfx_gspca_start_streaming+0x10/0x10
[ 47.501979][ T9479] gspca_start_streaming+0x6f/0x250
[ 47.502017][ T9479] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 47.502061][ T9479] ? __pfx_gspca_start_streaming+0x10/0x10
[ 47.502099][ T9479] vb2_start_streaming+0x128/0x460
[ 47.502135][ T9479] vb2_core_streamon+0x2e0/0x4f0
[ 47.502169][ T9479] __vb2_init_fileio+0xca2/0xff0
[ 47.502211][ T9479] __vb2_perform_fileio+0x282/0x1620
[ 47.502251][ T9479] ? __lock_acquire+0x74c/0x2db0
[ 47.502312][ T9479] vb2_fop_read+0x273/0x360
[ 47.502351][ T9479] v4l2_read+0x19c/0x2c0
[ 47.502380][ T9479] ? __pfx_v4l2_read+0x10/0x10
[ 47.502409][ T9479] vfs_read+0x20c/0xa70
[ 47.502448][ T9479] ? __pfx_vfs_read+0x10/0x10
[ 47.502482][ T9479] ? __fget_files+0x2a/0x420
[ 47.502514][ T9479] ? __fget_files+0x2a/0x420
[ 47.502543][ T9479] ? __fget_files+0x3a0/0x420
[ 47.502572][ T9479] ? __fget_files+0x2a/0x420
[ 47.502607][ T9479] ksys_read+0x150/0x270
[ 47.502641][ T9479] ? __pfx_ksys_read+0x10/0x10
[ 47.502674][ T9479] ? __pfx_v4l2_ioctl+0x10/0x10
[ 47.502709][ T9479] do_syscall_64+0x155/0x510
[ 47.502754][ T9479] ? trace_irq_disable+0x3b/0x140
[ 47.502794][ T9479] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 47.502826][ T9479] ? clear_bhb_loop+0x30/0x80
[ 47.502860][ T9479] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 47.502892][ T9479] RIP: 0033:0x43c9a2
[ 47.502940][ T9479] Code: 08 0f 85 21 e0 ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[ 47.502975][ T9479] RSP: 002b:00007ffd4e0b0518 EFLAGS: 00000246
ORIG_RAX: 0000000000000000
[ 47.503021][ T9479] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000043c9a2
[ 47.503044][ T9479] RDX: 0000000000001000 RSI: 00000000004d3b00
RDI: 0000000000000004
[ 47.503064][ T9479] RBP: 00007ffd4e0b0540 R08: 0000000000000000
R09: 0000000000000000
[ 47.503085][ T9479] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffd4e0b0998
[ 47.503105][ T9479] R13: 00007ffd4e0b09a8 R14: 0000000000000002
R15: 00000000004cd9e0
[ 47.503139][ T9479] </TASK>
[ 47.503150][ T9479]
[ 47.503158][ T9479] The buggy address belongs to the variable:
[ 47.503169][ T9479] set_frame_rate.rate_0+0x15/0x40
[ 47.503225][ T9479]
[ 47.503233][ T9479] The buggy address belongs to the physical page:
[ 47.503255][ T9479] page: refcount:1 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0xcc7f
[ 47.503300][ T9479] flags:
0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
[ 47.503367][ T9479] raw: 00fff00000002000 ffffea0000331fc8
ffffea0000331fc8 0000000000000000
[ 47.503394][ T9479] raw: 0000000000000000 0000000000000000
00000001ffffffff 0000000000000000
[ 47.503410][ T9479] page dumped because: kasan: bad access detected
[ 47.503433][ T9479] page_owner info is not present (never set?)
[ 47.503446][ T9479]
[ 47.503453][ T9479] Memory state around the buggy address:
[ 47.503469][ T9479] ffffffff8cc7ef00: 00 f9 f9 f9 00 00 02 f9 f9
f9 f9 f9 00 00 02 f9
[ 47.503489][ T9479] ffffffff8cc7ef80: f9 f9 f9 f9 00 00 02 f9 f9
f9 f9 f9 00 00 02 f9
[ 47.503510][ T9479] >ffffffff8cc7f000: f9 f9 f9 f9 00 00 00 00 00
00 00 00 00 00 04 f9
[ 47.503531][ T9479]
^
[ 47.503550][ T9479] ffffffff8cc7f080: f9 f9 f9 f9 00 00 00 00 00
f9 f9 f9 f9 f9 f9 f9
[ 47.503570][ T9479] ffffffff8cc7f100: 00 00 06 f9 f9 f9 f9 f9 00
00 02 f9 f9 f9 f9 f9
[ 47.503585][ T9479]
==================================================================
[ 47.503663][ T9479] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 47.557098][ T9479] CPU: 0 UID: 0 PID: 9479 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 47.558114][ T9479] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 47.559131][ T9479] Call Trace:
[ 47.559477][ T9479] <TASK>
[ 47.559755][ T9479] vpanic+0x56d/0xa60
[ 47.560130][ T9479] ? __pfx_vpanic+0x10/0x10
[ 47.560555][ T9479] panic+0xc5/0xd0
[ 47.560909][ T9479] ? __pfx_panic+0x10/0x10
[ 47.561326][ T9479] ? preempt_schedule_thunk+0x16/0x40
[ 47.561823][ T9479] ? set_frame_rate+0x48d/0x5b0
[ 47.562274][ T9479] ? preempt_schedule_thunk+0x16/0x40
[ 47.562770][ T9479] ? set_frame_rate+0x48d/0x5b0
[ 47.563218][ T9479] check_panic_on_warn+0x89/0xb0
[ 47.563681][ T9479] ? set_frame_rate+0x48d/0x5b0
[ 47.564160][ T9479] end_report+0x73/0x170
[ 47.564582][ T9479] ? set_frame_rate+0x48d/0x5b0
[ 47.565141][ T9479] kasan_report+0x128/0x150
[ 47.565573][ T9479] ? set_frame_rate+0x48d/0x5b0
[ 47.566023][ T9479] set_frame_rate+0x48d/0x5b0
[ 47.566466][ T9479] sd_start+0x6c9/0x1140
[ 47.566868][ T9479] gspca_init_transfer+0x2470/0x3060
[ 47.567363][ T9479] ? __pfx_gspca_init_transfer+0x10/0x10
[ 47.567879][ T9479] ? add_lock_to_list+0xc7/0x100
[ 47.568344][ T9479] ? __lock_acquire+0x74c/0x2db0
[ 47.568808][ T9479] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 47.569305][ T9479] ? __pfx_gspca_start_streaming+0x10/0x10
[ 47.569840][ T9479] gspca_start_streaming+0x6f/0x250
[ 47.570325][ T9479] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 47.570862][ T9479] ? __pfx_gspca_start_streaming+0x10/0x10
[ 47.571400][ T9479] vb2_start_streaming+0x128/0x460
[ 47.571873][ T9479] vb2_core_streamon+0x2e0/0x4f0
[ 47.572368][ T9479] __vb2_init_fileio+0xca2/0xff0
[ 47.572853][ T9479] __vb2_perform_fileio+0x282/0x1620
[ 47.573372][ T9479] ? __lock_acquire+0x74c/0x2db0
[ 47.573832][ T9479] vb2_fop_read+0x273/0x360
[ 47.574258][ T9479] v4l2_read+0x19c/0x2c0
[ 47.574707][ T9479] ? __pfx_v4l2_read+0x10/0x10
[ 47.575251][ T9479] vfs_read+0x20c/0xa70
[ 47.575661][ T9479] ? __pfx_vfs_read+0x10/0x10
[ 47.576120][ T9479] ? __fget_files+0x2a/0x420
[ 47.576581][ T9479] ? __fget_files+0x2a/0x420
[ 47.577006][ T9479] ? __fget_files+0x3a0/0x420
[ 47.577445][ T9479] ? __fget_files+0x2a/0x420
[ 47.577876][ T9479] ksys_read+0x150/0x270
[ 47.578273][ T9479] ? __pfx_ksys_read+0x10/0x10
[ 47.578714][ T9479] ? __pfx_v4l2_ioctl+0x10/0x10
[ 47.579163][ T9479] do_syscall_64+0x155/0x510
[ 47.579597][ T9479] ? trace_irq_disable+0x3b/0x140
[ 47.580062][ T9479] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 47.580619][ T9479] ? clear_bhb_loop+0x30/0x80
[ 47.581058][ T9479] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 47.581604][ T9479] RIP: 0033:0x43c9a2
[ 47.581967][ T9479] Code: 08 0f 85 21 e0 ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[ 47.583693][ T9479] RSP: 002b:00007ffd4e0b0518 EFLAGS: 00000246
ORIG_RAX: 0000000000000000
[ 47.584455][ T9479] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000043c9a2
[ 47.585237][ T9479] RDX: 0000000000001000 RSI: 00000000004d3b00
RDI: 0000000000000004
[ 47.585957][ T9479] RBP: 00007ffd4e0b0540 R08: 0000000000000000
R09: 0000000000000000
[ 47.586671][ T9479] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffd4e0b0998
[ 47.587386][ T9479] R13: 00007ffd4e0b09a8 R14: 0000000000000002
R15: 00000000004cd9e0
[ 47.588103][ T9479] </TASK>
[ 47.589051][ T9479] Kernel Offset: disabled
[ 47.589602][ T9479] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data