From: syzbot <syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, kartikey406@gmail.com,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-trace-kernel@vger.kernel.org, mark.rutland@arm.com,
mathieu.desnoyers@efficios.com, mhiramat@kernel.org,
rostedt@goodmis.org, rostedt@kernel.org, sh_def@163.com,
stable@vger.kernel.org, syzkaller-bugs@googlegroups.com,
vdonnefort@google.com, vulab@iscas.ac.cn
Subject: Re: [syzbot] [fs?] [trace?] WARNING in eventfs_create_events_dir
Date: Fri, 28 Aug 2026 04:27:27 -0700 [thread overview]
Message-ID: <6a91709f.4d659fcc.734b4.001c.GAE@google.com> (raw)
In-Reply-To: <6a8c13ee.91706f20.16b6e3.02d5.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16eddd49580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=3ef80b4ed02226d04a06
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17986d79580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fae2ca35a9f
R13: 00007fae2ca35adb R14: 00007fae2ca5ccc0 R15: 0000000000000002
</TASK>
------------[ cut here ]------------
!list_empty(&ei->children)
WARNING: fs/tracefs/event_inode.c:128 at free_ei fs/tracefs/event_inode.c:128 [inline], CPU#0: syz-executor340/6037
WARNING: fs/tracefs/event_inode.c:128 at cleanup_ei fs/tracefs/event_inode.c:150 [inline], CPU#0: syz-executor340/6037
WARNING: fs/tracefs/event_inode.c:128 at cleanup_ei fs/tracefs/event_inode.c:145 [inline], CPU#0: syz-executor340/6037
WARNING: fs/tracefs/event_inode.c:128 at eventfs_create_events_dir+0xa3d/0xbe0 fs/tracefs/event_inode.c:838, CPU#0: syz-executor340/6037
Modules linked in:
CPU: 0 UID: 0 PID: 6037 Comm: syz-executor340 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:free_ei fs/tracefs/event_inode.c:128 [inline]
RIP: 0010:cleanup_ei fs/tracefs/event_inode.c:150 [inline]
RIP: 0010:cleanup_ei fs/tracefs/event_inode.c:145 [inline]
RIP: 0010:eventfs_create_events_dir+0xa3d/0xbe0 fs/tracefs/event_inode.c:838
Code: 00 e8 e7 82 fa 00 e9 ab fb ff ff e8 1d 4e e1 fd 48 8b 7c 24 10 be 03 00 00 00 e8 ce 82 fa 00 e9 c2 fd ff ff e8 04 4e e1 fd 90 <0f> 0b 90 e9 59 fe ff ff e8 e6 21 54 fe e9 4b f7 ff ff 48 89 44 24
RSP: 0018:ffffc90005867b88 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888045883028 RCX: 0000000000000000
RDX: ffff88802ecd2580 RSI: ffffffff8429b3cc RDI: ffffffff8e69c920
RBP: ffff888030052f10 R08: 00000000ffffffff R09: fffffbfff1dff612
R10: ffffffff8effb093 R11: 0000000000000001 R12: ffff888030052f50
R13: 0000000000000003 R14: ffff888030052f4c R15: ffff888030052f00
FS: 000055555739d400(0000) GS:ffff8880d5ba2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c8902f3204 CR3: 0000000022b49000 CR4: 0000000000352ef0
Call Trace:
<TASK>
create_event_toplevel_files+0x12d/0x1a0 kernel/trace/trace_events.c:4709
event_trace_add_tracer+0x72/0x260 kernel/trace/trace_events.c:4740
trace_array_create_dir+0x8e/0x210 kernel/trace/trace.c:8550
trace_array_create_systems+0x8b3/0xc30 kernel/trace/trace.c:8641
trace_array_create kernel/trace/trace.c:8668 [inline]
instance_mkdir+0xca/0x140 kernel/trace/trace.c:8683
tracefs_syscall_mkdir+0x10e/0x180 fs/tracefs/inode.c:121
vfs_mkdir+0x364/0x850 fs/namei.c:5410
filename_mkdirat+0x48b/0x5e0 fs/namei.c:5443
__do_sys_mkdir fs/namei.c:5470 [inline]
__se_sys_mkdir fs/namei.c:5467 [inline]
__x64_sys_mkdir+0x6b/0x90 fs/namei.c:5467
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fae2c9d8ec7
Code: 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffcc38a20c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fae2c9d8ec7
RDX: 0000000000000000 RSI: 00000000000001ed RDI: 00007ffcc38a2160
RBP: 00007ffcc38a2160 R08: 0000000000000001 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fae2ca35a9f
R13: 00007fae2ca35adb R14: 00007fae2ca5ccc0 R15: 0000000000000002
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2026-08-28 11:27 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-24 9:50 [syzbot] [fs?] [trace?] WARNING in eventfs_create_events_dir syzbot
2026-08-24 13:08 ` Forwarded: [PATCH] eventfs: Initialize ei->children and ei->list in init_ei() syzbot
2026-08-28 11:27 ` syzbot [this message]
2026-08-28 13:50 ` [syzbot] [fs?] [trace?] WARNING in eventfs_create_events_dir Steven Rostedt
[not found] <20260824130806.51680-1-kartikey406@gmail.com>
2026-08-24 15:52 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a91709f.4d659fcc.734b4.001c.GAE@google.com \
--to=syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=kartikey406@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=rostedt@goodmis.org \
--cc=rostedt@kernel.org \
--cc=sh_def@163.com \
--cc=stable@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=vdonnefort@google.com \
--cc=vulab@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.