[syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    4ea7c1717f3f Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17346c12580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=143f5c12580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17c9a7cd980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1f8cf51c9042/disk-4ea7c171.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6f227246b5b7/vmlinux-4ea7c171.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f935766a00b3/bzImage-4ea7c171.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/bee9311f4026/mount_4.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff888111778c00 (size 512):
  comm "syz.0.17", pid 6092, jiffies 4294942644
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc eb1d7412):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
    alloc_fs_context+0x214/0x430 fs/fs_context.c:315
    do_new_mount fs/namespace.c:3707 [inline]
    path_mount+0x93c/0x12e0 fs/namespace.c:4037
    do_mount fs/namespace.c:4050 [inline]
    __do_sys_mount fs/namespace.c:4238 [inline]
    __se_sys_mount fs/namespace.c:4215 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a2e8800 (size 512):
  comm "syz.0.18", pid 6098, jiffies 4294942646
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc eb1d7412):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
    alloc_fs_context+0x214/0x430 fs/fs_context.c:315
    do_new_mount fs/namespace.c:3707 [inline]
    path_mount+0x93c/0x12e0 fs/namespace.c:4037
    do_mount fs/namespace.c:4050 [inline]
    __do_sys_mount fs/namespace.c:4238 [inline]
    __se_sys_mount fs/namespace.c:4215 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a2e8e00 (size 512):
  comm "syz.0.19", pid 6102, jiffies 4294942648
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc eb1d7412):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
    alloc_fs_context+0x214/0x430 fs/fs_context.c:315
    do_new_mount fs/namespace.c:3707 [inline]
    path_mount+0x93c/0x12e0 fs/namespace.c:4037
    do_mount fs/namespace.c:4050 [inline]
    __do_sys_mount fs/namespace.c:4238 [inline]
    __se_sys_mount fs/namespace.c:4215 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881263ed600 (size 512):
  comm "syz.0.20", pid 6125, jiffies 4294943177
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc eb1d7412):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
    alloc_fs_context+0x214/0x430 fs/fs_context.c:315
    do_new_mount fs/namespace.c:3707 [inline]
    path_mount+0x93c/0x12e0 fs/namespace.c:4037
    do_mount fs/namespace.c:4050 [inline]
    __do_sys_mount fs/namespace.c:4238 [inline]
    __se_sys_mount fs/namespace.c:4215 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810db18c00 (size 512):
  comm "syz.0.21", pid 6127, jiffies 4294943179
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc eb1d7412):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
    alloc_fs_context+0x214/0x430 fs/fs_context.c:315
    do_new_mount fs/namespace.c:3707 [inline]
    path_mount+0x93c/0x12e0 fs/namespace.c:4037
    do_mount fs/namespace.c:4050 [inline]
    __do_sys_mount fs/namespace.c:4238 [inline]
    __se_sys_mount fs/namespace.c:4215 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[Viacheslav Dubeyko]

Issue has been created:
https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/239

Thanks,
Slava.

On Wed, 2025-11-12 at 20:27 -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    4ea7c1717f3f Merge tag 'for-linus' of git://git.kernel.org..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17346c12580000  
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809  
> dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6  
> compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=143f5c12580000  
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17c9a7cd980000  
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/1f8cf51c9042/disk-4ea7c171.raw.xz  
> vmlinux: https://storage.googleapis.com/syzbot-assets/6f227246b5b7/vmlinux-4ea7c171.xz  
> kernel image: https://storage.googleapis.com/syzbot-assets/f935766a00b3/bzImage-4ea7c171.xz  
> mounted in repro: https://storage.googleapis.com/syzbot-assets/bee9311f4026/mount_4.gz  
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
> 
> BUG: memory leak
> unreferenced object 0xffff888111778c00 (size 512):
>   comm "syz.0.17", pid 6092, jiffies 4294942644
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace (crc eb1d7412):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
>     slab_post_alloc_hook mm/slub.c:4979 [inline]
>     slab_alloc_node mm/slub.c:5284 [inline]
>     __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
>     kmalloc_noprof include/linux/slab.h:957 [inline]
>     kzalloc_noprof include/linux/slab.h:1094 [inline]
>     hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
>     alloc_fs_context+0x214/0x430 fs/fs_context.c:315
>     do_new_mount fs/namespace.c:3707 [inline]
>     path_mount+0x93c/0x12e0 fs/namespace.c:4037
>     do_mount fs/namespace.c:4050 [inline]
>     __do_sys_mount fs/namespace.c:4238 [inline]
>     __se_sys_mount fs/namespace.c:4215 [inline]
>     __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
>     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>     do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> BUG: memory leak
> unreferenced object 0xffff88810a2e8800 (size 512):
>   comm "syz.0.18", pid 6098, jiffies 4294942646
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace (crc eb1d7412):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
>     slab_post_alloc_hook mm/slub.c:4979 [inline]
>     slab_alloc_node mm/slub.c:5284 [inline]
>     __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
>     kmalloc_noprof include/linux/slab.h:957 [inline]
>     kzalloc_noprof include/linux/slab.h:1094 [inline]
>     hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
>     alloc_fs_context+0x214/0x430 fs/fs_context.c:315
>     do_new_mount fs/namespace.c:3707 [inline]
>     path_mount+0x93c/0x12e0 fs/namespace.c:4037
>     do_mount fs/namespace.c:4050 [inline]
>     __do_sys_mount fs/namespace.c:4238 [inline]
>     __se_sys_mount fs/namespace.c:4215 [inline]
>     __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
>     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>     do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> BUG: memory leak
> unreferenced object 0xffff88810a2e8e00 (size 512):
>   comm "syz.0.19", pid 6102, jiffies 4294942648
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace (crc eb1d7412):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
>     slab_post_alloc_hook mm/slub.c:4979 [inline]
>     slab_alloc_node mm/slub.c:5284 [inline]
>     __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
>     kmalloc_noprof include/linux/slab.h:957 [inline]
>     kzalloc_noprof include/linux/slab.h:1094 [inline]
>     hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
>     alloc_fs_context+0x214/0x430 fs/fs_context.c:315
>     do_new_mount fs/namespace.c:3707 [inline]
>     path_mount+0x93c/0x12e0 fs/namespace.c:4037
>     do_mount fs/namespace.c:4050 [inline]
>     __do_sys_mount fs/namespace.c:4238 [inline]
>     __se_sys_mount fs/namespace.c:4215 [inline]
>     __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
>     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>     do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> BUG: memory leak
> unreferenced object 0xffff8881263ed600 (size 512):
>   comm "syz.0.20", pid 6125, jiffies 4294943177
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace (crc eb1d7412):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
>     slab_post_alloc_hook mm/slub.c:4979 [inline]
>     slab_alloc_node mm/slub.c:5284 [inline]
>     __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
>     kmalloc_noprof include/linux/slab.h:957 [inline]
>     kzalloc_noprof include/linux/slab.h:1094 [inline]
>     hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
>     alloc_fs_context+0x214/0x430 fs/fs_context.c:315
>     do_new_mount fs/namespace.c:3707 [inline]
>     path_mount+0x93c/0x12e0 fs/namespace.c:4037
>     do_mount fs/namespace.c:4050 [inline]
>     __do_sys_mount fs/namespace.c:4238 [inline]
>     __se_sys_mount fs/namespace.c:4215 [inline]
>     __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
>     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>     do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> BUG: memory leak
> unreferenced object 0xffff88810db18c00 (size 512):
>   comm "syz.0.21", pid 6127, jiffies 4294943179
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace (crc eb1d7412):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
>     slab_post_alloc_hook mm/slub.c:4979 [inline]
>     slab_alloc_node mm/slub.c:5284 [inline]
>     __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
>     kmalloc_noprof include/linux/slab.h:957 [inline]
>     kzalloc_noprof include/linux/slab.h:1094 [inline]
>     hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
>     alloc_fs_context+0x214/0x430 fs/fs_context.c:315
>     do_new_mount fs/namespace.c:3707 [inline]
>     path_mount+0x93c/0x12e0 fs/namespace.c:4037
>     do_mount fs/namespace.c:4050 [inline]
>     __do_sys_mount fs/namespace.c:4238 [inline]
>     __se_sys_mount fs/namespace.c:4215 [inline]
>     __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
>     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>     do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ   for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status   for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup

-- 
Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>

(no subject)

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/super.c b/fs/super.c
index 5bab94fb7e03..a9112b17b79f 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -484,6 +484,7 @@ void deactivate_locked_super(struct super_block *s)
 
 		put_filesystem(fs);
 		put_super(s);
+		kfree(s->s_fs_info);
 	} else {
 		super_unlock_excl(s);
 	}
-- 
2.51.2

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

roller area network core
[    9.749562][    T1] NET: Registered PF_CAN protocol family
[    9.750438][    T1] can: raw protocol
[    9.750982][    T1] can: broadcast manager protocol
[    9.751738][    T1] can: netlink gateway - max_hops=1
[    9.752496][    T1] can: SAE J1939
[    9.753010][    T1] can: isotp protocol (max_pdu_size 8300)
[    9.754130][    T1] Bluetooth: RFCOMM TTY layer initialized
[    9.754932][    T1] Bluetooth: RFCOMM socket layer initialized
[    9.755826][    T1] Bluetooth: RFCOMM ver 1.11
[    9.756640][    T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    9.757547][    T1] Bluetooth: BNEP filters: protocol multicast
[    9.758499][    T1] Bluetooth: BNEP socket layer initialized
[    9.759429][    T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[    9.760557][    T1] Bluetooth: HIDP socket layer initialized
[    9.762424][    T1] NET: Registered PF_RXRPC protocol family
[    9.763241][    T1] Key type rxrpc registered
[    9.764425][    T1] Key type rxrpc_s registered
[    9.765548][    T1] NET: Registered PF_KCM protocol family
[    9.766688][    T1] lec:lane_module_init: lec.c: initialized
[    9.767737][    T1] mpoa:atm_mpoa_init: mpc.c: initialized
[    9.768664][    T1] l2tp_core: L2TP core driver, V2.0
[    9.769494][    T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    9.770289][    T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[    9.771155][    T1] l2tp_netlink: L2TP netlink interface
[    9.771938][    T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[    9.772847][    T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[    9.774041][    T1] NET: Registered PF_PHONET protocol family
[    9.774894][    T1] 8021q: 802.1Q VLAN Support v1.8
[    9.775717][    T1] sctp: Hash tables configured (bind 256/256)
[    9.777068][    T1] NET: Registered PF_RDS protocol family
[    9.778075][    T1] Registered RDS/infiniband transport
[    9.778994][    T1] Registered RDS/tcp transport
[    9.779692][    T1] tipc: Activated (version 2.0.0)
[    9.780699][    T1] NET: Registered PF_TIPC protocol family
[    9.782344][    T1] tipc: Started in single node mode
[    9.784387][    T1] smc: adding smcd device lo without pnetid
[    9.785913][    T1] NET: Registered PF_SMC protocol family
[    9.787625][    T1] 9pnet: Installing 9P2000 support
[    9.789167][    T1] NET: Registered PF_CAIF protocol family
[    9.791371][    T1] NET: Registered PF_IEEE802154 protocol family
[    9.792806][    T1] Key type dns_resolver registered
[    9.794259][    T1] Key type ceph registered
[    9.795165][    T1] libceph: loaded (mon/osd proto 15/24)
[    9.796573][    T1] batman_adv: B.A.T.M.A.N. advanced 2025.4 (compatibility version 15) loaded
[    9.798385][    T1] openvswitch: Open vSwitch switching datapath
[    9.799992][    T1] NET: Registered PF_VSOCK protocol family
[    9.800986][    T1] mpls_gso: MPLS GSO support
[    9.819559][    T1] IPI shorthand broadcast: enabled
[   10.013424][    T1] sched_clock: Marking stable (9984532893, 23793120)->(10012625265, -4299252)
[   10.021125][    T1] registered taskstats version 1
[   10.025750][    T1] Loading compiled-in X.509 certificates
[   10.058263][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: ea23c8da7267aa5b617cb0954f38b31bf7cab05f'
[   10.088097][    T1] zswap: loaded using pool 842
[   10.089329][    T1] Demotion targets for Node 0: null
[   10.090444][    T1] Demotion targets for Node 1: null
[   10.091182][    T1] kmemleak: Kernel memory leak detector initialized (mem pool available: 15732)
[   10.093020][    T1] Key type .fscrypt registered
[   10.093752][    T1] Key type fscrypt-provisioning registered
[   10.095763][    T1] kAFS: Red Hat AFS client v0.1 registering.
[   10.099093][    T1] Btrfs loaded, assert=on, zoned=yes, fsverity=yes
[   10.100242][    T1] Key type big_key registered
[   10.101201][    T1] Key type encrypted registered
[   10.101898][    T1] AppArmor: AppArmor sha256 policy hashing enabled
[   10.102910][    T1] ima: No TPM chip found, activating TPM-bypass!
[   10.103860][    T1] Loading compiled-in module X.509 certificates
[   10.135501][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: ea23c8da7267aa5b617cb0954f38b31bf7cab05f'
[   10.137680][    T1] ima: Allocated hash algorithm: sha256
[   10.138660][    T1] ima: No architecture policies found
[   10.139629][    T1] evm: Initialising EVM extended attributes:
[   10.140520][    T1] evm: security.selinux (disabled)
[   10.141260][    T1] evm: security.SMACK64 (disabled)
[   10.142032][    T1] evm: security.SMACK64EXEC (disabled)
[   10.142977][    T1] evm: security.SMACK64TRANSMUTE (disabled)
[   10.143870][    T1] evm: security.SMACK64MMAP (disabled)
[   10.144647][    T1] evm: security.apparmor
[   10.145278][    T1] evm: security.ima
[   10.145794][    T1] evm: security.capability
[   10.146417][    T1] evm: HMAC attrs: 0x1
[   10.147566][    T1] PM:   Magic number: 1:78:913
[   10.148733][    T1] tty ptyz9: hash matches
[   10.149389][    T1] tty ptywc: hash matches
[   10.150164][    T1] netconsole: network logging started
[   10.151137][    T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[   10.153632][    T1] rdma_rxe: loaded
[   10.154685][    T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[   10.157212][    T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[   10.159121][    T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[   10.160513][ T3094] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[   10.161920][ T3094] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[   10.163450][    T1] clk: Disabling unused clocks
[   10.164221][    T1] ALSA device list:
[   10.164750][    T1]   #0: Dummy 1
[   10.165239][    T1]   #1: Loopback 1
[   10.165745][    T1]   #2: Virtual MIDI Card 1
[   10.167530][    T1] check access for rdinit=/init failed: -2, ignoring
[   10.168530][    T1] md: Waiting for all devices to be available before autodetect
[   10.169637][    T1] md: If you don't use raid, use raid=noautodetect
[   10.170520][    T1] md: Autodetecting RAID arrays.
[   10.171192][    T1] md: autorun ...
[   10.171746][    T1] md: ... autorun DONE.
[   10.355755][    T1] EXT4-fs (sda1): orphan cleanup on readonly fs
[   10.357816][    T1] EXT4-fs (sda1): mounted filesystem 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 ro with ordered data mode. Quota mode: none.
[   10.359703][    T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[   10.362032][    T1] devtmpfs: mounted
[   10.368420][    T1] Freeing unused kernel image (initmem) memory: 16140K
[   10.370400][    T1] Write protecting the kernel read-only data: 94208k
[   10.374836][    T1] Freeing unused kernel image (text/rodata gap) memory: 1156K
[   10.377014][    T1] Freeing unused kernel image (rodata/data gap) memory: 964K
[   10.479434][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   10.481095][    T1] x86/mm: Checking user space page tables
[   10.573323][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   10.574604][    T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[   10.578671][    T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[   10.580258][    T1] Run /sbin/init as init process
[   10.915515][ T5147] mount (5147) used greatest stack depth: 12376 bytes left
[   10.959767][ T5148] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 r/w.
[   10.962072][ T5148] mount (5148) used greatest stack depth: 11720 bytes left
mount: mounting devtmpfs on /dev failed: Device or resource busy
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[   11.009468][ T5152] mount (5152) used greatest stack depth: 10488 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [   11.409279][ T5182] udevd[5182]: starting version 3.2.14
[   11.616899][ T5183] udevd[5183]: starting eudev-3.2.14
[   11.618261][ T5182] udevd (5182) used greatest stack depth: 9464 bytes left
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-10.2.0 starting
dev: loaded udev
no interfaces have a carrier
[   16.257231][ T5478] 8021q: adding VLAN 0 to HW filter on device bond0
[   16.264394][ T5549] Oops: general protection fault, probably for non-canonical address 0x6564752f62696c4f: 0000 [#1] SMP PTI
[   16.265069][ T5478] eql: remember to turn off Van-Jacobson compression on your slave devices
[   16.275854][ T5549] CPU: 1 UID: 0 PID: 5549 Comm: rcS Not tainted syzkaller #0 PREEMPT(full) 
[   16.275872][ T5549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[   16.275881][ T5549] RIP: 0010:tomoyo_get_name+0xa9/0x270
[   16.308751][ T5549] Code: 0f 85 6a 01 00 00 e8 b6 b1 ec fe 89 d8 48 c1 e3 04 48 8b 9b c0 1a 85 89 48 89 04 24 49 39 dd 0f 84 b2 00 00 00 e8 97 b1 ec fe <44> 8b 7b 20 89 ee 44 89 ff e8 39 a9 ec fe 41 39 ef 0f 85 85 00 00
[   16.328351][ T5549] RSP: 0018:ffffc90002807c28 EFLAGS: 00010293
[   16.334412][ T5549] RAX: 0000000000000000 RBX: 6564752f62696c2f RCX: ffffffff8274e487
[   16.342387][ T5549] RDX: ffff888102fdb480 RSI: ffffffff8274e479 RDI: 0000000000000004
[   16.350405][ T5549] RBP: 000000000367e4aa R08: 0000000000000004 R09: 0000000061736c61
[   16.358373][ T5549] R10: 000000000367e4aa R11: 0000000000000000 R12: ffff88810984c000
[   16.366511][ T5549] R13: ffffffff898520c0 R14: 0000000000000038 R15: 0000000061736c61
[   16.374647][ T5549] FS:  00007fdabe210c80(0000) GS:ffff8881b26c2000(0000) knlGS:0000000000000000
[   16.383729][ T5549] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   16.390297][ T5549] CR2: 00007fec51a9a7b8 CR3: 000000010966c000 CR4: 00000000003526f0
[   16.398302][ T5549] Call Trace:
[   16.401564][ T5549]  <TASK>
[   16.404607][ T5549]  ? tomoyo_assign_namespace+0x84/0x1d0
[   16.410156][ T5549]  tomoyo_assign_domain+0x249/0x490
[   16.415496][ T5549]  tomoyo_find_next_domain+0x4d1/0xdb0
[   16.420969][ T5549]  tomoyo_bprm_check_security+0x72/0xc0
[   16.426508][ T5549]  security_bprm_check+0x1b9/0x1e0
[   16.431605][ T5549]  bprm_execve+0x381/0x830
[   16.436100][ T5549]  do_execveat_common.isra.0+0x262/0x2e0
[   16.441713][ T5549]  __x64_sys_execve+0x3d/0x50
[   16.446381][ T5549]  do_syscall_64+0xa4/0xfa0
[   16.450879][ T5549]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   16.456743][ T5549] RIP: 0033:0x7fdabe3ab107
[   16.461148][ T5549] Code: 0f 00 64 c7 00 07 00 00 00 b8 ff ff ff ff c9 c3 0f 1f 00 48 8b 05 a9 ee 0f 00 48 8b 10 e9 01 00 00 00 90 b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 ec 0f 00 f7 d8 64 89 01 48
[   16.480773][ T5549] RSP: 002b:00007fffd1b40b78 EFLAGS: 00000206 ORIG_RAX: 000000000000003b
[   16.489522][ T5549] RAX: ffffffffffffffda RBX: 000055ca63b60d30 RCX: 00007fdabe3ab107
[   16.497466][ T5549] RDX: 000055ca63b57bb8 RSI: 000055ca63b60d30 RDI: 000055ca63b60ce8
[   16.505417][ T5549] RBP: 000055ca63b60ce8 R08: 0000000000000000 R09: 0000000000000000
[   16.513806][ T5549] R10: 0000000000000008 R11: 0000000000000206 R12: 000055ca63b57bb8
[   16.521843][ T5549] R13: 00007fdabe570e8b R14: 000055ca63b57bb8 R15: 0000000000000000
[   16.529794][ T5549]  </TASK>
[   16.532798][ T5549] Modules linked in:
[   16.536769][ T5549] ---[ end trace 0000000000000000 ]---
[   16.542535][ T5549] RIP: 0010:tomoyo_get_name+0xa9/0x270
[   16.548074][ T5549] Code: 0f 85 6a 01 00 00 e8 b6 b1 ec fe 89 d8 48 c1 e3 04 48 8b 9b c0 1a 85 89 48 89 04 24 49 39 dd 0f 84 b2 00 00 00 e8 97 b1 ec fe <44> 8b 7b 20 89 ee 44 89 ff e8 39 a9 ec fe 41 39 ef 0f 85 85 00 00
[   16.567885][ T5549] RSP: 0018:ffffc90002807c28 EFLAGS: 00010293
[   16.574145][ T5549] RAX: 0000000000000000 RBX: 6564752f62696c2f RCX: ffffffff8274e487
[   16.582126][ T5549] RDX: ffff888102fdb480 RSI: ffffffff8274e479 RDI: 0000000000000004
[   16.590202][ T5549] RBP: 000000000367e4aa R08: 0000000000000004 R09: 0000000061736c61
[   16.598259][ T5549] R10: 000000000367e4aa R11: 0000000000000000 R12: ffff88810984c000
[   16.606251][ T5549] R13: ffffffff898520c0 R14: 0000000000000038 R15: 0000000061736c61
[   16.614332][ T5549] FS:  00007fdabe210c80(0000) GS:ffff8881b26c2000(0000) knlGS:0000000000000000
[   16.623328][ T5549] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   16.629908][ T5549] CR2: 00007fec51a9a7b8 CR3: 000000010966c000 CR4: 00000000003526f0
[   16.637983][ T5549] Kernel panic - not syncing: Fatal exception
[   16.644472][ T5549] Kernel Offset: disabled
[   16.648952][ T5549] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3937347293=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4def
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/cctPnRU9.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=16bad7cd980000


Tested on:

commit:         6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11f2b60a580000

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
Tested-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com

Tested on:

commit:         6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14cab532580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11c3eb42580000

Note: testing is done by a robot and is best-effort only.

(no subject)

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/super.c b/fs/super.c
index 5bab94fb7e03..b1a78189b2c5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1690,6 +1690,7 @@ int get_tree_bdev_flags(struct fs_context *fc,
 		if (!error)
 			error = fill_super(s, fc);
 		if (error) {
+			fc->s_fs_info = s->s_fs_info;
 			deactivate_locked_super(s);
 			return error;
 		}
-- 
2.51.2

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


Warning: Permanently added '10.128.1.132' (ED25519) to the list of known hosts.
2025/11/14 04:25:22 parsed 1 programs
[   38.568834][ T5812] cgroup: Unknown subsys name 'net'
[   38.681579][ T5812] cgroup: Unknown subsys name 'cpuset'
[   38.687948][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   47.206806][ T5812] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   48.634442][ T5821] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   49.057992][   T31] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.068464][   T31] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.080224][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.088091][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.177421][ T5870] chnl_net:caif_netlink_parms(): no params data found
[   49.197720][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.205546][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.212806][ T5870] bridge_slave_0: entered allmulticast mode
[   49.219093][ T5870] bridge_slave_0: entered promiscuous mode
[   49.226954][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.234019][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.241114][ T5870] bridge_slave_1: entered allmulticast mode
[   49.247273][ T5870] bridge_slave_1: entered promiscuous mode
[   49.257812][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   49.267520][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   49.283802][ T5870] team0: Port device team_slave_0 added
[   49.289970][ T5870] team0: Port device team_slave_1 added
[   49.299659][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0
[   49.306737][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.332781][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   49.344098][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1
[   49.351244][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.377242][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   49.395484][ T5870] hsr_slave_0: entered promiscuous mode
[   49.401255][ T5870] hsr_slave_1: entered promiscuous mode
[   49.429633][ T5870] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   49.437511][ T5870] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   49.445536][ T5870] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   49.453283][ T5870] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   49.466311][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.473549][ T5870] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.480828][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.487888][ T5870] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.506659][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0
[   49.515852][   T31] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.523955][   T31] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.533442][ T5870] 8021q: adding VLAN 0 to HW filter on device team0
[   49.541649][   T31] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.548678][   T31] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.557491][ T4775] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.564551][ T4775] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.609789][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0
[   49.624774][ T5870] veth0_vlan: entered promiscuous mode
[   49.632240][ T5870] veth1_vlan: entered promiscuous mode
[   49.642980][ T5870] veth0_macvtap: entered promiscuous mode
[   49.649568][ T5870] veth1_macvtap: entered promiscuous mode
[   49.658587][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0
[   49.667884][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1
[   49.677213][ T4775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   49.685998][ T4775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   49.696282][ T4775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   49.705044][ T4775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   49.739615][ T5893] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   49.746762][ T5893] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   49.754212][ T5893] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   49.761539][ T5893] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   49.768803][ T5893] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   49.777506][   T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   49.811620][   T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   49.872308][   T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   49.932883][   T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/14 04:25:36 executed programs: 0
[   52.871628][   T12] bridge_slave_1: left allmulticast mode
[   52.877509][   T12] bridge_slave_1: left promiscuous mode
[   52.883233][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.890693][   T12] bridge_slave_0: left allmulticast mode
[   52.896320][   T12] bridge_slave_0: left promiscuous mode
[   52.902081][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.942851][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   52.951925][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   52.960999][   T12] bond0 (unregistering): Released all slaves
[   53.054718][   T12] hsr_slave_0: left promiscuous mode
[   53.060223][   T12] hsr_slave_1: left promiscuous mode
[   53.065682][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   53.073538][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[   53.081030][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   53.088412][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[   53.097247][   T12] veth1_macvtap: left promiscuous mode
[   53.102787][   T12] veth0_macvtap: left promiscuous mode
[   53.108333][   T12] veth1_vlan: left promiscuous mode
[   53.113692][   T12] veth0_vlan: left promiscuous mode
[   53.146117][   T12] team0 (unregistering): Port device team_slave_1 removed
[   53.154944][   T12] team0 (unregistering): Port device team_slave_0 removed
[   55.775892][ T5893] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.783123][ T5893] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.790299][ T5893] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.797638][ T5893] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.805009][ T5893] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.842807][ T5987] chnl_net:caif_netlink_parms(): no params data found
[   55.861642][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.868694][ T5987] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.876286][ T5987] bridge_slave_0: entered allmulticast mode
[   55.882536][ T5987] bridge_slave_0: entered promiscuous mode
[   55.888863][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.896054][ T5987] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.903160][ T5987] bridge_slave_1: entered allmulticast mode
[   55.909310][ T5987] bridge_slave_1: entered promiscuous mode
[   55.921259][ T5987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.931363][ T5987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.946114][ T5987] team0: Port device team_slave_0 added
[   55.952406][ T5987] team0: Port device team_slave_1 added
[   55.962372][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.969330][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   55.995474][ T5987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.006426][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.013527][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.039738][ T5987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.056635][ T5987] hsr_slave_0: entered promiscuous mode
[   56.062419][ T5987] hsr_slave_1: entered promiscuous mode
[   56.253249][ T5987] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.261855][ T5987] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.269702][ T5987] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.278553][ T5987] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.294272][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.301460][ T5987] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.308739][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.315923][ T5987] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.338321][ T5987] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.348077][   T31] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.356081][   T31] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.366155][ T5987] 8021q: adding VLAN 0 to HW filter on device team0
[   56.374820][   T49] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.381909][   T49] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.400099][   T49] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.407204][   T49] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.458214][ T5987] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.477365][ T5987] veth0_vlan: entered promiscuous mode
[   56.485374][ T5987] veth1_vlan: entered promiscuous mode
[   56.498620][ T5987] veth0_macvtap: entered promiscuous mode
[   56.506001][ T5987] veth1_macvtap: entered promiscuous mode
[   56.516830][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.526501][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.536259][   T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.554454][   T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.571101][   T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.579028][   T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.589211][   T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   56.602245][   T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.602375][   T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.610080][   T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2609802501=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4def
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/ccG1R0tu.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16ceb60a580000

[PATCH] fs/super: fix memory leak of s_fs_info on setup_bdev_super failure

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/super.c b/fs/super.c
index 5bab94fb7e03..a99e5281b057 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
 		if (!error)
 			error = fill_super(s, fc);
 		if (error) {
+			/*
+			 * return back sb_info ownership to fc to be freed by put_fs_context()
+			 */
+			fc->s_fs_info = s->s_fs_info;
+			s->s_fs_info = NULL;
 			deactivate_locked_super(s);
 			return error;
 		}
-- 
2.51.2

Re: [PATCH] fs/super: fix memory leak of s_fs_info on setup_bdev_super failure

[Christian Brauner]

On Fri, Nov 14, 2025 at 06:12:12AM +0100, Mehdi Ben Hadj Khelifa wrote:
> #syz test
> 
> diff --git a/fs/super.c b/fs/super.c
> index 5bab94fb7e03..a99e5281b057 100644
> --- a/fs/super.c
> +++ b/fs/super.c
> @@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
>  		if (!error)
>  			error = fill_super(s, fc);
>  		if (error) {
> +			/*
> +			 * return back sb_info ownership to fc to be freed by put_fs_context()
> +			 */
> +			fc->s_fs_info = s->s_fs_info;
> +			s->s_fs_info = NULL;
>  			deactivate_locked_super(s);
>  			return error;
>  		}
> -- 
> 2.51.2
> 

No, either free it in hfs_fill_super() when it fails or add a wrapper
around kill_block_super() for hfs and free it after ->kill_sb() has run.

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


Warning: Permanently added '10.128.1.80' (ED25519) to the list of known hosts.
2025/11/14 15:28:16 parsed 1 programs
[   40.296558][ T5813] cgroup: Unknown subsys name 'net'
[   40.388732][ T5813] cgroup: Unknown subsys name 'cpuset'
[   40.395379][ T5813] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   48.529645][ T5813] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   49.725319][ T5826] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   50.124830][ T5874] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   50.132081][ T5874] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   50.139390][ T5874] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   50.146668][ T5874] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   50.153951][ T5874] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   50.211546][ T5881] chnl_net:caif_netlink_parms(): no params data found
[   50.232138][ T5881] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.239234][ T5881] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.246331][ T5881] bridge_slave_0: entered allmulticast mode
[   50.252736][ T5881] bridge_slave_0: entered promiscuous mode
[   50.259377][ T5881] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.266469][ T5881] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.273698][ T5881] bridge_slave_1: entered allmulticast mode
[   50.279872][ T5881] bridge_slave_1: entered promiscuous mode
[   50.291361][ T5881] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   50.301121][ T5881] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   50.314859][ T5881] team0: Port device team_slave_0 added
[   50.321138][ T5881] team0: Port device team_slave_1 added
[   50.337350][ T5881] batman_adv: batadv0: Adding interface: batadv_slave_0
[   50.344455][ T5881] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   50.370408][ T5881] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   50.381546][ T5881] batman_adv: batadv0: Adding interface: batadv_slave_1
[   50.388602][ T5881] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   50.414701][ T5881] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   50.432432][ T5881] hsr_slave_0: entered promiscuous mode
[   50.438187][ T5881] hsr_slave_1: entered promiscuous mode
[   50.464974][ T5881] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   50.472557][ T5881] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   50.480523][ T5881] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   50.488191][ T5881] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   50.501383][ T5881] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.508462][ T5881] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.515715][ T5881] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.522863][ T5881] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.540612][ T5881] 8021q: adding VLAN 0 to HW filter on device bond0
[   50.549623][   T31] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.557084][   T31] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.566000][ T5881] 8021q: adding VLAN 0 to HW filter on device team0
[   50.574224][   T74] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.581282][   T74] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.589909][   T31] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.596984][   T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.635045][ T5881] 8021q: adding VLAN 0 to HW filter on device batadv0
[   50.648984][ T5881] veth0_vlan: entered promiscuous mode
[   50.655799][ T5881] veth1_vlan: entered promiscuous mode
[   50.666178][ T5881] veth0_macvtap: entered promiscuous mode
[   50.672895][ T5881] veth1_macvtap: entered promiscuous mode
[   50.681496][ T5881] batman_adv: batadv0: Interface activated: batadv_slave_0
[   50.690818][ T5881] batman_adv: batadv0: Interface activated: batadv_slave_1
[   50.699598][   T74] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   50.708503][   T74] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   50.717969][   T74] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   50.727859][   T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   50.770674][   T31] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   50.781957][  T989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.790035][  T989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.800571][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.808621][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.816550][   T31] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   50.869426][   T31] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   50.899153][   T31] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/14 15:28:29 executed programs: 0
[   53.832316][   T31] bridge_slave_1: left allmulticast mode
[   53.838115][   T31] bridge_slave_1: left promiscuous mode
[   53.843745][   T31] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.851578][   T31] bridge_slave_0: left allmulticast mode
[   53.857222][   T31] bridge_slave_0: left promiscuous mode
[   53.862866][   T31] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.918713][   T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   53.927986][   T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   53.936965][   T31] bond0 (unregistering): Released all slaves
[   53.989491][   T31] hsr_slave_0: left promiscuous mode
[   53.995049][   T31] hsr_slave_1: left promiscuous mode
[   54.000970][   T31] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   54.008418][   T31] batman_adv: batadv0: Removing interface: batadv_slave_0
[   54.015806][   T31] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   54.023374][   T31] batman_adv: batadv0: Removing interface: batadv_slave_1
[   54.031704][   T31] veth1_macvtap: left promiscuous mode
[   54.037164][   T31] veth0_macvtap: left promiscuous mode
[   54.042886][   T31] veth1_vlan: left promiscuous mode
[   54.048139][   T31] veth0_vlan: left promiscuous mode
[   54.071579][   T31] team0 (unregistering): Port device team_slave_1 removed
[   54.079731][   T31] team0 (unregistering): Port device team_slave_0 removed
[   56.471062][ T5135] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   56.478199][ T5135] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   56.485237][ T5135] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   56.492501][ T5135] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   56.499741][ T5135] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   56.533269][ T5987] chnl_net:caif_netlink_parms(): no params data found
[   56.551048][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.558200][ T5987] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.565306][ T5987] bridge_slave_0: entered allmulticast mode
[   56.571616][ T5987] bridge_slave_0: entered promiscuous mode
[   56.578339][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.585394][ T5987] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.592725][ T5987] bridge_slave_1: entered allmulticast mode
[   56.599055][ T5987] bridge_slave_1: entered promiscuous mode
[   56.609383][ T5987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.619214][ T5987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.633179][ T5987] team0: Port device team_slave_0 added
[   56.639450][ T5987] team0: Port device team_slave_1 added
[   56.649461][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.656391][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.682534][ T5987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.693636][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.700652][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.726541][ T5987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.742791][ T5987] hsr_slave_0: entered promiscuous mode
[   56.748575][ T5987] hsr_slave_1: entered promiscuous mode
[   56.899621][ T5987] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.907406][ T5987] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.916005][ T5987] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.923914][ T5987] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.936978][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.944085][ T5987] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.951366][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.958429][ T5987] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.978679][ T5987] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.988116][   T31] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.995621][   T31] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.009787][ T5987] 8021q: adding VLAN 0 to HW filter on device team0
[   57.019929][   T31] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.026986][   T31] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.035013][   T31] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.042090][   T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.091660][ T5987] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.108045][ T5987] veth0_vlan: entered promiscuous mode
[   57.115202][ T5987] veth1_vlan: entered promiscuous mode
[   57.128314][ T5987] veth0_macvtap: entered promiscuous mode
[   57.135072][ T5987] veth1_macvtap: entered promiscuous mode
[   57.144855][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.153327][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.163642][   T74] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.175835][   T74] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.187129][   T74] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.200636][   T74] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.217417][   T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.227482][   T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.228996][   T74] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   57.243335][   T74] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3285272391=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4d
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/ccvacM34.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=140237cd980000

(no subject)

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/super.c b/fs/super.c
index 5bab94fb7e03..8fadf97fcc42 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
 		if (!error)
 			error = fill_super(s, fc);
 		if (error) {
+			/*
+			 * return s_fs_info ownership to fc to be cleaned up by put_fs_context()
+			 */
+			fc->s_fs_info = s->s_fs_info;
+			s->s_fs_info = NULL;
 			deactivate_locked_super(s);
 			return error;
 		}
-- 
2.51.2

Re: [PATCH] fs/super: fix memory leak of s_fs_info on setup_bdev_super failure

[Mehdi Ben Hadj Khelifa]

On 11/14/25 12:55 PM, Christian Brauner wrote:
> On Fri, Nov 14, 2025 at 06:12:12AM +0100, Mehdi Ben Hadj Khelifa wrote:
>> #syz test
>>
>> diff --git a/fs/super.c b/fs/super.c
>> index 5bab94fb7e03..a99e5281b057 100644
>> --- a/fs/super.c
>> +++ b/fs/super.c
>> @@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
>>   		if (!error)
>>   			error = fill_super(s, fc);
>>   		if (error) {
>> +			/*
>> +			 * return back sb_info ownership to fc to be freed by put_fs_context()
>> +			 */
>> +			fc->s_fs_info = s->s_fs_info;
>> +			s->s_fs_info = NULL;
>>   			deactivate_locked_super(s);
>>   			return error;
>>   		}
>> -- 
>> 2.51.2
>>
> 
> No, either free it in hfs_fill_super() when it fails or add a wrapper
> around kill_block_super() for hfs and free it after ->kill_sb() has run.

Ah. I just saw your reply after my I just sent out a new similar test.

I will be working on it with your suggestion.

Best Regards,
Mehdi Ben Hadj Khelifa

Re: [PATCH] fs/super: fix memory leak of s_fs_info on setup_bdev_super failure

[Mehdi Ben Hadj Khelifa]

On 11/14/25 12:55 PM, Christian Brauner wrote:
> On Fri, Nov 14, 2025 at 06:12:12AM +0100, Mehdi Ben Hadj Khelifa wrote:
>> #syz test
>>
>> diff --git a/fs/super.c b/fs/super.c
>> index 5bab94fb7e03..a99e5281b057 100644
>> --- a/fs/super.c
>> +++ b/fs/super.c
>> @@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
>>   		if (!error)
>>   			error = fill_super(s, fc);
>>   		if (error) {
>> +			/*
>> +			 * return back sb_info ownership to fc to be freed by put_fs_context()
>> +			 */
>> +			fc->s_fs_info = s->s_fs_info;
>> +			s->s_fs_info = NULL;
>>   			deactivate_locked_super(s);
>>   			return error;
>>   		}
>> -- 
>> 2.51.2
>>
> 
> No, either free it in hfs_fill_super() when it fails or add a wrapper
> around kill_block_super() for hfs and free it after ->kill_sb() has run.

Sorry for the noise,Resending with proper CCs:

I forgot to mention. I was giving back the ownership to the filesystem 
context because upon setup_bdev_super fails put_fs_context still gets 
called even if I would free s_fs_info in the kill_sb,so hfs_free_fc 
would get a NULL pointer to kfree as a result..I don't think that would 
be desirable.

I would be sending my patch out for more discussion.

Best Regards,
Mehdi Ben Hadj Khelifa

(no subject)

[Mehdi Ben Hadj Khelifa]

#syz test

Signed-off-by: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@gmail.com>
---
 fs/super.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/super.c b/fs/super.c
index 5bab94fb7e03..3f48e5cd733f 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1723,6 +1723,8 @@ void kill_block_super(struct super_block *sb)
 	if (bdev) {
 		sync_blockdev(bdev);
 		bdev_fput(sb->s_bdev_file);
+	}else{
+		kfree(sb->s_fs_info);	
 	}
 }
 
-- 
2.52.0

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
Tested-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com

Tested on:

commit:         e7c375b1 Merge tag 'vfs-6.18-rc7.fixes' of gitolite.ke..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10b63914580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13851658580000

Note: testing is done by a robot and is best-effort only.

Re:

[Al Viro]

On Tue, Nov 18, 2025 at 07:27:06PM +0100, Mehdi Ben Hadj Khelifa wrote:
> #syz test
> 
> diff --git a/fs/hfs/super.c b/fs/hfs/super.c
> index 47f50fa555a4..46cdff89fb00 100644
> --- a/fs/hfs/super.c
> +++ b/fs/hfs/super.c
> @@ -431,10 +431,21 @@ static int hfs_init_fs_context(struct fs_context *fc)
>  	return 0;
>  }
>  
> +static void hfs_kill_sb(struct super_block *sb)
> +{
> +	generic_shutdown_super(sb);
> +	hfs_mdb_put(sb);
> +	if (sb->s_bdev) {
> +		sync_blockdev(sb->s_bdev);
> +		bdev_fput(sb->s_bdev_file);
> +	}
> +
> +}
> +
>  static struct file_system_type hfs_fs_type = {
>  	.owner		= THIS_MODULE,
>  	.name		= "hfs",
> -	.kill_sb	= kill_block_super,
> +	.kill_sb	= hfs_kill_sb,
>  	.fs_flags	= FS_REQUIRES_DEV,
>  	.init_fs_context = hfs_init_fs_context,
>  };

Remove the calls of hfs_mdb_put() from hfs_fill_super() and
hfs_put_super() in addition to that.

(no subject)

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 47f50fa555a4..46cdff89fb00 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -431,10 +431,21 @@ static int hfs_init_fs_context(struct fs_context *fc)
 	return 0;
 }
 
+static void hfs_kill_sb(struct super_block *sb)
+{
+	generic_shutdown_super(sb);
+	hfs_mdb_put(sb);
+	if (sb->s_bdev) {
+		sync_blockdev(sb->s_bdev);
+		bdev_fput(sb->s_bdev_file);
+	}
+
+}
+
 static struct file_system_type hfs_fs_type = {
 	.owner		= THIS_MODULE,
 	.name		= "hfs",
-	.kill_sb	= kill_block_super,
+	.kill_sb	= hfs_kill_sb,
 	.fs_flags	= FS_REQUIRES_DEV,
 	.init_fs_context = hfs_init_fs_context,
 };
-- 
2.52.0

(no subject)

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 47f50fa555a4..06e1c25e47dc 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -49,8 +49,6 @@ static void hfs_put_super(struct super_block *sb)
 {
 	cancel_delayed_work_sync(&HFS_SB(sb)->mdb_work);
 	hfs_mdb_close(sb);
-	/* release the MDB's resources */
-	hfs_mdb_put(sb);
 }
 
 static void flush_mdb(struct work_struct *work)
@@ -383,7 +381,6 @@ static int hfs_fill_super(struct super_block *sb, struct fs_context *fc)
 bail_no_root:
 	pr_err("get root inode failed\n");
 bail:
-	hfs_mdb_put(sb);
 	return res;
 }
 
@@ -431,10 +428,21 @@ static int hfs_init_fs_context(struct fs_context *fc)
 	return 0;
 }
 
+static void hfs_kill_sb(struct super_block *sb)
+{
+	generic_shutdown_super(sb);
+	hfs_mdb_put(sb);
+	if (sb->s_bdev) {
+		sync_blockdev(sb->s_bdev);
+		bdev_fput(sb->s_bdev_file);
+	}
+
+}
+
 static struct file_system_type hfs_fs_type = {
 	.owner		= THIS_MODULE,
 	.name		= "hfs",
-	.kill_sb	= kill_block_super,
+	.kill_sb	= hfs_kill_sb,
 	.fs_flags	= FS_REQUIRES_DEV,
 	.init_fs_context = hfs_init_fs_context,
 };
-- 
2.52.0

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
Tested-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com

Tested on:

commit:         8b690556 Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16ca7884580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15e328b4580000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to checkout syzkaller repo: failed to run ["git" "fetch" "--force" "--tags" "8408054c2e598e2818e3e31f22aefcbac3668c43" "4e1406b4defac0e2a9d9424c70706f79a7750cf3"]: exit status 128


Tested on:

commit:         [unknown 
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15693212580000

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
Tested-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com

Tested on:

commit:         8b690556 Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14c40742580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16949658580000

Note: testing is done by a robot and is best-effort only.

(no subject)

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 47f50fa555a4..06e1c25e47dc 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -49,8 +49,6 @@ static void hfs_put_super(struct super_block *sb)
 {
 	cancel_delayed_work_sync(&HFS_SB(sb)->mdb_work);
 	hfs_mdb_close(sb);
-	/* release the MDB's resources */
-	hfs_mdb_put(sb);
 }
 
 static void flush_mdb(struct work_struct *work)
@@ -383,7 +381,6 @@ static int hfs_fill_super(struct super_block *sb, struct fs_context *fc)
 bail_no_root:
 	pr_err("get root inode failed\n");
 bail:
-	hfs_mdb_put(sb);
 	return res;
 }
 
@@ -431,10 +428,21 @@ static int hfs_init_fs_context(struct fs_context *fc)
 	return 0;
 }
 
+static void hfs_kill_sb(struct super_block *sb)
+{
+	generic_shutdown_super(sb);
+	hfs_mdb_put(sb);
+	if (sb->s_bdev) {
+		sync_blockdev(sb->s_bdev);
+		bdev_fput(sb->s_bdev_file);
+	}
+
+}
+
 static struct file_system_type hfs_fs_type = {
 	.owner		= THIS_MODULE,
 	.name		= "hfs",
-	.kill_sb	= kill_block_super,
+	.kill_sb	= hfs_kill_sb,
 	.fs_flags	= FS_REQUIRES_DEV,
 	.init_fs_context = hfs_init_fs_context,
 };
-- 
2.52.0

Re: [PATCH] fs/super: fix memory leak of s_fs_info on setup_bdev_super failure

[Christian Brauner]

On Fri, Nov 14, 2025 at 06:12:12AM +0100, Mehdi Ben Hadj Khelifa wrote:
> #syz test
> 
> diff --git a/fs/super.c b/fs/super.c
> index 5bab94fb7e03..a99e5281b057 100644
> --- a/fs/super.c
> +++ b/fs/super.c
> @@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
>  		if (!error)
>  			error = fill_super(s, fc);
>  		if (error) {
> +			/*
> +			 * return back sb_info ownership to fc to be freed by put_fs_context()
> +			 */
> +			fc->s_fs_info = s->s_fs_info;
> +			s->s_fs_info = NULL;
>  			deactivate_locked_super(s);
>  			return error;
>  		}

#syz test: https://github.com/brauner/linux.git work.hfs.fixes

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

pc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


Warning: Permanently added '10.128.10.29' (ED25519) to the list of known hosts.
2025/11/19 14:11:52 parsed 1 programs
[   42.022753][ T5811] cgroup: Unknown subsys name 'net'
[   42.175712][ T5811] cgroup: Unknown subsys name 'cpuset'
[   42.182256][ T5811] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.184013][ T5811] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   51.419720][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   51.816926][   T58] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   51.825249][   T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   51.836771][   T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   51.844633][   T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   51.992800][ T5887] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   52.000051][ T5887] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   52.007203][ T5887] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   52.014500][ T5887] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   52.021816][ T5887] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   52.104921][ T5895] chnl_net:caif_netlink_parms(): no params data found
[   52.123774][ T5895] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.130962][ T5895] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.138313][ T5895] bridge_slave_0: entered allmulticast mode
[   52.144523][ T5895] bridge_slave_0: entered promiscuous mode
[   52.151904][ T5895] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.159070][ T5895] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.166257][ T5895] bridge_slave_1: entered allmulticast mode
[   52.172607][ T5895] bridge_slave_1: entered promiscuous mode
[   52.184675][ T5895] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   52.194790][ T5895] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   52.210335][ T5895] team0: Port device team_slave_0 added
[   52.216530][ T5895] team0: Port device team_slave_1 added
[   52.226332][ T5895] batman_adv: batadv0: Adding interface: batadv_slave_0
[   52.233294][ T5895] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   52.259593][ T5895] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   52.270857][ T5895] batman_adv: batadv0: Adding interface: batadv_slave_1
[   52.277950][ T5895] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   52.304091][ T5895] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   52.330778][ T5895] hsr_slave_0: entered promiscuous mode
[   52.337739][ T5895] hsr_slave_1: entered promiscuous mode
[   52.365548][ T5895] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   52.373816][ T5895] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   52.382570][ T5895] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   52.390442][ T5895] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   52.402050][ T5895] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.409208][ T5895] bridge0: port 2(bridge_slave_1) entered forwarding state
[   52.416560][ T5895] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.424189][ T5895] bridge0: port 1(bridge_slave_0) entered forwarding state
[   52.442787][ T5895] 8021q: adding VLAN 0 to HW filter on device bond0
[   52.452023][   T31] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.461111][   T31] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.470558][ T5895] 8021q: adding VLAN 0 to HW filter on device team0
[   52.479109][   T31] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.486350][   T31] bridge0: port 1(bridge_slave_0) entered forwarding state
[   52.496004][ T2979] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.503421][ T2979] bridge0: port 2(bridge_slave_1) entered forwarding state
[   52.520122][ T5895] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   52.531213][ T5895] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   52.567709][ T5895] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.582539][ T5895] veth0_vlan: entered promiscuous mode
[   52.589714][ T5895] veth1_vlan: entered promiscuous mode
[   52.600093][ T5895] veth0_macvtap: entered promiscuous mode
[   52.606771][ T5895] veth1_macvtap: entered promiscuous mode
[   52.615855][ T5895] batman_adv: batadv0: Interface activated: batadv_slave_0
[   52.625167][ T5895] batman_adv: batadv0: Interface activated: batadv_slave_1
[   52.634137][   T58] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   52.642907][   T58] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   52.652172][   T58] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   52.661018][   T58] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   52.696362][   T35] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   52.736176][   T35] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   52.776000][   T35] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/19 14:12:05 executed programs: 0
[   52.826029][   T35] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   55.913007][   T35] bridge_slave_1: left allmulticast mode
[   55.924242][   T35] bridge_slave_1: left promiscuous mode
[   55.930898][   T35] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.939182][   T35] bridge_slave_0: left allmulticast mode
[   55.945141][   T35] bridge_slave_0: left promiscuous mode
[   55.951004][   T35] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.026188][   T35] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   56.036592][   T35] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   56.046139][   T35] bond0 (unregistering): Released all slaves
[   56.106597][   T35] hsr_slave_0: left promiscuous mode
[   56.112214][   T35] hsr_slave_1: left promiscuous mode
[   56.118098][   T35] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   56.126443][   T35] batman_adv: batadv0: Removing interface: batadv_slave_0
[   56.133898][   T35] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   56.141694][   T35] batman_adv: batadv0: Removing interface: batadv_slave_1
[   56.150927][   T35] veth1_macvtap: left promiscuous mode
[   56.157067][   T35] veth0_macvtap: left promiscuous mode
[   56.163187][   T35] veth1_vlan: left promiscuous mode
[   56.168965][   T35] veth0_vlan: left promiscuous mode
[   56.196836][   T35] team0 (unregistering): Port device team_slave_1 removed
[   56.205815][   T35] team0 (unregistering): Port device team_slave_0 removed
[   58.084150][ T5133] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   58.091289][ T5133] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   58.098477][ T5133] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   58.105739][ T5133] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   58.112872][ T5133] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   58.147089][ T5988] chnl_net:caif_netlink_parms(): no params data found
[   58.166338][ T5988] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.173578][ T5988] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.180784][ T5988] bridge_slave_0: entered allmulticast mode
[   58.187051][ T5988] bridge_slave_0: entered promiscuous mode
[   58.193583][ T5988] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.200740][ T5988] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.207833][ T5988] bridge_slave_1: entered allmulticast mode
[   58.214030][ T5988] bridge_slave_1: entered promiscuous mode
[   58.225238][ T5988] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   58.235910][ T5988] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   58.251413][ T5988] team0: Port device team_slave_0 added
[   58.257776][ T5988] team0: Port device team_slave_1 added
[   58.267463][ T5988] batman_adv: batadv0: Adding interface: batadv_slave_0
[   58.274482][ T5988] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   58.300974][ T5988] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   58.311990][ T5988] batman_adv: batadv0: Adding interface: batadv_slave_1
[   58.318969][ T5988] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   58.344994][ T5988] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   58.362193][ T5988] hsr_slave_0: entered promiscuous mode
[   58.368062][ T5988] hsr_slave_1: entered promiscuous mode
[   58.548290][ T5988] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   58.556831][ T5988] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   58.564665][ T5988] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   58.572522][ T5988] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   58.586118][ T5988] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.593280][ T5988] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.600654][ T5988] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.607726][ T5988] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.630191][ T5988] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.640402][   T58] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.649632][   T58] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.659837][ T5988] 8021q: adding VLAN 0 to HW filter on device team0
[   58.669532][   T58] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.676712][   T58] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.686492][   T35] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.693655][   T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.709390][ T5988] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   58.720129][ T5988] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   58.769091][ T5988] 8021q: adding VLAN 0 to HW filter on device batadv0
[   58.787789][ T5988] veth0_vlan: entered promiscuous mode
[   58.795800][ T5988] veth1_vlan: entered promiscuous mode
[   58.808550][ T5988] veth0_macvtap: entered promiscuous mode
[   58.816434][ T5988] veth1_macvtap: entered promiscuous mode
[   58.826869][ T5988] batman_adv: batadv0: Interface activated: batadv_slave_0
[   58.837590][ T5988] batman_adv: batadv0: Interface activated: batadv_slave_1
[   58.847552][ T2979] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   58.862969][ T2979] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   58.881016][ T2979] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   58.894676][   T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.903471][   T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   58.917260][   T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.925507][ T2979] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   58.934333][   T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3582148735=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4d
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/ccMkllK7.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=10715332580000


Tested on:

commit:         058747ce hfs: ensure sb->s_fs_info is always cleaned up
git tree:       https://github.com/brauner/linux.git work.hfs.fixes
kernel config:  https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[Christian Brauner]

On Wed, Nov 19, 2025 at 06:13:08AM -0800, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
> pc
> 
> SYZFAIL: failed to recv rpc
> fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
> 
> 
> Warning: Permanently added '10.128.10.29' (ED25519) to the list of known hosts.
> 2025/11/19 14:11:52 parsed 1 programs
> [   42.022753][ T5811] cgroup: Unknown subsys name 'net'
> [   42.175712][ T5811] cgroup: Unknown subsys name 'cpuset'
> [   42.182256][ T5811] cgroup: Unknown subsys name 'rlimit'
> Setting up swapspace version 1, size = 127995904 bytes
> [   50.184013][ T5811] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
> [   51.419720][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
> [   51.816926][   T58] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
> [   51.825249][   T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
> [   51.836771][   T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
> [   51.844633][   T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
> [   51.992800][ T5887] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
> [   52.000051][ T5887] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
> [   52.007203][ T5887] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
> [   52.014500][ T5887] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
> [   52.021816][ T5887] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
> [   52.104921][ T5895] chnl_net:caif_netlink_parms(): no params data found
> [   52.123774][ T5895] bridge0: port 1(bridge_slave_0) entered blocking state
> [   52.130962][ T5895] bridge0: port 1(bridge_slave_0) entered disabled state
> [   52.138313][ T5895] bridge_slave_0: entered allmulticast mode
> [   52.144523][ T5895] bridge_slave_0: entered promiscuous mode
> [   52.151904][ T5895] bridge0: port 2(bridge_slave_1) entered blocking state
> [   52.159070][ T5895] bridge0: port 2(bridge_slave_1) entered disabled state
> [   52.166257][ T5895] bridge_slave_1: entered allmulticast mode
> [   52.172607][ T5895] bridge_slave_1: entered promiscuous mode
> [   52.184675][ T5895] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
> [   52.194790][ T5895] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
> [   52.210335][ T5895] team0: Port device team_slave_0 added
> [   52.216530][ T5895] team0: Port device team_slave_1 added
> [   52.226332][ T5895] batman_adv: batadv0: Adding interface: batadv_slave_0
> [   52.233294][ T5895] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   52.259593][ T5895] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
> [   52.270857][ T5895] batman_adv: batadv0: Adding interface: batadv_slave_1
> [   52.277950][ T5895] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   52.304091][ T5895] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
> [   52.330778][ T5895] hsr_slave_0: entered promiscuous mode
> [   52.337739][ T5895] hsr_slave_1: entered promiscuous mode
> [   52.365548][ T5895] netdevsim netdevsim0 netdevsim0: renamed from eth0
> [   52.373816][ T5895] netdevsim netdevsim0 netdevsim1: renamed from eth1
> [   52.382570][ T5895] netdevsim netdevsim0 netdevsim2: renamed from eth2
> [   52.390442][ T5895] netdevsim netdevsim0 netdevsim3: renamed from eth3
> [   52.402050][ T5895] bridge0: port 2(bridge_slave_1) entered blocking state
> [   52.409208][ T5895] bridge0: port 2(bridge_slave_1) entered forwarding state
> [   52.416560][ T5895] bridge0: port 1(bridge_slave_0) entered blocking state
> [   52.424189][ T5895] bridge0: port 1(bridge_slave_0) entered forwarding state
> [   52.442787][ T5895] 8021q: adding VLAN 0 to HW filter on device bond0
> [   52.452023][   T31] bridge0: port 1(bridge_slave_0) entered disabled state
> [   52.461111][   T31] bridge0: port 2(bridge_slave_1) entered disabled state
> [   52.470558][ T5895] 8021q: adding VLAN 0 to HW filter on device team0
> [   52.479109][   T31] bridge0: port 1(bridge_slave_0) entered blocking state
> [   52.486350][   T31] bridge0: port 1(bridge_slave_0) entered forwarding state
> [   52.496004][ T2979] bridge0: port 2(bridge_slave_1) entered blocking state
> [   52.503421][ T2979] bridge0: port 2(bridge_slave_1) entered forwarding state
> [   52.520122][ T5895] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
> [   52.531213][ T5895] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
> [   52.567709][ T5895] 8021q: adding VLAN 0 to HW filter on device batadv0
> [   52.582539][ T5895] veth0_vlan: entered promiscuous mode
> [   52.589714][ T5895] veth1_vlan: entered promiscuous mode
> [   52.600093][ T5895] veth0_macvtap: entered promiscuous mode
> [   52.606771][ T5895] veth1_macvtap: entered promiscuous mode
> [   52.615855][ T5895] batman_adv: batadv0: Interface activated: batadv_slave_0
> [   52.625167][ T5895] batman_adv: batadv0: Interface activated: batadv_slave_1
> [   52.634137][   T58] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
> [   52.642907][   T58] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
> [   52.652172][   T58] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
> [   52.661018][   T58] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
> [   52.696362][   T35] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> [   52.736176][   T35] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> [   52.776000][   T35] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> 2025/11/19 14:12:05 executed programs: 0
> [   52.826029][   T35] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> [   55.913007][   T35] bridge_slave_1: left allmulticast mode
> [   55.924242][   T35] bridge_slave_1: left promiscuous mode
> [   55.930898][   T35] bridge0: port 2(bridge_slave_1) entered disabled state
> [   55.939182][   T35] bridge_slave_0: left allmulticast mode
> [   55.945141][   T35] bridge_slave_0: left promiscuous mode
> [   55.951004][   T35] bridge0: port 1(bridge_slave_0) entered disabled state
> [   56.026188][   T35] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
> [   56.036592][   T35] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
> [   56.046139][   T35] bond0 (unregistering): Released all slaves
> [   56.106597][   T35] hsr_slave_0: left promiscuous mode
> [   56.112214][   T35] hsr_slave_1: left promiscuous mode
> [   56.118098][   T35] batman_adv: batadv0: Interface deactivated: batadv_slave_0
> [   56.126443][   T35] batman_adv: batadv0: Removing interface: batadv_slave_0
> [   56.133898][   T35] batman_adv: batadv0: Interface deactivated: batadv_slave_1
> [   56.141694][   T35] batman_adv: batadv0: Removing interface: batadv_slave_1
> [   56.150927][   T35] veth1_macvtap: left promiscuous mode
> [   56.157067][   T35] veth0_macvtap: left promiscuous mode
> [   56.163187][   T35] veth1_vlan: left promiscuous mode
> [   56.168965][   T35] veth0_vlan: left promiscuous mode
> [   56.196836][   T35] team0 (unregistering): Port device team_slave_1 removed
> [   56.205815][   T35] team0 (unregistering): Port device team_slave_0 removed
> [   58.084150][ T5133] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
> [   58.091289][ T5133] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
> [   58.098477][ T5133] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
> [   58.105739][ T5133] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
> [   58.112872][ T5133] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
> [   58.147089][ T5988] chnl_net:caif_netlink_parms(): no params data found
> [   58.166338][ T5988] bridge0: port 1(bridge_slave_0) entered blocking state
> [   58.173578][ T5988] bridge0: port 1(bridge_slave_0) entered disabled state
> [   58.180784][ T5988] bridge_slave_0: entered allmulticast mode
> [   58.187051][ T5988] bridge_slave_0: entered promiscuous mode
> [   58.193583][ T5988] bridge0: port 2(bridge_slave_1) entered blocking state
> [   58.200740][ T5988] bridge0: port 2(bridge_slave_1) entered disabled state
> [   58.207833][ T5988] bridge_slave_1: entered allmulticast mode
> [   58.214030][ T5988] bridge_slave_1: entered promiscuous mode
> [   58.225238][ T5988] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
> [   58.235910][ T5988] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
> [   58.251413][ T5988] team0: Port device team_slave_0 added
> [   58.257776][ T5988] team0: Port device team_slave_1 added
> [   58.267463][ T5988] batman_adv: batadv0: Adding interface: batadv_slave_0
> [   58.274482][ T5988] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   58.300974][ T5988] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
> [   58.311990][ T5988] batman_adv: batadv0: Adding interface: batadv_slave_1
> [   58.318969][ T5988] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
> [   58.344994][ T5988] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
> [   58.362193][ T5988] hsr_slave_0: entered promiscuous mode
> [   58.368062][ T5988] hsr_slave_1: entered promiscuous mode
> [   58.548290][ T5988] netdevsim netdevsim0 netdevsim0: renamed from eth0
> [   58.556831][ T5988] netdevsim netdevsim0 netdevsim1: renamed from eth1
> [   58.564665][ T5988] netdevsim netdevsim0 netdevsim2: renamed from eth2
> [   58.572522][ T5988] netdevsim netdevsim0 netdevsim3: renamed from eth3
> [   58.586118][ T5988] bridge0: port 2(bridge_slave_1) entered blocking state
> [   58.593280][ T5988] bridge0: port 2(bridge_slave_1) entered forwarding state
> [   58.600654][ T5988] bridge0: port 1(bridge_slave_0) entered blocking state
> [   58.607726][ T5988] bridge0: port 1(bridge_slave_0) entered forwarding state
> [   58.630191][ T5988] 8021q: adding VLAN 0 to HW filter on device bond0
> [   58.640402][   T58] bridge0: port 1(bridge_slave_0) entered disabled state
> [   58.649632][   T58] bridge0: port 2(bridge_slave_1) entered disabled state
> [   58.659837][ T5988] 8021q: adding VLAN 0 to HW filter on device team0
> [   58.669532][   T58] bridge0: port 1(bridge_slave_0) entered blocking state
> [   58.676712][   T58] bridge0: port 1(bridge_slave_0) entered forwarding state
> [   58.686492][   T35] bridge0: port 2(bridge_slave_1) entered blocking state
> [   58.693655][   T35] bridge0: port 2(bridge_slave_1) entered forwarding state
> [   58.709390][ T5988] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
> [   58.720129][ T5988] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
> [   58.769091][ T5988] 8021q: adding VLAN 0 to HW filter on device batadv0
> [   58.787789][ T5988] veth0_vlan: entered promiscuous mode
> [   58.795800][ T5988] veth1_vlan: entered promiscuous mode
> [   58.808550][ T5988] veth0_macvtap: entered promiscuous mode
> [   58.816434][ T5988] veth1_macvtap: entered promiscuous mode
> [   58.826869][ T5988] batman_adv: batadv0: Interface activated: batadv_slave_0
> [   58.837590][ T5988] batman_adv: batadv0: Interface activated: batadv_slave_1
> [   58.847552][ T2979] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
> [   58.862969][ T2979] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
> [   58.881016][ T2979] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
> [   58.894676][   T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
> [   58.903471][   T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
> SYZFAIL: failed to recv rpc
> fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
> [   58.917260][   T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
> [   58.925507][ T2979] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
> [   58.934333][   T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
> 
> 
> syzkaller build log:
> go env (err=<nil>)
> AR='ar'
> CC='gcc'
> CGO_CFLAGS='-O2 -g'
> CGO_CPPFLAGS=''
> CGO_CXXFLAGS='-O2 -g'
> CGO_ENABLED='1'
> CGO_FFLAGS='-O2 -g'
> CGO_LDFLAGS='-O2 -g'
> CXX='g++'
> GCCGO='gccgo'
> GO111MODULE='auto'
> GOAMD64='v1'
> GOARCH='amd64'
> GOAUTH='netrc'
> GOBIN=''
> GOCACHE='/syzkaller/.cache/go-build'
> GOCACHEPROG=''
> GODEBUG=''
> GOENV='/syzkaller/.config/go/env'
> GOEXE=''
> GOEXPERIMENT=''
> GOFIPS140='off'
> GOFLAGS=''
> GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3582148735=/tmp/go-build -gno-record-gcc-switches'
> GOHOSTARCH='amd64'
> GOHOSTOS='linux'
> GOINSECURE=''
> GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
> GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
> GONOPROXY=''
> GONOSUMDB=''
> GOOS='linux'
> GOPATH='/syzkaller/jobs-2/linux/gopath'
> GOPRIVATE=''
> GOPROXY='https://proxy.golang.org,direct'
> GOROOT='/usr/local/go'
> GOSUMDB='sum.golang.org'
> GOTELEMETRY='local'
> GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
> GOTMPDIR=''
> GOTOOLCHAIN='auto'
> GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
> GOVCS=''
> GOVERSION='go1.24.4'
> GOWORK=''
> PKG_CONFIG='pkg-config'
> 
> git status (err=<nil>)
> HEAD detached at 4e1406b4d
> nothing to commit, working tree clean
> 
> 
> tput: No value for $TERM and no -T specified
> tput: No value for $TERM and no -T specified
> Makefile:31: run command via tools/syz-env for best compatibility, see:
> Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
> go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen
> make .descriptions
> tput: No value for $TERM and no -T specified
> tput: No value for $TERM and no -T specified
> Makefile:31: run command via tools/syz-env for best compatibility, see:
> Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
> bin/syz-sysgen
> touch .descriptions
> GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
> mkdir -p ./bin/linux_amd64
> g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
> 	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
> 	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
> /usr/bin/ld: /tmp/ccMkllK7.o: in function `Connection::Connect(char const*, char const*)':
> executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
> ./tools/check-syzos.sh 2>/dev/null
> 
> 
> Error text is too large and was truncated, full error text is at:
> https://syzkaller.appspot.com/x/error.txt?x=10715332580000
> 
> 
> Tested on:
> 
> commit:         058747ce hfs: ensure sb->s_fs_info is always cleaned up
> git tree:       https://github.com/brauner/linux.git work.hfs.fixes
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
> dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
> compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> 
> Note: no patches were applied.

Groan, unrelated error.
What do I do? Just restart?

#syz test https://github.com/brauner/linux.git work.hfs.fixes

Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
Tested-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com

Tested on:

commit:         058747ce hfs: ensure sb->s_fs_info is always cleaned up
git tree:       https://github.com/brauner/linux.git work.hfs.fixes
console output: https://syzkaller.appspot.com/x/log.txt?x=122ab914580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.