From: syzbot <syzbot+ccf9f05f06b4b951f3cd@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, axelrasmussen@google.com,
cem@kernel.org, david@kernel.org, hannes@cmpxchg.org,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
linux-xfs@vger.kernel.org, lorenzo.stoakes@oracle.com,
mhocko@kernel.org, shakeel.butt@linux.dev,
syzkaller-bugs@googlegroups.com, weixugc@google.com,
yuanchu@google.com, zhengqi.arch@bytedance.com
Subject: [syzbot] [xfs] general protection fault in workingset_refault (3)
Date: Wed, 17 Dec 2025 07:06:29 -0800 [thread overview]
Message-ID: <6942c6f5.a70a0220.207337.0063.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: ea1013c15392 Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16a839b4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=513255d80ab78f2b
dashboard link: https://syzkaller.appspot.com/bug?extid=ccf9f05f06b4b951f3cd
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-ea1013c1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea4d0b50128d/vmlinux-ea1013c1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f2e7f1524121/bzImage-ea1013c1.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ccf9f05f06b4b951f3cd@syzkaller.appspotmail.com
Zero length message leads to an empty skb
loop0: detected capacity change from 0 to 32768
=======================================================
WARNING: The mand mount option has been deprecated and
and is ignored by this kernel. Remove the mand
option from the mount to silence this warning.
=======================================================
xfs: Unknown parameter '�\x04'
Oops: general protection fault, probably for non-canonical address 0xdffffc00000009c0: 0000 [#1] SMP KASAN NOPTI
KASAN: probably user-memory-access in range [0x0000000000004e00-0x0000000000004e07]
CPU: 0 UID: 0 PID: 5343 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:mem_cgroup_lruvec include/linux/memcontrol.h:720 [inline]
RIP: 0010:lru_gen_test_recent mm/workingset.c:275 [inline]
RIP: 0010:lru_gen_refault mm/workingset.c:296 [inline]
RIP: 0010:workingset_refault+0x3f8/0x1170 mm/workingset.c:546
Code: 74 0c 48 c7 c7 e0 6a a2 8f e8 04 05 1d 00 4c 8b 35 3d c7 95 0d 49 81 c6 78 0c 00 00 4d 8d bd 00 4e 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 ce 05 00 00 49 63 07 4d 8d 34 c6 4c 89
RSP: 0018:ffffc9000a7b7880 EFLAGS: 00010206
RAX: 00000000000009c0 RBX: 0000000000000383 RCX: 0000000000100000
RDX: ffffc900208d2000 RSI: 0000000000000472 RDI: 0000000000000473
RBP: ffffc9000a7b7998 R08: ffff88801f7524c0 R09: 0000000000000002
R10: 0000000000000406 R11: 0000000000000002 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88801baf8c78 R15: 0000000000004e00
FS: 00007fbc75e8f6c0(0000) GS:ffff88808d22a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000040 CR3: 000000001234e000 CR4: 0000000000352ef0
Call Trace:
<TASK>
filemap_add_folio+0x33f/0x540 mm/filemap.c:981
do_read_cache_folio+0x32e/0x590 mm/filemap.c:4063
freader_get_folio+0x3c7/0x830 lib/buildid.c:58
freader_fetch+0xa3/0x750 lib/buildid.c:101
__build_id_parse+0x133/0x7d0 lib/buildid.c:289
do_procmap_query fs/proc/task_mmu.c:733 [inline]
procfs_procmap_ioctl+0x76f/0xce0 fs/proc/task_mmu.c:813
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbc74f8f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbc75e8f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fbc751e5fa0 RCX: 00007fbc74f8f7c9
RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 000000000000000d
RBP: 00007fbc75013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbc751e6038 R14: 00007fbc751e5fa0 R15: 00007fff29f355e8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mem_cgroup_lruvec include/linux/memcontrol.h:720 [inline]
RIP: 0010:lru_gen_test_recent mm/workingset.c:275 [inline]
RIP: 0010:lru_gen_refault mm/workingset.c:296 [inline]
RIP: 0010:workingset_refault+0x3f8/0x1170 mm/workingset.c:546
Code: 74 0c 48 c7 c7 e0 6a a2 8f e8 04 05 1d 00 4c 8b 35 3d c7 95 0d 49 81 c6 78 0c 00 00 4d 8d bd 00 4e 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 ce 05 00 00 49 63 07 4d 8d 34 c6 4c 89
RSP: 0018:ffffc9000a7b7880 EFLAGS: 00010206
RAX: 00000000000009c0 RBX: 0000000000000383 RCX: 0000000000100000
RDX: ffffc900208d2000 RSI: 0000000000000472 RDI: 0000000000000473
RBP: ffffc9000a7b7998 R08: ffff88801f7524c0 R09: 0000000000000002
R10: 0000000000000406 R11: 0000000000000002 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88801baf8c78 R15: 0000000000004e00
FS: 00007fbc75e8f6c0(0000) GS:ffff88808d22a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9f4cc08120 CR3: 000000001234e000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 74 0c je 0xe
2: 48 c7 c7 e0 6a a2 8f mov $0xffffffff8fa26ae0,%rdi
9: e8 04 05 1d 00 call 0x1d0512
e: 4c 8b 35 3d c7 95 0d mov 0xd95c73d(%rip),%r14 # 0xd95c752
15: 49 81 c6 78 0c 00 00 add $0xc78,%r14
1c: 4d 8d bd 00 4e 00 00 lea 0x4e00(%r13),%r15
23: 4c 89 f8 mov %r15,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 ce 05 00 00 jne 0x605
37: 49 63 07 movslq (%r15),%rax
3a: 4d 8d 34 c6 lea (%r14,%rax,8),%r14
3e: 4c rex.WR
3f: 89 .byte 0x89
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2025-12-17 15:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-17 15:06 syzbot [this message]
2025-12-18 5:15 ` [syzbot] [xfs] general protection fault in workingset_refault (3) Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6942c6f5.a70a0220.207337.0063.GAE@google.com \
--to=syzbot+ccf9f05f06b4b951f3cd@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=axelrasmussen@google.com \
--cc=cem@kernel.org \
--cc=david@kernel.org \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-xfs@vger.kernel.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=mhocko@kernel.org \
--cc=shakeel.butt@linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
--cc=weixugc@google.com \
--cc=yuanchu@google.com \
--cc=zhengqi.arch@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.