From: syzbot <syzbot+cc460646984184ad435a@syzkaller.appspotmail.com>
To: dakr@kernel.org, driver-core@lists.linux.dev,
gregkh@linuxfoundation.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, rafael@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [fs?] general protection fault in __simple_recursive_removal (2)
Date: Tue, 04 Aug 2026 10:15:39 -0700 [thread overview]
Message-ID: <6a721e3b.40259c87.584f4.04bd.GAE@google.com> (raw)
In-Reply-To: <6a6b45fb.57649fcc.360844.0016.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 7235a3e71949 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=16c913b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccf4bea59f67007
dashboard link: https://syzkaller.appspot.com/bug?extid=cc460646984184ad435a
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1116acc6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=121fb649580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fd45635beaae/disk-7235a3e7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d7d2e6507223/vmlinux-7235a3e7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b5b5d8de4cea/Image-7235a3e7.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cc460646984184ad435a@syzkaller.appspotmail.com
i2c i2c-1: failure reading functionality
i2c i2c-1: failure reading functionality
Unable to handle kernel paging request at virtual address dfff800000000028
KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000028] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 1 UID: 0 PID: 5728 Comm: syz.4.648 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : kasan_byte_accessible+0x10/0x20 mm/kasan/generic.c:210
lr : __kasan_check_byte+0x20/0x54 mm/kasan/common.c:573
sp : ffff800096777240
x29: ffff800096777240 x28: ffff800088b0a000 x27: ffff0000d0da3a80
x26: 2eb980008045b830 x25: 0000000000000000 x24: 0000000000000001
x23: 0000000000000000 x22: 0000000000000140 x21: 0000000000000140
x20: 0000000000000002 x19: ffff80008045b830 x18: 1fffe00035bc9e28
x17: 0000000000000003 x16: ffff800088b07000 x15: ffff800088bbd0a0
x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : dfff800000000000
x8 : 0000000000000028 x7 : ffff8000818fc2c8 x6 : ffff800080d4edec
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff80008045b830 x0 : 0000000000000140
Call trace:
kasan_mem_to_shadow include/linux/kasan.h:65 [inline] (P)
kasan_byte_accessible+0x10/0x20 mm/kasan/generic.c:210 (P)
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire+0xa4/0x364 kernel/locking/lockdep.c:5842
down_write_nested+0x58/0xcc kernel/locking/rwsem.c:1757
inode_lock_nested include/linux/fs.h:1069 [inline]
__simple_recursive_removal+0x7c/0x430 fs/libfs.c:606
simple_recursive_removal+0x2c/0x3c fs/libfs.c:646
debugfs_remove+0x60/0x88 fs/debugfs/inode.c:781
i2c_device_probe+0x884/0x9d4 drivers/i2c/i2c-core-base.c:610
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x29c/0x800 drivers/base/dd.c:706
__driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
__device_attach_driver+0x198/0x2f8 drivers/base/dd.c:1026
bus_for_each_drv+0x144/0x1dc drivers/base/bus.c:500
__device_attach+0x248/0x390 drivers/base/dd.c:1098
device_initial_probe+0x90/0xc8 drivers/base/dd.c:1153
bus_probe_device+0x58/0x120 drivers/base/bus.c:620
device_add+0x6cc/0x9e0 drivers/base/core.c:3772
device_register+0x28/0x38 drivers/base/core.c:3854
i2c_new_client_device+0x5ac/0xadc drivers/i2c/i2c-core-base.c:1019
new_device_store+0x210/0x3d4 drivers/i2c/i2c-core-base.c:1307
dev_attr_store+0x6c/0x90 drivers/base/core.c:2505
sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x51c/0xa0c fs/read_write.c:687
ksys_write+0x12c/0x228 fs/read_write.c:739
__do_sys_write fs/read_write.c:750 [inline]
__se_sys_write fs/read_write.c:747 [inline]
__arm64_sys_write+0x84/0x98 fs/read_write.c:747
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Code: d503245f d343fc08 d2d00009 f2fbffe9 (38696908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: d503245f bti c
4: d343fc08 lsr x8, x0, #3
8: d2d00009 mov x9, #0x800000000000 // #140737488355328
c: f2fbffe9 movk x9, #0xdfff, lsl #48
* 10: 38696908 ldrb w8, [x8, x9] <-- trapping instruction
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-08-04 17:15 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-30 12:39 [syzbot] [fs?] general protection fault in __simple_recursive_removal (2) syzbot
2026-08-04 17:15 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a721e3b.40259c87.584f4.04bd.GAE@google.com \
--to=syzbot+cc460646984184ad435a@syzkaller.appspotmail.com \
--cc=dakr@kernel.org \
--cc=driver-core@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.