* [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common @ 2025-12-01 9:58 syzbot 2025-12-01 12:57 ` Mateusz Guzik 2025-12-01 22:09 ` syzbot 0 siblings, 2 replies; 8+ messages in thread From: syzbot @ 2025-12-01 9:58 UTC (permalink / raw) To: brauner, jack, linux-fsdevel, linux-kernel, syzkaller-bugs, viro Hello, syzbot found the following issue on: HEAD commit: 7d31f578f323 Add linux-next specific files for 20251128 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=156402b4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=6336d8e94a7c517d dashboard link: https://syzkaller.appspot.com/bug?extid=984a5c208d87765b2ee7 compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a2322c580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a3c512580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/6b49d8ad90de/disk-7d31f578.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/dbe2d4988ca7/vmlinux-7d31f578.xz kernel image: https://storage.googleapis.com/syzbot-assets/fc0448ab2411/bzImage-7d31f578.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+984a5c208d87765b2ee7@syzkaller.appspotmail.com R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000002 R13: 00007f49009e5fa0 R14: 00007f49009e5fa0 R15: 0000000000000005 </TASK> VFS_BUG_ON_INODE(inode_state_read_once(inode) & I_CLEAR) encountered for inode ffff88805d116e00 fs sockfs mode 140777 opflags 0xc flags 0x0 state 0x300 count 0 ------------[ cut here ]------------ kernel BUG at fs/inode.c:1971! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5997 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:iput+0xfc9/0x1030 fs/inode.c:1971 Code: 8b 7c 24 18 48 c7 c6 e0 f2 79 8b e8 51 f8 e6 fe 90 0f 0b e8 a9 6f 80 ff 48 8b 7c 24 18 48 c7 c6 80 f2 79 8b e8 38 f8 e6 fe 90 <0f> 0b 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fb ff ff 4c 89 ef RSP: 0018:ffffc90003987b18 EFLAGS: 00010282 RAX: 000000000000009f RBX: dffffc0000000000 RCX: e99d72d115a78d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1ed7c72 R08: ffffc900039877c7 R09: 1ffff92000730ef8 R10: dffffc0000000000 R11: fffff52000730ef9 R12: 1ffff1100ba22e00 R13: ffff88805d117000 R14: 0000000000000200 R15: 1ffffffff1f02c74 FS: 000055557d588500(0000) GS:ffff888125e4f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000200 CR3: 0000000074b6e000 CR4: 00000000003526f0 Call Trace: <TASK> sctp_getsockopt_peeloff_common+0x6b7/0x8a0 net/sctp/socket.c:5733 sctp_getsockopt_peeloff_flags+0x102/0x140 net/sctp/socket.c:5779 sctp_getsockopt+0x3a5/0xb90 net/sctp/socket.c:8111 do_sock_getsockopt+0x2b4/0x3d0 net/socket.c:2389 __sys_getsockopt net/socket.c:2418 [inline] __do_sys_getsockopt net/socket.c:2425 [inline] __se_sys_getsockopt net/socket.c:2422 [inline] __x64_sys_getsockopt+0x1a5/0x250 net/socket.c:2422 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f490078f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffed38d1688 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007f49009e5fa0 RCX: 00007f490078f749 RDX: 000000000000007a RSI: 0000000000000084 RDI: 0000000000000003 RBP: 00007ffed38d16e0 R08: 0000200000000040 R09: 0000000000000000 R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000002 R13: 00007f49009e5fa0 R14: 00007f49009e5fa0 R15: 0000000000000005 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:iput+0xfc9/0x1030 fs/inode.c:1971 Code: 8b 7c 24 18 48 c7 c6 e0 f2 79 8b e8 51 f8 e6 fe 90 0f 0b e8 a9 6f 80 ff 48 8b 7c 24 18 48 c7 c6 80 f2 79 8b e8 38 f8 e6 fe 90 <0f> 0b 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fb ff ff 4c 89 ef RSP: 0018:ffffc90003987b18 EFLAGS: 00010282 RAX: 000000000000009f RBX: dffffc0000000000 RCX: e99d72d115a78d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1ed7c72 R08: ffffc900039877c7 R09: 1ffff92000730ef8 R10: dffffc0000000000 R11: fffff52000730ef9 R12: 1ffff1100ba22e00 R13: ffff88805d117000 R14: 0000000000000200 R15: 1ffffffff1f02c74 FS: 000055557d588500(0000) GS:ffff888125e4f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000200 CR3: 0000000074b6e000 CR4: 00000000003526f0 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common 2025-12-01 9:58 [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common syzbot @ 2025-12-01 12:57 ` Mateusz Guzik 2025-12-01 13:45 ` syzbot 2025-12-01 14:07 ` Al Viro 2025-12-01 22:09 ` syzbot 1 sibling, 2 replies; 8+ messages in thread From: Mateusz Guzik @ 2025-12-01 12:57 UTC (permalink / raw) To: syzbot; +Cc: brauner, jack, linux-fsdevel, linux-kernel, syzkaller-bugs, viro On Mon, Dec 01, 2025 at 01:58:43AM -0800, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 7d31f578f323 Add linux-next specific files for 20251128 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=156402b4580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=6336d8e94a7c517d > dashboard link: https://syzkaller.appspot.com/bug?extid=984a5c208d87765b2ee7 > compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a2322c580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a3c512580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/6b49d8ad90de/disk-7d31f578.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/dbe2d4988ca7/vmlinux-7d31f578.xz > kernel image: https://storage.googleapis.com/syzbot-assets/fc0448ab2411/bzImage-7d31f578.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+984a5c208d87765b2ee7@syzkaller.appspotmail.com > > R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000002 > R13: 00007f49009e5fa0 R14: 00007f49009e5fa0 R15: 0000000000000005 > </TASK> > VFS_BUG_ON_INODE(inode_state_read_once(inode) & I_CLEAR) encountered for inode ffff88805d116e00 > fs sockfs mode 140777 opflags 0xc flags 0x0 state 0x300 count 0 > ------------[ cut here ]------------ > kernel BUG at fs/inode.c:1971! > Oops: invalid opcode: 0000 [#1] SMP KASAN PTI > CPU: 0 UID: 0 PID: 5997 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 > RIP: 0010:iput+0xfc9/0x1030 fs/inode.c:1971 > Code: 8b 7c 24 18 48 c7 c6 e0 f2 79 8b e8 51 f8 e6 fe 90 0f 0b e8 a9 6f 80 ff 48 8b 7c 24 18 48 c7 c6 80 f2 79 8b e8 38 f8 e6 fe 90 <0f> 0b 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fb ff ff 4c 89 ef > RSP: 0018:ffffc90003987b18 EFLAGS: 00010282 > RAX: 000000000000009f RBX: dffffc0000000000 RCX: e99d72d115a78d00 > RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 > RBP: 1ffffffff1ed7c72 R08: ffffc900039877c7 R09: 1ffff92000730ef8 > R10: dffffc0000000000 R11: fffff52000730ef9 R12: 1ffff1100ba22e00 > R13: ffff88805d117000 R14: 0000000000000200 R15: 1ffffffff1f02c74 > FS: 000055557d588500(0000) GS:ffff888125e4f000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000200000000200 CR3: 0000000074b6e000 CR4: 00000000003526f0 > Call Trace: > <TASK> > sctp_getsockopt_peeloff_common+0x6b7/0x8a0 net/sctp/socket.c:5733 > sctp_getsockopt_peeloff_flags+0x102/0x140 net/sctp/socket.c:5779 > sctp_getsockopt+0x3a5/0xb90 net/sctp/socket.c:8111 > do_sock_getsockopt+0x2b4/0x3d0 net/socket.c:2389 > __sys_getsockopt net/socket.c:2418 [inline] > __do_sys_getsockopt net/socket.c:2425 [inline] > __se_sys_getsockopt net/socket.c:2422 [inline] > __x64_sys_getsockopt+0x1a5/0x250 net/socket.c:2422 > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > RIP: 0033:0x7f490078f749 The inode is I_FREEING | I_CLEAR. I suspect this is botched error handling in the recent conversion to FD_PREPARE machinery. #syz test diff --git b/net/sctp/socket.c a/net/sctp/socket.c index 1e59ac734f91..ed8293a34240 100644 --- b/net/sctp/socket.c +++ a/net/sctp/socket.c @@ -5664,45 +5664,47 @@ static int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, return err; } -static int sctp_getsockopt_peeloff_common(struct sock *sk, - sctp_peeloff_arg_t *peeloff, int len, - char __user *optval, - int __user *optlen, unsigned flags) +static int sctp_getsockopt_peeloff_common(struct sock *sk, sctp_peeloff_arg_t *peeloff, + struct file **newfile, unsigned flags) { struct socket *newsock; int retval; retval = sctp_do_peeloff(sk, peeloff->associd, &newsock); if (retval < 0) - return retval; + goto out; - FD_PREPARE(fdf, flags & SOCK_CLOEXEC, sock_alloc_file(newsock, 0, NULL)); - if (fdf.err) { + /* Map the socket to an unused fd that can be returned to the user. */ + retval = get_unused_fd_flags(flags & SOCK_CLOEXEC); + if (retval < 0) { sock_release(newsock); - return fdf.err; + goto out; } - pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk, - fd_prepare_fd(fdf)); - - if (flags & SOCK_NONBLOCK) - fd_prepare_file(fdf)->f_flags |= O_NONBLOCK; + *newfile = sock_alloc_file(newsock, 0, NULL); + if (IS_ERR(*newfile)) { + put_unused_fd(retval); + retval = PTR_ERR(*newfile); + *newfile = NULL; + return retval; + } - /* Return the fd mapped to the new socket. */ - if (put_user(len, optlen)) - return -EFAULT; + pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk, + retval); - peeloff->sd = fd_prepare_fd(fdf); - if (copy_to_user(optval, peeloff, len)) - return -EFAULT; + peeloff->sd = retval; - return fd_publish(fdf); + if (flags & SOCK_NONBLOCK) + (*newfile)->f_flags |= O_NONBLOCK; +out: + return retval; } -static int sctp_getsockopt_peeloff(struct sock *sk, int len, - char __user *optval, int __user *optlen) +static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval, int __user *optlen) { sctp_peeloff_arg_t peeloff; + struct file *newfile = NULL; + int retval = 0; if (len < sizeof(sctp_peeloff_arg_t)) return -EINVAL; @@ -5710,13 +5712,33 @@ static int sctp_getsockopt_peeloff(struct sock *sk, int len, if (copy_from_user(&peeloff, optval, len)) return -EFAULT; - return sctp_getsockopt_peeloff_common(sk, &peeloff, len, optval, optlen, 0); + retval = sctp_getsockopt_peeloff_common(sk, &peeloff, &newfile, 0); + if (retval < 0) + goto out; + + /* Return the fd mapped to the new socket. */ + if (put_user(len, optlen)) { + fput(newfile); + put_unused_fd(retval); + return -EFAULT; + } + + if (copy_to_user(optval, &peeloff, len)) { + fput(newfile); + put_unused_fd(retval); + return -EFAULT; + } + fd_install(retval, newfile); +out: + return retval; } static int sctp_getsockopt_peeloff_flags(struct sock *sk, int len, char __user *optval, int __user *optlen) { sctp_peeloff_flags_arg_t peeloff; + struct file *newfile = NULL; + int retval = 0; if (len < sizeof(sctp_peeloff_flags_arg_t)) return -EINVAL; @@ -5724,8 +5746,26 @@ static int sctp_getsockopt_peeloff_flags(struct sock *sk, int len, if (copy_from_user(&peeloff, optval, len)) return -EFAULT; - return sctp_getsockopt_peeloff_common(sk, &peeloff.p_arg, len, optval, - optlen, peeloff.flags); + retval = sctp_getsockopt_peeloff_common(sk, &peeloff.p_arg, + &newfile, peeloff.flags); + if (retval < 0) + goto out; + + /* Return the fd mapped to the new socket. */ + if (put_user(len, optlen)) { + fput(newfile); + put_unused_fd(retval); + return -EFAULT; + } + + if (copy_to_user(optval, &peeloff, len)) { + fput(newfile); + put_unused_fd(retval); + return -EFAULT; + } + fd_install(retval, newfile); +out: + return retval; } /* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS) ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common 2025-12-01 12:57 ` Mateusz Guzik @ 2025-12-01 13:45 ` syzbot 2025-12-01 14:07 ` Al Viro 1 sibling, 0 replies; 8+ messages in thread From: syzbot @ 2025-12-01 13:45 UTC (permalink / raw) To: brauner, jack, linux-fsdevel, linux-kernel, mjguzik, syzkaller-bugs, viro Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+984a5c208d87765b2ee7@syzkaller.appspotmail.com Tested-by: syzbot+984a5c208d87765b2ee7@syzkaller.appspotmail.com Tested on: commit: 95cb2fd6 Add linux-next specific files for 20251201 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=142b58c2580000 kernel config: https://syzkaller.appspot.com/x/.config?x=caadf525b0ab8d17 dashboard link: https://syzkaller.appspot.com/bug?extid=984a5c208d87765b2ee7 compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=10a62512580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common 2025-12-01 12:57 ` Mateusz Guzik 2025-12-01 13:45 ` syzbot @ 2025-12-01 14:07 ` Al Viro 2025-12-02 9:49 ` Christian Brauner 1 sibling, 1 reply; 8+ messages in thread From: Al Viro @ 2025-12-01 14:07 UTC (permalink / raw) To: Mateusz Guzik Cc: syzbot, brauner, jack, linux-fsdevel, linux-kernel, syzkaller-bugs, Linus Torvalds On Mon, Dec 01, 2025 at 01:57:11PM +0100, Mateusz Guzik wrote: > I suspect this is botched error handling in the recent conversion to > FD_PREPARE machinery. Quite. FWIW, at that point I believe that FD_ADD/FD_PREPARE branch is simply not ready - too little time in -next, if nothing else. Christian, drop that pull request, please. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common 2025-12-01 14:07 ` Al Viro @ 2025-12-02 9:49 ` Christian Brauner 0 siblings, 0 replies; 8+ messages in thread From: Christian Brauner @ 2025-12-02 9:49 UTC (permalink / raw) To: Al Viro Cc: Mateusz Guzik, syzbot, jack, linux-fsdevel, linux-kernel, syzkaller-bugs, Linus Torvalds On Mon, Dec 01, 2025 at 02:07:07PM +0000, Al Viro wrote: > On Mon, Dec 01, 2025 at 01:57:11PM +0100, Mateusz Guzik wrote: > > > I suspect this is botched error handling in the recent conversion to > > FD_PREPARE machinery. > > Quite. FWIW, at that point I believe that FD_ADD/FD_PREPARE branch > is simply not ready - too little time in -next, if nothing else. > > Christian, drop that pull request, please. Fwiw, this conversion isn't in mainline. This is -next being out of sync. Sorry I was too eager to push this. I just got excited about it. I'm happy to send a revert in case Linus wants that. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common 2025-12-01 9:58 [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common syzbot 2025-12-01 12:57 ` Mateusz Guzik @ 2025-12-01 22:09 ` syzbot 2025-12-04 22:53 ` Xin Long 1 sibling, 1 reply; 8+ messages in thread From: syzbot @ 2025-12-01 22:09 UTC (permalink / raw) To: brauner, davem, edumazet, horms, jack, kuba, linux-fsdevel, linux-kernel, linux-sctp, lucien.xin, marcelo.leitner, mjguzik, netdev, pabeni, syzkaller-bugs, torvalds, viro syzbot has bisected this issue to: commit 457528eb27c3a3053181939ca65998477cc39c49 Author: Christian Brauner <brauner@kernel.org> Date: Sun Nov 23 16:33:47 2025 +0000 net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE() bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1136a512580000 start commit: 7d31f578f323 Add linux-next specific files for 20251128 git tree: linux-next final oops: https://syzkaller.appspot.com/x/report.txt?x=1336a512580000 console output: https://syzkaller.appspot.com/x/log.txt?x=1536a512580000 kernel config: https://syzkaller.appspot.com/x/.config?x=6336d8e94a7c517d dashboard link: https://syzkaller.appspot.com/bug?extid=984a5c208d87765b2ee7 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a2322c580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a3c512580000 Reported-by: syzbot+984a5c208d87765b2ee7@syzkaller.appspotmail.com Fixes: 457528eb27c3 ("net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE()") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common 2025-12-01 22:09 ` syzbot @ 2025-12-04 22:53 ` Xin Long 2025-12-05 9:44 ` Christian Brauner 0 siblings, 1 reply; 8+ messages in thread From: Xin Long @ 2025-12-04 22:53 UTC (permalink / raw) To: syzbot Cc: brauner, davem, edumazet, horms, jack, kuba, linux-fsdevel, linux-kernel, linux-sctp, marcelo.leitner, mjguzik, netdev, pabeni, syzkaller-bugs, torvalds, viro On Mon, Dec 1, 2025 at 5:09 PM syzbot <syzbot+984a5c208d87765b2ee7@syzkaller.appspotmail.com> wrote: > > syzbot has bisected this issue to: > > commit 457528eb27c3a3053181939ca65998477cc39c49 > Author: Christian Brauner <brauner@kernel.org> > Date: Sun Nov 23 16:33:47 2025 +0000 > > net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE() > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1136a512580000 > start commit: 7d31f578f323 Add linux-next specific files for 20251128 > git tree: linux-next > final oops: https://syzkaller.appspot.com/x/report.txt?x=1336a512580000 > console output: https://syzkaller.appspot.com/x/log.txt?x=1536a512580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=6336d8e94a7c517d > dashboard link: https://syzkaller.appspot.com/bug?extid=984a5c208d87765b2ee7 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a2322c580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a3c512580000 > > Reported-by: syzbot+984a5c208d87765b2ee7@syzkaller.appspotmail.com > Fixes: 457528eb27c3 ("net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE()") This commit seems to no longer exist. But I triggered a similar call trace with FAULT_INJECTION on net-next.git: [] FAULT_INJECTION: forcing a failure. [] Call Trace: [] <TASK> [] dump_stack_lvl+0x180/0x1b0 [] should_fail_ex+0x520/0x650 [] should_failslab+0xc2/0x120 [] kmem_cache_alloc_lru_noprof+0x7a/0x780 [] d_alloc_pseudo+0x1d/0xc0 [] alloc_file_pseudo+0xbe/0x220 [] sock_alloc_file+0x53/0x220 [] __sys_socket+0x1be/0x320 [] VFS_BUG_ON_INODE(inode_state_read_once(inode) & I_CLEAR) encountered for inode ffff888054f9a900 [] ------------[ cut here ]------------ [] kernel BUG at fs/inode.c:1971! [] Call Trace: [] <TASK> [] iput+0x35/0x40 [] __sock_release+0x20b/0x270 [] __sys_socket+0x276/0x320 [] __x64_sys_socket+0x72/0xb0 which was caused by: commit 245f0d1c622b0183ce4f44b3e39aeacf78fae594 Author: Christian Brauner <brauner@kernel.org> Date: Sun Nov 23 17:33:48 2025 +0100 net/socket: convert sock_map_fd() to FD_ADD() static int sock_map_fd(struct socket *sock, int flags) { int fd; fd = FD_ADD(flags, sock_alloc_file(sock, flags, NULL)); if (fd < 0) sock_release(sock); return fd; } The allocation failure in sock_alloc_file() will call sock_release(), and it should not be called again in sock_map_fd(). It could be fixed by: diff --git a/net/socket.c b/net/socket.c index 809ef372727b..0c2b03cec83d 100644 --- a/net/socket.c +++ b/net/socket.c @@ -503,12 +503,13 @@ EXPORT_SYMBOL(sock_alloc_file); static int sock_map_fd(struct socket *sock, int flags) { - int fd; + struct file *file; - fd = FD_ADD(flags, sock_alloc_file(sock, flags, NULL)); - if (fd < 0) - sock_release(sock); - return fd; + file = sock_alloc_file(sock, flags, NULL); + if (IS_ERR(file)) + return PTR_ERR(file); + + return FD_ADD(flags, file); } ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common 2025-12-04 22:53 ` Xin Long @ 2025-12-05 9:44 ` Christian Brauner 0 siblings, 0 replies; 8+ messages in thread From: Christian Brauner @ 2025-12-05 9:44 UTC (permalink / raw) To: Xin Long Cc: syzbot, davem, edumazet, horms, jack, kuba, linux-fsdevel, linux-kernel, linux-sctp, marcelo.leitner, mjguzik, netdev, pabeni, syzkaller-bugs, torvalds, viro > But I triggered a similar call trace with FAULT_INJECTION on net-next.git: Thank you, I'll send a revert. ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2025-12-05 9:44 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-12-01 9:58 [syzbot] [fs?] kernel BUG in sctp_getsockopt_peeloff_common syzbot 2025-12-01 12:57 ` Mateusz Guzik 2025-12-01 13:45 ` syzbot 2025-12-01 14:07 ` Al Viro 2025-12-02 9:49 ` Christian Brauner 2025-12-01 22:09 ` syzbot 2025-12-04 22:53 ` Xin Long 2025-12-05 9:44 ` Christian Brauner
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).