* Re: [PATCH v1] fs: Move might_sleep() annotation to iput_final()
From: kernel test robot @ 2025-11-12 5:40 UTC (permalink / raw)
To: Mickaël Salaün
Cc: oe-lkp, lkp, Christian Brauner, Edward Adam Davis,
Günther Noack, Hillf Danton, Jan Kara, Jann Horn,
Mateusz Guzik, Max Kellermann, Tingmao Wang, linux-fsdevel,
Mickaël Salaün, linux-security-module, Al Viro,
syzbot+12479ae15958fc3f54ec, oliver.sang
In-Reply-To: <20251105193800.2340868-1-mic@digikod.net>
Hello,
kernel test robot noticed "BUG:sleeping_function_called_from_invalid_context_at_fs/inode.c" on:
commit: 29fb8368dfb5d1f784fd936cec578c9601d77325 ("[PATCH v1] fs: Move might_sleep() annotation to iput_final()")
url: https://github.com/intel-lab-lkp/linux/commits/Micka-l-Sala-n/fs-Move-might_sleep-annotation-to-iput_final/20251106-060704
patch link: https://lore.kernel.org/all/20251105193800.2340868-1-mic@digikod.net/
patch subject: [PATCH v1] fs: Move might_sleep() annotation to iput_final()
in testcase: boot
config: x86_64-rhel-9.4-rust
compiler: clang-20
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202511121304.5e522f7b-lkp@intel.com
[ 18.387422][ T1] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 18.389429][ T1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: init
[ 18.390340][ T1] preempt_count: 1, expected: 0
[ 18.390892][ T1] RCU nest depth: 0, expected: 0
[ 18.391438][ T1] CPU: 1 UID: 0 PID: 1 Comm: init Not tainted 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 18.391441][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 18.391443][ T1] Call Trace:
[ 18.392215][ T1] <TASK>
[ 18.392219][ T1] dump_stack_lvl (lib/dump_stack.c:123)
[ 18.392228][ T1] __might_resched (kernel/sched/core.c:8838)
[ 18.393064][ T1] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 18.393072][ T1] __dentry_kill (fs/dcache.c:?)
[ 18.393075][ T1] dput (fs/dcache.c:912)
[ 18.393077][ T1] __fput (fs/file_table.c:477)
[ 18.393081][ T1] __x64_sys_close (fs/open.c:1591)
[ 18.393082][ T1] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 18.393086][ T1] ? __x64_sys_connect (net/socket.c:2131 net/socket.c:2128 net/socket.c:2128)
[ 18.393098][ T1] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 18.393099][ T1] ? kmem_cache_alloc_noprof (include/linux/kernel.h:?)
[ 18.393104][ T1] ? alloc_empty_file (fs/file_table.c:238)
[ 18.393105][ T1] ? init_file (fs/file_table.c:174)
[ 18.393107][ T1] ? file_init_path (fs/file_table.c:326)
[ 18.393108][ T1] ? alloc_file_pseudo (fs/file_table.c:?)
[ 18.393110][ T1] ? sock_alloc_file (net/socket.c:?)
[ 18.393113][ T1] ? __sys_socket (net/socket.c:?)
[ 18.393115][ T1] ? __x64_sys_socket (net/socket.c:1765 net/socket.c:1763 net/socket.c:1763)
[ 18.393117][ T1] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 18.393119][ T1] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 18.393121][ T1] RIP: 0033:0x7fcfd14c3040
[ 18.393126][ T1] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 18.393128][ T1] RSP: 002b:00007ffd4cbc7398 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 18.393131][ T1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcfd14c3040
[ 18.393132][ T1] RDX: 00007fcfd1526f2c RSI: 0000000000000000 RDI: 0000000000000008
[ 18.393133][ T1] RBP: 0000000000000008 R08: 0000000000000003 R09: 0000000000000000
[ 18.393134][ T1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfd221b6a0
[ 18.393135][ T1] R13: 00007fcfd15563cb R14: 00000000ffffffff R15: 0000000000000000
[ 18.393137][ T1] </TASK>
LKP: ttyS0: 86: skip deploy intel ucode as no ucode is specified
LKP: ttyS0: 86: Kernel tests: Boot OK!
LKP: ttyS0: 86: HOSTNAME vm-snb, MAC 52:54:00:12:34:56, kernel 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 1
[ 18.589452][ T181] udevd[181]: starting version 175
[ 18.598118][ T107] is_virt=true
[ 18.598124][ T107]
[ 18.603531][ T107] lkp: kernel tainted state: 512
[ 18.603537][ T107]
[ 18.612979][ T107] LKP: stdout: 86: Kernel tests: Boot OK!
[ 18.612986][ T107]
LKP: ttyS0: 86: /lkp/lkp/src/bin/run-lkp /lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.661802][ T107] LKP: stdout: 86: HOSTNAME vm-snb, MAC 52:54:00:12:34:56, kernel 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 1
[ 18.661809][ T107]
[ 18.676637][ T107] NO_NETWORK=
[ 18.676643][ T107]
[ 18.680228][ T200] piix4_smbus 0000:00:01.3: SMBus Host Controller at 0x700, revision 0
[ 18.690939][ T107] INFO: lkp CACHE_DIR is /tmp/cache
[ 18.690945][ T107]
[ 18.694448][ T200] i2c i2c-0: Memory type 0x07 not supported yet, not instantiating SPD
[ 18.761028][ T107] LKP: stdout: 86: /lkp/lkp/src/bin/run-lkp /lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.761038][ T107]
[ 18.781039][ T107] RESULT_ROOT=/result/boot/1/vm-snb/quantal-x86_64-core-20190426.cgz/x86_64-rhel-9.4-rust/clang-20/29fb8368dfb5d1f784fd936cec578c9601d77325/0
[ 18.781047][ T107]
[ 18.805586][ T107] job=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.805592][ T107]
[ 18.857299][ T201] libata version 3.00 loaded.
[ 18.872519][ T107] result_service: raw_upload, RESULT_MNT: /internal-lkp-server/result, RESULT_ROOT: /internal-lkp-server/result/boot/1/vm-snb/quantal-x86_64-core-20190426.cgz/x86_64-rhel-9.4-rust/clang-20/29fb8368dfb5d1f784fd936cec578c9601d77325/0, TMP_RESULT_ROOT: /tmp/lkp/result
[ 18.872526][ T107]
[ 18.880780][ T201] scsi host0: ata_piix
[ 18.899515][ T107] run-job /lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.899520][ T107]
[ 18.908385][ T201] scsi host1: ata_piix
[ 18.910926][ T201] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc140 irq 14 lpm-pol 0
[ 18.911964][ T201] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc148 irq 15 lpm-pol 0
[ 18.932209][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=running -O /dev/null
[ 18.932216][ T107]
[ 18.974405][ T212] ACPI: bus type drm_connector registered
[ 18.978482][ T1] init: failsafe main process (320) killed by TERM signal
[ 19.074983][ T307] ata2: found unknown device (class 0)
[ 19.076067][ T307] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
[ 19.077908][ T12] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5
[ 19.099276][ T312] parport_pc 00:03: reported by Plug and Play ACPI
[ 19.104906][ T312] parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
[ 19.190656][ T384] sr 1:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray
[ 19.191608][ T384] cdrom: Uniform CD-ROM driver Revision: 3.20
[ 19.201172][ T212] bochs-drm 0000:00:02.0: vgaarb: deactivate vga console
[ 19.206902][ T212] Console: switching to colour dummy device 80x25
[ 19.207699][ T212] [drm] Found bochs VGA, ID 0xb0c5.
[ 19.208107][ T212] [drm] Framebuffer size 16384 kB @ 0xfd000000, mmio @ 0xfebf0000.
[ 19.209140][ T212] [drm] Initialized bochs-drm 1.0.0 for 0000:00:02.0 on minor 0
[ 19.216585][ T212] fbcon: bochs-drmdrmfb (fb0) is primary device
[ 19.233924][ T384] sr 1:0:0:0: Attached scsi CD-ROM sr0
[ 19.236779][ T212] Console: switching to colour frame buffer device 160x50
[ 19.296502][ T212] bochs-drm 0000:00:02.0: [drm] fb0: bochs-drmdrmfb frame buffer device
[ 19.300750][ T391] ppdev: user-space parallel port driver
[ 19.386935][ T82] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 19.387879][ T82] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 82, name: plymouthd
[ 19.388607][ T82] preempt_count: 1, expected: 0
[ 19.389718][ T82] RCU nest depth: 0, expected: 0
[ 19.391578][ T82] CPU: 1 UID: 0 PID: 82 Comm: plymouthd Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 19.391582][ T82] Tainted: [W]=WARN
[ 19.391583][ T82] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 19.391584][ T82] Call Trace:
[ 19.391587][ T82] <TASK>
[ 19.391590][ T82] dump_stack_lvl (lib/dump_stack.c:123)
[ 19.391599][ T82] __might_resched (kernel/sched/core.c:8838)
[ 19.391605][ T82] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 19.391609][ T82] __dentry_kill (fs/dcache.c:?)
[ 19.391613][ T82] dput (fs/dcache.c:912)
[ 19.391615][ T82] __fput (fs/file_table.c:477)
[ 19.391625][ T82] __x64_sys_close (fs/open.c:1591)
[ 19.391627][ T82] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 19.391631][ T82] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 19.391633][ T82] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 19.391635][ T82] ? __x64_sys_sendto (net/socket.c:2255 net/socket.c:2251 net/socket.c:2251)
[ 19.391645][ T82] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 19.391647][ T82] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 19.391650][ T82] RIP: 0033:0x7ff9cf9f9040
[ 19.391654][ T82] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 19.391656][ T82] RSP: 002b:00007ffd01a06c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 19.391659][ T82] RAX: ffffffffffffffda RBX: 0000000034e212e0 RCX: 00007ff9cf9f9040
[ 19.391661][ T82] RDX: 00007ffd01a06cbc RSI: 0000000034e212e0 RDI: 0000000000000007
[ 19.391662][ T82] RBP: 0000000034e20f50 R08: 00000000118a0360 R09: 7fffffffffffffff
[ 19.391664][ T82] R10: 3fffffffffffffff R11: 0000000000000246 R12: 0000000034e215a0
[ 19.391668][ T82] R13: 0000000034e21570 R14: 0000000000000058 R15: 0000000000000000
[ 19.391670][ T82] </TASK>
[ 19.684798][ C0] hrtimer: interrupt took 7335062 ns
[ 19.697123][ T109] 2025-11-10 18:26:34 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=running [0/0] -> "/dev/null" [1]
[ 19.773587][ T109]
[ 19.827552][ T107] target ucode:
[ 19.827558][ T107]
[ 19.854980][ T107] check_nr_cpu
[ 19.872576][ T107]
[ 19.875184][ T107] CPU(s): 2
[ 19.877090][ T107]
[ 19.888546][ T107] On-line CPU(s) list: 0,1
[ 19.888553][ T107]
[ 19.922264][ T107] Thread(s) per core: 1
[ 19.922272][ T107]
[ 19.925376][ T107] Core(s) per socket: 2
[ 19.925383][ T107]
[ 19.942720][ T107] Socket(s): 1
[ 19.942727][ T107]
[ 19.966452][ T107] NUMA node(s): 1
[ 19.966460][ T107]
[ 19.981930][ T107] NUMA node0 CPU(s): 0,1
[ 19.981942][ T107]
[ 20.557619][ T497] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 20.558839][ T497] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 497, name: udevd
[ 20.559927][ T497] preempt_count: 1, expected: 0
[ 20.562617][ T497] RCU nest depth: 0, expected: 0
[ 20.563969][ T497] CPU: 0 UID: 0 PID: 497 Comm: udevd Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 20.563978][ T497] Tainted: [W]=WARN
[ 20.563979][ T497] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 20.563981][ T497] Call Trace:
[ 20.563986][ T497] <TASK>
[ 20.563989][ T497] dump_stack_lvl (lib/dump_stack.c:123)
[ 20.563999][ T497] __might_resched (kernel/sched/core.c:8838)
[ 20.564004][ T497] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 20.564008][ T497] __dentry_kill (fs/dcache.c:?)
[ 20.564012][ T497] shrink_dentry_list (fs/dcache.c:1114)
[ 20.564015][ T497] shrink_dcache_parent (fs/dcache.c:1550)
[ 20.564019][ T497] d_invalidate (fs/dcache.c:1660)
[ 20.564022][ T497] proc_invalidate_siblings_dcache (fs/proc/inode.c:143)
[ 20.564026][ T497] release_task (kernel/exit.c:292)
[ 20.564030][ T497] wait_consider_task (kernel/exit.c:1276)
[ 20.564033][ T497] ? do_wait (kernel/exit.c:1714)
[ 20.564035][ T497] __do_wait (kernel/exit.c:1640 kernel/exit.c:1674)
[ 20.564037][ T497] ? do_wait (kernel/exit.c:1714)
[ 20.564039][ T497] do_wait (kernel/exit.c:1716)
[ 20.564041][ T497] kernel_wait4 (kernel/exit.c:1874)
[ 20.564043][ T497] ? get_task_struct (kernel/exit.c:1599)
[ 20.564045][ T497] __x64_sys_wait4 (kernel/exit.c:1902 kernel/exit.c:1898 kernel/exit.c:1898)
[ 20.564048][ T497] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 20.564052][ T497] ? vfs_read (fs/read_write.c:492)
[ 20.564055][ T497] ? __x64_sys_read (fs/read_write.c:?)
[ 20.564056][ T497] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 20.564058][ T497] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 20.564061][ T497] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 20.564064][ T497] RIP: 0033:0x7f0bbd443c3e
[ 20.564068][ T497] Code: 00 f7 d8 64 89 02 48 89 f8 eb cc 90 48 83 ec 28 8b 05 aa e5 2f 00 85 c0 75 1d 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 48 83 c4 28 c3 89 54 24 08 48 89 74 24 10
All code
========
0: 00 f7 add %dh,%bh
2: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4)
6: 48 89 f8 mov %rdi,%rax
9: eb cc jmp 0xffffffffffffffd7
b: 90 nop
c: 48 83 ec 28 sub $0x28,%rsp
10: 8b 05 aa e5 2f 00 mov 0x2fe5aa(%rip),%eax # 0x2fe5c0
16: 85 c0 test %eax,%eax
18: 75 1d jne 0x37
1a: 45 31 d2 xor %r10d,%r10d
1d: 48 63 d2 movslq %edx,%rdx
20: 48 63 ff movslq %edi,%rdi
23: b8 3d 00 00 00 mov $0x3d,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 51 ja 0x83
32: 48 83 c4 28 add $0x28,%rsp
36: c3 ret
37: 89 54 24 08 mov %edx,0x8(%rsp)
3b: 48 89 74 24 10 mov %rsi,0x10(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 51 ja 0x59
8: 48 83 c4 28 add $0x28,%rsp
c: c3 ret
d: 89 54 24 08 mov %edx,0x8(%rsp)
11: 48 89 74 24 10 mov %rsi,0x10(%rsp)
[ 20.564071][ T497] RSP: 002b:00007fff65aecee0 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
[ 20.564074][ T497] RAX: ffffffffffffffda RBX: 0000556a4924f6d0 RCX: 00007f0bbd443c3e
[ 20.564076][ T497] RDX: 0000000000000001 RSI: 00007fff65aedfe4 RDI: 00000000000001f2
[ 20.564077][ T497] RBP: 0000000000000000 R08: 000000001bb5db01 R09: 7fffffffffffffff
[ 20.564079][ T497] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff65af3948
[ 20.564080][ T497] R13: 00000000000001f2 R14: 0000556a49215250 R15: 00000000000003e8
[ 20.564083][ T497] </TASK>
[ 20.689253][ T1] init: networking main process (512) terminated with status 1
[ 21.005572][ T107] sleep started
[ 21.005581][ T107]
[ 22.006385][ T210] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 22.007457][ T210] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 210, name: run-lkp
[ 22.008482][ T210] preempt_count: 1, expected: 0
[ 22.009261][ T210] RCU nest depth: 0, expected: 0
[ 22.009992][ T210] CPU: 1 UID: 0 PID: 210 Comm: run-lkp Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 22.009996][ T210] Tainted: [W]=WARN
[ 22.009997][ T210] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 22.009999][ T210] Call Trace:
[ 22.010003][ T210] <TASK>
[ 22.010005][ T210] dump_stack_lvl (lib/dump_stack.c:123)
[ 22.010015][ T210] __might_resched (kernel/sched/core.c:8838)
[ 22.010021][ T210] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 22.010026][ T210] __dentry_kill (fs/dcache.c:?)
[ 22.010030][ T210] shrink_dentry_list (fs/dcache.c:1114)
[ 22.010034][ T210] shrink_dcache_parent (fs/dcache.c:1550)
[ 22.010037][ T210] d_invalidate (fs/dcache.c:1660)
[ 22.010040][ T210] proc_invalidate_siblings_dcache (fs/proc/inode.c:143)
[ 22.010046][ T210] release_task (kernel/exit.c:292)
[ 22.010051][ T210] wait_consider_task (kernel/exit.c:1276)
[ 22.010057][ T210] __do_wait (kernel/exit.c:1565 kernel/exit.c:1681)
[ 22.010059][ T210] ? do_wait (kernel/exit.c:1714)
[ 22.010061][ T210] do_wait (kernel/exit.c:1716)
[ 22.010063][ T210] kernel_wait4 (kernel/exit.c:1874)
[ 22.010066][ T210] ? get_task_struct (kernel/exit.c:1599)
[ 22.010069][ T210] __x64_sys_wait4 (kernel/exit.c:1902 kernel/exit.c:1898 kernel/exit.c:1898)
[ 22.010071][ T210] ? count_memcg_events (mm/memcontrol.c:? mm/memcontrol.c:847)
[ 22.010073][ T210] ? handle_mm_fault (mm/memory.c:6423)
[ 22.010078][ T210] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 22.010082][ T210] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 22.010086][ T210] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 22.010089][ T210] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 22.010093][ T210] RIP: 0033:0x7fe001e18c3e
[ 22.010097][ T210] Code: 00 f7 d8 64 89 02 48 89 f8 eb cc 90 48 83 ec 28 8b 05 aa e5 2f 00 85 c0 75 1d 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 48 83 c4 28 c3 89 54 24 08 48 89 74 24 10
All code
========
0: 00 f7 add %dh,%bh
2: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4)
6: 48 89 f8 mov %rdi,%rax
9: eb cc jmp 0xffffffffffffffd7
b: 90 nop
c: 48 83 ec 28 sub $0x28,%rsp
10: 8b 05 aa e5 2f 00 mov 0x2fe5aa(%rip),%eax # 0x2fe5c0
16: 85 c0 test %eax,%eax
18: 75 1d jne 0x37
1a: 45 31 d2 xor %r10d,%r10d
1d: 48 63 d2 movslq %edx,%rdx
20: 48 63 ff movslq %edi,%rdi
23: b8 3d 00 00 00 mov $0x3d,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 51 ja 0x83
32: 48 83 c4 28 add $0x28,%rsp
36: c3 ret
37: 89 54 24 08 mov %edx,0x8(%rsp)
3b: 48 89 74 24 10 mov %rsi,0x10(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 51 ja 0x59
8: 48 83 c4 28 add $0x28,%rsp
c: c3 ret
d: 89 54 24 08 mov %edx,0x8(%rsp)
11: 48 89 74 24 10 mov %rsi,0x10(%rsp)
[ 22.010099][ T210] RSP: 002b:00007ffc8644ef50 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
[ 22.010102][ T210] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe001e18c3e
[ 22.010104][ T210] RDX: 0000000000000000 RSI: 00007ffc8644efb8 RDI: ffffffffffffffff
[ 22.010105][ T210] RBP: 000000003db55300 R08: 000000003db553c8 R09: 0000000000000001
[ 22.010107][ T210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 22.010108][ T210] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000ffffffff
[ 22.010110][ T210] </TASK>
[ 22.147235][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=post_run -O /dev/null
[ 22.147244][ T107]
[ 22.859171][ T109] 2025-11-10 18:26:38 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=post_run [0/0] -> "/dev/null" [1]
[ 22.859180][ T109]
[ 23.872028][ T539] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 23.873181][ T539] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 539, name: post-run
[ 23.875374][ T539] preempt_count: 1, expected: 0
[ 23.876396][ T539] RCU nest depth: 0, expected: 0
[ 23.877455][ T539] CPU: 1 UID: 0 PID: 539 Comm: post-run Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 23.877459][ T539] Tainted: [W]=WARN
[ 23.877460][ T539] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 23.877461][ T539] Call Trace:
[ 23.877465][ T539] <TASK>
[ 23.877467][ T539] dump_stack_lvl (lib/dump_stack.c:123)
[ 23.877475][ T539] __might_resched (kernel/sched/core.c:8838)
[ 23.877480][ T539] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 23.877484][ T539] __dentry_kill (fs/dcache.c:?)
[ 23.877488][ T539] dput (fs/dcache.c:912)
[ 23.877490][ T539] __fput (fs/file_table.c:477)
[ 23.877494][ T539] __x64_sys_close (fs/open.c:1591)
[ 23.877496][ T539] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 23.877499][ T539] ? handle_mm_fault (mm/memory.c:6423)
[ 23.877504][ T539] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 23.877508][ T539] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 23.877510][ T539] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 23.877513][ T539] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 23.877516][ T539] RIP: 0033:0x7f1031cde040
[ 23.877519][ T539] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 23.877521][ T539] RSP: 002b:00007fff879e0888 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 23.877524][ T539] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f1031cde040
[ 23.877525][ T539] RDX: 0000000000000001 RSI: 0000000000000002 RDI: 0000000000000003
[ 23.877526][ T539] RBP: 0000000000000000 R08: 000000000000000a R09: 0000000000000000
[ 23.877527][ T539] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff879e08e4
[ 23.877528][ T539] R13: 0000000000000080 R14: 000000000000000a R15: 000000001dc63a08
[ 23.877530][ T539] </TASK>
[ 23.937654][ T107] kill 429 vmstat -n 10
[ 23.937662][ T107]
[ 23.944123][ T107] kill 425 cat /proc/kmsg
[ 23.944131][ T107]
[ 23.962000][ T107] wait for background processes: 435 432 oom-killer meminfo
[ 23.962008][ T107]
[ 24.972654][ T561] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 24.973813][ T561] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 561, name: post-run
[ 24.974943][ T561] preempt_count: 1, expected: 0
[ 24.975752][ T561] RCU nest depth: 0, expected: 0
[ 24.976454][ T561] CPU: 1 UID: 0 PID: 561 Comm: post-run Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 24.976459][ T561] Tainted: [W]=WARN
[ 24.976459][ T561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 24.976461][ T561] Call Trace:
[ 24.976464][ T561] <TASK>
[ 24.976466][ T561] dump_stack_lvl (lib/dump_stack.c:123)
[ 24.976476][ T561] __might_resched (kernel/sched/core.c:8838)
[ 24.976485][ T561] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 24.976489][ T561] __dentry_kill (fs/dcache.c:?)
[ 24.976492][ T561] shrink_dentry_list (fs/dcache.c:1114)
[ 24.976495][ T561] shrink_dcache_parent (fs/dcache.c:1550)
[ 24.976498][ T561] d_invalidate (fs/dcache.c:1660)
[ 24.976502][ T561] proc_invalidate_siblings_dcache (fs/proc/inode.c:143)
[ 24.976507][ T561] release_task (kernel/exit.c:292)
[ 24.976510][ T561] wait_consider_task (kernel/exit.c:1276)
[ 24.976513][ T561] __do_wait (kernel/exit.c:1565 kernel/exit.c:1681)
[ 24.976515][ T561] ? do_wait (kernel/exit.c:1714)
[ 24.976517][ T561] do_wait (kernel/exit.c:1716)
[ 24.976519][ T561] kernel_wait4 (kernel/exit.c:1874)
[ 24.976522][ T561] ? get_task_struct (kernel/exit.c:1599)
[ 24.976524][ T561] __x64_sys_wait4 (kernel/exit.c:1902 kernel/exit.c:1898 kernel/exit.c:1898)
[ 24.976526][ T561] ? _copy_to_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:134 arch/x86/include/asm/uaccess_64.h:147 include/linux/uaccess.h:204 lib/usercopy.c:26)
[ 24.976530][ T561] ? __x64_sys_rt_sigaction (include/linux/uaccess.h:232 kernel/signal.c:4648 kernel/signal.c:4629 kernel/signal.c:4629)
[ 24.976535][ T561] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 24.976538][ T561] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 24.976539][ T561] ? _copy_from_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:141 include/linux/uaccess.h:185 lib/usercopy.c:18)
[ 24.976541][ T561] ? __x64_sys_rt_sigprocmask (kernel/signal.c:3340)
[ 24.976544][ T561] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 24.976546][ T561] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 24.976549][ T561] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 24.976553][ T561] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 24.976556][ T561] RIP: 0033:0x7f1031cb6c3e
[ 24.976560][ T561] Code: 00 f7 d8 64 89 02 48 89 f8 eb cc 90 48 83 ec 28 8b 05 aa e5 2f 00 85 c0 75 1d 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 48 83 c4 28 c3 89 54 24 08 48 89 74 24 10
All code
========
0: 00 f7 add %dh,%bh
2: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4)
6: 48 89 f8 mov %rdi,%rax
9: eb cc jmp 0xffffffffffffffd7
b: 90 nop
c: 48 83 ec 28 sub $0x28,%rsp
10: 8b 05 aa e5 2f 00 mov 0x2fe5aa(%rip),%eax # 0x2fe5c0
16: 85 c0 test %eax,%eax
18: 75 1d jne 0x37
1a: 45 31 d2 xor %r10d,%r10d
1d: 48 63 d2 movslq %edx,%rdx
20: 48 63 ff movslq %edi,%rdi
23: b8 3d 00 00 00 mov $0x3d,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 51 ja 0x83
32: 48 83 c4 28 add $0x28,%rsp
36: c3 ret
37: 89 54 24 08 mov %edx,0x8(%rsp)
3b: 48 89 74 24 10 mov %rsi,0x10(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 51 ja 0x59
8: 48 83 c4 28 add $0x28,%rsp
c: c3 ret
d: 89 54 24 08 mov %edx,0x8(%rsp)
11: 48 89 74 24 10 mov %rsi,0x10(%rsp)
[ 24.976562][ T561] RSP: 002b:00007fff879dfb10 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
[ 24.976564][ T561] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1031cb6c3e
[ 24.976566][ T561] RDX: 0000000000000000 RSI: 00007fff879dfb78 RDI: ffffffffffffffff
[ 24.976567][ T561] RBP: 000000001dc65f00 R08: 000000001dc65f48 R09: 0000000000000000
[ 24.976568][ T561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 24.976570][ T561] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000ffffffff
[ 24.976572][ T561] </TASK>
[ 26.014722][ T539] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 26.015763][ T539] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 539, name: post-run
[ 26.016818][ T539] preempt_count: 1, expected: 0
[ 26.017515][ T539] RCU nest depth: 0, expected: 0
[ 26.018261][ T539] CPU: 0 UID: 0 PID: 539 Comm: post-run Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 26.018266][ T539] Tainted: [W]=WARN
[ 26.018266][ T539] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 26.018268][ T539] Call Trace:
[ 26.018271][ T539] <TASK>
[ 26.018274][ T539] dump_stack_lvl (lib/dump_stack.c:123)
[ 26.018284][ T539] __might_resched (kernel/sched/core.c:8838)
[ 26.018289][ T539] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 26.018293][ T539] __dentry_kill (fs/dcache.c:?)
[ 26.018296][ T539] dput (fs/dcache.c:912)
[ 26.018299][ T539] __fput (fs/file_table.c:477)
[ 26.018302][ T539] __x64_sys_close (fs/open.c:1591)
[ 26.018305][ T539] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 26.018309][ T539] ? mutex_lock (arch/x86/include/asm/current.h:25 kernel/locking/mutex.c:152 kernel/locking/mutex.c:273)
[ 26.018311][ T539] ? anon_pipe_read (fs/pipe.c:404)
[ 26.018313][ T539] ? arch_exit_to_user_mode_prepare (arch/x86/include/asm/entry-common.h:?)
[ 26.018317][ T539] ? vfs_read (fs/read_write.c:492)
[ 26.018319][ T539] ? __x64_sys_read (fs/read_write.c:?)
[ 26.018321][ T539] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 26.018323][ T539] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 26.018324][ T539] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 26.018328][ T539] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 26.018332][ T539] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 26.018334][ T539] RIP: 0033:0x7f1031cde040
[ 26.018338][ T539] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 26.018340][ T539] RSP: 002b:00007fff879e0888 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 26.018343][ T539] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f1031cde040
[ 26.018345][ T539] RDX: 0000000000000001 RSI: 0000000000000002 RDI: 0000000000000003
[ 26.018346][ T539] RBP: 0000000000000000 R08: 000000000000000a R09: 0000000000000000
[ 26.018347][ T539] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff879e08e4
[ 26.018348][ T539] R13: 0000000000000080 R14: 000000000000000a R15: 000000001dc65a08
[ 26.018350][ T539] </TASK>
[ 27.079314][ T577] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 27.080408][ T577] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 577, name: grep
[ 27.081456][ T577] preempt_count: 1, expected: 0
[ 27.082233][ T577] RCU nest depth: 0, expected: 0
[ 27.082945][ T577] CPU: 0 UID: 0 PID: 577 Comm: grep Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 27.082949][ T577] Tainted: [W]=WARN
[ 27.082950][ T577] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 27.082951][ T577] Call Trace:
[ 27.082954][ T577] <TASK>
[ 27.082957][ T577] dump_stack_lvl (lib/dump_stack.c:123)
[ 27.082966][ T577] __might_resched (kernel/sched/core.c:8838)
[ 27.082972][ T577] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 27.082979][ T577] __dentry_kill (fs/dcache.c:?)
[ 27.082983][ T577] dput (fs/dcache.c:912)
[ 27.082986][ T577] __fput (fs/file_table.c:477)
[ 27.082989][ T577] task_work_run (kernel/task_work.c:235)
[ 27.082994][ T577] do_exit (kernel/exit.c:971)
[ 27.082997][ T577] do_group_exit (kernel/exit.c:1111)
[ 27.083000][ T577] __x64_sys_exit_group (kernel/exit.c:1122)
[ 27.083001][ T577] x64_sys_call (??:?)
[ 27.083004][ T577] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 27.083008][ T577] ? __x64_sys_close (fs/open.c:1591)
[ 27.083010][ T577] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 27.083011][ T577] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 27.083015][ T577] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 27.083018][ T577] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 27.083021][ T577] RIP: 0033:0x7f5f03de3408
[ 27.083024][ T577] Code: Unable to access opcode bytes at 0x7f5f03de33de.
Code starting with the faulting instruction
===========================================
[ 27.083025][ T577] RSP: 002b:00007ffd05f705b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 27.083028][ T577] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5f03de3408
[ 27.083029][ T577] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 27.083031][ T577] RBP: 00007f5f040d7820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 27.083032][ T577] R10: 00007f5f040ddb80 R11: 0000000000000246 R12: 00007f5f040d7820
[ 27.083033][ T577] R13: 0000000000000001 R14: 000000002f100438 R15: 000000000000000a
[ 27.083036][ T577] </TASK>
[ 28.126767][ T582] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 28.127828][ T582] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 582, name: grep
[ 28.128876][ T582] preempt_count: 1, expected: 0
[ 28.129633][ T582] RCU nest depth: 0, expected: 0
[ 28.130368][ T582] CPU: 1 UID: 0 PID: 582 Comm: grep Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 28.130373][ T582] Tainted: [W]=WARN
[ 28.130374][ T582] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 28.130375][ T582] Call Trace:
[ 28.130379][ T582] <TASK>
[ 28.130381][ T582] dump_stack_lvl (lib/dump_stack.c:123)
[ 28.130391][ T582] __might_resched (kernel/sched/core.c:8838)
[ 28.130396][ T582] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 28.130400][ T582] __dentry_kill (fs/dcache.c:?)
[ 28.130404][ T582] dput (fs/dcache.c:912)
[ 28.130407][ T582] __fput (fs/file_table.c:477)
[ 28.130410][ T582] task_work_run (kernel/task_work.c:235)
[ 28.130414][ T582] do_exit (kernel/exit.c:971)
[ 28.130418][ T582] ? get_page_from_freelist (mm/page_alloc.c:?)
[ 28.130421][ T582] do_group_exit (kernel/exit.c:1111)
[ 28.130423][ T582] __x64_sys_exit_group (kernel/exit.c:1122)
[ 28.130425][ T582] x64_sys_call (??:?)
[ 28.130428][ T582] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 28.130431][ T582] ? __x64_sys_close (fs/open.c:1591)
[ 28.130433][ T582] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 28.130435][ T582] ? __x64_sys_close (fs/open.c:1591)
[ 28.130436][ T582] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 28.130438][ T582] ? alloc_pages_mpol (mm/mempolicy.c:2481)
[ 28.130443][ T582] ? update_curr (kernel/sched/fair.c:1224)
[ 28.130445][ T582] ? place_entity (kernel/sched/fair.c:?)
[ 28.130447][ T582] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91)
[ 28.130450][ T582] ? __smp_call_single_queue (kernel/smp.c:117)
[ 28.130454][ T582] ? native_smp_send_reschedule (arch/x86/kernel/apic/ipi.c:78)
[ 28.130457][ T582] ? ttwu_queue_wakelist (kernel/sched/core.c:? kernel/sched/core.c:3880)
[ 28.130459][ T582] ? try_to_wake_up (kernel/sched/core.c:4224)
[ 28.130460][ T582] ? tick_setup_sched_timer (kernel/time/tick-sched.c:307)
[ 28.130464][ T582] ? swake_up_one (include/linux/list.h:226 include/linux/list.h:295 kernel/sched/swait.c:31 kernel/sched/swait.c:53)
[ 28.130467][ T582] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91)
[ 28.130469][ T582] ? sched_clock (arch/x86/include/asm/preempt.h:95 arch/x86/kernel/tsc.c:289)
[ 28.130477][ T582] ? sched_clock_cpu (kernel/sched/clock.c:397)
[ 28.130478][ T582] ? irqtime_account_irq (kernel/sched/cputime.c:67)
[ 28.130481][ T582] ? handle_softirqs (arch/x86/include/asm/preempt.h:27 kernel/softirq.c:407 kernel/softirq.c:468 kernel/softirq.c:654)
[ 28.130483][ T582] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 28.130486][ T582] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 28.130488][ T582] RIP: 0033:0x7fe98a926408
[ 28.130491][ T582] Code: Unable to access opcode bytes at 0x7fe98a9263de.
Code starting with the faulting instruction
===========================================
[ 28.130493][ T582] RSP: 002b:00007ffc82246da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 28.130496][ T582] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe98a926408
[ 28.130497][ T582] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 28.130498][ T582] RBP: 00007fe98ac1a820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 28.130499][ T582] R10: 00007fe98ac20b80 R11: 0000000000000246 R12: 00007fe98ac1a820
[ 28.130501][ T582] R13: 0000000000000001 R14: 0000000012c71014 R15: 000000000000000a
[ 28.130503][ T582] </TASK>
[ 28.839638][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&loadavg=0.78%200.19%200.06%201/108%20594&start_time=1762799196&end_time=1762799197&version=/lkp/lkp/.src-20251109-171750:1aad5493ad31-dirty:35b842bfeaee-dirty& -O /dev/null
[ 28.839648][ T107]
[ 29.442824][ T614] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 29.443836][ T614] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 614, name: wget
[ 29.444824][ T614] preempt_count: 1, expected: 0
[ 29.445535][ T614] RCU nest depth: 0, expected: 0
[ 29.446242][ T614] CPU: 1 UID: 0 PID: 614 Comm: wget Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 29.446246][ T614] Tainted: [W]=WARN
[ 29.446247][ T614] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 29.446249][ T614] Call Trace:
[ 29.446252][ T614] <TASK>
[ 29.446255][ T614] dump_stack_lvl (lib/dump_stack.c:123)
[ 29.446265][ T614] __might_resched (kernel/sched/core.c:8838)
[ 29.446270][ T614] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 29.446274][ T614] __dentry_kill (fs/dcache.c:?)
[ 29.446278][ T614] dput (fs/dcache.c:912)
[ 29.446280][ T614] __fput (fs/file_table.c:477)
[ 29.446283][ T614] task_work_run (kernel/task_work.c:235)
[ 29.446287][ T614] do_exit (kernel/exit.c:971)
[ 29.446290][ T614] ? __lruvec_stat_mod_folio (include/linux/rcupdate.h:899 mm/memcontrol.c:798)
[ 29.446292][ T614] do_group_exit (kernel/exit.c:1111)
[ 29.446294][ T614] __x64_sys_exit_group (kernel/exit.c:1122)
[ 29.446296][ T614] x64_sys_call (??:?)
[ 29.446298][ T614] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 29.446300][ T614] ? filemap_map_pages (mm/filemap.c:3935)
[ 29.446307][ T614] ? count_memcg_events (mm/memcontrol.c:? mm/memcontrol.c:847)
[ 29.446308][ T614] ? handle_mm_fault (mm/memory.c:6423)
[ 29.446317][ T614] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 29.446321][ T614] ? __x64_sys_close (fs/open.c:1591)
[ 29.446323][ T614] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 29.446326][ T614] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 29.446329][ T614] RIP: 0033:0x7f69b74d2408
[ 29.446331][ T614] Code: Unable to access opcode bytes at 0x7f69b74d23de.
Code starting with the faulting instruction
===========================================
[ 29.446332][ T614] RSP: 002b:00007ffcd55f1d78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 29.446335][ T614] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f69b74d2408
[ 29.446337][ T614] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 29.446338][ T614] RBP: 00007f69b77c6820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 29.446339][ T614] R10: 00007f69b77cdfa8 R11: 0000000000000246 R12: 00007f69b77c6820
[ 29.446340][ T614] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
[ 29.446343][ T614] </TASK>
[ 29.519252][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=finished -O /dev/null
[ 29.519260][ T107]
[ 29.555346][ T109] 2025-11-10 18:26:44 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&loadavg=0.78%200.19%200.06%201/108%20594&start_time=1762799196&end_time=1762799197&version=/lkp/lkp/.src-20251109-171750:1aad5493ad31-dirty:35b842bfeaee-dirty& [0/0] -> "/dev/null" [1]
[ 29.555355][ T109]
[ 30.276210][ T109] 2025-11-10 18:26:45 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=finished [0/0] -> "/dev/null" [1]
LKP: ttyS0: 86: LKP: rebooting forcely
[ 30.276218][ T109]
[ 30.285962][ T107] LKP: stdout: 86: LKP: rebooting forcely
[ 30.285968][ T107]
[ 30.324585][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-wtmp?tbox_name=vm-snb&tbox_state=rebooting&job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml -O /dev/null
[ 30.324593][ T107]
[ 31.152096][ T641] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 31.153357][ T641] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 641, name: wget
[ 31.154471][ T641] preempt_count: 1, expected: 0
[ 31.155280][ T641] RCU nest depth: 0, expected: 0
[ 31.156362][ T641] CPU: 1 UID: 0 PID: 641 Comm: wget Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 31.156367][ T641] Tainted: [W]=WARN
[ 31.156367][ T641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 31.156369][ T641] Call Trace:
[ 31.156392][ T641] <TASK>
[ 31.156395][ T641] dump_stack_lvl (lib/dump_stack.c:123)
[ 31.156408][ T641] __might_resched (kernel/sched/core.c:8838)
[ 31.156415][ T641] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 31.156420][ T641] __dentry_kill (fs/dcache.c:?)
[ 31.156423][ T641] dput (fs/dcache.c:912)
[ 31.156429][ T641] __fput (fs/file_table.c:477)
[ 31.156432][ T641] task_work_run (kernel/task_work.c:235)
[ 31.156436][ T641] do_exit (kernel/exit.c:971)
[ 31.156440][ T641] do_group_exit (kernel/exit.c:1111)
[ 31.156442][ T641] __x64_sys_exit_group (kernel/exit.c:1122)
[ 31.156444][ T641] x64_sys_call (??:?)
[ 31.156447][ T641] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 31.156451][ T641] ? count_memcg_events (mm/memcontrol.c:? mm/memcontrol.c:847)
[ 31.156453][ T641] ? handle_mm_fault (mm/memory.c:6423)
[ 31.156458][ T641] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 31.156462][ T641] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 31.156463][ T641] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 31.156466][ T641] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 31.156468][ T641] RIP: 0033:0x7f07d32bf408
[ 31.156471][ T641] Code: Unable to access opcode bytes at 0x7f07d32bf3de.
Code starting with the faulting instruction
===========================================
[ 31.156472][ T641] RSP: 002b:00007ffc164c7eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 31.156475][ T641] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f07d32bf408
[ 31.156477][ T641] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 31.156478][ T641] RBP: 00007f07d35b3820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 31.156479][ T641] R10: 00007f07d35bafa8 R11: 0000000000000246 R12: 00007f07d35b3820
[ 31.156480][ T641] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
[ 31.156482][ T641] </TASK>
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20251112/202511121304.5e522f7b-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [BUG] landlock: sleeping function called from invalid context in hook_sb_delete()
From: 许佳凯 @ 2025-11-12 2:35 UTC (permalink / raw)
To: linux-kernel; +Cc: linux-security-module, Günther Noack, Serge E. Hallyn
Hello,
This issue occurs when unmounting a tmpfs filesystem that has previously been added to a Landlock path-beneath rule.
During this operation, the kernel reports a “sleeping function called from invalid context” bug in hook_sb_delete() (security/landlock/fs.c).
This bug was initially discovered on the Linux riscv branch via a fuzzing framework.
It was later confirmed reproducible on Linux mainline v6.18-rc5 (x86).
The tested kernel source, configuration, and related materials are provided below:
Kernel source: https://git.kernel.org/torvalds/t/linux-6.18-rc5.tar.gz
Config file: https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/.config
Reproducer source: https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/repro.cprog
GCC compiler info: https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/gcc.info
Kernel log (dmesg): https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/dmesg.info
Additional riscv fuzzing context (report0, etc.): https://github.com/j1akai/KConfigFuzz_bug/tree/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b
The call trace indicates that hook_sb_delete() holds s_inode_list_lock (a spinlock) while invoking operations that may eventually call iput(), which can sleep.
This violates the locking context expectations and triggers __might_sleep() warnings.
The issue seems to be related to how Landlock handles superblock cleanup during security_sb_delete().
I’m currently only reporting this issue to the community; the exact fix will likely need to be confirmed and implemented by the Landlock and filesystem maintainers.
^ permalink raw reply
* 少子化は追い風。次世代の教育ビジネス
From: 教育フランチャイズセミナー事務局 @ 2025-11-12 2:04 UTC (permalink / raw)
To: linux-security-module
いつもお世話になります。
少子化が進む中で、多くの企業が 「教育市場は縮小する」 と考えています。
しかし実際には、一人あたりの教育支出は年々微増しており、
教育業界はむしろ堅調に成長を続けています。
今回は、地域貢献と収益性を両立できる
次世代型の教育事業をテーマに、
新規事業での収益づくりをお考えの法人様向けに
オンライン説明会を開催いたします。
11月18日（火）16：00〜17：00 オンライン開催
----------------------------------------------------------
◆フランチャイズ事業 WEB説明会◆
“プログラミング教育×個別指導”
不況に強く、少子化でも成長する
ハイブリッド型の教育事業
▼ 視聴予約 ▼
https://wam-edu-fc.jp/wam2/
◆ ご案内事業 ◆
個別指導 WAM
◇ 提供 ◇
エイチ・エム・グループ
----------------------------------------------------------
『少子化なのに、教育事業？』と思うかもしれませんが、
実は子ども一人にかける教育費の増加に伴い、市場は成長し続けています。
また、教育費は不況時でも削減されにくいため
コロナ下でも大きく落ち込むことなく底堅さを見せました。
幼児教育無償化などの国策もあり、今後も教育投資の増加が予想されます。
そこでご紹介するのが、「プログラミング×個別指導」の
ハイブリッド教育事業です。
プログラミングは小学校で必修化されたため、保護者の関心も高まっています。
本事業のスタートは業界未経験・社員１名で可能です。
新たな事業収益づくりをお考えの方は、是非ご参加ください。
11月18日（火）16：00〜17：00 オンライン開催
▼ 視聴予約はこちら
https://wam-edu-fc.jp/wam2/
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
教育事業FCセミナー事務局
電話：0120-891-893
住所：東京都中央区銀座7-13-6
―――――――――――――――――――――――――――――――
本メールのご不要な方には大変ご迷惑をおかけいたしました。
今後ご案内が不要な方は下記URLよりお手続きをお願いいたします。
┗ https://wam-edu-fc.jp/mail/
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
^ permalink raw reply
* Re: [PATCH] security: sctp: Format type and permission checks tables
From: Paul Moore @ 2025-11-12 0:50 UTC (permalink / raw)
To: Bagas Sanjaya
Cc: Linux Kernel Mailing List, Linux Documentation,
Linux Security Module, Jonathan Corbet, Jarkko Sakkinen,
Christian Brauner, Jeff Layton, Kees Cook,
Mickaël Salaün, Stuart Yoder, Randy Dunlap
In-Reply-To: <aRKgyvrTxldlTv9t@archie.me>
On Mon, Nov 10, 2025 at 9:35 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
>
> On Mon, Nov 03, 2025 at 06:39:23PM +0700, Bagas Sanjaya wrote:
> > Use reST grid tables for both type and permission checks tables.
>
> review ping
You don't need to 'ping' for a review, your patch is in my review
queue, but code changes take priority at this point in the dev cycle
as I'm okay with merging documentation changes fairly late.
--
paul-moore.com
^ permalink raw reply
* Re: [PATCH v2] device_cgroup: Refactor devcgroup_seq_show to use seq_put* helpers
From: Paul Moore @ 2025-11-12 0:47 UTC (permalink / raw)
To: Thorsten Blum, David Laight, James Morris, Serge E. Hallyn
Cc: Thorsten Blum, linux-security-module, linux-kernel
In-Reply-To: <20251031213915.211046-1-thorsten.blum@linux.dev>
On Oct 31, 2025 Thorsten Blum <thorsten.blum@linux.dev> wrote:
>
> Replace set_access(), set_majmin(), and type_to_char() with new helpers
> seq_putaccess(), seq_puttype(), and seq_putversion() that write directly
> to 'seq_file'.
>
> Simplify devcgroup_seq_show() by hard-coding "a *:* rwm", and use the
> new seq_put* helper functions to list the exceptions otherwise.
>
> This allows us to remove the intermediate string buffers while
> maintaining the same functionality, including wildcard handling.
>
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> Acked-by: Serge Hallyn <serge@hallyn.com>
> ---
> Changes in v2:
> - Add setq_put* helpers to modify seq_file directly (David)
> - Update patch subject and description
> - Link to v1: https://lore.kernel.org/lkml/20251031110647.102728-2-thorsten.blum@linux.dev/
> ---
> security/device_cgroup.c | 56 ++++++++++++++++++----------------------
> 1 file changed, 25 insertions(+), 31 deletions(-)
Looks good to me, merged into lsm/dev, thanks!
--
paul-moore.com
^ permalink raw reply
* [PATCH] nsproxy: fix free_nsproxy() and simplify create_new_namespaces()
From: Christian Brauner @ 2025-11-11 21:29 UTC (permalink / raw)
To: syzbot
Cc: Christian Brauner, akpm, bpf, bsegall, david, dietmar.eggemann,
jack, jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid, syzbot+0a8655a80e189278487e
In-Reply-To: <691360cc.a70a0220.22f260.013e.GAE@google.com>
Make it possible to handle NULL being passed to the reference count
helpers instead of forcing the caller to handle this. Afterwards we can
nicely allow a cleanup guard to handle nsproxy freeing.
Active reference count handling is not done in nsproxy_free() but rather
in free_nsproxy() as nsproxy_free() is also called from setns() failure
paths where a new nsproxy has been prepared but has not been marked as
active via switch_task_namespaces().
Fixes: 3c9820d5c64a ("ns: add active reference count")
Reported-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com
Reported-by: syzbot+0a8655a80e189278487e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/690bfb9e.050a0220.2e3c35.0013.GAE@google.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
---
include/linux/ns_common.h | 11 ++--
kernel/nsproxy.c | 107 +++++++++++++++-----------------------
2 files changed, 48 insertions(+), 70 deletions(-)
diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index 136f6a322e53..825f5865bfc5 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -114,11 +114,14 @@ static __always_inline __must_check bool __ns_ref_dec_and_lock(struct ns_common
}
#define ns_ref_read(__ns) __ns_ref_read(to_ns_common((__ns)))
-#define ns_ref_inc(__ns) __ns_ref_inc(to_ns_common((__ns)))
-#define ns_ref_get(__ns) __ns_ref_get(to_ns_common((__ns)))
-#define ns_ref_put(__ns) __ns_ref_put(to_ns_common((__ns)))
+#define ns_ref_inc(__ns) \
+ do { if (__ns) __ns_ref_inc(to_ns_common((__ns))); } while (0)
+#define ns_ref_get(__ns) \
+ ((__ns) ? __ns_ref_get(to_ns_common((__ns))) : false)
+#define ns_ref_put(__ns) \
+ ((__ns) ? __ns_ref_put(to_ns_common((__ns))) : false)
#define ns_ref_put_and_lock(__ns, __ns_lock) \
- __ns_ref_dec_and_lock(to_ns_common((__ns)), __ns_lock)
+ ((__ns) ? __ns_ref_dec_and_lock(to_ns_common((__ns)), __ns_lock) : false)
#define ns_ref_active_read(__ns) \
((__ns) ? __ns_ref_active_read(to_ns_common(__ns)) : 0)
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 94c2cfe0afa1..2c94452dc793 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -60,6 +60,27 @@ static inline struct nsproxy *create_nsproxy(void)
return nsproxy;
}
+static inline void nsproxy_free(struct nsproxy *ns)
+{
+ put_mnt_ns(ns->mnt_ns);
+ put_uts_ns(ns->uts_ns);
+ put_ipc_ns(ns->ipc_ns);
+ put_pid_ns(ns->pid_ns_for_children);
+ put_time_ns(ns->time_ns);
+ put_time_ns(ns->time_ns_for_children);
+ put_cgroup_ns(ns->cgroup_ns);
+ put_net(ns->net_ns);
+ kmem_cache_free(nsproxy_cachep, ns);
+}
+
+DEFINE_FREE(nsproxy_free, struct nsproxy *, if (_T) nsproxy_free(_T))
+
+void free_nsproxy(struct nsproxy *ns)
+{
+ nsproxy_ns_active_put(ns);
+ nsproxy_free(ns);
+}
+
/*
* Create new nsproxy and all of its the associated namespaces.
* Return the newly created nsproxy. Do not attach this to the task,
@@ -69,76 +90,45 @@ static struct nsproxy *create_new_namespaces(u64 flags,
struct task_struct *tsk, struct user_namespace *user_ns,
struct fs_struct *new_fs)
{
- struct nsproxy *new_nsp;
- int err;
+ struct nsproxy *new_nsp __free(nsproxy_free) = NULL;
new_nsp = create_nsproxy();
if (!new_nsp)
return ERR_PTR(-ENOMEM);
new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs);
- if (IS_ERR(new_nsp->mnt_ns)) {
- err = PTR_ERR(new_nsp->mnt_ns);
- goto out_ns;
- }
+ if (IS_ERR(new_nsp->mnt_ns))
+ return ERR_CAST(new_nsp->mnt_ns);
new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns);
- if (IS_ERR(new_nsp->uts_ns)) {
- err = PTR_ERR(new_nsp->uts_ns);
- goto out_uts;
- }
+ if (IS_ERR(new_nsp->uts_ns))
+ return ERR_CAST(new_nsp->uts_ns);
new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns);
- if (IS_ERR(new_nsp->ipc_ns)) {
- err = PTR_ERR(new_nsp->ipc_ns);
- goto out_ipc;
- }
+ if (IS_ERR(new_nsp->ipc_ns))
+ return ERR_CAST(new_nsp->ipc_ns);
- new_nsp->pid_ns_for_children =
- copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
- if (IS_ERR(new_nsp->pid_ns_for_children)) {
- err = PTR_ERR(new_nsp->pid_ns_for_children);
- goto out_pid;
- }
+ new_nsp->pid_ns_for_children = copy_pid_ns(flags, user_ns,
+ tsk->nsproxy->pid_ns_for_children);
+ if (IS_ERR(new_nsp->pid_ns_for_children))
+ return ERR_CAST(new_nsp->pid_ns_for_children);
new_nsp->cgroup_ns = copy_cgroup_ns(flags, user_ns,
tsk->nsproxy->cgroup_ns);
- if (IS_ERR(new_nsp->cgroup_ns)) {
- err = PTR_ERR(new_nsp->cgroup_ns);
- goto out_cgroup;
- }
+ if (IS_ERR(new_nsp->cgroup_ns))
+ return ERR_CAST(new_nsp->cgroup_ns);
new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns);
- if (IS_ERR(new_nsp->net_ns)) {
- err = PTR_ERR(new_nsp->net_ns);
- goto out_net;
- }
+ if (IS_ERR(new_nsp->net_ns))
+ return ERR_CAST(new_nsp->net_ns);
new_nsp->time_ns_for_children = copy_time_ns(flags, user_ns,
- tsk->nsproxy->time_ns_for_children);
- if (IS_ERR(new_nsp->time_ns_for_children)) {
- err = PTR_ERR(new_nsp->time_ns_for_children);
- goto out_time;
- }
+ tsk->nsproxy->time_ns_for_children);
+ if (IS_ERR(new_nsp->time_ns_for_children))
+ return ERR_CAST(new_nsp->time_ns_for_children);
new_nsp->time_ns = get_time_ns(tsk->nsproxy->time_ns);
- return new_nsp;
-
-out_time:
- put_net(new_nsp->net_ns);
-out_net:
- put_cgroup_ns(new_nsp->cgroup_ns);
-out_cgroup:
- put_pid_ns(new_nsp->pid_ns_for_children);
-out_pid:
- put_ipc_ns(new_nsp->ipc_ns);
-out_ipc:
- put_uts_ns(new_nsp->uts_ns);
-out_uts:
- put_mnt_ns(new_nsp->mnt_ns);
-out_ns:
- kmem_cache_free(nsproxy_cachep, new_nsp);
- return ERR_PTR(err);
+ return no_free_ptr(new_nsp);
}
/*
@@ -185,21 +175,6 @@ int copy_namespaces(u64 flags, struct task_struct *tsk)
return 0;
}
-void free_nsproxy(struct nsproxy *ns)
-{
- nsproxy_ns_active_put(ns);
-
- put_mnt_ns(ns->mnt_ns);
- put_uts_ns(ns->uts_ns);
- put_ipc_ns(ns->ipc_ns);
- put_pid_ns(ns->pid_ns_for_children);
- put_time_ns(ns->time_ns);
- put_time_ns(ns->time_ns_for_children);
- put_cgroup_ns(ns->cgroup_ns);
- put_net(ns->net_ns);
- kmem_cache_free(nsproxy_cachep, ns);
-}
-
/*
* Called from unshare. Unshare all the namespaces part of nsproxy.
* On success, returns the new nsproxy.
@@ -338,7 +313,7 @@ static void put_nsset(struct nsset *nsset)
if (nsset->fs && (flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS))
free_fs_struct(nsset->fs);
if (nsset->nsproxy)
- free_nsproxy(nsset->nsproxy);
+ nsproxy_free(nsset->nsproxy);
}
static int prepare_nsset(unsigned flags, struct nsset *nsset)
--
2.47.3
^ permalink raw reply related
* Re: Module signing and post-quantum crypto public key algorithms
From: David Howells @ 2025-11-11 18:38 UTC (permalink / raw)
To: Simo Sorce
Cc: dhowells, Elliott, Robert (Servers), James Bottomley,
Ignat Korchagin, Herbert Xu, Stephan Mueller,
torvalds@linux-foundation.org, Paul Moore, Lukas Wunner,
Clemens Lang, David Bohannon, Roberto Sassu,
keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <1ce413b202ca7c008e077a6f1cfa88f94a3a7cbd.camel@redhat.com>
Simo Sorce <simo@redhat.com> wrote:
> If a defect in a signing algorithm is found you can simply distribute a
> new kernel with modules resigned with a different algorithm.
Probably more "have to" than "can". The cert providing the composite key for
both would have to be invalidated to stop it from being used - and invalidated
by having it added to the UEFI dbx table.
David
^ permalink raw reply
* Re: Module signing and post-quantum crypto public key algorithms
From: Simo Sorce @ 2025-11-11 16:14 UTC (permalink / raw)
To: Elliott, Robert (Servers), David Howells
Cc: James Bottomley, Ignat Korchagin, Herbert Xu, Stephan Mueller,
torvalds@linux-foundation.org, Paul Moore, Lukas Wunner,
Clemens Lang, David Bohannon, Roberto Sassu,
keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <IA4PR84MB4011485C0EFFFF9F2820A1BFABC1A@IA4PR84MB4011.NAMPRD84.PROD.OUTLOOK.COM>
On Sun, 2025-11-09 at 19:30 +0000, Elliott, Robert (Servers) wrote:
> The composite motivation is to provide some protection if someone
> discovers a basic flaw in the PQC algorithm. If quantum computers
> haven't arrived yet to break the traditional algorithm, the
> composite still proves validity.
Given you quoted me wrt composite signatures, I'd like to make clear I
do *not* necessarily favor it.
Unlike regular software or firmware, kernel modules are generally tied
to a specific version of the kernel, therefore there is no real need
for long term resistance (unless you plan to never upgrade a kernel).
If a defect in a signing algorithm is found you can simply distribute a
new kernel with modules resigned with a different algorithm.
The problem of using composite algorithms are many:
- You need composite keys (or at least two keys, depending on the
implementation).
- You will pay a higher price in terms of CPU/time for verification for
each signature.
- You will pay a higher price in terms of disk/ram space to store
multiple signatures.
It is generally not worth paying this price when the remediation is
easy.
--
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: syzbot @ 2025-11-11 16:14 UTC (permalink / raw)
To: akpm, bpf, brauner, bsegall, david, dietmar.eggemann, jack,
jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid
In-Reply-To: <20251111-gaspipeline-getippt-9b19b62f89d2@brauner>
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com
Tested-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com
Tested on:
commit: d2bab7f2 nsproxy: fix free_nsproxy() and simplify crea..
git tree: https://github.com/brauner/linux.git namespace-6.19
console output: https://syzkaller.appspot.com/x/log.txt?x=123a8658580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59952e73920025e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0b2e79f91ff6579bfa5b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: Christian Brauner @ 2025-11-11 15:07 UTC (permalink / raw)
To: syzbot
Cc: akpm, bpf, bsegall, david, dietmar.eggemann, jack, jsavitz,
juri.lelli, kartikey406, kees, liam.howlett, linux-fsdevel,
linux-kernel, linux-mm, linux-security-module, lorenzo.stoakes,
mgorman, mhocko, mingo, mjguzik, oleg, paul, peterz, rostedt,
rppt, sergeh, surenb, syzkaller-bugs, vbabka, vincent.guittot,
viro, vschneid
In-Reply-To: <69133407.a70a0220.22f260.0138.GAE@google.com>
On Tue, Nov 11, 2025 at 05:03:03AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in __ns_ref_active_put
#syz test: https://github.com/brauner/linux.git namespace-6.19
Groan, forgot the actual important bit after the cleanup:
* Called from unshare. Unshare all the namespaces part of nsproxy.
* On success, returns the new nsproxy.
@@ -338,7 +313,7 @@ static void put_nsset(struct nsset *nsset)
if (nsset->fs && (flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS))
free_fs_struct(nsset->fs);
if (nsset->nsproxy)
- free_nsproxy(nsset->nsproxy);
+ nsproxy_free(nsset->nsproxy);
}
^ permalink raw reply
* Re: [RFC PATCH 2/3] exec: don't wait for zombie threads with cred_guard_mutex held
From: Oleg Nesterov @ 2025-11-11 14:09 UTC (permalink / raw)
To: Cyrill Gorcunov
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest, linux-mm, linux-security-module
In-Reply-To: <aRJd8Z-DrYrjRt4r@grain>
On 11/11, Cyrill Gorcunov wrote:
>
> Anyway while looking into patch I got wonder why
>
> +static int wait_for_notify_count(struct task_struct *tsk)
> +{
> + for (;;) {
> + return -EINTR;
> + set_current_state(TASK_KILLABLE);
> + if (!tsk->signal->notify_count)
> + break;
>
> We have no any barrier here in fetching @notify_count? I mean updating
> this value is done under locks (spin or read/write) in turn condition
> test is a raw one. Not a big deal since set_current_state() and schedule()
Yes, so I think that, correctness-wise, this doesn't need additional barriers.
> but I've
> been a bit confused that we don't use some read_once here or something.
Yes, this needs READ_ONCE() to avoid the warnings from KCSAN. And in fact
this code was written with READ_ONCE() but I removed it before sending this
RFC.
I was going to do this later. I always forget how KCSAN works, IIUC I also
need to add WRITE_ONCE() into exit_notify() and __exit_signal() to make
KCSAN happy, even if ->notify_count is always updated under the lock.
Same for the "if (me->signal->group_exec_task == me)" check in begin_new_exec().
Right now I would like to know if this RFC (approach) makes any sense,
especially because 3/3 adds a user-visible change.
Oleg.
^ permalink raw reply
* Re: [PATCH v17] exec: Fix dead-lock in de_thread with ptrace_attach
From: Bernd Edlinger @ 2025-11-11 13:45 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Christian Brauner, Alexander Viro, Alexey Dobriyan, Kees Cook,
Andy Lutomirski, Will Drewry, Andrew Morton, Michal Hocko,
Serge Hallyn, James Morris, Randy Dunlap, Suren Baghdasaryan,
Yafang Shao, Helge Deller, Eric W. Biederman, Adrian Reber,
Thomas Gleixner, Jens Axboe, Alexei Starovoitov,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest, linux-mm, linux-security-module, tiozhang,
Luis Chamberlain, Paulo Alcantara (SUSE), Sergey Senozhatsky,
Frederic Weisbecker, YueHaibing, Paul Moore, Aleksa Sarai,
Stefan Roesch, Chao Yu, xu xin, Jeff Layton, Jan Kara,
David Hildenbrand, Dave Chinner, Shuah Khan, Elena Reshetova,
David Windsor, Mateusz Guzik, Ard Biesheuvel,
Joel Fernandes (Google), Matthew Wilcox (Oracle),
Hans Liljestrand, Penglei Jiang, Lorenzo Stoakes, Adrian Ratiu,
Ingo Molnar, Peter Zijlstra (Intel), Cyrill Gorcunov,
Eric Dumazet
In-Reply-To: <aRM2POTDTxEzeF2F@redhat.com>
On 11/11/25 14:12, Oleg Nesterov wrote:
> On 11/11, Bernd Edlinger wrote:
>>
>> On 11/11/25 10:21, Christian Brauner wrote:
>>> On Wed, Nov 05, 2025 at 03:32:10PM +0100, Oleg Nesterov wrote:
>>>>
>>>> This is the most problematic change which I can't review...
>>>>
>>>> Firstly, it changes task->mm/real_cred for __ptrace_may_access() and this
>>>> looks dangerous to me.
>>>
>>> Yeah, that is not ok. This is effectively override_creds for real_cred
>>> and that is not a pattern I want to see us establish at all! Temporary
>>> credential overrides for the subjective credentials is already terrible
>>> but at least we have the explicit split between real_cred and cred
>>> expressely for that. So no, that's not an acceptable solution.
>>>
>>
>> Well when this is absolutely not acceptable then I would have to change
>> all security engines to be aware of the current and the new credentials.
>
> Hmm... even if we find another way to avoid the deadlock? Say, the patches
> I sent...
>
Maybe, but it looks almost too simple ;-)
164 sleep(2);
165 /* deadlock may happen here */
166 k = ptrace(PTRACE_ATTACH, thread2_tid, 0L, 0L);
what happens if you change the test expectation here, that the
ptrace may fail instead of succeed?
What signals does the debugger receive after that point?
Is the debugger notified that the debugged process continues,
has the same PID, and is no longer ptraced?
Thanks
Bernd.
> Oleg.
>
^ permalink raw reply
* Re: [PATCH v17] exec: Fix dead-lock in de_thread with ptrace_attach
From: Oleg Nesterov @ 2025-11-11 13:12 UTC (permalink / raw)
To: Bernd Edlinger
Cc: Christian Brauner, Alexander Viro, Alexey Dobriyan, Kees Cook,
Andy Lutomirski, Will Drewry, Andrew Morton, Michal Hocko,
Serge Hallyn, James Morris, Randy Dunlap, Suren Baghdasaryan,
Yafang Shao, Helge Deller, Eric W. Biederman, Adrian Reber,
Thomas Gleixner, Jens Axboe, Alexei Starovoitov,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest, linux-mm, linux-security-module, tiozhang,
Luis Chamberlain, Paulo Alcantara (SUSE), Sergey Senozhatsky,
Frederic Weisbecker, YueHaibing, Paul Moore, Aleksa Sarai,
Stefan Roesch, Chao Yu, xu xin, Jeff Layton, Jan Kara,
David Hildenbrand, Dave Chinner, Shuah Khan, Elena Reshetova,
David Windsor, Mateusz Guzik, Ard Biesheuvel,
Joel Fernandes (Google), Matthew Wilcox (Oracle),
Hans Liljestrand, Penglei Jiang, Lorenzo Stoakes, Adrian Ratiu,
Ingo Molnar, Peter Zijlstra (Intel), Cyrill Gorcunov,
Eric Dumazet
In-Reply-To: <GV2PPF74270EBEEDCF80CEE0F08891ED37BE4CFA@GV2PPF74270EBEE.EURP195.PROD.OUTLOOK.COM>
On 11/11, Bernd Edlinger wrote:
>
> On 11/11/25 10:21, Christian Brauner wrote:
> > On Wed, Nov 05, 2025 at 03:32:10PM +0100, Oleg Nesterov wrote:
> >>
> >> This is the most problematic change which I can't review...
> >>
> >> Firstly, it changes task->mm/real_cred for __ptrace_may_access() and this
> >> looks dangerous to me.
> >
> > Yeah, that is not ok. This is effectively override_creds for real_cred
> > and that is not a pattern I want to see us establish at all! Temporary
> > credential overrides for the subjective credentials is already terrible
> > but at least we have the explicit split between real_cred and cred
> > expressely for that. So no, that's not an acceptable solution.
> >
>
> Well when this is absolutely not acceptable then I would have to change
> all security engines to be aware of the current and the new credentials.
Hmm... even if we find another way to avoid the deadlock? Say, the patches
I sent...
Oleg.
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: syzbot @ 2025-11-11 13:03 UTC (permalink / raw)
To: akpm, bpf, brauner, bsegall, david, dietmar.eggemann, jack,
jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid
In-Reply-To: <20251111-covern-deklamieren-ee89b7b4e502@brauner>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in __ns_ref_active_put
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6581 at kernel/nscommon.c:171 __ns_ref_active_put+0x3d7/0x450 kernel/nscommon.c:171
Modules linked in:
CPU: 0 UID: 0 PID: 6581 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__ns_ref_active_put+0x3d7/0x450 kernel/nscommon.c:171
Code: 4d 8b 3e e9 1b fd ff ff e8 76 62 32 00 90 0f 0b 90 e9 29 fd ff ff e8 68 62 32 00 90 0f 0b 90 e9 59 fd ff ff e8 5a 62 32 00 90 <0f> 0b 90 e9 72 ff ff ff e8 4c 62 32 00 90 0f 0b 90 e9 64 ff ff ff
RSP: 0018:ffffc9000238fd68 EFLAGS: 00010293
RAX: ffffffff818e5946 RBX: 00000000ffffffff RCX: ffff8880302ebc80
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
RBP: ffffc9000238fe00 R08: ffff888078968c2b R09: 1ffff1100f12d185
R10: dffffc0000000000 R11: ffffed100f12d186 R12: dffffc0000000000
R13: 1ffff1100f12d184 R14: ffff888078968c20 R15: ffff888078968c28
FS: 00007efc0fd536c0(0000) GS:ffff888125cf3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33263fff CR3: 0000000030876000 CR4: 00000000003526f0
Call Trace:
<TASK>
nsproxy_ns_active_put+0x4a/0x200 fs/nsfs.c:701
free_nsproxy kernel/nsproxy.c:80 [inline]
put_nsset kernel/nsproxy.c:316 [inline]
__do_sys_setns kernel/nsproxy.c:-1 [inline]
__se_sys_setns+0x1349/0x1b60 kernel/nsproxy.c:534
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efc0ef90ef7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efc0fd52fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000134
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007efc0ef90ef7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c9
RBP: 00007efc0f011f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efc0f1e6038 R14: 00007efc0f1e5fa0 R15: 00007fff5692b648
</TASK>
Tested on:
commit: cc719c88 nsproxy: fix free_nsproxy() and simplify crea..
git tree: https://github.com/brauner/linux.git namespace-6.19
console output: https://syzkaller.appspot.com/x/log.txt?x=1613f17c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59952e73920025e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0b2e79f91ff6579bfa5b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
^ permalink raw reply
* Re: [PATCH 1/2] fs: add iput_not_last()
From: Mateusz Guzik @ 2025-11-11 11:53 UTC (permalink / raw)
To: Christian Brauner
Cc: mic, linux-security-module, linux-fsdevel, viro, eadavis, gnoack,
jack, jannh, max.kellermann, m, syzbot+12479ae15958fc3f54ec
In-Reply-To: <20251111-fluss-vokabel-7be060af7f11@brauner>
On Tue, Nov 11, 2025 at 12:46 PM Christian Brauner <brauner@kernel.org> wrote:
>
> On Wed, 05 Nov 2025 22:20:24 +0100, Mateusz Guzik wrote:
> >
>
>
> Applied to the vfs-6.19.inode branch of the vfs/vfs.git tree.
> Patches in the vfs-6.19.inode branch should appear in linux-next soon.
>
That might_sleep in iput is already in master slated for 6.18, so this
should land in vfs.fixes instead.
^ permalink raw reply
* Re: [PATCH 1/2] fs: add iput_not_last()
From: Christian Brauner @ 2025-11-11 11:46 UTC (permalink / raw)
To: mic, Mateusz Guzik
Cc: Christian Brauner, linux-security-module, linux-fsdevel, viro,
eadavis, gnoack, jack, jannh, max.kellermann, m,
syzbot+12479ae15958fc3f54ec
In-Reply-To: <20251105212025.807549-1-mjguzik@gmail.com>
On Wed, 05 Nov 2025 22:20:24 +0100, Mateusz Guzik wrote:
>
Applied to the vfs-6.19.inode branch of the vfs/vfs.git tree.
Patches in the vfs-6.19.inode branch should appear in linux-next soon.
Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.
It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.
Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs-6.19.inode
[1/2] fs: add iput_not_last()
https://git.kernel.org/vfs/vfs/c/a1cece5d8881
[2/2] landlock: fix splats from iput() after it started calling might_sleep()
https://git.kernel.org/vfs/vfs/c/9638e5c3b673
^ permalink raw reply
* Re: [Patch V1] ima: avoid duplicate policy rules insertions
From: Mimi Zohar @ 2025-11-11 11:40 UTC (permalink / raw)
To: Tahera Fahimi, roberto.sassu, dmitry.kasatkin, eric.snowberg,
paul, jmorris, serge, linux-integrity, linux-security-module,
linux-kernel, code
Cc: Lennart Poettering
In-Reply-To: <20251106181404.3429710-1-taherafahimi@linux.microsoft.com>
[Cc'ing Lennart Poettering]
On Thu, 2025-11-06 at 18:14 +0000, Tahera Fahimi wrote:
> Prevent redundant IMA policy rules by checking for duplicates before insertion. This ensures that
> rules are not re-added when userspace is restarted (using systemd-soft-reboot) without a full system
> reboot. ima_rule_exists() detects duplicates in both temporary and active rule lists.
>
> Signed-off-by: Tahera Fahimi <taherafahimi@linux.microsoft.com>
Sorry for the delay in responding ...
Before trying to fix the "problem", let's try to understand it first. At least
on my test system (-rc5), kexec is working as designed. On boot, systemd
replaces the existing builtin IMA policy with a custom IMA policy. The arch
specific policies are not affected, as they are persistent. On a soft reboot
(kexec), the IMA custom policy is re-loaded as expected.
To verify the above behavior, extend the IMA policy before the soft reboot.
Notice after the soft reboot that the original custom IMA policy is loaded and
not the extended IMA policy. Roberto, if there is a problem with this behavior,
we'll discuss it independently of this proposed patch.
The question is why are you seeing duplicate IMA policy rules? What is special
about your environment?
--
thanks,
Mimi
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: Christian Brauner @ 2025-11-11 11:38 UTC (permalink / raw)
To: syzbot
Cc: akpm, bpf, bsegall, david, dietmar.eggemann, jack, jsavitz,
juri.lelli, kartikey406, kees, liam.howlett, linux-fsdevel,
linux-kernel, linux-mm, linux-security-module, lorenzo.stoakes,
mgorman, mhocko, mingo, mjguzik, oleg, paul, peterz, rostedt,
rppt, sergeh, surenb, syzkaller-bugs, vbabka, vincent.guittot,
viro, vschneid
In-Reply-To: <20251111-dozent-losgefahren-0a3a086b293e@brauner>
On Tue, Nov 11, 2025 at 12:23:18PM +0100, Christian Brauner wrote:
> On Tue, Nov 11, 2025 at 03:02:03AM -0800, syzbot wrote:
> > Hello,
> >
> > syzbot tried to test the proposed patch but the build/boot failed:
>
> I think that's unrelated. Anyway, I managed to point this to the wrong
> branch. I'll send another test request in a bit.
#syz test: https://github.com/brauner/linux.git namespace-6.19
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: Christian Brauner @ 2025-11-11 11:23 UTC (permalink / raw)
To: syzbot
Cc: akpm, bpf, bsegall, david, dietmar.eggemann, jack, jsavitz,
juri.lelli, kartikey406, kees, liam.howlett, linux-fsdevel,
linux-kernel, linux-mm, linux-security-module, lorenzo.stoakes,
mgorman, mhocko, mingo, mjguzik, oleg, paul, peterz, rostedt,
rppt, sergeh, surenb, syzkaller-bugs, vbabka, vincent.guittot,
viro, vschneid
In-Reply-To: <691317ab.a70a0220.22f260.0135.GAE@google.com>
On Tue, Nov 11, 2025 at 03:02:03AM -0800, syzbot wrote:
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
I think that's unrelated. Anyway, I managed to point this to the wrong
branch. I'll send another test request in a bit.
^ permalink raw reply
* Re: [PATCH v17] exec: Fix dead-lock in de_thread with ptrace_attach
From: Bernd Edlinger @ 2025-11-11 11:07 UTC (permalink / raw)
To: Christian Brauner, Oleg Nesterov
Cc: Alexander Viro, Alexey Dobriyan, Kees Cook, Andy Lutomirski,
Will Drewry, Andrew Morton, Michal Hocko, Serge Hallyn,
James Morris, Randy Dunlap, Suren Baghdasaryan, Yafang Shao,
Helge Deller, Eric W. Biederman, Adrian Reber, Thomas Gleixner,
Jens Axboe, Alexei Starovoitov, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-kselftest, linux-mm,
linux-security-module, tiozhang, Luis Chamberlain,
Paulo Alcantara (SUSE), Sergey Senozhatsky, Frederic Weisbecker,
YueHaibing, Paul Moore, Aleksa Sarai, Stefan Roesch, Chao Yu,
xu xin, Jeff Layton, Jan Kara, David Hildenbrand, Dave Chinner,
Shuah Khan, Elena Reshetova, David Windsor, Mateusz Guzik,
Ard Biesheuvel, Joel Fernandes (Google), Matthew Wilcox (Oracle),
Hans Liljestrand, Penglei Jiang, Lorenzo Stoakes, Adrian Ratiu,
Ingo Molnar, Peter Zijlstra (Intel), Cyrill Gorcunov,
Eric Dumazet
In-Reply-To: <20251111-ankreiden-augen-eadcf9bbdfaa@brauner>
On 11/11/25 10:21, Christian Brauner wrote:
> On Wed, Nov 05, 2025 at 03:32:10PM +0100, Oleg Nesterov wrote:
>> I am still thinking about another approach, will write another email.
>> But let me take a closer look at your patch.
>>
>> First of all, can you split it? See below.
>>
>> On 08/21, Bernd Edlinger wrote:
>>>
>>> -static int de_thread(struct task_struct *tsk)
>>> +static int de_thread(struct task_struct *tsk, struct linux_binprm *bprm)
>>> {
>>> struct signal_struct *sig = tsk->signal;
>>> struct sighand_struct *oldsighand = tsk->sighand;
>>> spinlock_t *lock = &oldsighand->siglock;
>>> + struct task_struct *t;
>>> + bool unsafe_execve_in_progress = false;
>>>
>>> if (thread_group_empty(tsk))
>>> goto no_thread_group;
>>> @@ -932,6 +934,19 @@ static int de_thread(struct task_struct *tsk)
>>> if (!thread_group_leader(tsk))
>>> sig->notify_count--;
>>>
>>> + for_other_threads(tsk, t) {
>>> + if (unlikely(t->ptrace)
>>> + && (t != tsk->group_leader || !t->exit_state))
>>> + unsafe_execve_in_progress = true;
>>
>> you can add "break" into the "if ()" block...
>>
>> But this is minor. Why do we need "bool unsafe_execve_in_progress" ?
>> If this patch is correct, de_thread() can drop/reacquire cred_guard_mutex
>> unconditionally.
>>
>> If you really think it makes sense, please make another patch with the
>> changelog.
>>
>> I'd certainly prefer to avoid this boolean at least for the start. If nothing
>> else to catch the potential problems earlier.
>>
>>> + if (unlikely(unsafe_execve_in_progress)) {
>>> + spin_unlock_irq(lock);
>>> + sig->exec_bprm = bprm;
>>> + mutex_unlock(&sig->cred_guard_mutex);
>>> + spin_lock_irq(lock);
>>
>> I don't think spin_unlock_irq() + spin_lock_irq() makes any sense...
>>
>>> @@ -1114,13 +1139,31 @@ int begin_new_exec(struct linux_binprm * bprm)
>>> */
>>> trace_sched_prepare_exec(current, bprm);
>>>
>>> + /* If the binary is not readable then enforce mm->dumpable=0 */
>>> + would_dump(bprm, bprm->file);
>>> + if (bprm->have_execfd)
>>> + would_dump(bprm, bprm->executable);
>>> +
>>> + /*
>>> + * Figure out dumpability. Note that this checking only of current
>>> + * is wrong, but userspace depends on it. This should be testing
>>> + * bprm->secureexec instead.
>>> + */
>>> + if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||
>>> + is_dumpability_changed(current_cred(), bprm->cred) ||
>>> + !(uid_eq(current_euid(), current_uid()) &&
>>> + gid_eq(current_egid(), current_gid())))
>>> + set_dumpable(bprm->mm, suid_dumpable);
>>> + else
>>> + set_dumpable(bprm->mm, SUID_DUMP_USER);
>>> +
>>
>> OK, we need to do this before de_thread() drops cred_guard_mutex.
>> But imo this too should be done in a separate patch, the changelog should
>> explain this change.
>>
>>> @@ -1361,6 +1387,11 @@ static int prepare_bprm_creds(struct linux_binprm *bprm)
>>> if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex))
>>> return -ERESTARTNOINTR;
>>>
>>> + if (unlikely(current->signal->exec_bprm)) {
>>> + mutex_unlock(¤t->signal->cred_guard_mutex);
>>> + return -ERESTARTNOINTR;
>>> + }
>>
>> OK, if signal->exec_bprm != NULL, then current is already killed. But
>> proc_pid_attr_write() and ptrace_traceme() do the same. So how about
>> something like
>>
>> int lock_current_cgm(void)
>> {
>> if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex))
>> return -ERESTARTNOINTR;
>>
>> if (!current->signal->group_exec_task)
>> return 0;
>>
>> WARN_ON(!fatal_signal_pending(current));
>> mutex_unlock(¤t->signal->cred_guard_mutex);
>> return -ERESTARTNOINTR;
>> }
>>
>> ?
>>
>> Note that it checks ->group_exec_task, not ->exec_bprm. So this change can
>> come in a separate patch too, but I won't insist.
>>
>>> @@ -453,6 +454,28 @@ static int ptrace_attach(struct task_struct *task, long request,
>>> return retval;
>>> }
>>>
>>> + if (unlikely(task == task->signal->group_exec_task)) {
>>> + retval = down_write_killable(&task->signal->exec_update_lock);
>>> + if (retval)
>>> + return retval;
>>> +
>>> + scoped_guard (task_lock, task) {
>>> + struct linux_binprm *bprm = task->signal->exec_bprm;
>>> + const struct cred __rcu *old_cred = task->real_cred;
>>> + struct mm_struct *old_mm = task->mm;
>>> +
>>> + rcu_assign_pointer(task->real_cred, bprm->cred);
>>> + task->mm = bprm->mm;
>>> + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS);
>>> + rcu_assign_pointer(task->real_cred, old_cred);
>>> + task->mm = old_mm;
>>> + }
>>
>> This is the most problematic change which I can't review...
>>
>> Firstly, it changes task->mm/real_cred for __ptrace_may_access() and this
>> looks dangerous to me.
>
> Yeah, that is not ok. This is effectively override_creds for real_cred
> and that is not a pattern I want to see us establish at all! Temporary
> credential overrides for the subjective credentials is already terrible
> but at least we have the explicit split between real_cred and cred
> expressely for that. So no, that's not an acceptable solution.
>
Well when this is absolutely not acceptable then I would have to change
all security engines to be aware of the current and the new credentials.
That may be as well be possible but would be a rather big change.
Of course that was only meant as a big exception, and somehow safe
as long as it is protected under the right mutexes: cred_guard_mutex,
exec_update_lock and task_lock at least.
>>
>> Say, current_is_single_threaded() called by another CLONE_VM process can
>> miss group_exec_task and falsely return true. Probably not that bad, in
>> this case old_mm should go away soon, but still...
>>
>> And I don't know if this can fool the users of task_cred_xxx/__task_cred
>> somehow.
>>
>> Or. check_unsafe_exec() sets LSM_UNSAFE_PTRACE if ptrace. Is it safe to
>> ptrace the execing task after that? I have no idea what the security hooks
>> can do...
>>
>> Again, can't review this part.
>>
Never mind, your review was really helpful. At the very least it pointed
out some places where better comments are needed.
Thanks
Bernd.
>> Oleg.
>>
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: syzbot @ 2025-11-11 11:02 UTC (permalink / raw)
To: akpm, bpf, brauner, bsegall, david, dietmar.eggemann, jack,
jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid
In-Reply-To: <20251111-anbraten-suggerieren-da8ca707af2c@brauner>
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
Warning: Permanently added '10.128.1.29' (ED25519) to the list of known hosts.
2025/11/11 11:01:12 parsed 1 programs
[ 92.366829][ T894] cfg80211: failed to load regulatory.db
[ 94.101317][ T5831] cgroup: Unknown subsys name 'net'
[ 94.208868][ T5831] cgroup: Unknown subsys name 'cpuset'
[ 94.218695][ T5831] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 95.913996][ T5831] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 99.210494][ T5845] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 99.368014][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 99.376801][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 99.385991][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 99.394090][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 99.403295][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 99.760048][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.769465][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.812956][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.820978][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.094305][ T5880] chnl_net:caif_netlink_parms(): no params data found
[ 101.244059][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.252746][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.261818][ T5880] bridge_slave_0: entered allmulticast mode
[ 101.270392][ T5880] bridge_slave_0: entered promiscuous mode
[ 101.283473][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.291198][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.298667][ T5880] bridge_slave_1: entered allmulticast mode
[ 101.307108][ T5880] bridge_slave_1: entered promiscuous mode
[ 101.360560][ T5880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 101.373330][ T5880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 101.413565][ T5880] team0: Port device team_slave_0 added
[ 101.422832][ T5880] team0: Port device team_slave_1 added
[ 101.463069][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 101.470261][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.497282][ T5880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 101.511788][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 101.518889][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.545058][ T5880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 101.590841][ T5880] hsr_slave_0: entered promiscuous mode
[ 101.597434][ T5880] hsr_slave_1: entered promiscuous mode
[ 101.741572][ T5880] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 101.754163][ T5880] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 101.764799][ T5880] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 101.774770][ T5880] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 101.805511][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.812788][ T5880] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 101.820983][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.828371][ T5880] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 101.843110][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.851795][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.904027][ T5880] 8021q: adding VLAN 0 to HW filter on device bond0
[ 101.928006][ T5880] 8021q: adding VLAN 0 to HW filter on device team0
[ 101.942529][ T3448] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.950392][ T3448] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 101.964563][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.971799][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 102.152983][ T5880] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 102.197805][ T5880] veth0_vlan: entered promiscuous mode
[ 102.210102][ T5880] veth1_vlan: entered promiscuous mode
[ 102.244663][ T5880] veth0_macvtap: entered promiscuous mode
[ 102.254634][ T5880] veth1_macvtap: entered promiscuous mode
[ 102.273656][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 102.289496][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 102.304731][ T67] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.314238][ T67] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.324278][ T67] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.334159][ T67] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 102.469673][ T67] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.543054][ T67] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.622429][ T67] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.698368][ T67] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/11 11:01:26 executed programs: 0
[ 104.788606][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 104.799432][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 104.807512][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 104.816410][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 104.824560][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 104.982601][ T5940] chnl_net:caif_netlink_parms(): no params data found
[ 105.059249][ T5940] bridge0: port 1(bridge_slave_0) entered blocking state
[ 105.066542][ T5940] bridge0: port 1(bridge_slave_0) entered disabled state
[ 105.073685][ T5940] bridge_slave_0: entered allmulticast mode
[ 105.081124][ T5940] bridge_slave_0: entered promiscuous mode
[ 105.089124][ T5940] bridge0: port 2(bridge_slave_1) entered blocking state
[ 105.096583][ T5940] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.104018][ T5940] bridge_slave_1: entered allmulticast mode
[ 105.111771][ T5940] bridge_slave_1: entered promiscuous mode
[ 105.143334][ T5940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 105.155734][ T5940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 105.191407][ T5940] team0: Port device team_slave_0 added
[ 105.201031][ T5940] team0: Port device team_slave_1 added
[ 105.235802][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 105.242802][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 105.269608][ T5940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 105.296300][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 105.303516][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 105.331738][ T5940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 105.417552][ T5940] hsr_slave_0: entered promiscuous mode
[ 105.424204][ T5940] hsr_slave_1: entered promiscuous mode
[ 105.430828][ T5940] debugfs: 'hsr0' already exists in 'hsr'
[ 105.437317][ T5940] Cannot create hsr debugfs directory
[ 105.454873][ T67] bridge_slave_1: left allmulticast mode
[ 105.460813][ T67] bridge_slave_1: left promiscuous mode
[ 105.467853][ T67] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.479304][ T67] bridge_slave_0: left allmulticast mode
[ 105.485065][ T67] bridge_slave_0: left promiscuous mode
[ 105.491001][ T67] bridge0: port 1(bridge_slave_0) entered disabled state
[ 105.729562][ T67] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 105.741503][ T67] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 105.752583][ T67] bond0 (unregistering): Released all slaves
[ 105.835828][ T67] hsr_slave_0: left promiscuous mode
[ 105.842862][ T67] hsr_slave_1: left promiscuous mode
[ 105.849433][ T67] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 105.857469][ T67] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 105.865850][ T67] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 105.873344][ T67] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 105.890846][ T67] veth1_macvtap: left promiscuous mode
[ 105.897610][ T67] veth0_macvtap: left promiscuous mode
[ 105.903553][ T67] veth1_vlan: left promiscuous mode
[ 105.910171][ T67] veth0_vlan: left promiscuous mode
[ 106.222498][ T67] team0 (unregistering): Port device team_slave_1 removed
[ 106.255035][ T67] team0 (unregistering): Port device team_slave_0 removed
[ 106.849861][ T52] Bluetooth: hci0: command tx timeout
[ 107.366951][ T5940] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 107.390747][ T5940] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 107.409101][ T5940] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 107.429220][ T5940] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 107.687917][ T5940] 8021q: adding VLAN 0 to HW filter on device bond0
[ 107.729157][ T5940] 8021q: adding VLAN 0 to HW filter on device team0
[ 107.757652][ T1309] bridge0: port 1(bridge_slave_0) entered blocking state
[ 107.764863][ T1309] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 107.814393][ T1309] bridge0: port 2(bridge_slave_1) entered blocking state
[ 107.821819][ T1309] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 108.188295][ T5940] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 108.234481][ T5940] veth0_vlan: entered promiscuous mode
[ 108.246943][ T5940] veth1_vlan: entered promiscuous mode
[ 108.277479][ T5940] veth0_macvtap: entered promiscuous mode
[ 108.288108][ T5940] veth1_macvtap: entered promiscuous mode
[ 108.306578][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 108.321859][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 108.336901][ T1322] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 108.346834][ T1322] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 108.358941][ T1322] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 108.368475][ T1322] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 108.430497][ T1309] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.438794][ T1309] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.474331][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.484170][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3388558029=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 4e1406b4def
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/ccimHo7N.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: ae901e5e Merge patch series "ns: fixes for namespace i..
git tree: https://github.com/brauner/linux.git namespace-6.19.fixes
kernel config: https://syzkaller.appspot.com/x/.config?x=7b0bf36f88602817
dashboard link: https://syzkaller.appspot.com/bug?extid=0b2e79f91ff6579bfa5b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: Christian Brauner @ 2025-11-11 10:26 UTC (permalink / raw)
To: syzbot
Cc: akpm, bpf, bsegall, david, dietmar.eggemann, jack, jsavitz,
juri.lelli, kartikey406, kees, liam.howlett, linux-fsdevel,
linux-kernel, linux-mm, linux-security-module, lorenzo.stoakes,
mgorman, mhocko, mingo, mjguzik, oleg, paul, peterz, rostedt,
rppt, sergeh, surenb, syzkaller-bugs, vbabka, vincent.guittot,
viro, vschneid
In-Reply-To: <691305db.a70a0220.22f260.0130.GAE@google.com>
On Tue, Nov 11, 2025 at 01:46:03AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in __ns_ref_active_put
#syz test: https://github.com/brauner/linux.git namespace-6.19.fixes
^ permalink raw reply
* Re: [Patch V1] ima: avoid duplicate policy rules insertions
From: Roberto Sassu @ 2025-11-11 9:46 UTC (permalink / raw)
To: Tahera Fahimi, Anirudh Venkataramanan, zohar, roberto.sassu,
dmitry.kasatkin, eric.snowberg, paul, jmorris, serge,
linux-integrity, linux-security-module, linux-kernel, code
In-Reply-To: <14c61ba5-437f-496d-8356-5712ddb37d47@linux.microsoft.com>
On Mon, 2025-11-10 at 11:06 -0800, Tahera Fahimi wrote:
> On 11/6/2025 12:32 PM, Anirudh Venkataramanan wrote:
> > On 11/6/2025 10:14 AM, Tahera Fahimi wrote:
> > > Prevent redundant IMA policy rules by checking for duplicates before insertion. This ensures that
> > > rules are not re-added when userspace is restarted (using systemd-soft-reboot) without a full system
> > > reboot. ima_rule_exists() detects duplicates in both temporary and active rule lists.
> >
> > I have run into this too. Thanks for proposing a patch!
> >
> > FWIW - I am fairly new to the IMA subsystem, so feedback below is mostly structural, with some IMA specific comments.
> Hi Ahirudh, Thanks for your feedback.
> > >
> > > Signed-off-by: Tahera Fahimi <taherafahimi@linux.microsoft.com>
> > > ---
> > > security/integrity/ima/ima_policy.c | 157 +++++++++++++++++++++++++++-
> > > 1 file changed, 156 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> > > index 164d62832f8ec..3dd902101dbda 100644
> > > --- a/security/integrity/ima/ima_policy.c
> > > +++ b/security/integrity/ima/ima_policy.c
> > > @@ -1953,6 +1953,153 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
> > > return result;
> > > }
> > > +static bool template_has_field(const char *field_id, const struct ima_template_desc *template2)
> > > +{
> > > + int j;
> >
> > j is declared in the loop header below too, which is more correct because it keeps the scope of j to be within the loop. So I'd say get rid of the above declaration.
> The declaration of j is at the beginning to adhere proper kernel style and ancient compile support.
> > > +
> > > + for (int j = 0; j < template2->num_fields; j++)
> > > + if (strcmp(field_id, template2->fields[j]->field_id) == 0)
> > > + return true;
> > I believe the preferred kernel style is to use if (!strcmp(...)).
> >
> > > +
> > > + return false;
> > > +}
> > > +
> > > +static bool keyring_has_item(const char *item, const struct ima_rule_opt_list *keyrings)
> > > +{
> > > + int j;
> > > +
> > > + for (j = 0; j < keyrings->count; j++) {
> > > + if (strcmp(item, keyrings->items[j]) == 0)
> > > + return true;
> > > + }
> > > + return false;
> > > +}
> > > +
> > > +static bool labels_has_item(const char *item, const struct ima_rule_opt_list *labels)
> > > +{
> > > + int j;
> > > +
> > > + for (j = 0; j < labels->count; j++) {
> > > + if (strcmp(item, labels->items[j]) == 0)
> > > + return true;
> > > + }
> > > + return false;
> > > +}
> > > +
> > > +static bool ima_rules_equal(const struct ima_rule_entry *rule1, const struct ima_rule_entry *rule2)
> > > +{
> > > + int i;
> >
> > i is used further down in this function, and even in all those cases, the scope of i can be limited to the loop body where it's used.
> >
> > If you didn't know this already - you can use cppcheck to identify and reduce the scope of variables.
> >
> > > +
> > > + if (rule1->flags != rule2->flags)
> > > + return false;
> > > +
> > > + if (rule1->action != rule2->action)
> > > + return false;
> > > +
> > > + if (((rule1->flags & IMA_FUNC) && rule1->func != rule2->func) ||
> > > + ((rule1->flags & (IMA_MASK | IMA_INMASK)) && rule1->mask != rule2->mask) ||
> > > + ((rule1->flags & IMA_FSMAGIC) && rule1->fsmagic != rule2->fsmagic) ||
> > > + ((rule1->flags & IMA_FSUUID) && !uuid_equal(&rule1->fsuuid, &rule2->fsuuid)) ||
> > > + ((rule1->flags & IMA_UID) && !uid_eq(rule1->uid, rule2->uid)) ||
> > > + ((rule1->flags & IMA_GID) && !gid_eq(rule1->gid, rule2->gid)) ||
> > > + ((rule1->flags & IMA_FOWNER) && !uid_eq(rule1->fowner, rule2->fowner)) ||
> > > + ((rule1->flags & IMA_FGROUP) && !gid_eq(rule1->fgroup, rule2->fgroup)) ||
> > > + ((rule1->flags & IMA_FSNAME) && (strcmp(rule1->fsname, rule2->fsname) != 0)) ||
> > > + ((rule1->flags & IMA_PCR) && rule1->pcr != rule2->pcr) ||
> > > + ((rule1->flags & IMA_VALIDATE_ALGOS) &&
> > > + rule1->allowed_algos != rule2->allowed_algos) ||
> > > + ((rule1->flags & IMA_EUID) && !uid_eq(rule1->uid, rule2->uid)) ||
> > > + ((rule1->flags & IMA_EGID) && !gid_eq(rule1->gid, rule2->gid)))
> > > + return false;
> >
> > So the goal is to prevent the exact same policy rule from being added, not to update an existing rule, correct? IOW, you could end up with two very similar rules, because the new rule has one thing that's different compared to the existing rule?
>
> The purpose of this patch is to prohibit two exact same rule.
Why would an administrator attempt to load the same rule twice?
How likely is the case where one would like to combine multiple signed
IMA policies with common rules?
Unless there is a realistic use case, it would be better to patch user
space first.
Thanks
Roberto
> We can have other approaches like merging the new rule to the previously existing rule, ignore
> new rule if a similar rule exists. However, this approaches would add more complexity to the code
> and are not the purpose of this patch.
>
> > I feel that a little bit of commentary around what makes two rules the same would be useful.
> >
> > > +
> > > + if (!rule1->template && !rule2->template) {
> > > + ;
> > You're trying to do nothing and continue on. A goto statement would communicate intent better. There are other places below with the same noop structure.
> >
> > To be fair, I also don't completely understand what you're trying to achieve here, Regardless, this "do nothing inside a conditional" looks weird and I feel like there should be a way to structure your logic without resorting to this.
> >
> > > + } else if (!rule1->template || !rule2->template) {
> > > + return false;
> > > + } else if (rule1->template->num_fields != rule2->template->num_fields) {
> > > + return false;
> > > + } else if (rule1->template->num_fields != 0) {
> > > + for (i = 0; i < rule1->template->num_fields; i++) {
> > > + if (!template_has_field(rule1->template->fields[i]->field_id,
> > > + rule2->template))
> > > + return false;
> > > + }
> > > + }
> >
> > if + return will achieve the same end goals as else if + return, with lesser clutter. I have seen some static analyzers flag this pattern, but I can't remember which one at the moment.
> >
> > So something like this:
> >
> > if (!rule1->template && !rule2->template)
> > goto some_target;
> >
> > if (!rule1->template || !rule2->template)
> > return false;
> >
> > if (rule1->template->num_fields != rule2->template->num_fields)
> > return false;
> >
> > if (rule1->template->num_fields != 0) {
> > for (i = 0; i < rule1->template->num_fields; i++) {
> > if (!template_has_field(rule1->template->fields[i]->field_id,
> > rule2->template))
> > return false;
> > }
> > }> some_target:
> > ...
> > ...
> I don't think having two goto in the code will improve its readability.
>
> > > +
> > > + if (rule1->flags & IMA_KEYRINGS) {
> > > + if (!rule1->keyrings && !rule2->keyrings) {
> > > + ;
> >
> > Another if block no-op
> >
> > > + } else if (!rule1->keyrings || !rule2->keyrings) {
> > > + return false;
> > > + } else if (rule1->keyrings->count != rule2->keyrings->count) {
> > > + return false;
> > > + } else if (rule1->keyrings->count != 0) {
> >
> > if (rule1->keyrings->count)
> >
> > > + for (i = 0; i < rule1->keyrings->count; i++) {
> >
> > for (int i,
> >
> > > + if (!keyring_has_item(rule1->keyrings->items[i], rule2->keyrings))
> > > + return false;
> > > + }
> > > + }
> > > + }
> > > +
> > > + if (rule1->flags & IMA_LABEL) {
> > > + if (!rule1->label && !rule2->label) {
> > > + ;
> >
> > Another if block no-op
> >
> > > + } else if (!rule1->label || !rule2->label) {
> > > + return false;
> > > + } else if (rule1->label->count != rule2->label->count) {
> > > + return false;
> > > + } else if (rule1->label->count != 0) {
> > > + for (i = 0; i < rule1->label->count; i++) {
> > > + if (!labels_has_item(rule1->label->items[i], rule2->label))
> > > + return false;
> > > + }
> > > + }
> > > + }
> > > +
> > > + for (i = 0; i < MAX_LSM_RULES; i++) {
> >
> > for (int i,
> >
> > > + if (!rule1->lsm[i].rule && !rule2->lsm[i].rule)
> > > + continue;
> > > +
> > > + if (!rule1->lsm[i].rule || !rule2->lsm[i].rule)
> > > + return false;
> > > +
> > > + if (strcmp(rule1->lsm[i].args_p, rule2->lsm[i].args_p) != 0)
> > > + return false;
> > > + }
> > > +
> > > + return true;
> > > +}
> > > +
> > > +/**
> > > + * ima_rule_exists - check if a rule already exists in the policy
> > > + *
> > > + * Checking both the active policy and the temporary rules list.
> > > + */
> > > +static bool ima_rule_exists(struct ima_rule_entry *new_rule)
> > > +{
> > > + struct ima_rule_entry *entry;
> > > + struct list_head *ima_rules_tmp;
> > > +
> > > + if (!list_empty(&ima_temp_rules)) {
> > > + list_for_each_entry(entry, &ima_temp_rules, list) {
> > > + if (ima_rules_equal(entry, new_rule))
> > > + return true;
> > > + }
> > > + }
> > > +
> > > + rcu_read_lock();
> > > + ima_rules_tmp = rcu_dereference(ima_rules);
> > > + list_for_each_entry_rcu(entry, ima_rules_tmp, list) {
> > > + if (ima_rules_equal(entry, new_rule)) {
> > > + rcu_read_unlock();
> > > + return true;
> > > + }
> > > + }
> > > + rcu_read_unlock();
> > > +
> > > + return false;
> > > +}
> > > +
> > > /**
> > > * ima_parse_add_rule - add a rule to ima_policy_rules
> > > * @rule: ima measurement policy rule
> > > @@ -1993,7 +2140,15 @@ ssize_t ima_parse_add_rule(char *rule)
> > > return result;
> > > }
> > > - list_add_tail(&entry->list, &ima_temp_rules);
> > > + if (!ima_rule_exists(entry)) {
> > > + list_add_tail(&entry->list, &ima_temp_rules);
> > > + } else {
> > > + result = -EEXIST;
> > Is it necessary to set result? Or can you just pass -EEXIST to the audit call below?
> >
> > > + ima_free_rule(entry);
> > > + integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
> > > + NULL, op, "duplicate-policy", result,
> > > + audit_info);
> > > + }
> > > return len;
> > > }
> I
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: syzbot @ 2025-11-11 9:46 UTC (permalink / raw)
To: akpm, bpf, brauner, bsegall, david, dietmar.eggemann, jack,
jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid
In-Reply-To: <20251111-lausbub-wieweit-76ec521875b2@brauner>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in __ns_ref_active_put
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6489 at kernel/nscommon.c:171 __ns_ref_active_put+0x3d7/0x450 kernel/nscommon.c:171
Modules linked in:
CPU: 0 UID: 0 PID: 6489 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__ns_ref_active_put+0x3d7/0x450 kernel/nscommon.c:171
Code: 4d 8b 3e e9 1b fd ff ff e8 b6 61 32 00 90 0f 0b 90 e9 29 fd ff ff e8 a8 61 32 00 90 0f 0b 90 e9 59 fd ff ff e8 9a 61 32 00 90 <0f> 0b 90 e9 72 ff ff ff e8 8c 61 32 00 90 0f 0b 90 e9 64 ff ff ff
RSP: 0018:ffffc90003457d50 EFLAGS: 00010293
RAX: ffffffff818e5b86 RBX: 00000000ffffffff RCX: ffff88802cc69e40
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
RBP: ffffc90003457e00 R08: ffff8880320be42b R09: 1ffff11006417c85
R10: dffffc0000000000 R11: ffffed1006417c86 R12: dffffc0000000000
R13: 1ffff11006417c84 R14: ffff8880320be420 R15: ffff8880320be428
FS: 00007fe11c3746c0(0000) GS:ffff888125cf3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d863fff CR3: 000000007798c000 CR4: 00000000003526f0
Call Trace:
<TASK>
nsproxy_ns_active_put+0x4a/0x200 fs/nsfs.c:701
free_nsproxy+0x21/0x140 kernel/nsproxy.c:190
put_nsset kernel/nsproxy.c:341 [inline]
__do_sys_setns kernel/nsproxy.c:594 [inline]
__se_sys_setns+0x1459/0x1c60 kernel/nsproxy.c:559
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe11b590ef7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe11c373fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000134
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe11b590ef7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c9
RBP: 00007fe11b611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe11b7e6038 R14: 00007fe11b7e5fa0 R15: 00007ffcd9b83d18
</TASK>
Tested on:
commit: 18b5c400 Merge patch series "ns: header cleanups and i..
git tree: https://github.com/brauner/linux.git namespace-6.19
console output: https://syzkaller.appspot.com/x/log.txt?x=12c08658580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59952e73920025e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0b2e79f91ff6579bfa5b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
^ permalink raw reply
* Re: [linux-next:master] [ns] 3a18f80918: WARNING:at_include/linux/ns_common.h:#put_cred_rcu
From: Christian Brauner @ 2025-11-11 9:36 UTC (permalink / raw)
To: kernel test robot
Cc: oe-lkp, lkp, linux-fsdevel, linux-kernel, linux-security-module
In-Reply-To: <202511111547.de480df9-lkp@intel.com>
On Tue, Nov 11, 2025 at 03:08:10PM +0800, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "WARNING:at_include/linux/ns_common.h:#put_cred_rcu" on:
>
> commit: 3a18f809184bc5a1cfad7cde5b8b026e2ff61587 ("ns: add active reference count")
> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
This is fixed in namespace-6.19 which should've made it into -next about
five hours ago.
Note that "linux-next.git master" is pretty useless. By the time I read
this mail linux-next's master branch will have already been updated. So
you should give a commit hash as well or a tag.
>
> in testcase: trinity
> version:
> with following parameters:
>
> runtime: 300s
> group: group-01
> nr_groups: 5
>
>
>
> config: x86_64-randconfig-r053-20251109
> compiler: gcc-14
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202511111547.de480df9-lkp@intel.com
>
>
> [ 41.172047][ C1] ------------[ cut here ]------------
> [ 41.172821][ C1] WARNING: CPU: 1 PID: 0 at include/linux/ns_common.h:227 put_cred_rcu (include/linux/ns_common.h:227 include/linux/user_namespace.h:189 kernel/cred.c:88)
> [ 41.173907][ C1] Modules linked in: serio_raw(F) floppy(F) tiny_power_button(F) button(F)
> [ 41.174959][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: GF T 6.18.0-rc2-00014-g3a18f809184b #1 PREEMPTLAZY 9f2dc8152166a7dcc87d7d6a6b2b12a17475cded
> [ 41.176815][ C1] Tainted: [F]=FORCED_MODULE, [T]=RANDSTRUCT
> [ 41.177517][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [ 41.178764][ C1] RIP: 0010:put_cred_rcu (include/linux/ns_common.h:227 include/linux/user_namespace.h:189 kernel/cred.c:88)
> [ 41.179419][ C1] Code: 02 48 89 e8 83 e0 07 83 c0 03 38 d0 7c 0c 84 d2 74 08 48 89 ef e8 0d 9f 55 00 8b 83 30 03 00 00 85 c0 74 09 e8 ae 24 1c 00 90 <0f> 0b 90 e8 a5 24 1c 00 48 89 df e8 fd a9 1b 00 e8 98 24 1c 00 4c
> All code
> ========
> 0: 02 48 89 add -0x77(%rax),%cl
> 3: e8 83 e0 07 83 call 0xffffffff8307e08b
> 8: c0 03 38 rolb $0x38,(%rbx)
> b: d0 7c 0c 84 sarb $1,-0x7c(%rsp,%rcx,1)
> f: d2 74 08 48 shlb %cl,0x48(%rax,%rcx,1)
> 13: 89 ef mov %ebp,%edi
> 15: e8 0d 9f 55 00 call 0x559f27
> 1a: 8b 83 30 03 00 00 mov 0x330(%rbx),%eax
> 20: 85 c0 test %eax,%eax
> 22: 74 09 je 0x2d
> 24: e8 ae 24 1c 00 call 0x1c24d7
> 29: 90 nop
> 2a:* 0f 0b ud2 <-- trapping instruction
> 2c: 90 nop
> 2d: e8 a5 24 1c 00 call 0x1c24d7
> 32: 48 89 df mov %rbx,%rdi
> 35: e8 fd a9 1b 00 call 0x1baa37
> 3a: e8 98 24 1c 00 call 0x1c24d7
> 3f: 4c rex.WR
>
> Code starting with the faulting instruction
> ===========================================
> 0: 0f 0b ud2
> 2: 90 nop
> 3: e8 a5 24 1c 00 call 0x1c24ad
> 8: 48 89 df mov %rbx,%rdi
> b: e8 fd a9 1b 00 call 0x1baa0d
> 10: e8 98 24 1c 00 call 0x1c24ad
> 15: 4c rex.WR
> [ 41.181507][ C1] RSP: 0018:ffffc900001c8e58 EFLAGS: 00010246
> [ 41.182352][ C1] RAX: 0000000000000000 RBX: ffff8881649b8780 RCX: 0000000000000000
> [ 41.183326][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 41.184311][ C1] RBP: ffff8881649b8ab0 R08: 0000000000000000 R09: 0000000000000000
> [ 41.185324][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88815d490c80
> [ 41.186287][ C1] R13: ffffffff83d2b7c0 R14: 0000000000000004 R15: ffffffff813e6e70
> [ 41.187244][ C1] FS: 0000000000000000(0000) GS:ffff888799e76000(0000) knlGS:0000000000000000
> [ 41.188285][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 41.191457][ C1] CR2: 00000000004003c0 CR3: 0000000003c88000 CR4: 00000000000406b0
> [ 41.192491][ C1] Call Trace:
> [ 41.192939][ C1] <IRQ>
> [ 41.193359][ C1] rcu_do_batch (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607)
> [ 41.193952][ C1] ? rcu_pending (kernel/rcu/tree.c:2529)
> [ 41.194567][ C1] ? rcu_disable_urgency_upon_qs (kernel/rcu/tree.c:725 (discriminator 1))
> [ 41.195408][ C1] ? trace_irq_enable+0xac/0xe0
> [ 41.196177][ C1] rcu_core (kernel/rcu/tree.c:2863)
> [ 41.196782][ C1] handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623)
> [ 41.197442][ C1] __irq_exit_rcu (kernel/softirq.c:496 kernel/softirq.c:723)
> [ 41.198071][ C1] irq_exit_rcu (kernel/softirq.c:741 (discriminator 38))
> [ 41.198779][ C1] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052 (discriminator 35) arch/x86/kernel/apic/apic.c:1052 (discriminator 35))
> [ 41.199466][ C1] </IRQ>
> [ 41.199885][ C1] <TASK>
> [ 41.200311][ C1] asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:569)
> [ 41.201027][ C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82)
> [ 41.201736][ C1] Code: 48 8b 3d 28 51 54 02 e8 23 00 00 00 48 2b 05 fc cf af 00 31 ff c3 cc cc cc cc cc cc cc cc cc eb 07 0f 00 2d 97 fc 0e 00 fb f4 <c3> cc cc cc cc 41 57 41 56 41 55 41 54 55 48 89 fd 53 44 8b 6d 00
> All code
> ========
> 0: 48 8b 3d 28 51 54 02 mov 0x2545128(%rip),%rdi # 0x254512f
> 7: e8 23 00 00 00 call 0x2f
> c: 48 2b 05 fc cf af 00 sub 0xafcffc(%rip),%rax # 0xafd00f
> 13: 31 ff xor %edi,%edi
> 15: c3 ret
> 16: cc int3
> 17: cc int3
> 18: cc int3
> 19: cc int3
> 1a: cc int3
> 1b: cc int3
> 1c: cc int3
> 1d: cc int3
> 1e: cc int3
> 1f: eb 07 jmp 0x28
> 21: 0f 00 2d 97 fc 0e 00 verw 0xefc97(%rip) # 0xefcbf
> 28: fb sti
> 29: f4 hlt
> 2a:* c3 ret <-- trapping instruction
> 2b: cc int3
> 2c: cc int3
> 2d: cc int3
> 2e: cc int3
> 2f: 41 57 push %r15
> 31: 41 56 push %r14
> 33: 41 55 push %r13
> 35: 41 54 push %r12
> 37: 55 push %rbp
> 38: 48 89 fd mov %rdi,%rbp
> 3b: 53 push %rbx
> 3c: 44 8b 6d 00 mov 0x0(%rbp),%r13d
>
> Code starting with the faulting instruction
> ===========================================
> 0: c3 ret
> 1: cc int3
> 2: cc int3
> 3: cc int3
> 4: cc int3
> 5: 41 57 push %r15
> 7: 41 56 push %r14
> 9: 41 55 push %r13
> b: 41 54 push %r12
> d: 55 push %rbp
> e: 48 89 fd mov %rdi,%rbp
> 11: 53 push %rbx
> 12: 44 8b 6d 00 mov 0x0(%rbp),%r13d
> [ 41.203822][ C1] RSP: 0018:ffffc9000014fe38 EFLAGS: 00000246
> [ 41.204551][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> [ 41.205618][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 41.206601][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> [ 41.207613][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881008322c0
> [ 41.208650][ C1] R13: 1ffff92000029fca R14: dffffc0000000000 R15: 0000000000000000
> [ 41.209689][ C1] default_idle (arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767)
> [ 41.210257][ C1] default_idle_call (include/linux/cpuidle.h:143 (discriminator 1) kernel/sched/idle.c:123 (discriminator 1))
> [ 41.210879][ C1] cpuidle_idle_call (kernel/sched/idle.c:191)
> [ 41.211506][ C1] ? arch_cpu_idle_exit+0x30/0x30
> [ 41.215390][ C1] ? tick_nohz_start_idle (kernel/time/tick-sched.c:753)
> [ 41.216069][ C1] ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:81)
> [ 41.216763][ C1] do_idle (kernel/sched/idle.c:332)
> [ 41.217295][ C1] cpu_startup_entry (kernel/sched/idle.c:427)
> [ 41.217929][ C1] start_secondary (arch/x86/kernel/smpboot.c:315)
> [ 41.218650][ C1] ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:233)
> [ 41.219100][ C1] common_startup_64 (arch/x86/kernel/head_64.S:419)
> [ 41.219506][ C1] </TASK>
> [ 41.219783][ C1] irq event stamp: 42022
> [ 41.220131][ C1] hardirqs last enabled at (42021): tick_nohz_idle_exit (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:119 kernel/time/tick-sched.c:1472)
> [ 41.220844][ C1] hardirqs last disabled at (42022): __schedule (kernel/sched/core.c:6814)
> [ 41.221520][ C1] softirqs last enabled at (42010): handle_softirqs (kernel/softirq.c:469 (discriminator 2) kernel/softirq.c:650 (discriminator 2))
> [ 41.222380][ C1] softirqs last disabled at (42001): __irq_exit_rcu (kernel/softirq.c:496 kernel/softirq.c:723)
> [ 41.223139][ C1] ---[ end trace 0000000000000000 ]---
>
>
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20251111/202511111547.de480df9-lkp@intel.com
>
>
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox