From: syzbot <syzbot+2e3bf0bd49acd9b21d4b@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, nenkov2004@gmail.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote
Date: Tue, 10 Nov 2026 13:49:04 -0800 [thread overview]
Message-ID: <6af39150.6ea51c61.3838e6.0017.GAE@google.com> (raw)
In-Reply-To: <CAO7_G+wHdgLNKCbCGypfCUbp23eB+fdp-OmFRkn6WNnRTCfTkg@mail.gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: null-ptr-deref Write in fib_insert_alias
==================================================================
BUG: KASAN: null-ptr-deref in hlist_add_before_rcu include/linux/rculist.h:744 [inline]
BUG: KASAN: null-ptr-deref in fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
Write of size 8 at addr 0000000000000000 by task syz-executor/5244
CPU: 1 UID: 0 PID: 5244 Comm: syz-executor Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_report+0x58/0x84 mm/kasan/report.c:485
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
__kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
hlist_add_before_rcu include/linux/rculist.h:744 [inline]
fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
fib_table_insert+0x5dc/0x12bc net/ipv4/fib_trie.c:1352
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1147
fib_add_ifaddr+0x2e0/0x500 net/ipv4/fib_frontend.c:1184
fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1529
notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:86
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:558
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2313
call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
call_netdevice_notifiers net/core/dev.c:2365 [inline]
__dev_notify_flags+0x288/0x438 net/core/dev.c:10051
netif_change_flags+0xd0/0x15c net/core/dev.c:10080
do_setlink+0xc28/0x32d4 net/core/rtnetlink.c:3294
rtnl_changelink net/core/rtnetlink.c:3942 [inline]
__rtnl_newlink net/core/rtnetlink.c:4113 [inline]
rtnl_newlink+0xf48/0x1390 net/core/rtnetlink.c:4252
rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7169
netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2584
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7196
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x73c/0x934 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x670/0x98c net/netlink/af_netlink.c:1920
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg+0xc8/0x188 net/socket.c:818
__sys_sendto+0x250/0x328 net/socket.c:2283
__do_sys_sendto net/socket.c:2290 [inline]
__se_sys_sendto net/socket.c:2286 [inline]
__arm64_sys_sendto+0xec/0x10c net/socket.c:2286
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
==================================================================
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000044
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
CM = 0, WnR = 1, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173dd000
[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000044 [#1] SMP
Modules linked in:
CPU: 1 UID: 0 PID: 5244 Comm: syz-executor Tainted: G B syzkaller #0 PREEMPT
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : hlist_add_before_rcu include/linux/rculist.h:744 [inline]
pc : fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
lr : hlist_add_before_rcu include/linux/rculist.h:744 [inline]
lr : fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
sp : ffff800096b86750
x29: ffff800096b86780 x28: ffff0000c8fb8528 x27: ffff0000eb35fc20
x26: dfff800000000000 x25: 0000000000000018 x24: ffff0000c8fb8210
x23: ffff0000dcc87660 x22: 0000000000000000 x21: ffff0000c8fb8528
x20: ffff0000c8fb8218 x19: 1fffe000191f7043 x18: 0000000000000000
x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d
x14: 00000000000006f9 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001161f92d x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff8000804a0c38
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030c9a8
x2 : 0000000000000000 x1 : ffff0000c1fb1d80 x0 : 0000000000000000
Call trace:
hlist_add_before_rcu include/linux/rculist.h:744 [inline] (P)
fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160 (P)
fib_table_insert+0x5dc/0x12bc net/ipv4/fib_trie.c:1352
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1147
fib_add_ifaddr+0x2e0/0x500 net/ipv4/fib_frontend.c:1184
fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1529
notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:86
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:558
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2313
call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
call_netdevice_notifiers net/core/dev.c:2365 [inline]
__dev_notify_flags+0x288/0x438 net/core/dev.c:10051
netif_change_flags+0xd0/0x15c net/core/dev.c:10080
do_setlink+0xc28/0x32d4 net/core/rtnetlink.c:3294
rtnl_changelink net/core/rtnetlink.c:3942 [inline]
__rtnl_newlink net/core/rtnetlink.c:4113 [inline]
rtnl_newlink+0xf48/0x1390 net/core/rtnetlink.c:4252
rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7169
netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2584
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7196
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x73c/0x934 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x670/0x98c net/netlink/af_netlink.c:1920
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg+0xc8/0x188 net/socket.c:818
__sys_sendto+0x250/0x328 net/socket.c:2283
__do_sys_sendto net/socket.c:2290 [inline]
__se_sys_sendto net/socket.c:2286 [inline]
__arm64_sys_sendto+0xec/0x10c net/socket.c:2286
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
Code: aa1603e0 52800101 f90002b8 96d8b07a (c89ffed5)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: aa1603e0 mov x0, x22
4: 52800101 mov w1, #0x8 // #8
8: f90002b8 str x24, [x21]
c: 96d8b07a bl 0xfffffffffb62c1f4
* 10: c89ffed5 stlr x21, [x22] <-- trapping instruction
Tested on:
commit: 067c5c24 Merge tag 'page_alloc-for-7.4-rc2' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c7b1fd580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c06331d9bb9c8204
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=16dccebe580000
next parent reply other threads:[~2026-11-10 21:49 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAO7_G+wHdgLNKCbCGypfCUbp23eB+fdp-OmFRkn6WNnRTCfTkg@mail.gmail.com>
2026-11-10 21:49 ` syzbot [this message]
2026-11-11 1:13 ` [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote Hristos Nenkov
[not found] <CAO7_G+xSmFavmMUAKYcLVBFaDt4okxAFx0XZT5t-3v=hULmO5w@mail.gmail.com>
2026-11-11 4:51 ` syzbot
[not found] <CAO7_G+xxRab6PJQnffPhpV+fiYbEj85bDOLYO6Uho360ohVYLw@mail.gmail.com>
2026-11-11 4:42 ` syzbot
[not found] <CAO7_G+xNhBX9OmcoLHLA_ygEArCRGEVvX1fHgT5DJpoG26BbJQ@mail.gmail.com>
2026-11-11 4:27 ` syzbot
[not found] <CAO7_G+xfNddPzLFwOEK1nm06WbPMH2b_DgFNOHeE50Za0Zr+eQ@mail.gmail.com>
2026-11-11 4:26 ` syzbot
[not found] <CAO7_G+wivY7+jm_JWMuXMa1+ttqNEiQ25iOdUyT=_CrnSEKGNA@mail.gmail.com>
2026-11-11 4:26 ` syzbot
[not found] <CAO7_G+w-YoXKa7uTPZgu8JK=zvVOigzOjewNu=kZMZvGTxh8Jw@mail.gmail.com>
2026-11-10 22:09 ` syzbot
[not found] <CAO7_G+y3L5-N_-01cHPEbyvEob5mwgDCN2JgEHJoALzcptMX8A@mail.gmail.com>
2026-11-10 22:08 ` syzbot
2026-08-27 10:07 syzbot
2026-10-07 11:18 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6af39150.6ea51c61.3838e6.0017.GAE@google.com \
--to=syzbot+2e3bf0bd49acd9b21d4b@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nenkov2004@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.