* [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2)
@ 2025-08-07 17:05 syzbot
2025-09-17 10:45 ` Forwarded: syzbot
` (4 more replies)
0 siblings, 5 replies; 85+ messages in thread
From: syzbot @ 2025-08-07 17:05 UTC (permalink / raw)
To: davem, edumazet, horms, krzk, kuba, linux-kernel, netdev, pabeni,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 89748acdf226 Merge tag 'drm-next-2025-08-01' of https://gi..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=165cfcf0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7ff65239b4835001
dashboard link: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b88042580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=115cfcf0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce090dd92dc2/disk-89748acd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/32b5903a7759/vmlinux-89748acd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dc68a867773d/bzImage-89748acd.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in nci_init_req net/nfc/nci/core.c:177 [inline]
BUG: KMSAN: uninit-value in __nci_request net/nfc/nci/core.c:108 [inline]
BUG: KMSAN: uninit-value in nci_open_device net/nfc/nci/core.c:521 [inline]
BUG: KMSAN: uninit-value in nci_dev_up+0x13a2/0x1ba0 net/nfc/nci/core.c:632
nci_init_req net/nfc/nci/core.c:177 [inline]
__nci_request net/nfc/nci/core.c:108 [inline]
nci_open_device net/nfc/nci/core.c:521 [inline]
nci_dev_up+0x13a2/0x1ba0 net/nfc/nci/core.c:632
nfc_dev_up+0x201/0x3d0 net/nfc/core.c:118
nfc_genl_dev_up+0xe9/0x1c0 net/nfc/netlink.c:775
genl_family_rcv_msg_doit+0x335/0x3f0 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0xacf/0xc10 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x54a/0x680 net/netlink/af_netlink.c:2552
genl_rcv+0x41/0x60 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x333/0x3d0 net/socket.c:729
____sys_sendmsg+0x7e0/0xd80 net/socket.c:2614
___sys_sendmsg+0x271/0x3b0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2703
x64_sys_call+0x1dfd/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:47
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6169 at kernel/stacktrace.c:29 stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29
Modules linked in:
CPU: 1 UID: 0 PID: 6169 Comm: syz-executor421 Not tainted 6.16.0-syzkaller-10499-g89748acdf226 #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29
Code: 8f bc 03 92 89 de ba 20 00 00 00 4c 89 e1 e8 c3 5d 4d ff 49 83 c6 08 49 ff cd 0f 85 6e ff ff ff eb 0b e8 ff 26 c3 00 eb d4 90 <0f> 0b 90 5b 41 5c 41 5d 41 5e 41 5f 5d e9 9a 33 07 0f cc 66 0f 1f
RSP: 0018:ffff8881343b31c8 EFLAGS: 00010246
RAX: ffff888114afac20 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8881343b31f0 R08: 0000000000000000 R09: 0000000000000000
R10: ffff888133bb3208 R11: 0000000000000001 R12: 0000000000000000
R13: 00000000abcd0100 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f0c264ae6c0(0000) GS:ffff8881aa9a5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0c26531650 CR3: 00000001193c6000 CR4: 00000000003526f0
Call Trace:
<TASK>
kmsan_print_origin+0xb0/0x340 mm/kmsan/report.c:133
kmsan_report+0x1d3/0x320 mm/kmsan/report.c:196
__msan_warning+0x1b/0x30 mm/kmsan/instrumentation.c:315
nci_init_req net/nfc/nci/core.c:177 [inline]
__nci_request net/nfc/nci/core.c:108 [inline]
nci_open_device net/nfc/nci/core.c:521 [inline]
nci_dev_up+0x13a2/0x1ba0 net/nfc/nci/core.c:632
nfc_dev_up+0x201/0x3d0 net/nfc/core.c:118
nfc_genl_dev_up+0xe9/0x1c0 net/nfc/netlink.c:775
genl_family_rcv_msg_doit+0x335/0x3f0 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0xacf/0xc10 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x54a/0x680 net/netlink/af_netlink.c:2552
genl_rcv+0x41/0x60 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x333/0x3d0 net/socket.c:729
____sys_sendmsg+0x7e0/0xd80 net/socket.c:2614
___sys_sendmsg+0x271/0x3b0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2703
x64_sys_call+0x1dfd/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:47
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0c264f62c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0c264ae218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f0c2657f368 RCX: 00007f0c264f62c9
RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004
RBP: 00007f0c2657f360 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0c2654c074
R13: 0000200000000150 R14: 00002000000000c0 R15: 0000200000000300
</TASK>
---[ end trace 0000000000000000 ]---
Uninit was stored to memory at:
nci_core_reset_ntf_packet net/nfc/nci/ntf.c:36 [inline]
nci_ntf_packet+0x179d/0x42b0 net/nfc/nci/ntf.c:812
nci_rx_work+0x403/0x750 net/nfc/nci/core.c:1555
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xb8e/0x1d80 kernel/workqueue.c:3319
worker_thread+0xedf/0x1590 kernel/workqueue.c:3400
kthread+0xd5c/0xf00 kernel/kthread.c:464
ret_from_fork+0x1e0/0x310 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4186 [inline]
slab_alloc_node mm/slub.c:4229 [inline]
kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4281
kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:578
__alloc_skb+0x347/0x7d0 net/core/skbuff.c:669
alloc_skb include/linux/skbuff.h:1336 [inline]
virtual_ncidev_write+0x6b/0x430 drivers/nfc/virtual_ncidev.c:120
vfs_write+0x463/0x1580 fs/read_write.c:684
ksys_write fs/read_write.c:738 [inline]
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
x64_sys_call+0x3014/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 1 UID: 0 PID: 6169 Comm: syz-executor421 Tainted: G W 6.16.0-syzkaller-10499-g89748acdf226 #0 PREEMPT(none)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
@ 2025-09-17 10:45 ` syzbot
2025-09-17 13:13 ` Forwarded: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
` (3 subsequent siblings)
4 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-09-17 10:45 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: deepak.takumi.120@gmail.com
#syz test
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2)
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
2025-09-17 10:45 ` Forwarded: syzbot
@ 2025-09-17 13:13 ` syzbot
2025-09-18 16:41 ` syzbot
` (2 subsequent siblings)
4 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-09-17 13:13 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2)
Author: deepak.takumi.120@gmail.com
#syz test
On Wed, Sep 17, 2025 at 6:40 PM Cortex Auth <deepak.takumi.120@gmail.com> wrote:
>
>
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2)
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
2025-09-17 10:45 ` Forwarded: syzbot
2025-09-17 13:13 ` Forwarded: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
@ 2025-09-18 16:41 ` syzbot
2025-09-25 9:11 ` syzbot
2026-02-18 8:46 ` Forwarded: Re: [PATCH net v6] net: nfc: nci: Fix parameter validation for packet data syzbot
4 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-09-18 16:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2)
Author: deepak.takumi.120@gmail.com
#syz test
On Wed, Sep 17, 2025 at 7:25 PM syzbot
<syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
> Tested-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 5aca7966 Merge tag 'perf-tools-fixes-for-v6.17-2025-09..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14cd8c7c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1b093ccee5a9e08c
> dashboard link: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> patch: https://syzkaller.appspot.com/x/patch.diff?x=13dfaf62580000
>
> Note: testing is done by a robot and is best-effort only.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/68cabdb6.050a0220.3c6139.0fa6.GAE%40google.com.
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2)
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
` (2 preceding siblings ...)
2025-09-18 16:41 ` syzbot
@ 2025-09-25 9:11 ` syzbot
2026-02-18 8:46 ` Forwarded: Re: [PATCH net v6] net: nfc: nci: Fix parameter validation for packet data syzbot
4 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-09-25 9:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2)
Author: deepak.takumi.120@gmail.com
#syz test
On Thu, Sep 18, 2025 at 11:29 PM syzbot
<syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
> Tested-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 86cc796e Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13d94712580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1b093ccee5a9e08c
> dashboard link: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> patch: https://syzkaller.appspot.com/x/patch.diff?x=162bdf62580000
>
> Note: testing is done by a robot and is best-effort only.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/68cc4866.050a0220.28a605.000a.GAE%40google.com.
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded: Re: [PATCH net v6] net: nfc: nci: Fix parameter validation for packet data
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
` (3 preceding siblings ...)
2025-09-25 9:11 ` syzbot
@ 2026-02-18 8:46 ` syzbot
4 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2026-02-18 8:46 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH net v6] net: nfc: nci: Fix parameter validation for packet data
Author: krzk@kernel.org
On 18/02/2026 09:30, Michael Thalmeier wrote:
> Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for
> packet data") communication with nci nfc chips is not working any more.
>
> The mentioned commit tries to fix access of uninitialized data, but
> failed to understand that in some cases the data packet is of variable
> length and can therefore not be compared to the maximum packet length
> given by the sizeof(struct).
>
> Fixes: 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data")
Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
#syz unfix
> Cc: stable@vger.kernel.org
> Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
> ---
> v6:
> - use ssize_t for data_len parameter to guard against underflows
> - omit unneeded data_len decrements at the end of the functions
>
> v5:
> - also check helper functions in nci_extract_rf_params_nfcf_passive_listen
> and nci_rf_discover_ntf_packet
>
> v4:
> - formatting fixes
>
> v3:
> - perform complete checks
> - replace magic numbers with offsetofend and sizeof
>
> v2:
> - Reference correct commit hash
>
> ---
> net/nfc/nci/ntf.c | 159 ++++++++++++++++++++++++++++++++++++++++------
> 1 file changed, 141 insertions(+), 18 deletions(-)
>
> diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
> index 418b84e2b260..c96512bb8653 100644
> --- a/net/nfc/nci/ntf.c
> +++ b/net/nfc/nci/ntf.c
> @@ -58,7 +58,7 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
> struct nci_conn_info *conn_info;
> int i;
>
> - if (skb->len < sizeof(struct nci_core_conn_credit_ntf))
> + if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries))
> return -EINVAL;
>
> ntf = (struct nci_core_conn_credit_ntf *)skb->data;
> @@ -68,6 +68,10 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
> if (ntf->num_entries > NCI_MAX_NUM_CONN)
> ntf->num_entries = NCI_MAX_NUM_CONN;
>
> + if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries) +
> + ntf->num_entries * sizeof(struct conn_credit_entry))
> + return -EINVAL;
> +
> /* update the credits */
> for (i = 0; i < ntf->num_entries; i++) {
> ntf->conn_entries[i].conn_id =
> @@ -138,23 +142,48 @@ static int nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
> static const __u8 *
> nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
> struct rf_tech_specific_params_nfca_poll *nfca_poll,
> - const __u8 *data)
> + const __u8 *data, ssize_t data_len)
> {
> + /* Check if we have enough data for sens_res (2 bytes) */
> + if (data_len < 2)
> + return ERR_PTR(-EINVAL);
> +
> nfca_poll->sens_res = __le16_to_cpu(*((__le16 *)data));
> data += 2;
> + data_len -= 2;
> +
> + /* Check if we have enough data for nfcid1_len (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
>
> nfca_poll->nfcid1_len = min_t(__u8, *data++, NFC_NFCID1_MAXSIZE);
> + data_len--;
>
> pr_debug("sens_res 0x%x, nfcid1_len %d\n",
> nfca_poll->sens_res, nfca_poll->nfcid1_len);
>
> + /* Check if we have enough data for nfcid1 */
> + if (data_len < nfca_poll->nfcid1_len)
> + return ERR_PTR(-EINVAL);
> +
> memcpy(nfca_poll->nfcid1, data, nfca_poll->nfcid1_len);
> data += nfca_poll->nfcid1_len;
> + data_len -= nfca_poll->nfcid1_len;
> +
> + /* Check if we have enough data for sel_res_len (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
>
> nfca_poll->sel_res_len = *data++;
> + data_len--;
> +
> + if (nfca_poll->sel_res_len != 0) {
> + /* Check if we have enough data for sel_res (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
>
> - if (nfca_poll->sel_res_len != 0)
> nfca_poll->sel_res = *data++;
> + }
>
> pr_debug("sel_res_len %d, sel_res 0x%x\n",
> nfca_poll->sel_res_len,
> @@ -166,12 +195,21 @@ nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
> static const __u8 *
> nci_extract_rf_params_nfcb_passive_poll(struct nci_dev *ndev,
> struct rf_tech_specific_params_nfcb_poll *nfcb_poll,
> - const __u8 *data)
> + const __u8 *data, ssize_t data_len)
> {
> + /* Check if we have enough data for sensb_res_len (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
> +
> nfcb_poll->sensb_res_len = min_t(__u8, *data++, NFC_SENSB_RES_MAXSIZE);
> + data_len--;
>
> pr_debug("sensb_res_len %d\n", nfcb_poll->sensb_res_len);
>
> + /* Check if we have enough data for sensb_res */
> + if (data_len < nfcb_poll->sensb_res_len)
> + return ERR_PTR(-EINVAL);
> +
> memcpy(nfcb_poll->sensb_res, data, nfcb_poll->sensb_res_len);
> data += nfcb_poll->sensb_res_len;
>
> @@ -181,14 +219,29 @@ nci_extract_rf_params_nfcb_passive_poll(struct nci_dev *ndev,
> static const __u8 *
> nci_extract_rf_params_nfcf_passive_poll(struct nci_dev *ndev,
> struct rf_tech_specific_params_nfcf_poll *nfcf_poll,
> - const __u8 *data)
> + const __u8 *data, ssize_t data_len)
> {
> + /* Check if we have enough data for bit_rate (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
> +
> nfcf_poll->bit_rate = *data++;
> + data_len--;
> +
> + /* Check if we have enough data for sensf_res_len (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
> +
> nfcf_poll->sensf_res_len = min_t(__u8, *data++, NFC_SENSF_RES_MAXSIZE);
> + data_len--;
>
> pr_debug("bit_rate %d, sensf_res_len %d\n",
> nfcf_poll->bit_rate, nfcf_poll->sensf_res_len);
>
> + /* Check if we have enough data for sensf_res */
> + if (data_len < nfcf_poll->sensf_res_len)
> + return ERR_PTR(-EINVAL);
> +
> memcpy(nfcf_poll->sensf_res, data, nfcf_poll->sensf_res_len);
> data += nfcf_poll->sensf_res_len;
>
> @@ -198,22 +251,49 @@ nci_extract_rf_params_nfcf_passive_poll(struct nci_dev *ndev,
> static const __u8 *
> nci_extract_rf_params_nfcv_passive_poll(struct nci_dev *ndev,
> struct rf_tech_specific_params_nfcv_poll *nfcv_poll,
> - const __u8 *data)
> + const __u8 *data, ssize_t data_len)
> {
> + /* Skip 1 byte (reserved) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
> +
> ++data;
> + data_len--;
> +
> + /* Check if we have enough data for dsfid (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
> +
> nfcv_poll->dsfid = *data++;
> + data_len--;
> +
> + /* Check if we have enough data for uid (8 bytes) */
> + if (data_len < NFC_ISO15693_UID_MAXSIZE)
> + return ERR_PTR(-EINVAL);
> +
> memcpy(nfcv_poll->uid, data, NFC_ISO15693_UID_MAXSIZE);
> data += NFC_ISO15693_UID_MAXSIZE;
> +
> return data;
> }
>
> static const __u8 *
> nci_extract_rf_params_nfcf_passive_listen(struct nci_dev *ndev,
> struct rf_tech_specific_params_nfcf_listen *nfcf_listen,
> - const __u8 *data)
> + const __u8 *data, ssize_t data_len)
> {
> + /* Check if we have enough data for local_nfcid2_len (1 byte) */
> + if (data_len < 1)
> + return ERR_PTR(-EINVAL);
> +
> nfcf_listen->local_nfcid2_len = min_t(__u8, *data++,
> NFC_NFCID2_MAXSIZE);
> + data_len--;
> +
> + /* Check if we have enough data for local_nfcid2 */
> + if (data_len < nfcf_listen->local_nfcid2_len)
> + return ERR_PTR(-EINVAL);
> +
> memcpy(nfcf_listen->local_nfcid2, data, nfcf_listen->local_nfcid2_len);
> data += nfcf_listen->local_nfcid2_len;
>
> @@ -364,7 +444,7 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev,
> const __u8 *data;
> bool add_target = true;
>
> - if (skb->len < sizeof(struct nci_rf_discover_ntf))
> + if (skb->len < offsetofend(struct nci_rf_discover_ntf, rf_tech_specific_params_len))
> return -EINVAL;
>
> data = skb->data;
> @@ -380,26 +460,42 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev,
> pr_debug("rf_tech_specific_params_len %d\n",
> ntf.rf_tech_specific_params_len);
>
> + if (skb->len < (data - skb->data) +
> + ntf.rf_tech_specific_params_len + sizeof(ntf.ntf_type))
> + return -EINVAL;
> +
> if (ntf.rf_tech_specific_params_len > 0) {
> switch (ntf.rf_tech_and_mode) {
> case NCI_NFC_A_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfca_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfca_poll), data);
> + &(ntf.rf_tech_specific_params.nfca_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return PTR_ERR(data);
> break;
>
> case NCI_NFC_B_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfcb_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfcb_poll), data);
> + &(ntf.rf_tech_specific_params.nfcb_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return PTR_ERR(data);
> break;
>
> case NCI_NFC_F_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfcf_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfcf_poll), data);
> + &(ntf.rf_tech_specific_params.nfcf_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return PTR_ERR(data);
> break;
>
> case NCI_NFC_V_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfcv_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfcv_poll), data);
> + &(ntf.rf_tech_specific_params.nfcv_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return PTR_ERR(data);
> break;
>
> default:
> @@ -596,7 +692,7 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
> const __u8 *data;
> int err = NCI_STATUS_OK;
>
> - if (skb->len < sizeof(struct nci_rf_intf_activated_ntf))
> + if (skb->len < offsetofend(struct nci_rf_intf_activated_ntf, rf_tech_specific_params_len))
> return -EINVAL;
>
> data = skb->data;
> @@ -628,26 +724,41 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
> if (ntf.rf_interface == NCI_RF_INTERFACE_NFCEE_DIRECT)
> goto listen;
>
> + if (skb->len < (data - skb->data) + ntf.rf_tech_specific_params_len)
> + return -EINVAL;
> +
> if (ntf.rf_tech_specific_params_len > 0) {
> switch (ntf.activation_rf_tech_and_mode) {
> case NCI_NFC_A_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfca_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfca_poll), data);
> + &(ntf.rf_tech_specific_params.nfca_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return -EINVAL;
> break;
>
> case NCI_NFC_B_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfcb_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfcb_poll), data);
> + &(ntf.rf_tech_specific_params.nfcb_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return -EINVAL;
> break;
>
> case NCI_NFC_F_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfcf_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfcf_poll), data);
> + &(ntf.rf_tech_specific_params.nfcf_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return -EINVAL;
> break;
>
> case NCI_NFC_V_PASSIVE_POLL_MODE:
> data = nci_extract_rf_params_nfcv_passive_poll(ndev,
> - &(ntf.rf_tech_specific_params.nfcv_poll), data);
> + &(ntf.rf_tech_specific_params.nfcv_poll), data,
> + ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return -EINVAL;
> break;
>
> case NCI_NFC_A_PASSIVE_LISTEN_MODE:
> @@ -657,7 +768,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
> case NCI_NFC_F_PASSIVE_LISTEN_MODE:
> data = nci_extract_rf_params_nfcf_passive_listen(ndev,
> &(ntf.rf_tech_specific_params.nfcf_listen),
> - data);
> + data, ntf.rf_tech_specific_params_len);
> + if (IS_ERR(data))
> + return -EINVAL;
> break;
>
> default:
> @@ -668,6 +781,13 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
> }
> }
>
> + if (skb->len < (data - skb->data) +
> + sizeof(ntf.data_exch_rf_tech_and_mode) +
> + sizeof(ntf.data_exch_tx_bit_rate) +
> + sizeof(ntf.data_exch_rx_bit_rate) +
> + sizeof(ntf.activation_params_len))
> + return -EINVAL;
> +
> ntf.data_exch_rf_tech_and_mode = *data++;
> ntf.data_exch_tx_bit_rate = *data++;
> ntf.data_exch_rx_bit_rate = *data++;
> @@ -679,6 +799,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
> pr_debug("data_exch_rx_bit_rate 0x%x\n", ntf.data_exch_rx_bit_rate);
> pr_debug("activation_params_len %d\n", ntf.activation_params_len);
>
> + if (skb->len < (data - skb->data) + ntf.activation_params_len)
> + return -EINVAL;
> +
> if (ntf.activation_params_len > 0) {
> switch (ntf.rf_interface) {
> case NCI_RF_INTERFACE_ISO_DEP:
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [block?] kernel BUG in bio_chain
@ 2025-12-07 6:24 syzbot
2025-12-12 12:17 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-12-07 6:24 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: b2c27842ba85 Add linux-next specific files for 20251203
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1688d2b4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=caadf525b0ab8d17
dashboard link: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13dd5512580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=158d7512580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1168b2ea1fd1/disk-b2c27842.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2c3066faf780/vmlinux-b2c27842.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f6693abe374d/bzImage-b2c27842.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/caedad91e176/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=118d7512580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com
gfs2: fsid=syz:syz.0: jid=0, already locked for use
gfs2: fsid=syz:syz.0: jid=0: Looking at journal...
------------[ cut here ]------------
kernel BUG at block/bio.c:342!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 912 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: gfs2_recovery gfs2_recover_func
RIP: 0010:bio_chain+0xee/0x100 block/bio.c:342
Code: 43 1c 5b 41 5c 41 5d 41 5e 41 5f 5d e9 1b e1 f2 06 cc 89 f9 80 e1 07 fe c1 38 c1 7c cf e8 aa fc bd fd eb c8 e8 d3 a8 57 fd 90 <0f> 0b e8 cb a8 57 fd 90 0f 0b 0f 1f 84 00 00 00 00 00 90 90 90 90
RSP: 0018:ffffc90003d07540 EFLAGS: 00010293
RAX: ffffffff846a0a5d RBX: ffff8880207223c0 RCX: ffff888025b49e80
RDX: 0000000000000000 RSI: ffff8880207223c0 RDI: ffff888020722500
RBP: 0000000000002004 R08: ffffffff8476a450 R09: ffffffff8df419e0
R10: dffffc0000000000 R11: ffffed10040e4487 R12: dffffc0000000000
R13: 1ffff110040e44a8 R14: ffff888020722500 R15: ffff888020722540
FS: 0000000000000000(0000) GS:ffff888125f49000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff5e0f43000 CR3: 0000000073e76000 CR4: 00000000003526f0
Call Trace:
<TASK>
gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459
process_one_work+0x93a/0x15a0 kernel/workqueue.c:3261
process_scheduled_works kernel/workqueue.c:3344 [inline]
worker_thread+0x9b0/0xee0 kernel/workqueue.c:3425
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bio_chain+0xee/0x100 block/bio.c:342
Code: 43 1c 5b 41 5c 41 5d 41 5e 41 5f 5d e9 1b e1 f2 06 cc 89 f9 80 e1 07 fe c1 38 c1 7c cf e8 aa fc bd fd eb c8 e8 d3 a8 57 fd 90 <0f> 0b e8 cb a8 57 fd 90 0f 0b 0f 1f 84 00 00 00 00 00 90 90 90 90
RSP: 0018:ffffc90003d07540 EFLAGS: 00010293
RAX: ffffffff846a0a5d RBX: ffff8880207223c0 RCX: ffff888025b49e80
RDX: 0000000000000000 RSI: ffff8880207223c0 RDI: ffff888020722500
RBP: 0000000000002004 R08: ffffffff8476a450 R09: ffffffff8df419e0
R10: dffffc0000000000 R11: ffffed10040e4487 R12: dffffc0000000000
R13: 1ffff110040e44a8 R14: ffff888020722500 R15: ffff888020722540
FS: 0000000000000000(0000) GS:ffff888125f49000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563e2b893950 CR3: 0000000026910000 CR4: 00000000003526f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [input?] [usb?] memory leak in dualshock4_get_calibration_data
@ 2025-11-13 4:38 syzbot
2025-11-15 1:12 ` Forwarded: syzbot
2025-11-15 1:44 ` Forwarded: syzbot
0 siblings, 2 replies; 85+ messages in thread
From: syzbot @ 2025-11-13 4:38 UTC (permalink / raw)
To: bentiss, jikos, linux-input, linux-kernel, linux-usb,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 24172e0d7990 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12a44692580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=4f5f81e1456a1f645bf8
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1508c658580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1051897c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ded911fa4408/disk-24172e0d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a1f3e61cb784/vmlinux-24172e0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b92fd0e25cb7/bzImage-24172e0d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4f5f81e1456a1f645bf8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff8881192f9a40 (size 64):
comm "kworker/1:0", pid 23, jiffies 4294944710
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc c51b5d6b):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5766
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
dualshock4_get_calibration_data+0x437/0x500 drivers/hid/hid-playstation.c:1919
dualshock4_create drivers/hid/hid-playstation.c:2747 [inline]
ps_probe drivers/hid/hid-playstation.c:2845 [inline]
ps_probe+0x747/0x17d0 drivers/hid/hid-playstation.c:2821
__hid_device_probe drivers/hid/hid-core.c:2775 [inline]
hid_device_probe+0x298/0x3b0 drivers/hid/hid-core.c:2812
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x12f/0x430 drivers/base/dd.c:659
__driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:801
driver_probe_device+0x2a/0x120 drivers/base/dd.c:831
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:959
bus_for_each_drv+0xcf/0x120 drivers/base/bus.c:462
__device_attach+0xf9/0x290 drivers/base/dd.c:1031
bus_probe_device+0xcd/0xe0 drivers/base/bus.c:537
device_add+0x983/0xc80 drivers/base/core.c:3689
hid_add_device+0x140/0x250 drivers/hid/hid-core.c:2951
usbhid_probe+0x5ed/0x950 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x173/0x3f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x12f/0x430 drivers/base/dd.c:659
BUG: memory leak
unreferenced object 0xffff8881192e7740 (size 64):
comm "kworker/1:0", pid 23, jiffies 4294944884
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc c51b5d6b):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5766
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
dualshock4_get_calibration_data+0x437/0x500 drivers/hid/hid-playstation.c:1919
dualshock4_create drivers/hid/hid-playstation.c:2747 [inline]
ps_probe drivers/hid/hid-playstation.c:2845 [inline]
ps_probe+0x747/0x17d0 drivers/hid/hid-playstation.c:2821
__hid_device_probe drivers/hid/hid-core.c:2775 [inline]
hid_device_probe+0x298/0x3b0 drivers/hid/hid-core.c:2812
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x12f/0x430 drivers/base/dd.c:659
__driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:801
driver_probe_device+0x2a/0x120 drivers/base/dd.c:831
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:959
bus_for_each_drv+0xcf/0x120 drivers/base/bus.c:462
__device_attach+0xf9/0x290 drivers/base/dd.c:1031
bus_probe_device+0xcd/0xe0 drivers/base/bus.c:537
device_add+0x983/0xc80 drivers/base/core.c:3689
hid_add_device+0x140/0x250 drivers/hid/hid-core.c:2951
usbhid_probe+0x5ed/0x950 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x173/0x3f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x12f/0x430 drivers/base/dd.c:659
BUG: memory leak
unreferenced object 0xffff88812484e5c0 (size 64):
comm "kworker/0:0", pid 9, jiffies 4294945059
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc c51b5d6b):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5766
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
dualshock4_get_calibration_data+0x437/0x500 drivers/hid/hid-playstation.c:1919
dualshock4_create drivers/hid/hid-playstation.c:2747 [inline]
ps_probe drivers/hid/hid-playstation.c:2845 [inline]
ps_probe+0x747/0x17d0 drivers/hid/hid-playstation.c:2821
__hid_device_probe drivers/hid/hid-core.c:2775 [inline]
hid_device_probe+0x298/0x3b0 drivers/hid/hid-core.c:2812
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x12f/0x430 drivers/base/dd.c:659
__driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:801
driver_probe_device+0x2a/0x120 drivers/base/dd.c:831
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:959
bus_for_each_drv+0xcf/0x120 drivers/base/bus.c:462
__device_attach+0xf9/0x290 drivers/base/dd.c:1031
bus_probe_device+0xcd/0xe0 drivers/base/bus.c:537
device_add+0x983/0xc80 drivers/base/core.c:3689
hid_add_device+0x140/0x250 drivers/hid/hid-core.c:2951
usbhid_probe+0x5ed/0x950 drivers/hid/usbhid/hid-core.c:1435
usb_probe_interface+0x173/0x3f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x12f/0x430 drivers/base/dd.c:659
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [kernel?] memory leak in do_timer_create
@ 2025-11-13 4:26 syzbot
2025-11-14 1:20 ` Forwarded: syzbot
` (2 more replies)
0 siblings, 3 replies; 85+ messages in thread
From: syzbot @ 2025-11-13 4:26 UTC (permalink / raw)
To: anna-maria, frederic, linux-kernel, syzkaller-bugs, tglx
Hello,
syzbot found the following issue on:
HEAD commit: 24172e0d7990 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=165417cd980000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=9c47ad18f978d4394986
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15004914580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ea6b42580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ded911fa4408/disk-24172e0d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a1f3e61cb784/vmlinux-24172e0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b92fd0e25cb7/bzImage-24172e0d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9c47ad18f978d4394986@syzkaller.appspotmail.com
2025/11/12 09:47:51 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888108465800 (size 384):
comm "syz.0.17", pid 6100, jiffies 4294944668
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1025e73e):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881084a0000 (size 384):
comm "syz.0.18", pid 6104, jiffies 4294944670
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 63c47fd0):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881084a0180 (size 384):
comm "syz.0.19", pid 6107, jiffies 4294944671
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc d769495f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888108464600 (size 384):
comm "syz.0.20", pid 6127, jiffies 4294945201
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a3c907e):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881084a0300 (size 384):
comm "syz.0.21", pid 6128, jiffies 4294945201
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc bb0da4da):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
@ 2025-11-14 1:20 ` syzbot
2025-11-14 3:54 ` Forwarded: syzbot
2025-11-14 4:17 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-14 1:20 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
2025-11-14 1:20 ` Forwarded: syzbot
@ 2025-11-14 3:54 ` syzbot
2025-11-14 4:17 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-14 3:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
2025-11-14 1:20 ` Forwarded: syzbot
2025-11-14 3:54 ` Forwarded: syzbot
@ 2025-11-14 4:17 ` syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-14 4:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: eslam.medhat1993@gmail.com
#syz test
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] linux-next build error (24)
@ 2025-11-04 9:17 syzbot
2025-12-17 13:51 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-11-04 9:17 UTC (permalink / raw)
To: linux-kernel, linux-next, sfr, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 982312090977 Add linux-next specific files for 20251103
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=110f817c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1cf6c387ad3e8e7a
dashboard link: https://syzkaller.appspot.com/bug?extid=c78a89917a1b7c0fa4c6
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c78a89917a1b7c0fa4c6@syzkaller.appspotmail.com
error[E0599]: no method named `data` found for struct `core::pin::Pin<kbox::Box<T, Kmalloc>>` in the current scope
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [nbd?] KASAN: slab-use-after-free Write in recv_work (3)
@ 2025-11-02 23:48 syzbot
2025-11-05 14:40 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-11-02 23:48 UTC (permalink / raw)
To: axboe, josef, linux-block, linux-kernel, nbd, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 98bd8b16ae57 Add linux-next specific files for 20251031
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16802292580000
kernel config: https://syzkaller.appspot.com/x/.config?x=55e89517f3847929
dashboard link: https://syzkaller.appspot.com/bug?extid=56fbf4c7ddf65e95c7cc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=152a5012580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108dee14580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f5d0f0fd772a/disk-98bd8b16.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ead68b596c79/vmlinux-98bd8b16.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6722387b293d/bzImage-98bd8b16.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+56fbf4c7ddf65e95c7cc@syzkaller.appspotmail.com
block nbd0: Receive control failed (result -32)
block nbd0: shutting down sockets
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
BUG: KASAN: slab-use-after-free in recv_work+0x1b78/0x1c60 drivers/block/nbd.c:1028
Write of size 4 at addr ffff88802f2bee78 by task kworker/u9:1/5145
CPU: 0 UID: 0 PID: 5145 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: nbd0-recv recv_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
recv_work+0x1b78/0x1c60 drivers/block/nbd.c:1028
process_one_work+0x94a/0x15d0 kernel/workqueue.c:3267
process_scheduled_works kernel/workqueue.c:3350 [inline]
worker_thread+0x9b0/0xee0 kernel/workqueue.c:3431
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 5998:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:397 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414
kasan_kmalloc include/linux/kasan.h:262 [inline]
__kmalloc_cache_noprof+0x3e2/0x700 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
nbd_alloc_and_init_config+0x88/0x260 drivers/block/nbd.c:1683
nbd_genl_connect+0x9d7/0x18f0 drivers/block/nbd.c:2145
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:746
____sys_sendmsg+0x505/0x830 net/socket.c:2634
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2688
__sys_sendmsg net/socket.c:2720 [inline]
__do_sys_sendmsg net/socket.c:2725 [inline]
__se_sys_sendmsg net/socket.c:2723 [inline]
__x64_sys_sendmsg+0x19b/0x260 net/socket.c:2723
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5145:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2547 [inline]
slab_free mm/slub.c:6638 [inline]
kfree+0x19a/0x6d0 mm/slub.c:6845
nbd_config_put+0x4a1/0x580 drivers/block/nbd.c:1463
recv_work+0x1b62/0x1c60 drivers/block/nbd.c:1027
process_one_work+0x94a/0x15d0 kernel/workqueue.c:3267
process_scheduled_works kernel/workqueue.c:3350 [inline]
worker_thread+0x9b0/0xee0 kernel/workqueue.c:3431
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88802f2bee00
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 120 bytes inside of
freed 256-byte region [ffff88802f2bee00, ffff88802f2bef00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f2be
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b026b40 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b026b40 dead000000000122 0000000000000000
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffea0000bcaf81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5937, tgid 5937 (syz-executor), ts 108999640718, free_ts 108976063617
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3920
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5214
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2479
alloc_slab_page mm/slub.c:3063 [inline]
allocate_slab+0x96/0x350 mm/slub.c:3236
new_slab mm/slub.c:3290 [inline]
___slab_alloc+0xe94/0x18a0 mm/slub.c:4659
__slab_alloc+0x65/0x100 mm/slub.c:4778
__slab_alloc_node mm/slub.c:4854 [inline]
slab_alloc_node mm/slub.c:5276 [inline]
__do_kmalloc_node mm/slub.c:5649 [inline]
__kmalloc_noprof+0x47d/0x800 mm/slub.c:5662
kmalloc_noprof include/linux/slab.h:961 [inline]
kmalloc_array_noprof include/linux/slab.h:1003 [inline]
genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 net/netlink/genetlink.c:940
genl_family_rcv_msg_doit+0xb8/0x300 net/netlink/genetlink.c:1093
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:746
page last free pid 5937 tgid 5937 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
__free_frozen_pages+0xbc8/0xd30 mm/page_alloc.c:2948
__slab_free+0x2e7/0x390 mm/slub.c:5970
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:349
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x37d/0x700 mm/slub.c:5295
__kernfs_new_node+0xd7/0x7e0 fs/kernfs/dir.c:637
kernfs_new_node+0x102/0x210 fs/kernfs/dir.c:713
__kernfs_create_file+0x4b/0x2e0 fs/kernfs/file.c:1057
sysfs_add_file_mode_ns+0x238/0x300 fs/sysfs/file.c:313
sysfs_merge_group+0x177/0x310 fs/sysfs/group.c:376
dpm_sysfs_add+0xd2/0x270 drivers/base/power/sysfs.c:704
device_add+0x4d8/0xb80 drivers/base/core.c:3649
wiphy_register+0x1d2e/0x2d20 net/wireless/core.c:1035
ieee80211_register_hw+0x34a7/0x4110 net/mac80211/main.c:1591
mac80211_hwsim_new_radio+0x2f85/0x5340 drivers/net/wireless/virtual/mac80211_hwsim.c:5804
Memory state around the buggy address:
ffff88802f2bed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802f2bed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802f2bee00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802f2bee80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802f2bef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [ntfs3?] WARNING in ntfs_fill_super (2)
@ 2025-10-29 0:12 syzbot
2025-11-02 16:40 ` Forwarded: syzbot
2025-11-03 13:28 ` Forwarded: syzbot
0 siblings, 2 replies; 85+ messages in thread
From: syzbot @ 2025-10-29 0:12 UTC (permalink / raw)
To: almaz.alexandrovich, linux-kernel, ntfs3, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: f7d2388eeec2 Add linux-next specific files for 20251028
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15edde7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ecdce5bceba74f
dashboard link: https://syzkaller.appspot.com/bug?extid=2e6c1eda2eff0745b028
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=116e6704580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11198fe2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8aa0aaa475d1/disk-f7d2388e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fc97cba5a8b0/vmlinux-f7d2388e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/30e4617d837c/bzImage-f7d2388e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7f2ed67d49f3/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2e6c1eda2eff0745b028@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 4096
ntfs3(loop0): Different NTFS sector size (4096) and media sector size (512).
ntfs3(loop0): $Secure::$SII is corrupted.
ntfs3(loop0): Failed to initialize $Secure (-22).
------------[ cut here ]------------
WARNING: mm/slub.c:6752 at free_large_kmalloc+0x15c/0x1f0 mm/slub.c:6752, CPU#1: syz.0.17/5997
Modules linked in:
CPU: 1 UID: 0 PID: 5997 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:free_large_kmalloc+0x15c/0x1f0 mm/slub.c:6752
Code: 44 89 f6 e8 16 d1 fc ff 65 48 8b 05 1e c3 57 10 48 3b 44 24 08 75 57 48 83 c4 10 5b 41 5c 41 5e 41 5f 5d e9 86 7b 3b 09 cc 90 <0f> 0b 90 65 48 8b 05 f9 c2 57 10 48 3b 44 24 08 75 32 48 89 df 48
RSP: 0018:ffffc90003a3f880 EFLAGS: 00010206
RAX: 00000000ff000000 RBX: ffffea0000389000 RCX: ffffea0000389008
RDX: 0000000000000000 RSI: ffffffff8e240de0 RDI: ffffea0000389000
RBP: ffffc90003a3fbb0 R08: ffffc90003a3f4a7 R09: 1ffff92000747e94
R10: dffffc0000000000 R11: fffff52000747e95 R12: 0000000000000000
R13: 00000000ffffffea R14: dffffc0000000000 R15: ffff88807b48e9b0
FS: 0000555574161500(0000) GS:ffff888125feb000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe9d639d000 CR3: 000000007fa22000 CR4: 00000000003526f0
Call Trace:
<TASK>
ntfs_fill_super+0x656/0x43d0 fs/ntfs3/super.c:1674
get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1691
vfs_get_tree+0x92/0x2b0 fs/super.c:1751
fc_mount fs/namespace.c:1208 [inline]
do_new_mount_fc fs/namespace.c:3651 [inline]
do_new_mount+0x302/0xa10 fs/namespace.c:3727
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount+0x313/0x410 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9eef39076a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8b15b1b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffd8b15b240 RCX: 00007f9eef39076a
RDX: 0000200000000100 RSI: 0000200000000140 RDI: 00007ffd8b15b200
RBP: 0000200000000100 R08: 00007ffd8b15b240 R09: 0000000002200010
R10: 0000000002200010 R11: 0000000000000246 R12: 0000200000000140
R13: 00007ffd8b15b200 R14: 000000000001f2b6 R15: 0000200000000780
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-10-29 0:12 [syzbot] [ntfs3?] WARNING in ntfs_fill_super (2) syzbot
@ 2025-11-02 16:40 ` syzbot
2025-11-03 13:28 ` Forwarded: syzbot
1 sibling, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 16:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index aae1f32f4dab..f193912d8632 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -704,8 +704,8 @@ static void ntfs_put_super(struct super_block *sb)
ntfs_set_state(sbi, NTFS_DIRTY_CLEAR);
if (sbi->options) {
+ kfree(sbi->options->nls_name);
unload_nls(sbi->options->nls);
- kfree(sbi->options->nls);
kfree(sbi->options);
sbi->options = NULL;
}
@@ -1670,8 +1670,8 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
iput(inode);
out:
if (sbi && sbi->options) {
+ kfree(sbi->options->nls_name);
unload_nls(sbi->options->nls);
- kfree(sbi->options->nls);
kfree(sbi->options);
sbi->options = NULL;
}
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-10-29 0:12 [syzbot] [ntfs3?] WARNING in ntfs_fill_super (2) syzbot
2025-11-02 16:40 ` Forwarded: syzbot
@ 2025-11-03 13:28 ` syzbot
1 sibling, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-03 13:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz dup: WARNING in ntfs_put_super
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [jfs?] general protection fault in inode_set_ctime_current
@ 2025-10-24 23:10 syzbot
2025-10-27 23:06 ` Forwarded: syzbot
` (2 more replies)
0 siblings, 3 replies; 85+ messages in thread
From: syzbot @ 2025-10-24 23:10 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 6fab32bb6508 MAINTAINERS: add Mark Brown as a linux-next m..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16bd2d2f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=df98b4d1d5944c56
dashboard link: https://syzkaller.appspot.com/bug?extid=cd7590567cc388f064f3
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155a8be2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15078258580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-6fab32bb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b126dd4d891b/vmlinux-6fab32bb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ae26100863fd/bzImage-6fab32bb.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6617e28639c8/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=125f8c92580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cd7590567cc388f064f3@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
Oops: general protection fault, probably for non-canonical address 0xe00e9c0e000c60d6: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x00750070006306b0-0x00750070006306b7]
CPU: 0 UID: 0 PID: 5495 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:timestamp_truncate fs/inode.c:2732 [inline]
RIP: 0010:inode_set_ctime_current+0xcf/0xb40 fs/inode.c:2774
Code: d8 48 c1 e8 03 48 89 44 24 30 42 80 3c 20 00 74 08 48 89 df e8 e2 67 e7 ff 4c 8b 3b 49 8d bf 40 06 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 d6 07 00 00 48 89 5c 24 20 41 8b 87 40
RSP: 0018:ffffc90002b4f600 EFLAGS: 00010202
RAX: 000ea00e000c60d6 RBX: ffff88801c1ab220 RCX: ffff8880002b0000
RDX: 0000000000000000 RSI: 187182c674eb3579 RDI: 00750070006306b2
RBP: ffffc90002b4f6f0 R08: ffffffff8f7cf377 R09: 1ffffffff1ef9e6e
R10: dffffc0000000000 R11: fffffbfff1ef9e6f R12: dffffc0000000000
R13: ffff88801c1abe60 R14: ffffc90002b4f660 R15: 0075007000630072
FS: 000055557920a500(0000) GS:ffff88808d733000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31463fff CR3: 0000000011599000 CR4: 0000000000352ef0
Call Trace:
<TASK>
jfs_create+0x7f7/0xa80 fs/jfs/namei.c:152
lookup_open fs/namei.c:3796 [inline]
open_last_lookups fs/namei.c:3895 [inline]
path_openat+0x14f4/0x3830 fs/namei.c:4131
do_filp_open+0x1fa/0x410 fs/namei.c:4161
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3f1c98efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd9e448248 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f3f1cbe5fa0 RCX: 00007f3f1c98efc9
RDX: 000000000000275a RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007f3f1ca11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3f1cbe5fa0 R14: 00007f3f1cbe5fa0 R15: 0000000000000004
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:timestamp_truncate fs/inode.c:2732 [inline]
RIP: 0010:inode_set_ctime_current+0xcf/0xb40 fs/inode.c:2774
Code: d8 48 c1 e8 03 48 89 44 24 30 42 80 3c 20 00 74 08 48 89 df e8 e2 67 e7 ff 4c 8b 3b 49 8d bf 40 06 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 d6 07 00 00 48 89 5c 24 20 41 8b 87 40
RSP: 0018:ffffc90002b4f600 EFLAGS: 00010202
RAX: 000ea00e000c60d6 RBX: ffff88801c1ab220 RCX: ffff8880002b0000
RDX: 0000000000000000 RSI: 187182c674eb3579 RDI: 00750070006306b2
RBP: ffffc90002b4f6f0 R08: ffffffff8f7cf377 R09: 1ffffffff1ef9e6e
R10: dffffc0000000000 R11: fffffbfff1ef9e6f R12: dffffc0000000000
R13: ffff88801c1abe60 R14: ffffc90002b4f660 R15: 0075007000630072
FS: 000055557920a500(0000) GS:ffff88808d733000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffabbbdc000 CR3: 0000000011599000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: d8 48 c1 fmuls -0x3f(%rax)
3: e8 03 48 89 44 call 0x4489480b
8: 24 30 and $0x30,%al
a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
f: 74 08 je 0x19
11: 48 89 df mov %rbx,%rdi
14: e8 e2 67 e7 ff call 0xffe767fb
19: 4c 8b 3b mov (%rbx),%r15
1c: 49 8d bf 40 06 00 00 lea 0x640(%r15),%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 d6 07 00 00 jne 0x80d
37: 48 89 5c 24 20 mov %rbx,0x20(%rsp)
3c: 41 rex.B
3d: 8b .byte 0x8b
3e: 87 .byte 0x87
3f: 40 rex
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
@ 2025-10-27 23:06 ` syzbot
2025-10-28 17:25 ` Forwarded: syzbot
2025-10-28 20:53 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-27 23:06 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..07dd01c79ca2 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
int ri, struct component_name * key, int flag);
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
- ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+ ddata_t * data, struct dt_lock **);
static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
lv->length = 1;
dtlck->index++;
- dtInsertEntry(p, index, name, &data, &dtlck);
+ if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+ return rc;
/* linelock stbl of non-root leaf page */
if (!(p->header.flag & BT_ROOT)) {
@@ -3627,7 +3628,7 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */
*
* return: entry slot index
*/
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
ddata_t * data, struct dt_lock ** dtlock)
{
struct dtslot *h, *t;
@@ -3649,6 +3650,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* allocate a free slot */
hsi = fsi = p->header.freelist;
+ if (fsi >= p->header.maxslot) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
h = &p->slot[fsi];
p->header.freelist = h->next;
--p->header.freecnt;
@@ -3697,6 +3702,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
while (klen) {
/* get free slot */
fsi = p->header.freelist;
+ if (fsi >= p->header.maxslot) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
t = &p->slot[fsi];
p->header.freelist = t->next;
--p->header.freecnt;
@@ -3774,6 +3783,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* advance next available entry index of stbl */
++p->header.nextindex;
+
+ return 0;
}
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
2025-10-27 23:06 ` Forwarded: syzbot
@ 2025-10-28 17:25 ` syzbot
2025-10-28 18:02 ` Forwarded: Al Viro
2025-10-28 20:53 ` Forwarded: syzbot
2 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-10-28 17:25 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/jfs_dtree.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..e919de01c42a 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
int ri, struct component_name * key, int flag);
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
- ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+ ddata_t * data, struct dt_lock **);
static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
lv->length = 1;
dtlck->index++;
- dtInsertEntry(p, index, name, &data, &dtlck);
+ if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+ return rc;
/* linelock stbl of non-root leaf page */
if (!(p->header.flag & BT_ROOT)) {
@@ -3625,9 +3626,10 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */
* function: allocate free slot(s) and
* write a leaf/internal entry
*
- * return: entry slot index
+ * * return: 0 - success;
+ * errno - failure;
*/
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
ddata_t * data, struct dt_lock ** dtlock)
{
struct dtslot *h, *t;
@@ -3649,6 +3651,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* allocate a free slot */
hsi = fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
h = &p->slot[fsi];
p->header.freelist = h->next;
--p->header.freecnt;
@@ -3697,6 +3703,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
while (klen) {
/* get free slot */
fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
t = &p->slot[fsi];
p->header.freelist = t->next;
--p->header.freecnt;
@@ -3774,6 +3784,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* advance next available entry index of stbl */
++p->header.nextindex;
+
+ return 0;
}
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
2025-10-27 23:06 ` Forwarded: syzbot
2025-10-28 17:25 ` Forwarded: syzbot
@ 2025-10-28 20:53 ` syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-28 20:53 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/jfs_dtree.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..e919de01c42a 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
int ri, struct component_name * key, int flag);
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
- ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+ ddata_t * data, struct dt_lock **);
static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
lv->length = 1;
dtlck->index++;
- dtInsertEntry(p, index, name, &data, &dtlck);
+ if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+ return rc;
/* linelock stbl of non-root leaf page */
if (!(p->header.flag & BT_ROOT)) {
@@ -3625,9 +3626,10 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */
* function: allocate free slot(s) and
* write a leaf/internal entry
*
- * return: entry slot index
+ * * return: 0 - success;
+ * errno - failure;
*/
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
ddata_t * data, struct dt_lock ** dtlock)
{
struct dtslot *h, *t;
@@ -3649,6 +3651,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* allocate a free slot */
hsi = fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
h = &p->slot[fsi];
p->header.freelist = h->next;
--p->header.freecnt;
@@ -3697,6 +3703,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
while (klen) {
/* get free slot */
fsi = p->header.freelist;
+ if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
t = &p->slot[fsi];
p->header.freelist = t->next;
--p->header.freecnt;
@@ -3774,6 +3784,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
/* advance next available entry index of stbl */
++p->header.nextindex;
+
+ return 0;
}
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [hfs?] kernel BUG in hfs_new_inode
@ 2025-10-23 5:35 syzbot
2025-11-02 18:07 ` Forwarded: syzbot
` (2 more replies)
0 siblings, 3 replies; 85+ messages in thread
From: syzbot @ 2025-10-23 5:35 UTC (permalink / raw)
To: frank.li, glaubitz, linux-fsdevel, linux-kernel, slava,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 552c50713f27 Merge tag 'vfio-v6.18-rc3' of https://github...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1231d734580000
kernel config: https://syzkaller.appspot.com/x/.config?x=216353986aa62c5d
dashboard link: https://syzkaller.appspot.com/bug?extid=17cc9bb6d8d69b4139f0
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e953e2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=176d7c58580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/822137407e34/disk-552c5071.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c352dbdc77fe/vmlinux-552c5071.xz
kernel image: https://storage.googleapis.com/syzbot-assets/96bd9d9f8c50/bzImage-552c5071.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/d008a2751bbd/mount_0.gz
The issue was bisected to:
commit a06ec283e125e334155fe13005c76c9f484ce759
Author: Viacheslav Dubeyko <slava@dubeyko.com>
Date: Tue Jun 10 23:16:09 2025 +0000
hfs: add logic of correcting a next unused CNID
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11b4e3e2580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=13b4e3e2580000
console output: https://syzkaller.appspot.com/x/log.txt?x=15b4e3e2580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+17cc9bb6d8d69b4139f0@syzkaller.appspotmail.com
Fixes: a06ec283e125 ("hfs: add logic of correcting a next unused CNID")
loop0: detected capacity change from 0 to 64
hfs: unable to loca[ 123.243188][ T5988] hfs: unable to locate alternate MDB
hfs: continuing without an alternate MDB
------------[ cut here ]------------
kernel BUG at fs/hfs/inode.c:222!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5988 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:hfs_new_inode+0xbc4/0xbd0 fs/hfs/inode.c:222
Code: 89 f1 80 e1 07 fe c1 38 c1 0f 8c 15 fa ff ff 4c 89 f7 e8 0f 6f 8b ff e9 08 fa ff ff e8 b5 b7 29 ff 90 0f 0b e8 ad b7 29 ff 90 <0f> 0b e8 a5 b7 29 ff 90 0f 0b 66 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900040af848 EFLAGS: 00010293
RAX: ffffffff829555d3 RBX: ffff8880335088c8 RCX: ffff888026d23c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1005214608 R12: ffff8880290a3000
R13: 1ffff110073d90f3 R14: 0000000100000000 R15: ffff8880335088c8
FS: 00007f6c84dde6c0(0000) GS:ffff888126cc2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e263fff CR3: 000000003276a000 CR4: 00000000003526f0
Call Trace:
<TASK>
hfs_create+0x2a/0xe0 fs/hfs/dir.c:198
lookup_open fs/namei.c:3796 [inline]
open_last_lookups fs/namei.c:3895 [inline]
path_openat+0x1500/0x3840 fs/namei.c:4131
do_filp_open+0x1fa/0x410 fs/namei.c:4161
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6c8576efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6c84dde038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6c859c5fa0 RCX: 00007f6c8576efc9
RDX: 0000000000000042 RSI: 00002000000002c0 RDI: ffffffffffffff9c
RBP: 00007f6c857f1f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000058 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6c859c6038 R14: 00007f6c859c5fa0 R15: 00007fffc4216518
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hfs_new_inode+0xbc4/0xbd0 fs/hfs/inode.c:222
Code: 89 f1 80 e1 07 fe c1 38 c1 0f 8c 15 fa ff ff 4c 89 f7 e8 0f 6f 8b ff e9 08 fa ff ff e8 b5 b7 29 ff 90 0f 0b e8 ad b7 29 ff 90 <0f> 0b e8 a5 b7 29 ff 90 0f 0b 66 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900040af848 EFLAGS: 00010293
RAX: ffffffff829555d3 RBX: ffff8880335088c8 RCX: ffff888026d23c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1005214608 R12: ffff8880290a3000
R13: 1ffff110073d90f3 R14: 0000000100000000 R15: ffff8880335088c8
FS: 00007f6c84dde6c0(0000) GS:ffff888126cc2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e263fff CR3: 000000003276a000 CR4: 00000000003526f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
@ 2025-11-02 18:07 ` syzbot
2025-11-02 19:22 ` Forwarded: syzbot
2025-11-03 12:27 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 18:07 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
- if (!inode)
- return -ENOMEM;
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index fff149af89da..6808b1316b60 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -273,4 +273,6 @@ static inline void hfs_bitmap_dirty(struct super_block *sb)
__bh; \
})
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..ef46a2d29d6a 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -188,7 +188,7 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
s64 folder_count;
if (!inode)
- return NULL;
+ return ERR_PTR(-ENOMEM);
mutex_init(&HFS_I(inode)->extents_lock);
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
@@ -209,7 +209,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
if (S_ISDIR(mode)) {
inode->i_size = 2;
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
- BUG_ON(folder_count > U32_MAX);
+ if (folder_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: folder count on super block is corrupt");
+ return ERR_PTR(-EFSCORRUPTED);
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_dirs++;
inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +222,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
} else if (S_ISREG(mode)) {
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
- BUG_ON(file_count > U32_MAX);
+ if (file_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: file count on super block is corrupt");
+ return ERR_PTR(-EFSCORRUPTED);
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_files++;
inode->i_op = &hfs_file_inode_operations;
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
2025-11-02 18:07 ` Forwarded: syzbot
@ 2025-11-02 19:22 ` syzbot
2025-11-03 12:27 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 19:22 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
- if (!inode)
- return -ENOMEM;
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index fff149af89da..6808b1316b60 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -273,4 +273,6 @@ static inline void hfs_bitmap_dirty(struct super_block *sb)
__bh; \
})
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..cb74904994cc 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -186,16 +186,22 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
s64 next_id;
s64 file_count;
s64 folder_count;
+ int err = -ENOMEM;
if (!inode)
- return NULL;
+ goto out_err;
+
+ err = -EFSCORRUPTED;
mutex_init(&HFS_I(inode)->extents_lock);
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
spin_lock_init(&HFS_I(inode)->open_dir_lock);
hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
- BUG_ON(next_id > U32_MAX);
+ if (next_id > U32_MAX) {
+ printk(KERN_CRIT "hfs error: next file id on super block is corrupt");
+ goto out_discard;
+ }
inode->i_ino = (u32)next_id;
inode->i_mode = mode;
inode->i_uid = current_fsuid();
@@ -209,7 +215,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
if (S_ISDIR(mode)) {
inode->i_size = 2;
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
- BUG_ON(folder_count > U32_MAX);
+ if (folder_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: folder count on super block is corrupt");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_dirs++;
inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +228,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
} else if (S_ISREG(mode)) {
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
- BUG_ON(file_count > U32_MAX);
+ if (file_count > U32_MAX) {
+ printk(KERN_CRIT "hfs error: file count on super block is corrupt");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_files++;
inode->i_op = &hfs_file_inode_operations;
@@ -243,6 +255,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
hfs_mark_mdb_dirty(sb);
return inode;
+
+ out_discard:
+ iput(inode);
+ out_err:
+ return ERR_PTR(err);
}
void hfs_delete_inode(struct inode *inode)
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
2025-11-02 18:07 ` Forwarded: syzbot
2025-11-02 19:22 ` Forwarded: syzbot
@ 2025-11-03 12:27 ` syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-03 12:27 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
- if (!inode)
- return -ENOMEM;
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..beec6fe7e801 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -186,16 +186,23 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
s64 next_id;
s64 file_count;
s64 folder_count;
+ int err = -ENOMEM;
if (!inode)
- return NULL;
+ goto out_err;
+
+ err = -ENOSPC;
mutex_init(&HFS_I(inode)->extents_lock);
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
spin_lock_init(&HFS_I(inode)->open_dir_lock);
hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
- BUG_ON(next_id > U32_MAX);
+ if (next_id > U32_MAX) {
+ pr_err("hfs: next file ID exceeds 32-bit limit — possible "
+ "superblock corruption");
+ goto out_discard;
+ }
inode->i_ino = (u32)next_id;
inode->i_mode = mode;
inode->i_uid = current_fsuid();
@@ -209,7 +216,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
if (S_ISDIR(mode)) {
inode->i_size = 2;
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
- BUG_ON(folder_count > U32_MAX);
+ if (folder_count > U32_MAX) {
+ pr_err("hfs: folder count exceeds 32-bit limit — possible "
+ "superblock corruption");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_dirs++;
inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +230,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
} else if (S_ISREG(mode)) {
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
- BUG_ON(file_count > U32_MAX);
+ if (file_count > U32_MAX) {
+ pr_err("hfs: file count exceeds 32-bit limit — possible "
+ "superblock corruption");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_files++;
inode->i_op = &hfs_file_inode_operations;
@@ -243,6 +258,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
hfs_mark_mdb_dirty(sb);
return inode;
+
+ out_discard:
+ iput(inode);
+ out_err:
+ return ERR_PTR(err);
}
void hfs_delete_inode(struct inode *inode)
@@ -251,7 +271,6 @@ void hfs_delete_inode(struct inode *inode)
hfs_dbg("ino %lu\n", inode->i_ino);
if (S_ISDIR(inode->i_mode)) {
- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
atomic64_dec(&HFS_SB(sb)->folder_count);
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
HFS_SB(sb)->root_dirs--;
@@ -260,7 +279,6 @@ void hfs_delete_inode(struct inode *inode)
return;
}
- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
atomic64_dec(&HFS_SB(sb)->file_count);
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
HFS_SB(sb)->root_files--;
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 53f3fae60217..1c3fb631cc8e 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -273,15 +273,12 @@ void hfs_mdb_commit(struct super_block *sb)
/* These parameters may have been modified, so write them back */
mdb->drLsMod = hfs_mtime();
mdb->drFreeBks = cpu_to_be16(HFS_SB(sb)->free_ablocks);
- BUG_ON(atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX);
mdb->drNxtCNID =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->next_id));
mdb->drNmFls = cpu_to_be16(HFS_SB(sb)->root_files);
mdb->drNmRtDirs = cpu_to_be16(HFS_SB(sb)->root_dirs);
- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
mdb->drFilCnt =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->file_count));
- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
mdb->drDirCnt =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->folder_count));
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [net?] kernel BUG in set_ipsecrequest
@ 2025-10-17 5:53 syzbot
2025-10-20 11:19 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-10-17 5:53 UTC (permalink / raw)
To: davem, edumazet, herbert, horms, kuba, linux-kernel, netdev,
pabeni, steffen.klassert, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 48a97ffc6c82 bpf: Consistently use bpf_rcu_lock_held() eve..
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=144d0734580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9ad7b090a18654a7
dashboard link: https://syzkaller.appspot.com/bug?extid=be97dd4da14ae88b6ba4
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16f7e5e2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11ecec58580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/87ffd600eff3/disk-48a97ffc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/aa84f0e32430/vmlinux-48a97ffc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/16498048e16c/bzImage-48a97ffc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+be97dd4da14ae88b6ba4@syzkaller.appspotmail.com
skbuff: skb_over_panic: text:ffffffff8a1fdd63 len:392 put:16 head:ffff888073664d00 data:ffff888073664d00 tail:0x188 end:0x180 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:212!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 6012 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:212
Code: c7 60 10 6e 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 6e 54 f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003d5eb68 EFLAGS: 00010282
RAX: 0000000000000088 RBX: dffffc0000000000 RCX: bc84b821dc35fd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000180 R08: ffffc90003d5e867 R09: 1ffff920007abd0c
R10: dffffc0000000000 R11: fffff520007abd0d R12: ffff8880720b7b50
R13: ffff888073664d00 R14: ffff888073664d00 R15: 0000000000000188
FS: 000055555b9e7500(0000) GS:ffff888125e0c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555b9e7808 CR3: 000000007ead6000 CR4: 00000000003526f0
Call Trace:
<TASK>
skb_over_panic net/core/skbuff.c:217 [inline]
skb_put+0x159/0x210 net/core/skbuff.c:2583
skb_put_zero include/linux/skbuff.h:2788 [inline]
set_ipsecrequest+0x73/0x680 net/key/af_key.c:3532
pfkey_send_migrate+0x11f2/0x1de0 net/key/af_key.c:3636
km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2838
xfrm_migrate+0x2020/0x2330 net/xfrm/xfrm_policy.c:4698
xfrm_do_migrate+0x796/0x900 net/xfrm/xfrm_user.c:3144
xfrm_user_rcv_msg+0x7a3/0xab0 net/xfrm/xfrm_user.c:3501
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3523
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742
____sys_sendmsg+0x505/0x830 net/socket.c:2630
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684
__sys_sendmsg net/socket.c:2716 [inline]
__do_sys_sendmsg net/socket.c:2721 [inline]
__se_sys_sendmsg net/socket.c:2719 [inline]
__x64_sys_sendmsg+0x19b/0x260 net/socket.c:2719
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5fcd58eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe59dd1ab8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f5fcd7e5fa0 RCX: 00007f5fcd58eec9
RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000004
RBP: 00007f5fcd611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5fcd7e5fa0 R14: 00007f5fcd7e5fa0 R15: 0000000000000003
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:212
Code: c7 60 10 6e 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 6e 54 f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003d5eb68 EFLAGS: 00010282
RAX: 0000000000000088 RBX: dffffc0000000000 RCX: bc84b821dc35fd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000180 R08: ffffc90003d5e867 R09: 1ffff920007abd0c
R10: dffffc0000000000 R11: fffff520007abd0d R12: ffff8880720b7b50
R13: ffff888073664d00 R14: ffff888073664d00 R15: 0000000000000188
FS: 000055555b9e7500(0000) GS:ffff888125e0c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555b9e7808 CR3: 000000007ead6000 CR4: 00000000003526f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-10-17 5:53 [syzbot] [net?] kernel BUG in set_ipsecrequest syzbot
@ 2025-10-20 11:19 ` syzbot
0 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-20 11:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: clf700383@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
From 6dc2deb09faf7d53707cc9e75e175b09644fd181 Mon Sep 17 00:00:00 2001
From: clingfei <clf700383@gmail.com>
Date: Mon, 20 Oct 2025 13:48:54 +0800
Subject: [PATCH] fix integer overflow in set_ipsecrequest
syzbot reported a kernel BUG in set_ipsecrequest() due to an skb_over_panic.
The mp->new_family and mp->old_family is u16, while set_ipsecrequest receives
family as uint8_t, causing a integer overflow and the later size_req calculation
error, which exceeds the size used in alloc_skb, and ultimately triggered the
kernel bug in skb_put.
Reported-by: syzbot+be97dd4da14ae88b6ba4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=be97dd4da14ae88b6ba4
Signed-off-by: Cheng Lingfei <clf700383@gmail.com>
---
net/key/af_key.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 2ebde0352245..08f4cde01994 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3518,7 +3518,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *
static int set_ipsecrequest(struct sk_buff *skb,
uint8_t proto, uint8_t mode, int level,
- uint32_t reqid, uint8_t family,
+ uint32_t reqid, uint16_t family,
const xfrm_address_t *src, const xfrm_address_t *dst)
{
struct sadb_x_ipsecrequest *rq;
--
2.34.1
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [ntfs3?] WARNING in indx_insert_into_buffer (3)
@ 2025-10-05 23:30 syzbot
2025-10-07 21:52 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-10-05 23:30 UTC (permalink / raw)
To: almaz.alexandrovich, linux-kernel, ntfs3, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 6093a688a07d Merge tag 'char-misc-6.18-rc1' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13962458580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e654219ed2546322
dashboard link: https://syzkaller.appspot.com/bug?extid=3a1878433bc1cb97b42a
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=104b692f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17962458580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/660883fc9bdb/disk-6093a688.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/29f543ec9187/vmlinux-6093a688.xz
kernel image: https://storage.googleapis.com/syzbot-assets/456918818f89/bzImage-6093a688.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/dc6369359d19/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3a1878433bc1cb97b42a@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 4096
------------[ cut here ]------------
memcpy: detected field-spanning write (size 3656) of single field "hdr1" at fs/ntfs3/index.c:1927 (size 16)
WARNING: CPU: 0 PID: 6065 at fs/ntfs3/index.c:1927 indx_insert_into_buffer.isra.0+0x1041/0x12a0 fs/ntfs3/index.c:1927
Modules linked in:
CPU: 0 UID: 0 PID: 6065 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:indx_insert_into_buffer.isra.0+0x1041/0x12a0 fs/ntfs3/index.c:1927
Code: b5 ed a3 fe c6 05 52 41 31 0d 01 90 48 8b 74 24 68 b9 10 00 00 00 48 c7 c2 20 53 a7 8b 48 c7 c7 80 53 a7 8b e8 a0 74 62 fe 90 <0f> 0b 90 90 e9 df fd ff ff e8 71 6d 0b ff e9 4d f4 ff ff e8 67 6d
RSP: 0018:ffffc900039af748 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 00000000ffffffe4 RCX: ffffffff81799b88
RDX: ffff88802ed50000 RSI: ffffffff81799b95 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888146f46800
R13: ffff888069637800 R14: 0000000000000e48 R15: ffff88807ae74018
FS: 0000555563ff7500(0000) GS:ffff888124e6a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdbd7fd4286 CR3: 0000000069517000 CR4: 0000000000350ef0
Call Trace:
<TASK>
indx_insert_entry+0x1a0/0x460 fs/ntfs3/index.c:1996
ni_add_name+0x4dd/0x820 fs/ntfs3/frecord.c:2995
ni_rename+0x98/0x170 fs/ntfs3/frecord.c:3026
ntfs_rename+0xab9/0xf00 fs/ntfs3/namei.c:332
vfs_rename+0xfa3/0x2290 fs/namei.c:5216
do_renameat2+0x7d8/0xc20 fs/namei.c:5364
__do_sys_rename fs/namei.c:5411 [inline]
__se_sys_rename fs/namei.c:5409 [inline]
__x64_sys_rename+0x7d/0xa0 fs/namei.c:5409
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f780118eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcbf706748 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f78013e5fa0 RCX: 00007f780118eec9
RDX: 0000000000000000 RSI: 0000200000000f40 RDI: 00002000000003c0
RBP: 00007f7801211f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f78013e5fa0 R14: 00007f78013e5fa0 R15: 0000000000000002
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-10-05 23:30 [syzbot] [ntfs3?] WARNING in indx_insert_into_buffer (3) syzbot
@ 2025-10-07 21:52 ` syzbot
0 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-07 21:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
fs/ntfs3/index.c | 10 +++++-----
fs/ntfs3/ntfs.h | 5 ++++-
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 6d1bf890929d..2e512abc7000 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1808,7 +1808,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
CLST new_vbn;
__le64 t_vbn, *sub_vbn;
u16 sp_size;
- void *hdr1_saved = NULL;
+ void *blk1_saved = NULL;
/* Try the most easy case. */
e = fnd->level - 1 == level ? fnd->de[level] : NULL;
@@ -1842,8 +1842,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
memcpy(up_e, sp, sp_size);
used1 = le32_to_cpu(hdr1->used);
- hdr1_saved = kmemdup(hdr1, used1, GFP_NOFS);
- if (!hdr1_saved) {
+ blk1_saved = kmemdup(&n1->index->blk, used1, GFP_NOFS);
+ if (!blk1_saved) {
err = -ENOMEM;
goto out;
}
@@ -1924,13 +1924,13 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
- memcpy(hdr1, hdr1_saved, used1);
+ memcpy(&n1->index->blk, blk1_saved, used1);
indx_write(indx, ni, n1, 0);
}
out:
kfree(up_e);
- kfree(hdr1_saved);
+ kfree(blk1_saved);
return err;
}
diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 552b97905813..d5e2b22eacd7 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -754,7 +754,10 @@ static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr)
struct INDEX_BUFFER {
struct NTFS_RECORD_HEADER rhdr; // 'INDX'
__le64 vbn; // 0x10: vcn if index >= cluster or vsn id index < cluster
- struct INDEX_HDR ihdr; // 0x18:
+ struct_group(blk,
+ struct INDEX_HDR ihdr; // 0x18:
+ u8 data[]; // NTFS_DE entries
+ );
};
static_assert(sizeof(struct INDEX_BUFFER) == 0x28);
--
2.51.0
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [ntfs3?] KMSAN: uninit-value in ntfs_read_hdr (3)
@ 2025-09-17 22:55 syzbot
2025-10-26 15:54 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-09-17 22:55 UTC (permalink / raw)
To: almaz.alexandrovich, linux-kernel, ntfs3, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 5aca7966d2a7 Merge tag 'perf-tools-fixes-for-v6.17-2025-09..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12998c7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1b093ccee5a9e08c
dashboard link: https://syzkaller.appspot.com/bug?extid=332bd4e9d148f11a87dc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14ccc534580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16998c7c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7dcf9f15bc6a/disk-5aca7966.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8836a30085d9/vmlinux-5aca7966.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b00f10dc0558/bzImage-5aca7966.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/78b7a2febda1/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in ntfs_dir_emit fs/ntfs3/dir.c:335 [inline]
BUG: KMSAN: uninit-value in ntfs_read_hdr+0xfcc/0x13e0 fs/ntfs3/dir.c:385
ntfs_dir_emit fs/ntfs3/dir.c:335 [inline]
ntfs_read_hdr+0xfcc/0x13e0 fs/ntfs3/dir.c:385
ntfs_readdir+0xf21/0x1a30 fs/ntfs3/dir.c:496
iterate_dir+0x452/0x620 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:410 [inline]
__se_sys_getdents64+0x17e/0x550 fs/readdir.c:396
__x64_sys_getdents64+0x97/0xe0 fs/readdir.c:396
x64_sys_call+0x3a14/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:218
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
ntfs_write_bh+0x6ae/0xe90 fs/ntfs3/fsntfs.c:1430
indx_write fs/ntfs3/index.c:1027 [inline]
indx_insert_into_buffer+0x287/0x2010 fs/ntfs3/index.c:1809
indx_insert_entry+0xcde/0x1050 fs/ntfs3/index.c:1986
ni_add_name+0xef7/0x11e0 fs/ntfs3/frecord.c:2995
ntfs_link_inode+0x221/0x350 fs/ntfs3/inode.c:1728
ntfs_link+0x20e/0x500 fs/ntfs3/namei.c:146
vfs_link+0x8eb/0xb30 fs/namei.c:4854
do_linkat+0x4af/0x1040 fs/namei.c:4924
__do_sys_link fs/namei.c:4958 [inline]
__se_sys_link fs/namei.c:4956 [inline]
__x64_sys_link+0xd7/0x140 fs/namei.c:4956
x64_sys_call+0x162f/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:87
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
hdr_insert_de+0x4c8/0x550 fs/ntfs3/index.c:838
indx_insert_into_buffer+0x1b6/0x2010 fs/ntfs3/index.c:1805
indx_insert_entry+0xcde/0x1050 fs/ntfs3/index.c:1986
ni_add_name+0xef7/0x11e0 fs/ntfs3/frecord.c:2995
ntfs_link_inode+0x221/0x350 fs/ntfs3/inode.c:1728
ntfs_link+0x20e/0x500 fs/ntfs3/namei.c:146
vfs_link+0x8eb/0xb30 fs/namei.c:4854
do_linkat+0x4af/0x1040 fs/namei.c:4924
__do_sys_link fs/namei.c:4958 [inline]
__se_sys_link fs/namei.c:4956 [inline]
__x64_sys_link+0xd7/0x140 fs/namei.c:4956
x64_sys_call+0x162f/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:87
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4197 [inline]
slab_alloc_node mm/slub.c:4240 [inline]
kmem_cache_alloc_noprof+0x81b/0xec0 mm/slub.c:4247
ntfs_link_inode+0x90/0x350 fs/ntfs3/inode.c:1716
ntfs_link+0x20e/0x500 fs/ntfs3/namei.c:146
vfs_link+0x8eb/0xb30 fs/namei.c:4854
do_linkat+0x4af/0x1040 fs/namei.c:4924
__do_sys_link fs/namei.c:4958 [inline]
__se_sys_link fs/namei.c:4956 [inline]
__x64_sys_link+0xd7/0x140 fs/namei.c:4956
x64_sys_call+0x162f/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:87
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 0 UID: 0 PID: 5963 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bfs?] INFO: task hung in bfs_lookup (6)
@ 2025-09-17 22:54 syzbot
2025-10-20 18:09 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-09-17 22:54 UTC (permalink / raw)
To: aivazian.tigran, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 46a51f4f5eda Merge tag 'for-v6.17-rc' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1735fb12580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4d8792ecb6308d0f
dashboard link: https://syzkaller.appspot.com/bug?extid=e7be6bf3e45b7b463bfa
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1498ce42580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1372f47c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6619a20dd985/disk-46a51f4f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a1bd79f3645b/vmlinux-46a51f4f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bf4ae36aa984/bzImage-46a51f4f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/5effb040f80e/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e7be6bf3e45b7b463bfa@syzkaller.appspotmail.com
INFO: task syz.0.17:6050 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:27944 pid:6050 tgid:6048 ppid:5989 task_flags:0x400040 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1798/0x4cc0 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7058
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115
__mutex_lock_common kernel/locking/mutex.c:676 [inline]
__mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760
bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
__lookup_slow+0x297/0x3d0 fs/namei.c:1808
lookup_slow+0x53/0x70 fs/namei.c:1825
walk_component fs/namei.c:2129 [inline]
link_path_walk+0x935/0xea0 fs/namei.c:2497
path_parentat fs/namei.c:2701 [inline]
__filename_parentat+0x246/0x670 fs/namei.c:2725
filename_parentat fs/namei.c:2743 [inline]
filename_create+0xd2/0x3c0 fs/namei.c:4120
do_mkdirat+0xa0/0x590 fs/namei.c:4391
__do_sys_mkdirat fs/namei.c:4416 [inline]
__se_sys_mkdirat fs/namei.c:4414 [inline]
__x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4414
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2cbfd8eba9
RSP: 002b:00007f2cc0c24038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f2cbffd6090 RCX: 00007f2cbfd8eba9
RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007f2cbfe11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2cbffd6128 R14: 00007f2cbffd6090 R15: 00007fff497ab7d8
</TASK>
Showing all locks held in the system:
3 locks held by kworker/u8:1/13:
#0: ffff88801a481148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff88801a481148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319
#1: ffffc90000127bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc90000127bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319
#2: ffffffff8f539f48 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303
1 lock held by khungtaskd/31:
#0: ffffffff8e13a0e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e13a0e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e13a0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by kswapd0/85:
2 locks held by kworker/u8:9/3515:
#0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:636
#1: ffff8880b8624008 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
3 locks held by kworker/u8:11/3585:
#0: ffff88802f1b4148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff88802f1b4148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319
#1: ffffc9000c50fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc9000c50fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319
#2: ffffffff8f539f48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff8f539f48 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734
2 locks held by getty/5618:
#0: ffff8880331760a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
3 locks held by syz.0.17/6049:
2 locks held by syz.0.17/6050:
#0: ffff88805b33c160 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: inode_lock_shared include/linux/fs.h:885 [inline]
#0: ffff88805b33c160 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1824
#1: ffff88807eec4ad8 (&info->bfs_lock){+.+.}-{4:4}, at: bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
2 locks held by syz.1.18/6074:
2 locks held by syz.1.18/6075:
#0: ffff888075e98160 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: inode_lock_shared include/linux/fs.h:885 [inline]
#0: ffff888075e98160 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1824
#1: ffff888142f9ecd8 (&info->bfs_lock){+.+.}-{4:4}, at: bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
3 locks held by syz.2.19/6105:
2 locks held by syz.2.19/6106:
#0: ffff888075e98680 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: inode_lock_shared include/linux/fs.h:885 [inline]
#0: ffff888075e98680 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1824
#1: ffff88807ff9f8d8 (&info->bfs_lock){+.+.}-{4:4}, at: bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
2 locks held by syz.3.20/6130:
2 locks held by syz.3.20/6131:
#0: ffff88805b33c680 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: inode_lock_shared include/linux/fs.h:885 [inline]
#0: ffff88805b33c680 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1824
#1: ffff88807669e6d8 (&info->bfs_lock){+.+.}-{4:4}, at: bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
2 locks held by syz.4.21/6163:
2 locks held by syz.4.21/6164:
#0: ffff888075e98ba0 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: inode_lock_shared include/linux/fs.h:885 [inline]
#0: ffff888075e98ba0 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1824
#1: ffff88807e38ead8 (&info->bfs_lock){+.+.}-{4:4}, at: bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
4 locks held by syz.5.22/6201:
2 locks held by syz.5.22/6202:
#0: ffff88805b33cba0 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: inode_lock_shared include/linux/fs.h:885 [inline]
#0: ffff88805b33cba0 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1824
#1: ffff888079c822d8 (&info->bfs_lock){+.+.}-{4:4}, at: bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
2 locks held by syz.6.23/6232:
2 locks held by syz.6.23/6233:
#0: ffff88805b33d0c0 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: inode_lock_shared include/linux/fs.h:885 [inline]
#0: ffff88805b33d0c0 (&type->i_mutex_dir_key#8){.+.+}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1824
#1: ffff88807f1d6ed8 (&info->bfs_lock){+.+.}-{4:4}, at: bfs_lookup+0xe3/0x1d0 fs/bfs/dir.c:136
3 locks held by syz-executor/6236:
#0: ffffffff8eca94a0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8eca94a0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8eca94a0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff8f539f48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f539f48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8f539f48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4056
#2: ffffffff8e13fb78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
#2: ffffffff8e13fb78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 kernel/rcu/tree_exp.h:957
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf93/0xfe0 kernel/hung_task.c:491
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6105 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:32 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline]
RIP: 0010:lock_release+0xaa/0x3e0 kernel/locking/lockdep.c:5885
Code: 92 41 83 bf ec 0a 00 00 00 0f 85 1e 02 00 00 49 81 3e 20 73 64 93 0f 84 11 02 00 00 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 <48> 8b 5c 24 20 fa 48 c7 c7 ce d9 9c 8d e8 64 f3 dc 09 65 ff 05 0d
RSP: 0018:ffffc900031e7118 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffffffff81aac64d RCX: 2a325ada796eef00
RDX: 0000000000000000 RSI: ffffffff8be33e60 RDI: ffffffff8be33e20
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff81aac64d
R10: dffffc0000000000 R11: ffffffff81ac4b00 R12: ffff88807c293c00
R13: ffffffff81aac64d R14: ffffffff8e13a0e0 R15: ffff88807c293c00
FS: 00007f813c8526c0(0000) GS:ffff888125c15000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563fc1d6aa38 CR3: 0000000032a9c000 CR4: 0000000000350ef0
Call Trace:
<TASK>
rcu_lock_release include/linux/rcupdate.h:341 [inline]
rcu_read_unlock include/linux/rcupdate.h:871 [inline]
class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
is_module_text_address+0x18b/0x1e0 kernel/module/main.c:3847
kernel_text_address+0x94/0xe0 kernel/extable.c:119
__kernel_text_address+0xd/0x40 kernel/extable.c:79
unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xfc/0x150 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4376 [inline]
__kmalloc_node_noprof+0x276/0x4e0 mm/slub.c:4382
kmalloc_array_node_noprof include/linux/slab.h:1020 [inline]
alloc_slab_obj_exts+0x39/0xa0 mm/slub.c:2033
__memcg_slab_post_alloc_hook+0x31e/0x7f0 mm/memcontrol.c:3174
memcg_slab_post_alloc_hook mm/slub.c:2221 [inline]
slab_post_alloc_hook mm/slub.c:4201 [inline]
slab_alloc_node mm/slub.c:4240 [inline]
kmem_cache_alloc_noprof+0x2bf/0x3c0 mm/slub.c:4247
alloc_buffer_head+0x2a/0x270 fs/buffer.c:3025
folio_alloc_buffers+0x32d/0x640 fs/buffer.c:935
grow_dev_folio fs/buffer.c:1075 [inline]
grow_buffers fs/buffer.c:1116 [inline]
__getblk_slow fs/buffer.c:1134 [inline]
bdev_getblk+0x286/0x660 fs/buffer.c:1461
__bread_gfp+0x89/0x3c0 fs/buffer.c:1515
sb_bread include/linux/buffer_head.h:346 [inline]
bfs_find_entry+0x1c2/0x420 fs/bfs/dir.c:333
bfs_lookup+0xf1/0x1d0 fs/bfs/dir.c:137
lookup_open fs/namei.c:3686 [inline]
open_last_lookups fs/namei.c:3807 [inline]
path_openat+0x1101/0x3830 fs/namei.c:4043
do_filp_open+0x1fa/0x410 fs/namei.c:4073
do_sys_openat2+0x121/0x1c0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1461
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f813b98eba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f813c852038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f813bbd5fa0 RCX: 00007f813b98eba9
RDX: 0000000000000000 RSI: 0000200000000100 RDI: ffffffffffffff9c
RBP: 00007f813ba11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f813bbd6038 R14: 00007f813bbd5fa0 R15: 00007fffad51a318
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [kernel?] KASAN: slab-out-of-bounds Read in change_page_attr_set_clr
@ 2025-09-03 17:36 syzbot
2025-09-29 7:50 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-09-03 17:36 UTC (permalink / raw)
To: bp, dave.hansen, hpa, linux-kernel, luto, mingo, peterz,
syzkaller-bugs, tglx, x86
Hello,
syzbot found the following issue on:
HEAD commit: 5d50cf9f7cf2 Add linux-next specific files for 20250903
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1737aa42580000
kernel config: https://syzkaller.appspot.com/x/.config?x=75c8190df02c3a12
dashboard link: https://syzkaller.appspot.com/bug?extid=e34177f6091df113ef20
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17863e34580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14cace62580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/507bf19223ad/disk-5d50cf9f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/291d21d10813/vmlinux-5d50cf9f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c70044ef19c4/bzImage-5d50cf9f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e34177f6091df113ef20@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in __cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline]
BUG: KASAN: slab-out-of-bounds in cpa_flush arch/x86/mm/pat/set_memory.c:449 [inline]
BUG: KASAN: slab-out-of-bounds in change_page_attr_set_clr+0x625/0xfc0 arch/x86/mm/pat/set_memory.c:2115
Read of size 8 at addr ffff8880307dca48 by task syz.0.17/6026
CPU: 0 UID: 0 PID: 6026 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline]
cpa_flush arch/x86/mm/pat/set_memory.c:449 [inline]
change_page_attr_set_clr+0x625/0xfc0 arch/x86/mm/pat/set_memory.c:2115
cpa_set_pages_array arch/x86/mm/pat/set_memory.c:2137 [inline]
_set_pages_array+0x145/0x270 arch/x86/mm/pat/set_memory.c:2521
drm_gem_shmem_get_pages_locked+0x2d0/0x440 drivers/gpu/drm/drm_gem_shmem_helper.c:214
drm_gem_shmem_mmap+0x193/0x460 drivers/gpu/drm/drm_gem_shmem_helper.c:646
drm_gem_mmap_obj+0x18a/0x4e0 drivers/gpu/drm/drm_gem.c:1167
drm_gem_mmap+0x384/0x640 drivers/gpu/drm/drm_gem.c:1245
vfs_mmap include/linux/fs.h:2281 [inline]
mmap_file mm/internal.h:167 [inline]
__mmap_new_file_vma mm/vma.c:2413 [inline]
__mmap_new_vma mm/vma.c:2476 [inline]
__mmap_region mm/vma.c:2669 [inline]
mmap_region+0x18ab/0x20c0 mm/vma.c:2739
do_mmap+0xc45/0x10d0 mm/mmap.c:558
vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:580
ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f16ecf8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe3ff9fb58 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f16ed1c5fa0 RCX: 00007f16ecf8ebe9
RDX: 0000000000000004 RSI: 0000000000004000 RDI: 0000200000001000
RBP: 00007f16ed011e19 R08: 0000000000000003 R09: 0000000100000000
R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f16ed1c5fa0 R14: 00007f16ed1c5fa0 R15: 0000000000000006
</TASK>
Allocated by task 6026:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:397 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:5366 [inline]
__kvmalloc_node_noprof+0x5cd/0x910 mm/slub.c:6527
kvmalloc_array_node_noprof include/linux/slab.h:1118 [inline]
drm_gem_get_pages+0x166/0xa20 drivers/gpu/drm/drm_gem.c:647
drm_gem_shmem_get_pages_locked+0x201/0x440 drivers/gpu/drm/drm_gem_shmem_helper.c:200
drm_gem_shmem_mmap+0x193/0x460 drivers/gpu/drm/drm_gem_shmem_helper.c:646
drm_gem_mmap_obj+0x18a/0x4e0 drivers/gpu/drm/drm_gem.c:1167
drm_gem_mmap+0x384/0x640 drivers/gpu/drm/drm_gem.c:1245
vfs_mmap include/linux/fs.h:2281 [inline]
mmap_file mm/internal.h:167 [inline]
__mmap_new_file_vma mm/vma.c:2413 [inline]
__mmap_new_vma mm/vma.c:2476 [inline]
__mmap_region mm/vma.c:2669 [inline]
mmap_region+0x18ab/0x20c0 mm/vma.c:2739
do_mmap+0xc45/0x10d0 mm/mmap.c:558
vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:580
ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8880307dc800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes to the right of
allocated 584-byte region [ffff8880307dc800, ffff8880307dca48)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x307d8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801a841dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801a841dc0 dead000000000122 0000000000000000
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000c1f601 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 36, tgid 36 (kworker/u8:2), ts 106205622023, free_ts 105780713777
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850
prep_new_page mm/page_alloc.c:1858 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3857
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5147
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2996 [inline]
allocate_slab+0x8a/0x330 mm/slub.c:3164
new_slab mm/slub.c:3218 [inline]
___slab_alloc+0xbd1/0x13f0 mm/slub.c:4420
__slab_alloc+0x55/0xa0 mm/slub.c:4511
__slab_alloc_node mm/slub.c:4586 [inline]
slab_alloc_node mm/slub.c:4996 [inline]
__do_kmalloc_node mm/slub.c:5365 [inline]
__kmalloc_noprof+0x471/0x7f0 mm/slub.c:5378
kmalloc_noprof include/linux/slab.h:960 [inline]
kzalloc_noprof include/linux/slab.h:1090 [inline]
neigh_alloc net/core/neighbour.c:522 [inline]
___neigh_create+0x6d5/0x2260 net/core/neighbour.c:656
ip6_finish_output2+0x1175/0x1480 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbce/0x1510 net/ipv6/ndisc.c:512
ndisc_send_ns+0xcb/0x150 net/ipv6/ndisc.c:670
addrconf_dad_work+0xaae/0x14b0 net/ipv6/addrconf.c:4282
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
page last free pid 6021 tgid 6021 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2894
__slab_free+0x2e7/0x390 mm/slub.c:5596
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:349
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4710 [inline]
slab_alloc_node mm/slub.c:5008 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5015
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
__split_vma+0x1a9/0xa00 mm/vma.c:515
vms_gather_munmap_vmas+0x2ea/0x12f0 mm/vma.c:1359
__mmap_prepare mm/vma.c:2359 [inline]
__mmap_region mm/vma.c:2651 [inline]
mmap_region+0x724/0x20c0 mm/vma.c:2739
do_mmap+0xc45/0x10d0 mm/mmap.c:558
vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:580
ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8880307dc900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880307dc980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880307dca00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
^
ffff8880307dca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880307dcb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-09-03 17:36 [syzbot] [kernel?] KASAN: slab-out-of-bounds Read in change_page_attr_set_clr syzbot
@ 2025-09-29 7:50 ` syzbot
0 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-09-29 7:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nooraineqbal@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
Resending this patch in the existing thread with a '#syz test:' directive
so syzbot can test it.
From 1bb35c6722b8fb03e9262f6e6530d240629a44df Mon Sep 17 00:00:00 2001
From: neqbal <nooraineqbal@gmail.com>
Date: Sun, 28 Sep 2025 03:52:44 +0530
Subject: [PATCH] x86/mm: Fix off-by-one error in set_memory
Correct end page calculation by subtracting 1 to prevent
out-of-bounds access.
Reported-by: syzbot+e34177f6091df113ef20@syzkaller.appspotmail.com
Signed-off-by: neqbal <nooraineqbal@gmail.com>
---
arch/x86/mm/pat/set_memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index d2d54b8c4dbb..daefc96403f1 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -446,7 +446,7 @@ static void cpa_flush(struct cpa_data *cpa, int cache)
}
start = fix_addr(__cpa_addr(cpa, 0));
- end = fix_addr(__cpa_addr(cpa, cpa->numpages));
+ end = fix_addr(__cpa_addr(cpa, cpa->numpages - 1));
if (cpa->force_flush_all)
end = TLB_FLUSH_ALL;
--
2.51.0
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [usb?] UBSAN: shift-out-of-bounds in ax88772_bind
@ 2025-08-16 3:08 syzbot
2025-08-17 19:42 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-08-16 3:08 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, linux-kernel, linux-usb,
netdev, pabeni, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: d7ee5bdce789 Merge tag 'firewire-fixes-6.17-rc1' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11835af0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=412ee2f8b704a5e6
dashboard link: https://syzkaller.appspot.com/bug?extid=20537064367a0f98d597
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11d253a2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/62d2c52c687a/disk-d7ee5bdc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f827f7b0a929/vmlinux-d7ee5bdc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0babf789124a/bzImage-d7ee5bdc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+20537064367a0f98d597@syzkaller.appspotmail.com
asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71
asix 1-1:0.0 (unnamed net_device) (uninitialized): Error reading Medium Status register: ffffffb9
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/net/usb/asix_devices.c:679:27
shift exponent 240 is too large for 64-bit type 'unsigned long'
CPU: 1 UID: 0 PID: 6020 Comm: kworker/1:4 Not tainted 6.17.0-rc1-syzkaller-00116-gd7ee5bdce789 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
ax88772_init_mdio drivers/net/usb/asix_devices.c:679 [inline]
ax88772_bind+0xdcf/0xfa0 drivers/net/usb/asix_devices.c:910
usbnet_probe+0xa93/0x2870 drivers/net/usb/usbnet.c:1781
usb_probe_interface+0x665/0xc30 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26a/0x9e0 drivers/base/dd.c:659
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1031
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x20e0 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x390 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x26a/0x9e0 drivers/base/dd.c:659
__driver_probe_device+0x18c/0x2f0 drivers/base/dd.c:801
driver_probe_device+0x4f/0x430 drivers/base/dd.c:831
__device_attach_driver+0x2ce/0x530 drivers/base/dd.c:959
bus_for_each_drv+0x251/0x2e0 drivers/base/bus.c:462
__device_attach+0x2b8/0x400 drivers/base/dd.c:1031
bus_probe_device+0x185/0x260 drivers/base/bus.c:537
device_add+0x7b6/0xb50 drivers/base/core.c:3689
usb_new_device+0xa39/0x16f0 drivers/usb/core/hub.c:2694
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5870 [inline]
hub_event+0x2958/0x4a20 drivers/usb/core/hub.c:5952
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-08-16 3:08 [syzbot] [usb?] UBSAN: shift-out-of-bounds in ax88772_bind syzbot
@ 2025-08-17 19:42 ` syzbot
0 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-08-17 19:42 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: abinashsinghlalotra@gmail.com
#syz test
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -872,6 +872,11 @@ static int ax88772_bind(struct usbnet *dev, struct
usb_interface *intf)
if (ret < 0)
return ret;
+ if (ret >= 32) {
+ netdev_warn(dev->net, "Invalid PHY address %d, clamping\n", ret);
+ return -EINVAL;
+ }
+
priv->phy_addr = ret;
priv->embd_phy = ((priv->phy_addr & 0x1f) == AX_EMBD_PHY_ADDR);
--
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [overlayfs?] WARNING in shmem_unlink
@ 2025-08-16 3:08 syzbot
2025-08-17 19:52 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-08-16 3:08 UTC (permalink / raw)
To: amir73il, linux-kernel, linux-unionfs, miklos, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 0cc53520e68b Merge tag 'probes-fixes-v6.17-rc1' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14a003a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=13f39c6a0380a209
dashboard link: https://syzkaller.appspot.com/bug?extid=ec9fab8b7f0386b98a17
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1387bc34580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1f4865acb167/disk-0cc53520.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/14540c5ef981/vmlinux-0cc53520.xz
kernel image: https://storage.googleapis.com/syzbot-assets/35534bfe1c7e/bzImage-0cc53520.xz
Bisection is inconclusive: the first bad commit could be any of:
241062ae5d87 ovl: change ovl_workdir_cleanup() to take dir lock as needed.
a45ee87ded78 ovl: narrow locking in ovl_workdir_cleanup_recurse()
c69566b1d11d ovl: narrow locking on ovl_remove_and_whiteout()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=130d1dbc580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec9fab8b7f0386b98a17@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 9026 at fs/inode.c:417 drop_nlink+0xc5/0x110 fs/inode.c:417
Modules linked in:
CPU: 1 UID: 0 PID: 9026 Comm: syz.4.1430 Tainted: G W 6.17.0-rc1-syzkaller-00038-g0cc53520e68b #0 PREEMPT_{RT,(full)}
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:drop_nlink+0xc5/0x110 fs/inode.c:417
Code: c8 08 00 00 be 08 00 00 00 e8 b7 90 ec ff f0 48 ff 83 c8 08 00 00 5b 41 5c 41 5e 41 5f 5d e9 82 9f c8 08 cc e8 dc 5a 8d ff 90 <0f> 0b 90 eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5b ff ff ff
RSP: 0018:ffffc9000f5ef600 EFLAGS: 00010293
RAX: ffffffff82310064 RBX: ffff88803352c420 RCX: ffff88802cfcbb80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52001ebdeb5 R12: 1ffff110066a588d
R13: 00000000689e7afa R14: ffff88803352c468 R15: dffffc0000000000
FS: 00007fec6bd366c0(0000) GS:ffff8881269c5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555591d73608 CR3: 00000000274f4000 CR4: 00000000003526f0
Call Trace:
<TASK>
shmem_unlink+0x1f5/0x2d0 mm/shmem.c:4041
vfs_unlink+0x39a/0x660 fs/namei.c:4586
ovl_do_unlink fs/overlayfs/overlayfs.h:218 [inline]
ovl_cleanup_locked fs/overlayfs/dir.c:36 [inline]
ovl_cleanup+0x151/0x230 fs/overlayfs/dir.c:56
ovl_check_rename_whiteout fs/overlayfs/super.c:607 [inline]
ovl_make_workdir fs/overlayfs/super.c:704 [inline]
ovl_get_workdir+0xabd/0x17c0 fs/overlayfs/super.c:827
ovl_fill_super+0x1365/0x35b0 fs/overlayfs/super.c:1406
vfs_get_super fs/super.c:1325 [inline]
get_tree_nodev+0xbb/0x150 fs/super.c:1344
vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fec6c6cebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fec6bd36038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fec6c8f5fa0 RCX: 00007fec6c6cebe9
RDX: 0000200000000200 RSI: 0000200000000000 RDI: 0000000000000000
RBP: 00007fec6c751e19 R08: 0000200000000140 R09: 0000000000000000
R10: 00000000000000d4 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fec6c8f6038 R14: 00007fec6c8f5fa0 R15: 00007ffc15eea8d8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-08-16 3:08 [syzbot] [overlayfs?] WARNING in shmem_unlink syzbot
@ 2025-08-17 19:52 ` syzbot
0 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-08-17 19:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: abinashsinghlalotra@gmail.com
#syz test
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -33,6 +33,12 @@ static int ovl_cleanup_locked(struct dentry *workdir,
struct dentry *dentry)
struct inode *dir = d_inode(workdir);
struct inode *inode = d_inode(dentry);
+ /* Avoid unlinking an already unlinked inode */
+ if (inode && inode->i_nlink == 0) {
+ d_drop(dentry);
+ return 0;
+ }
+
if (ovl_is_whiteout(dentry))
return ovl_remove_and_whiteout(workdir, dentry, true);
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [sound?] linux-next test error: general protection fault in snd_seq_oss_midi_check_new_port
@ 2025-08-13 8:00 syzbot
2025-09-01 8:48 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-08-13 8:00 UTC (permalink / raw)
To: linux-kernel, linux-next, linux-sound, perex, sfr, syzkaller-bugs,
tiwai
Hello,
syzbot found the following issue on:
HEAD commit: 43c3c17f0c80 Add linux-next specific files for 20250813
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10c02c34580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c9952dc295dad7ea
dashboard link: https://syzkaller.appspot.com/bug?extid=51c1105d06b79f38316d
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8911961a91d3/disk-43c3c17f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d2f0ab430eb7/vmlinux-43c3c17f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1a0d0d7fc76a/bzImage-43c3c17f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+51c1105d06b79f38316d@syzkaller.appspotmail.com
device-mapper: ioctl: 4.50.0-ioctl (2025-04-28) initialised: dm-devel@lists.linux.dev
device-mapper: multipath round-robin: version 1.2.0 loaded
device-mapper: multipath queue-length: version 0.2.0 loaded
device-mapper: multipath service-time: version 0.3.0 loaded
Bluetooth: HCI UART driver ver 2.3
Bluetooth: HCI UART protocol H4 registered
Bluetooth: HCI UART protocol BCSP registered
Bluetooth: HCI UART protocol LL registered
Bluetooth: HCI UART protocol Three-wire (H5) registered
Bluetooth: HCI UART protocol QCA registered
Bluetooth: HCI UART protocol AG6XX registered
Bluetooth: HCI UART protocol Marvell registered
usbcore: registered new interface driver bcm203x
usbcore: registered new interface driver bpa10x
usbcore: registered new interface driver bfusb
usbcore: registered new interface driver btusb
usbcore: registered new interface driver ath3k
Modular ISDN core version 1.1.29
NET: Registered PF_ISDN protocol family
DSP module 2.0
mISDN_dsp: DSP clocks every 80 samples. This equals 1 jiffies.
mISDN: Layer-1-over-IP driver Rev. 2.00
0 virtual devices registered
usbcore: registered new interface driver HFC-S_USB
intel_pstate: CPU model not supported
VUB300 Driver rom wait states = 1C irqpoll timeout = 0400
usbcore: registered new interface driver vub300
usbcore: registered new interface driver ushc
iscsi: registered transport (iser)
SoftiWARP attached
hid: raw HID events driver (C) Jiri Kosina
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
usbcore: registered new interface driver es2_ap_driver
comedi: version 0.7.76 - http://www.comedi.org
comedi comedi4: comedi_test: 1000000 microvolt, 100000 microsecond waveform attached
comedi comedi4: driver 'comedi_test' has successfully auto-configured 'comedi_test'.
usbcore: registered new interface driver dt9812
usbcore: registered new interface driver ni6501
usbcore: registered new interface driver usbdux
usbcore: registered new interface driver usbduxfast
usbcore: registered new interface driver usbduxsigma
usbcore: registered new interface driver vmk80xx
greybus: registered new driver hid
greybus: registered new driver gbphy
gb_gbphy: registered new driver usb
asus_wmi: ASUS WMI generic driver loaded
gnss: GNSS driver registered with major 493
usbcore: registered new interface driver gnss-usb
usbcore: registered new interface driver hdm_usb
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc1-next-20250813-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:snd_seq_oss_midi_check_new_port+0x4a9/0x770 sound/core/seq/oss/seq_oss_midi.c:196
Code: 2d 4c 51 d3 10 4c 8b 2c 24 4c 89 e8 48 c1 e8 03 48 bb 00 00 00 00 00 fc ff df 0f b6 04 18 84 c0 0f 85 7f 02 00 00 45 89 65 00 <0f> b6 03 84 c0 0f 85 8e 02 00 00 4c 63 3c 25 00 00 00 00 bf 20 00
RSP: 0000:ffffc90000067038 EFLAGS: 00010046
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88801ce90000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000001f
RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200000cde4 R12: 0000000000000000
R13: ffff88802e92b400 R14: 0000000000000a02 R15: ffff88802e92b438
FS: 0000000000000000(0000) GS:ffff888125d10000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000000df36000 CR4: 00000000003526f0
Call Trace:
<TASK>
receive_announce+0x22f/0x300 sound/core/seq/oss/seq_oss_init.c:132
__snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:599 [inline]
_snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:645 [inline]
snd_seq_deliver_single_event+0x8dd/0xc90 sound/core/seq/seq_clientmgr.c:660
__deliver_to_subscribers sound/core/seq/seq_clientmgr.c:707 [inline]
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:735 [inline]
snd_seq_deliver_event+0x538/0x9c0 sound/core/seq/seq_clientmgr.c:785
snd_seq_kernel_client_dispatch+0x2c0/0x400 sound/core/seq/seq_clientmgr.c:2407
snd_seq_system_broadcast+0x11d/0x170 sound/core/seq/seq_system.c:88
snd_seq_ioctl_create_port+0x733/0x950 sound/core/seq/seq_clientmgr.c:1313
create_port+0x258/0x360 sound/core/seq/seq_dummy.c:146
register_client+0x5d/0x190 sound/core/seq/seq_dummy.c:198
do_one_initcall+0x233/0x820 init/main.c:1281
do_initcall_level+0x104/0x190 init/main.c:1343
do_initcalls+0x59/0xa0 init/main.c:1359
kernel_init_freeable+0x334/0x4b0 init/main.c:1591
kernel_init+0x1d/0x1d0 init/main.c:1481
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:snd_seq_oss_midi_check_new_port+0x4a9/0x770 sound/core/seq/oss/seq_oss_midi.c:196
Code: 2d 4c 51 d3 10 4c 8b 2c 24 4c 89 e8 48 c1 e8 03 48 bb 00 00 00 00 00 fc ff df 0f b6 04 18 84 c0 0f 85 7f 02 00 00 45 89 65 00 <0f> b6 03 84 c0 0f 85 8e 02 00 00 4c 63 3c 25 00 00 00 00 bf 20 00
RSP: 0000:ffffc90000067038 EFLAGS: 00010046
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88801ce90000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000001f
RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200000cde4 R12: 0000000000000000
R13: ffff88802e92b400 R14: 0000000000000a02 R15: ffff88802e92b438
FS: 0000000000000000(0000) GS:ffff888125d10000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000000df36000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 2d 4c 51 d3 10 sub $0x10d3514c,%eax
5: 4c 8b 2c 24 mov (%rsp),%r13
9: 4c 89 e8 mov %r13,%rax
c: 48 c1 e8 03 shr $0x3,%rax
10: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx
17: fc ff df
1a: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax
1e: 84 c0 test %al,%al
20: 0f 85 7f 02 00 00 jne 0x2a5
26: 45 89 65 00 mov %r12d,0x0(%r13)
* 2a: 0f b6 03 movzbl (%rbx),%eax <-- trapping instruction
2d: 84 c0 test %al,%al
2f: 0f 85 8e 02 00 00 jne 0x2c3
35: 4c 63 3c 25 00 00 00 movslq 0x0,%r15
3c: 00
3d: bf .byte 0xbf
3e: 20 00 and %al,(%rax)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_accounting_validate
@ 2025-08-04 7:18 syzbot
2025-08-04 22:56 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-08-04 7:18 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 352af6a011d5 Merge tag 'rust-6.17' of git://git.kernel.org..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=135d7aa2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cae1291240e8962a
dashboard link: https://syzkaller.appspot.com/bug?extid=cd063f869beedf5b9cd7
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14dcc6a2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=133e02f0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a762497d1fce/disk-352af6a0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3055e1e47995/vmlinux-352af6a0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aa300ee98202/bzImage-352af6a0.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/de2a4b00a48a/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cd063f869beedf5b9cd7@syzkaller.appspotmail.com
bcachefs (loop0): error reading btree root btree=subvolumes level=0: btree_node_read_error, fixing
bcachefs (loop0): invalid bkey in btree_node btree=snapshot_trees level=0: u64s 6 type snapshot_tree POS_MIN len 0 ver 0: subvol 1 root snapshot 4294967295
bad pos, deleting
bcachefs (loop0): error reading btree root btree=snapshot_trees level=0: btree_node_read_error, fixing
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/bcachefs/disk_accounting.c:238:2
index 175 is out of range for type 'const unsigned int[9]'
CPU: 0 UID: 0 PID: 5849 Comm: syz-executor427 Tainted: G W 6.16.0-syzkaller-11322-g352af6a011d5 #0 PREEMPT_{RT,(full)}
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:455
bch2_accounting_validate+0x112f/0x1400 fs/bcachefs/disk_accounting.c:238
bch2_bkey_val_validate+0x202/0x3e0 fs/bcachefs/bkey_methods.c:143
btree_node_bkey_val_validate fs/bcachefs/btree_io.c:880 [inline]
bch2_btree_node_read_done+0x4051/0x5550 fs/bcachefs/btree_io.c:1303
btree_node_read_work+0x40e/0xe60 fs/bcachefs/btree_io.c:1440
bch2_btree_node_read+0x887/0x2a00 fs/bcachefs/btree_io.c:-1
__bch2_btree_root_read fs/bcachefs/btree_io.c:1906 [inline]
bch2_btree_root_read+0x5f0/0x760 fs/bcachefs/btree_io.c:1928
read_btree_roots+0x2c6/0x840 fs/bcachefs/recovery.c:615
bch2_fs_recovery+0x261f/0x3a50 fs/bcachefs/recovery.c:1006
bch2_fs_start+0xaaf/0xda0 fs/bcachefs/super.c:1213
bch2_fs_get_tree+0xb39/0x1520 fs/bcachefs/fs.c:2488
vfs_get_tree+0x92/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5016bf5eaa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd552f5c58 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffd552f5c70 RCX: 00007f5016bf5eaa
RDX: 0000200000001000 RSI: 0000200000000000 RDI: 00007ffd552f5c70
RBP: 0000200000000000 R08: 00007ffd552f5cb0 R09: 000000000000492c
R10: 0000000000000000 R11: 0000000000000282 R12: 0000200000001000
R13: 00007ffd552f5cb0 R14: 0000000000000003 R15: 0000000000000000
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [dri?] upstream test error: WARNING in __ww_mutex_wound
@ 2025-08-01 7:54 syzbot
2025-09-01 8:51 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-08-01 7:54 UTC (permalink / raw)
To: airlied, dri-devel, linux-kernel, maarten.lankhorst, mripard,
simona, syzkaller-bugs, tzimmermann
Hello,
syzbot found the following issue on:
HEAD commit: f2d282e1dfb3 Merge tag 'bitmap-for-6.17' of https://github..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=122cd2a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b44f1a914fd00509
dashboard link: https://syzkaller.appspot.com/bug?extid=c4f4e64f6ac2733325f9
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f2d282e1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2ef45393ac9e/vmlinux-f2d282e1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8200ce1bbcbf/bzImage-f2d282e1.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c4f4e64f6ac2733325f9@syzkaller.appspotmail.com
9p: Installing v9fs 9p2000 file system support
NILFS version 2 loaded
befs: version: 0.9.3
ocfs2: Registered cluster interface o2cb
ocfs2: Registered cluster interface user
OCFS2 User DLM kernel interface loaded
gfs2: GFS2 installed
ceph: loaded (mds proto 32)
cryptd: max_cpu_qlen set to 1000
NET: Registered PF_ALG protocol family
xor: automatically using best checksumming function avx
async_tx: api initialized (async)
Key type asymmetric registered
Asymmetric key parser 'x509' registered
Asymmetric key parser 'pkcs8' registered
Key type pkcs7_test registered
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 238)
io scheduler mq-deadline registered
io scheduler kyber registered
io scheduler bfq registered
ACPI: \_SB_.GSIE: Enabled at IRQ 20
pcieport 0000:00:04.0: PME: Signaling with IRQ 25
pcieport 0000:00:04.0: AER: enabled with IRQ 26
input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
ACPI: button: Power Button [PWRF]
ioatdma: Intel(R) QuickData Technology Driver 5.00
ACPI: \_SB_.GSIF: Enabled at IRQ 21
ACPI: \_SB_.GSIH: Enabled at IRQ 23
N_HDLC line discipline registered with maxframe=4096
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
00:04: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
Non-volatile memory driver v1.3
Linux agpgart interface v0.103
usbcore: registered new interface driver xillyusb
ACPI: bus type drm_connector registered
[drm] Initialized vgem 1.0.0 for vgem on minor 0
[drm] Initialized vkms 1.0.0 for vkms on minor 1
Console: switching to colour frame buffer device 128x48
faux_driver vkms: [drm] fb0: vkmsdrmfb frame buffer device
usbcore: registered new interface driver udl
[drm] pci: virtio-vga detected at 0000:00:01.0
virtio-pci 0000:00:01.0: vgaarb: deactivate vga console
[drm] features: -virgl +edid -resource_blob -host_visible
[drm] features: -context_init
[drm] number of scanouts: 1
[drm] number of cap sets: 0
[drm] Initialized virtio_gpu 0.1.0 for 0000:00:01.0 on minor 2
fbcon: virtio_gpudrmfb (fb1) is primary device
fbcon: Remapping primary device, fb1, to tty 1-63
------------[ cut here ]------------
WARNING: CPU: 2 PID: 1 at ./include/linux/sched.h:2180 __clear_task_blocked_on include/linux/sched.h:2180 [inline]
WARNING: CPU: 2 PID: 1 at ./include/linux/sched.h:2180 __ww_mutex_wound+0x23b/0x3e0 kernel/locking/ww_mutex.h:346
Modules linked in:
CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.0-syzkaller-10355-gf2d282e1dfb3 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__clear_task_blocked_on include/linux/sched.h:2180 [inline]
RIP: 0010:__ww_mutex_wound+0x23b/0x3e0 kernel/locking/ww_mutex.h:346
Code: 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 85 01 00 00 48 8b 81 78 0a 00 00 48 85 c0 74 09 48 39 c3 74 04 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 80 3c
RSP: 0000:ffffc90000046e58 EFLAGS: 00010002
RAX: ffff888026fa4048 RBX: ffff888027180068 RCX: ffff888022320000
RDX: 1ffff1100446414f RSI: ffffffff8ddf7d2d RDI: ffffffff8c15fb80
RBP: ffff888022320a78 R08: 0000000000000000 R09: ffffed1004e3000d
R10: ffff88802718006f R11: 0000000000000001 R12: ffffc90000adfa30
R13: 0000000000000001 R14: 0000000000000007 R15: ffffc90000046f50
FS: 0000000000000000(0000) GS:ffff8880d68fe000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000000e380000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__ww_mutex_add_waiter kernel/locking/ww_mutex.h:574 [inline]
__mutex_lock_common kernel/locking/mutex.c:638 [inline]
__ww_mutex_lock.constprop.0+0x1a3e/0x3110 kernel/locking/mutex.c:767
ww_mutex_lock+0x37/0x160 kernel/locking/mutex.c:885
modeset_lock+0x4a0/0x6e0 drivers/gpu/drm/drm_modeset_lock.c:316
drm_modeset_lock drivers/gpu/drm/drm_modeset_lock.c:398 [inline]
drm_modeset_lock+0x59/0x90 drivers/gpu/drm/drm_modeset_lock.c:394
drm_atomic_get_crtc_state+0x100/0x450 drivers/gpu/drm/drm_atomic.c:356
drm_atomic_get_plane_state+0x436/0x590 drivers/gpu/drm/drm_atomic.c:561
drm_client_modeset_commit_atomic+0x237/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1055
drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1206
pan_display_atomic drivers/gpu/drm/drm_fb_helper.c:1388 [inline]
drm_fb_helper_pan_display+0x32d/0xa40 drivers/gpu/drm/drm_fb_helper.c:1448
fb_pan_display+0x47c/0x7d0 drivers/video/fbdev/core/fbmem.c:193
bit_update_start+0x49/0x1f0 drivers/video/fbdev/core/bitblit.c:380
fbcon_switch+0xbf8/0x14c0 drivers/video/fbdev/core/fbcon.c:2193
redraw_screen+0x2c1/0x760 drivers/tty/vt/vt.c:965
con2fb_init_display drivers/video/fbdev/core/fbcon.c:829 [inline]
set_con2fb_map+0x79b/0x1060 drivers/video/fbdev/core/fbcon.c:890
do_fb_registered drivers/video/fbdev/core/fbcon.c:2999 [inline]
fbcon_fb_registered+0x21d/0x6a0 drivers/video/fbdev/core/fbcon.c:3015
do_register_framebuffer+0x500/0x870 drivers/video/fbdev/core/fbmem.c:509
register_framebuffer+0x23/0x40 drivers/video/fbdev/core/fbmem.c:575
__drm_fb_helper_initial_config_and_unlock+0xdb7/0x17b0 drivers/gpu/drm/drm_fb_helper.c:1852
drm_fb_helper_initial_config drivers/gpu/drm/drm_fb_helper.c:1917 [inline]
drm_fb_helper_initial_config+0x44/0x60 drivers/gpu/drm/drm_fb_helper.c:1909
drm_fbdev_client_hotplug+0x1a6/0x280 drivers/gpu/drm/clients/drm_fbdev_client.c:52
drm_client_register+0x197/0x280 drivers/gpu/drm/drm_client.c:141
drm_fbdev_client_setup+0x1bd/0x480 drivers/gpu/drm/clients/drm_fbdev_client.c:159
drm_client_setup drivers/gpu/drm/clients/drm_client_setup.c:46 [inline]
drm_client_setup+0x19f/0x240 drivers/gpu/drm/clients/drm_client_setup.c:35
virtio_gpu_probe+0x29e/0x500 drivers/gpu/drm/virtio/virtgpu_drv.c:110
virtio_dev_probe+0x69d/0xbe0 drivers/virtio/virtio.c:347
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__driver_attach+0x283/0x580 drivers/base/dd.c:1217
bus_for_each_dev+0x13b/0x1d0 drivers/base/bus.c:370
bus_add_driver+0x2e9/0x690 drivers/base/bus.c:678
driver_register+0x15c/0x4b0 drivers/base/driver.c:249
virtio_gpu_driver_init+0xa8/0x1b0 drivers/gpu/drm/virtio/virtgpu_drv.c:194
do_one_initcall+0x120/0x6e0 init/main.c:1269
do_initcall_level init/main.c:1331 [inline]
do_initcalls init/main.c:1347 [inline]
do_basic_setup init/main.c:1366 [inline]
kernel_init_freeable+0x5c2/0x900 init/main.c:1579
kernel_init+0x1c/0x2b0 init/main.c:1469
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] kernel BUG in bch2_btree_repair_topology_recurse
@ 2025-07-31 9:11 syzbot
2025-08-01 23:03 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-07-31 9:11 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 260f6f4fda93 Merge tag 'drm-next-2025-07-30' of https://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=154669bc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3e6923811cbcd88f
dashboard link: https://syzkaller.appspot.com/bug?extid=9eb4c69fd4d4a1934f3a
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16d0c834580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10961ca2580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-260f6f4f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/28b1dc006a89/vmlinux-260f6f4f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dcbc50612705/bzImage-260f6f4f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/f8e958cdbaf9/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9eb4c69fd4d4a1934f3a@syzkaller.appspotmail.com
btree=alloc level=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3a29d24e27fd9a2e written 65534 min_key R 0:0:16777215 durability: 1 ptr: 0:178:0 gen 0
btree topology error:
------------[ cut here ]------------
kernel BUG at fs/bcachefs/btree_gc.c:528!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5534 Comm: syz.0.16 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_btree_repair_topology_recurse+0x52dc/0x52e0 fs/bcachefs/btree_gc.c:528
Code: fd 90 0f 0b e8 05 e1 9c fd 90 0f 0b e8 fd e0 9c fd 90 0f 0b e8 f5 e0 9c fd 90 0f 0b e8 ed e0 9c fd 90 0f 0b e8 e5 e0 9c fd 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc9000240ea60 EFLAGS: 00010293
RAX: ffffffff8422bbdb RBX: 00000000fffff6e8 RCX: ffff888000292440
RDX: 0000000000000000 RSI: 00000000fffff6e8 RDI: 0000000000000000
RBP: ffffc9000240ef90 R08: ffffffff8fa09237 R09: 1ffffffff1f41246
R10: dffffc0000000000 R11: fffffbfff1f41247 R12: ffff888011db2e00
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88804137c000
FS: 0000555570dd9500(0000) GS:ffff88808d26e000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1344372eb8 CR3: 000000001e88d000 CR4: 0000000000352ef0
Call Trace:
<TASK>
bch2_check_topology+0x692/0xe00 fs/bcachefs/btree_gc.c:602
bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:484 [inline]
__bch2_run_recovery_passes+0x392/0x1010 fs/bcachefs/recovery_passes.c:539
bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:610
bch2_fs_recovery+0x2690/0x3a50 fs/bcachefs/recovery.c:1016
bch2_fs_start+0xaaf/0xda0 fs/bcachefs/super.c:1213
bch2_fs_get_tree+0xb39/0x1520 fs/bcachefs/fs.c:2488
vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f91ded9014a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff349f3738 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff349f37c0 RCX: 00007f91ded9014a
RDX: 0000200000001000 RSI: 0000200000001040 RDI: 00007fff349f3780
RBP: 0000200000001000 R08: 00007fff349f37c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000001040
R13: 00007fff349f3780 R14: 0000000000004914 R15: 0000200000001080
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_btree_repair_topology_recurse+0x52dc/0x52e0 fs/bcachefs/btree_gc.c:528
Code: fd 90 0f 0b e8 05 e1 9c fd 90 0f 0b e8 fd e0 9c fd 90 0f 0b e8 f5 e0 9c fd 90 0f 0b e8 ed e0 9c fd 90 0f 0b e8 e5 e0 9c fd 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc9000240ea60 EFLAGS: 00010293
RAX: ffffffff8422bbdb RBX: 00000000fffff6e8 RCX: ffff888000292440
RDX: 0000000000000000 RSI: 00000000fffff6e8 RDI: 0000000000000000
RBP: ffffc9000240ef90 R08: ffffffff8fa09237 R09: 1ffffffff1f41246
R10: dffffc0000000000 R11: fffffbfff1f41247 R12: ffff888011db2e00
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88804137c000
FS: 0000555570dd9500(0000) GS:ffff88808d26e000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9b6a72b720 CR3: 000000001e88d000 CR4: 0000000000352ef0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] kernel panic: in transaction restart: transaction_restart_relock, last restarted by
@ 2025-07-30 21:21 syzbot
2025-08-03 18:30 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-07-30 21:21 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4b290aae788e Merge tag 'sysctl-6.17-rc1' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13faeca2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d57eeb4d30293deb
dashboard link: https://syzkaller.appspot.com/bug?extid=d3fa2fb715cfcc9d201d
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-4b290aae.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5deb700fdcf/vmlinux-4b290aae.xz
kernel image: https://storage.googleapis.com/syzbot-assets/303ba5e224e7/bzImage-4b290aae.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3fa2fb715cfcc9d201d@syzkaller.appspotmail.com
ppp0: PPP: VJ uncompressed error
loop0: detected capacity change from 0 to 32768
bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,foreground_target=invalid label 255,nocow
allowing incompatible features above 0.0: (unknown version)
features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0
bcachefs (loop0): initializing new filesystem
bcachefs (loop0): going read-write
bcachefs (loop0): marking superblocks
bcachefs (loop0): initializing freespace
bcachefs (loop0): done initializing freespace
bcachefs (loop0): reading snapshots table
bcachefs (loop0): reading snapshots done
bcachefs (loop0): loop0: Superblock write was silently dropped! (seq 0 expected 42)
bcachefs (loop0): done starting filesystem
Kernel panic - not syncing: in transaction restart: transaction_restart_relock, last restarted by
[<0>] btree_trans_restart_ip fs/bcachefs/btree_iter.h:364 [inline]
[<0>] btree_trans_restart fs/bcachefs/btree_iter.h:372 [inline]
[<0>] btree_path_get_locks+0x3ad/0xa30 fs/bcachefs/btree_locking.c:491
[<0>] __bch2_trans_relock+0x234/0x5f0 fs/bcachefs/btree_locking.c:826
[<0>] bch2_new_inode fs/bcachefs/fs.c:484 [inline]
[<0>] bch2_inode_hash_init_insert+0x118/0x170 fs/bcachefs/fs.c:501
[<0>] bch2_vfs_inode_get+0x272/0x330 fs/bcachefs/fs.c:524
[<0>] bch2_fs_get_tree+0xfe4/0x1520 fs/bcachefs/fs.c:2572
[<0>] vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
[<0>] do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
[<0>] do_mount fs/namespace.c:4133 [inline]
[<0>] __do_sys_mount fs/namespace.c:4344 [inline]
[<0>] __se_sys_mount+0x317/0x410 fs/namespace.c:4321
[<0>] do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
[<0>] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
[<0>] entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted 6.16.0-syzkaller-04405-g4b290aae788e #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
panic+0x2db/0x790 kernel/panic.c:442
bch2_trans_in_restart_error+0xdb/0x110 fs/bcachefs/btree_iter.c:1455
bch2_trans_put+0x1012/0x1220 fs/bcachefs/btree_iter.c:3559
bch2_vfs_inode_get+0x285/0x330 fs/bcachefs/fs.c:525
bch2_fs_get_tree+0xfe4/0x1520 fs/bcachefs/fs.c:2572
vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
do_mount fs/namespace.c:4133 [inline]
__do_sys_mount fs/namespace.c:4344 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4321
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f699279014a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6993591e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f6993591ef0 RCX: 00007f699279014a
RDX: 00002000000000c0 RSI: 00002000000003c0 RDI: 00007f6993591eb0
RBP: 00002000000000c0 R08: 00007f6993591ef0 R09: 0000000000000810
R10: 0000000000000810 R11: 0000000000000246 R12: 00002000000003c0
R13: 00007f6993591eb0 R14: 0000000000005aa3 R15: 0000200000000040
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea
@ 2025-07-17 19:14 syzbot
2025-07-19 7:57 ` Forwarded: syzbot
` (2 more replies)
0 siblings, 3 replies; 85+ messages in thread
From: syzbot @ 2025-07-17 19:14 UTC (permalink / raw)
To: linux-fsdevel, linux-kernel, mikulas, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 155a3c003e55 Merge tag 'for-6.16/dm-fixes-2' of git://git...
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=166d6382580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f09d04131ef56b22
dashboard link: https://syzkaller.appspot.com/bug?extid=fa88eb476e42878f2844
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14b20d8c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ebe58c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8b4489a1d2de/disk-155a3c00.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1c498d4c0c85/vmlinux-155a3c00.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ea8acdf1d890/bzImage-155a3c00.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/e47f2d7541be/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fa88eb476e42878f2844@syzkaller.appspotmail.com
hpfs: filesystem error: warning: spare dnodes used, try chkdsk
hpfs: You really don't want any checks? You are crazy...
hpfs: hpfs_map_sector(): read error
hpfs: code page support is disabled
==================================================================
BUG: KASAN: use-after-free in strcmp+0x6f/0xc0 lib/string.c:283
Read of size 1 at addr ffff8880116728a6 by task syz-executor411/6741
CPU: 1 UID: 0 PID: 6741 Comm: syz-executor411 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
strcmp+0x6f/0xc0 lib/string.c:283
hpfs_get_ea+0x114/0xdb0 fs/hpfs/ea.c:139
hpfs_read_inode+0x19d/0x1010 fs/hpfs/inode.c:63
hpfs_fill_super+0x12bd/0x2070 fs/hpfs/super.c:654
get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1681
vfs_get_tree+0x92/0x2b0 fs/super.c:1804
do_new_mount+0x24a/0xa40 fs/namespace.c:3902
do_mount fs/namespace.c:4239 [inline]
__do_sys_mount fs/namespace.c:4450 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4427
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f718b86112a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffee99fcba8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffee99fcbc0 RCX: 00007f718b86112a
RDX: 0000200000009e80 RSI: 0000200000009ec0 RDI: 00007ffee99fcbc0
RBP: 0000200000009ec0 R08: 00007ffee99fcc00 R09: 0000000000009dfd
R10: 0000000000000041 R11: 0000000000000286 R12: 0000200000009e80
R13: 0000000000000004 R14: 0000000000000003 R15: 00007ffee99fcc00
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11672
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001ff38c8 ffffea0001ff3908 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5213, tgid 5213 (udevd), ts 38150701195, free_ts 195740390996
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x21d5/0x22b0 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4959
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
folio_alloc_mpol_noprof+0x39/0x70 mm/mempolicy.c:2438
shmem_alloc_folio mm/shmem.c:1851 [inline]
shmem_alloc_and_add_folio+0x447/0xf60 mm/shmem.c:1890
shmem_get_folio_gfp+0x59d/0x1660 mm/shmem.c:2536
shmem_get_folio mm/shmem.c:2642 [inline]
shmem_write_begin+0xf7/0x2b0 mm/shmem.c:3292
generic_perform_write+0x2c7/0x910 mm/filemap.c:4112
shmem_file_write_iter+0xf8/0x120 mm/shmem.c:3467
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x54b/0xa90 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6740 tgid 6740 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
free_unref_folios+0xcd2/0x1570 mm/page_alloc.c:2763
folios_put_refs+0x559/0x640 mm/swap.c:992
folio_batch_release include/linux/pagevec.h:101 [inline]
shmem_undo_range+0x49e/0x14b0 mm/shmem.c:1125
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x272/0xa70 mm/shmem.c:1365
evict+0x501/0x9c0 fs/inode.c:810
__dentry_kill+0x209/0x660 fs/dcache.c:669
shrink_kill+0xa9/0x2c0 fs/dcache.c:1114
shrink_dentry_list+0x2e0/0x5e0 fs/dcache.c:1141
shrink_dcache_parent+0xa1/0x2c0 fs/dcache.c:-1
do_one_tree+0x23/0xe0 fs/dcache.c:1604
shrink_dcache_for_umount+0xa0/0x170 fs/dcache.c:1621
generic_shutdown_super+0x67/0x2c0 fs/super.c:621
kill_anon_super fs/super.c:1282 [inline]
kill_litter_super+0x76/0xb0 fs/super.c:1292
deactivate_locked_super+0xbc/0x130 fs/super.c:474
cleanup_mnt+0x425/0x4c0 fs/namespace.c:1417
task_work_run+0x1d4/0x260 kernel/task_work.c:227
Memory state around the buggy address:
ffff888011672780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888011672800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888011672880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888011672900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888011672980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
@ 2025-07-19 7:57 ` syzbot
2025-07-20 6:54 ` Forwarded: syzbot
2025-07-20 7:29 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-07-19 7:57 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz-test
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
2025-07-19 7:57 ` Forwarded: syzbot
@ 2025-07-20 6:54 ` syzbot
2025-07-20 7:29 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-07-20 6:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz-test
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
2025-07-19 7:57 ` Forwarded: syzbot
2025-07-20 6:54 ` Forwarded: syzbot
@ 2025-07-20 7:29 ` syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-07-20 7:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz-test
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2)
@ 2025-07-14 17:53 syzbot
2025-07-15 14:15 ` Forwarded: syzbot
` (2 more replies)
0 siblings, 3 replies; 85+ messages in thread
From: syzbot @ 2025-07-14 17:53 UTC (permalink / raw)
To: agruenba, gfs2, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 347e9f5043c8 Linux 6.16-rc6
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13c070f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62a2ef17395702a
dashboard link: https://syzkaller.appspot.com/bug?extid=4708579bb230a0582a57
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-347e9f50.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/49ae91eb36e0/vmlinux-347e9f50.xz
kernel image: https://storage.googleapis.com/syzbot-assets/78497f74bd6b/bzImage-347e9f50.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz"
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms
gfs2: fsid=syz:syz.s: first mount done, others may mount
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/gfs2/dir.c:1544:15
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:233
__ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:494
dir_e_read fs/gfs2/dir.c:1544 [inline]
gfs2_dir_read+0x1730/0x1780 fs/gfs2/dir.c:1585
gfs2_readdir+0x14c/0x1b0 fs/gfs2/file.c:116
iterate_dir+0x5ac/0x770 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:410 [inline]
__se_sys_getdents64+0xe4/0x260 fs/readdir.c:396
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f97c858e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f97c94ce038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007f97c87b5fa0 RCX: 00007f97c858e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f97c8610b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f97c87b5fa0 R15: 00007ffd76387a88
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
@ 2025-07-15 14:15 ` syzbot
2025-07-15 14:29 ` Forwarded: syzbot
2025-07-16 6:28 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-07-15 14:15 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-15 14:15 ` Forwarded: syzbot
@ 2025-07-15 14:29 ` syzbot
2025-07-16 6:28 ` Forwarded: syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-07-15 14:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-15 14:15 ` Forwarded: syzbot
2025-07-15 14:29 ` Forwarded: syzbot
@ 2025-07-16 6:28 ` syzbot
2 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-07-16 6:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bluetooth?] [bcachefs?] KASAN: slab-use-after-free Read in hci_uart_write_work
@ 2025-07-14 17:09 syzbot
2025-07-20 17:34 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-07-14 17:09 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-bluetooth, linux-kernel,
luiz.dentz, marcel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 3f31a806a62e Merge tag 'mm-hotfixes-stable-2025-07-11-16-1..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=174b07d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b309c907eaab29da
dashboard link: https://syzkaller.appspot.com/bug?extid=fde6bd779f78e6e0992e
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127ece8c580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-3f31a806.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7304d62ced97/vmlinux-3f31a806.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4913df6ab730/bzImage-3f31a806.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/bb03f46b9e61/mount_5.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fde6bd779f78e6e0992e@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in hci_uart_write_work+0x2ca/0x550 drivers/bluetooth/hci_ldisc.c:165
Read of size 8 at addr ffff8880555a35d8 by task kworker/0:7/5631
CPU: 0 UID: 0 PID: 5631 Comm: kworker/0:7 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events hci_uart_write_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
hci_uart_write_work+0x2ca/0x550 drivers/bluetooth/hci_ldisc.c:165
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 54:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4148 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
kmem_cache_alloc_node_noprof+0x1bb/0x3c0 mm/slub.c:4249
__alloc_skb+0x112/0x2d0 net/core/skbuff.c:660
alloc_skb include/linux/skbuff.h:1336 [inline]
h5_prepare_pkt+0x184/0x530 drivers/bluetooth/hci_h5.c:702
h5_dequeue+0x197/0x790 drivers/bluetooth/hci_h5.c:761
hci_uart_dequeue drivers/bluetooth/hci_ldisc.c:107 [inline]
hci_uart_write_work+0x24a/0x550 drivers/bluetooth/hci_ldisc.c:161
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff8880555a3500
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 216 bytes inside of
freed 240-byte region [ffff8880555a3500, ffff8880555a35f0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x555a3
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000000 ffff8880304e0b40 dead000000000100 dead000000000122
raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5474, tgid 5474 (syz-executor), ts 183992405509, free_ts 181552341552
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4959
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab+0x8a/0x3b0 mm/slub.c:2619
new_slab mm/slub.c:2673 [inline]
___slab_alloc+0xbfc/0x1480 mm/slub.c:3859
__slab_alloc mm/slub.c:3949 [inline]
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
kmem_cache_alloc_node_noprof+0x280/0x3c0 mm/slub.c:4249
__alloc_skb+0x112/0x2d0 net/core/skbuff.c:660
alloc_skb include/linux/skbuff.h:1336 [inline]
nlmsg_new include/net/netlink.h:1041 [inline]
inet_netconf_notify_devconf+0x173/0x240 net/ipv4/devinet.c:2210
__devinet_sysctl_register+0x3f6/0x470 net/ipv4/devinet.c:2684
devinet_sysctl_register+0x187/0x200 net/ipv4/devinet.c:2718
inetdev_init+0x2b4/0x500 net/ipv4/devinet.c:291
inetdev_event+0x301/0x15b0 net/ipv4/devinet.c:1591
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
call_netdevice_notifiers net/core/dev.c:2282 [inline]
register_netdevice+0x1608/0x1ae0 net/core/dev.c:11143
team_newlink+0x114/0x160 drivers/net/team/team_core.c:2231
page last free pid 5407 tgid 5407 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
__free_frozen_pages+0xc71/0xe70 mm/page_alloc.c:2706
vfree+0x25a/0x400 mm/vmalloc.c:3434
kcov_put kernel/kcov.c:439 [inline]
kcov_close+0x28/0x50 kernel/kcov.c:535
__fput+0x449/0xa70 fs/file_table.c:465
task_work_run+0x1d1/0x260 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x6b5/0x22e0 kernel/exit.c:964
do_group_exit+0x21c/0x2d0 kernel/exit.c:1105
get_signal+0x1286/0x1340 kernel/signal.c:3034
arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8880555a3480: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
ffff8880555a3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880555a3580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
^
ffff8880555a3600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff8880555a3680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in __bch2_alloc_to_v4
@ 2025-07-06 21:30 syzbot
2025-07-19 22:04 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-07-06 21:30 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: c435a4f487e8 Merge tag 'riscv-for-linus-6.16-rc5' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=127673d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29b1a0d7330d4a8
dashboard link: https://syzkaller.appspot.com/bug?extid=487dd8c670b175dd59ed
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-c435a4f4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3a184d1ad283/vmlinux-c435a4f4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/db5931917c56/bzImage-c435a4f4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+487dd8c670b175dd59ed@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in __bch2_alloc_to_v4+0x7b/0x8b0 fs/bcachefs/alloc_background.c:388
Read of size 64 at addr ffff888055140ba8 by task kworker/u4:5/1035
CPU: 0 UID: 0 PID: 1035 Comm: kworker/u4:5 Not tainted 6.16.0-rc4-syzkaller-00286-gc435a4f487e8 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: btree_update btree_interior_update_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xd2/0x2b0 mm/kasan/report.c:521
kasan_report+0x118/0x150 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
__bch2_alloc_to_v4+0x7b/0x8b0 fs/bcachefs/alloc_background.c:388
bch2_alloc_to_v4 fs/bcachefs/alloc_background.h:236 [inline]
bch2_trigger_alloc+0x323/0x4090 fs/bcachefs/alloc_background.c:871
run_one_trans_trigger fs/bcachefs/btree_trans_commit.c:-1 [inline]
bch2_trans_commit_run_triggers fs/bcachefs/btree_trans_commit.c:554 [inline]
__bch2_trans_commit+0xa84/0x8870 fs/bcachefs/btree_trans_commit.c:1023
bch2_trans_commit fs/bcachefs/btree_update.h:241 [inline]
btree_update_nodes_written fs/bcachefs/btree_update_interior.c:729 [inline]
btree_interior_update_work+0x1082/0x27d0 fs/bcachefs/btree_update_interior.c:867
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 5334:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4328 [inline]
__kmalloc_noprof+0x27a/0x4f0 mm/slub.c:4340
kmalloc_noprof include/linux/slab.h:909 [inline]
bch2_journal_key_insert+0x50/0x140 fs/bcachefs/btree_journal_iter.c:342
do_bch2_trans_commit_to_journal_replay+0x127/0xd70 fs/bcachefs/btree_trans_commit.c:966
__bch2_trans_commit+0x1b67/0x8870 fs/bcachefs/btree_trans_commit.c:1030
bch2_trans_commit fs/bcachefs/btree_update.h:241 [inline]
bch2_gc_alloc_done fs/bcachefs/btree_gc.c:951 [inline]
bch2_check_allocations+0x2ee0/0x57b0 fs/bcachefs/btree_gc.c:1100
bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:484 [inline]
__bch2_run_recovery_passes+0x395/0x1010 fs/bcachefs/recovery_passes.c:539
bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:610
bch2_fs_recovery+0x2690/0x3a50 fs/bcachefs/recovery.c:1005
bch2_fs_start+0xaaf/0xda0 fs/bcachefs/super.c:1213
bch2_fs_get_tree+0xb39/0x1520 fs/bcachefs/fs.c:2488
vfs_get_tree+0x92/0x2b0 fs/super.c:1804
do_new_mount+0x24a/0xa40 fs/namespace.c:3902
do_mount fs/namespace.c:4239 [inline]
__do_sys_mount fs/namespace.c:4450 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4427
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888055140b80
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 40 bytes inside of
allocated 88-byte region [ffff888055140b80, ffff888055140bd8)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55140
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000000 ffff88801a441280 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 13, tgid 13 (kworker/u4:1), ts 69427733463, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4959
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab+0x8a/0x3b0 mm/slub.c:2619
new_slab mm/slub.c:2673 [inline]
___slab_alloc+0xbfc/0x1480 mm/slub.c:3859
__slab_alloc mm/slub.c:3949 [inline]
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_noprof+0x305/0x4f0 mm/slub.c:4340
kmalloc_noprof include/linux/slab.h:909 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
cfg80211_inform_single_bss_data+0x905/0x1ac0 net/wireless/scan.c:2339
cfg80211_inform_bss_data+0x1fb/0x3b20 net/wireless/scan.c:3222
cfg80211_inform_bss_frame_data+0x3d7/0x730 net/wireless/scan.c:3313
ieee80211_bss_info_update+0x746/0x9e0 net/mac80211/scan.c:226
ieee80211_rx_bss_info net/mac80211/ibss.c:1094 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1573 [inline]
ieee80211_ibss_rx_queued_mgmt+0xa36/0x2ae0 net/mac80211/ibss.c:1600
ieee80211_iface_process_skb net/mac80211/iface.c:1668 [inline]
ieee80211_iface_work+0x806/0xfe0 net/mac80211/iface.c:1722
cfg80211_wiphy_work+0x2df/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
page_owner free stack trace missing
Memory state around the buggy address:
ffff888055140a80: 00 00 00 00 00 00 00 00 00 00 03 fc fc fc fc fc
ffff888055140b00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
>ffff888055140b80: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
^
ffff888055140c00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff888055140c80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [fs?] linux-next test error: WARNING: suspicious RCU usage in proc_sys_compare
@ 2025-07-01 12:30 syzbot
2025-09-01 8:49 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-07-01 12:30 UTC (permalink / raw)
To: joel.granados, kees, linux-fsdevel, linux-kernel, linux-next, sfr,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 3f804361f3b9 Add linux-next specific files for 20250701
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14e11770580000
kernel config: https://syzkaller.appspot.com/x/.config?x=46111759e155f4cc
dashboard link: https://syzkaller.appspot.com/bug?extid=37d54f0f58ba8519cdbe
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c371987646a7/disk-3f804361.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94a8f81e003e/vmlinux-3f804361.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a126fddf774b/bzImage-3f804361.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+37d54f0f58ba8519cdbe@syzkaller.appspotmail.com
=============================
WARNING: suspicious RCU usage
6.16.0-rc4-next-20250701-syzkaller #0 Not tainted
-----------------------------
fs/proc/proc_sysctl.c:934 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
3 locks held by syz-executor/5832:
#0: ffff888030574428 (sb_writers#3){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:557
#1: ffff8880230d8190 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:884 [inline]
#1: ffff8880230d8190 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: open_last_lookups fs/namei.c:3806 [inline]
#1: ffff8880230d8190 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: path_openat+0x8cb/0x3830 fs/namei.c:4043
#2: ffff88807e2779c8 (&lockref->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#2: ffff88807e2779c8 (&lockref->lock){+.+.}-{3:3}, at: d_wait_lookup fs/dcache.c:2537 [inline]
#2: ffff88807e2779c8 (&lockref->lock){+.+.}-{3:3}, at: d_alloc_parallel+0xbe4/0x15e0 fs/dcache.c:2624
stack backtrace:
CPU: 0 UID: 0 PID: 5832 Comm: syz-executor Not tainted 6.16.0-rc4-next-20250701-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6871
proc_sys_compare+0x27d/0x2c0 fs/proc/proc_sysctl.c:934
d_same_name fs/dcache.c:2179 [inline]
d_alloc_parallel+0x105d/0x15e0 fs/dcache.c:2637
lookup_open fs/namei.c:3630 [inline]
open_last_lookups fs/namei.c:3807 [inline]
path_openat+0xa3b/0x3830 fs/namei.c:4043
do_filp_open+0x1fa/0x410 fs/namei.c:4073
do_sys_openat2+0x121/0x1c0 fs/open.c:1434
do_sys_open fs/open.c:1449 [inline]
__do_sys_openat fs/open.c:1465 [inline]
__se_sys_openat fs/open.c:1460 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1460
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa66218d211
Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 3a 83 1f 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 93 00 00 00 48 8b 54 24 28 64 48 2b 14 25
RSP: 002b:00007ffe575748d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000080001 RCX: 00007fa66218d211
RDX: 0000000000080001 RSI: 00007fa66222ae2b RDI: 00000000ffffff9c
RBP: 00007fa66222ae2b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000009
R13: 00007ffe57574970 R14: 0000000000000009 R15: 0000000000000000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [fs?] WARNING in minix_rename
@ 2025-06-24 17:02 syzbot
2025-10-13 13:38 ` Forwarded: syzbot
` (5 more replies)
0 siblings, 6 replies; 85+ messages in thread
From: syzbot @ 2025-06-24 17:02 UTC (permalink / raw)
To: linux-fsdevel, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 78f4e737a53e Merge tag 'for-6.16/dm-fixes' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10b29182580000
kernel config: https://syzkaller.appspot.com/x/.config?x=28cc6f051378bb16
dashboard link: https://syzkaller.appspot.com/bug?extid=a65e824272c5f741247d
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1446370c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/560a423a60ad/disk-78f4e737.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9e97e18d85b9/vmlinux-78f4e737.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a147a5a27c6e/bzImage-78f4e737.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2c4c332ed1d0/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=12276b70580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a65e824272c5f741247d@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6388 at fs/inode.c:417 drop_nlink+0xc5/0x110 fs/inode.c:417
Modules linked in:
CPU: 0 UID: 0 PID: 6388 Comm: syz.6.27 Not tainted 6.16.0-rc3-syzkaller-00042-g78f4e737a53e #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:drop_nlink+0xc5/0x110 fs/inode.c:417
Code: 78 07 00 00 be 08 00 00 00 e8 c7 35 e8 ff f0 48 ff 83 78 07 00 00 5b 41 5c 41 5e 41 5f 5d e9 42 01 29 09 cc e8 fc da 86 ff 90 <0f> 0b 90 eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5b ff ff ff
RSP: 0018:ffffc900030c7a30 EFLAGS: 00010293
RAX: ffffffff82397124 RBX: ffff888055405aa8 RCX: ffff88802da29e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f9fe1f7 R09: 1ffffffff1f3fc3e
R10: dffffc0000000000 R11: fffffbfff1f3fc3f R12: 1ffff1100aa80b5e
R13: 0000000000000000 R14: ffff888055405af0 R15: dffffc0000000000
FS: 00007fb57180a6c0(0000) GS:ffff888125c83000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb571809f98 CR3: 0000000032278000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
inode_dec_link_count include/linux/fs.h:2634 [inline]
minix_rename+0x3cf/0x700 fs/minix/namei.c:222
vfs_rename+0xb99/0xec0 fs/namei.c:5137
do_renameat2+0x878/0xc50 fs/namei.c:5286
__do_sys_rename fs/namei.c:5333 [inline]
__se_sys_rename fs/namei.c:5331 [inline]
__x64_sys_rename+0x82/0x90 fs/namei.c:5331
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb57098e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb57180a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007fb570bb6080 RCX: 00007fb57098e929
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000200000001980
RBP: 00007fb570a10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fb570bb6080 R15: 00007fffa5abc5a8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
@ 2025-10-13 13:38 ` syzbot
2025-10-14 15:24 ` Forwarded: syzbot
` (4 subsequent siblings)
5 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-13 13:38 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/namei.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..86779a6ec1a7 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -224,7 +224,7 @@ static int minix_rename(struct mnt_idmap *idmap,
err = minix_add_link(new_dentry, old_inode);
if (err)
goto out_dir;
- if (dir_de)
+ if (dir_de && old_dir != new_dir)
inode_inc_link_count(new_dir);
}
@@ -236,7 +236,7 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de) {
err = minix_set_link(dir_de, dir_folio, new_dir);
- if (!err)
+ if (!err && (new_inode || old_dir != new_dir))
inode_dec_link_count(old_dir);
}
out_dir:
--
2.51.0
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-10-13 13:38 ` Forwarded: syzbot
@ 2025-10-14 15:24 ` syzbot
2025-11-02 14:41 ` Forwarded: syzbot
` (3 subsequent siblings)
5 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-14 15:24 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/inode.c | 14 ++++++++++++++
fs/minix/namei.c | 22 ++++++++++++++--------
2 files changed, 28 insertions(+), 8 deletions(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EIO;
+
+ if (dir->i_nlink <= 2)
+ goto out;
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
}
+out:
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-10-13 13:38 ` Forwarded: syzbot
2025-10-14 15:24 ` Forwarded: syzbot
@ 2025-11-02 14:41 ` syzbot
2025-11-02 14:56 ` Forwarded: syzbot
` (2 subsequent siblings)
5 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 14:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (dir_de && new_inode->i_nlink != 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (2 preceding siblings ...)
2025-11-02 14:41 ` Forwarded: syzbot
@ 2025-11-02 14:56 ` syzbot
2025-11-02 15:50 ` Forwarded: syzbot
2025-11-02 16:58 ` Forwarded: syzbot
5 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 14:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (dir_de && new_inode->i_nlink != 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (3 preceding siblings ...)
2025-11-02 14:56 ` Forwarded: syzbot
@ 2025-11-02 15:50 ` syzbot
2025-11-02 16:58 ` Forwarded: syzbot
5 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 15:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..493a75eff2c9 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -208,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", new_inode->i_ino);
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (4 preceding siblings ...)
2025-11-02 15:50 ` Forwarded: syzbot
@ 2025-11-02 16:58 ` syzbot
5 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 16:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..f18f7474aca4 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -145,6 +145,12 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
struct minix_dir_entry * de;
int err;
+ if (inode->i_nlink < 1) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", inode->i_ino);
+ return -EFSCORRUPTED;
+ }
+
de = minix_find_entry(dentry, &folio);
if (!de)
return -ENOENT;
@@ -218,6 +224,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", new_inode->i_ino);
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in bch2_sb_members_v1_to_text
@ 2025-06-10 19:15 syzbot
2025-07-20 4:06 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-06-10 19:15 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: b27cc623e01b Add linux-next specific files for 20250610
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=11a1e9d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=846e731334efc0f8
dashboard link: https://syzkaller.appspot.com/bug?extid=e577022d4fba380653be
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14b2260c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1144cd70580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1c0c417339c8/disk-b27cc623.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fa29c0f3a1fa/vmlinux-b27cc623.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b902a80b6e7e/bzImage-b27cc623.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9ddd2f474e69/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e577022d4fba380653be@syzkaller.appspotmail.com
WARNING: The mand mount option has been deprecated and
and is ignored by this kernel. Remove the mand
option from the mount to silence this warning.
=======================================================
==================================================================
BUG: KASAN: slab-out-of-bounds in members_v1_get fs/bcachefs/sb-members.c:81 [inline]
BUG: KASAN: slab-out-of-bounds in bch2_sb_members_v1_to_text+0x1b2/0x2b0 fs/bcachefs/sb-members.c:334
Read of size 56 at addr ffff88803377dfd8 by task syz-executor978/5840
CPU: 1 UID: 0 PID: 5840 Comm: syz-executor978 Not tainted 6.16.0-rc1-next-20250610-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xd2/0x2b0 mm/kasan/report.c:521
kasan_report+0x118/0x150 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
members_v1_get fs/bcachefs/sb-members.c:81 [inline]
bch2_sb_members_v1_to_text+0x1b2/0x2b0 fs/bcachefs/sb-members.c:334
bch2_sb_field_validate+0x1c6/0x280 fs/bcachefs/super-io.c:1380
bch2_sb_validate+0x14bd/0x1980 fs/bcachefs/super-io.c:552
__bch2_read_super+0xba4/0x1040 fs/bcachefs/super-io.c:925
bch2_fs_open+0x1fe/0x2570 fs/bcachefs/super.c:2382
bch2_fs_get_tree+0x437/0x14f0 fs/bcachefs/fs.c:2473
vfs_get_tree+0x8f/0x2b0 fs/super.c:1802
do_new_mount+0x24a/0xa40 fs/namespace.c:3885
do_mount fs/namespace.c:4222 [inline]
__do_sys_mount fs/namespace.c:4433 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4410
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3ede35b93a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffebfe7f6d8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffebfe7f6f0 RCX: 00007f3ede35b93a
RDX: 00002000000003c0 RSI: 0000200000000080 RDI: 00007ffebfe7f6f0
RBP: 0000200000000080 R08: 00007ffebfe7f730 R09: 000000000000592e
R10: 0000000000808040 R11: 0000000000000282 R12: 00002000000003c0
R13: 00007ffebfe7f730 R14: 0000000000000003 R15: 0000000000808040
</TASK>
Allocated by task 5840:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4328 [inline]
__kmalloc_node_track_caller_noprof+0x271/0x4e0 mm/slub.c:4347
__do_krealloc mm/slub.c:4905 [inline]
krealloc_noprof+0x124/0x340 mm/slub.c:4958
bch2_sb_realloc+0x348/0x630 fs/bcachefs/super-io.c:222
read_one_super+0x3a3/0x850 fs/bcachefs/super-io.c:759
__bch2_read_super+0x6c6/0x1040 fs/bcachefs/super-io.c:851
bch2_fs_open+0x1fe/0x2570 fs/bcachefs/super.c:2382
bch2_fs_get_tree+0x437/0x14f0 fs/bcachefs/fs.c:2473
vfs_get_tree+0x8f/0x2b0 fs/super.c:1802
do_new_mount+0x24a/0xa40 fs/namespace.c:3885
do_mount fs/namespace.c:4222 [inline]
__do_sys_mount fs/namespace.c:4433 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4410
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88803377c000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 8152 bytes inside of
allocated 8192-byte region [ffff88803377c000, ffff88803377e000)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33778
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801a442280 ffffea0000d03200 0000000000000005
raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801a442280 ffffea0000d03200 0000000000000005
head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000cdde01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5495, tgid 5495 (sh), ts 57351029645, free_ts 57299723965
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4959
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
alloc_slab_page mm/slub.c:2451 [inline]
allocate_slab+0x8a/0x3b0 mm/slub.c:2619
new_slab mm/slub.c:2673 [inline]
___slab_alloc+0xbfc/0x1480 mm/slub.c:3859
__slab_alloc mm/slub.c:3949 [inline]
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__kmalloc_cache_noprof+0x296/0x3d0 mm/slub.c:4354
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
tomoyo_init_log+0x111f/0x1f70 security/tomoyo/audit.c:264
tomoyo_supervisor+0x340/0x1480 security/tomoyo/common.c:2198
tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
tomoyo_env_perm+0x149/0x1e0 security/tomoyo/environ.c:63
tomoyo_environ security/tomoyo/domain.c:672 [inline]
tomoyo_find_next_domain+0x15cf/0x1aa0 security/tomoyo/domain.c:888
tomoyo_bprm_check_security+0x11c/0x180 security/tomoyo/tomoyo.c:102
security_bprm_check+0x89/0x270 security/security.c:1302
search_binary_handler fs/exec.c:1655 [inline]
exec_binprm fs/exec.c:1697 [inline]
bprm_execve+0x8ee/0x1450 fs/exec.c:1749
do_execveat_common+0x510/0x6a0 fs/exec.c:1855
do_execve fs/exec.c:1929 [inline]
__do_sys_execve fs/exec.c:2005 [inline]
__se_sys_execve fs/exec.c:2000 [inline]
__x64_sys_execve+0x94/0xb0 fs/exec.c:2000
page last free pid 5494 tgid 5494 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
__free_frozen_pages+0xc71/0xe70 mm/page_alloc.c:2706
discard_slab mm/slub.c:2717 [inline]
__put_partials+0x161/0x1c0 mm/slub.c:3186
put_cpu_partial+0x17c/0x250 mm/slub.c:3261
__slab_free+0x2f7/0x400 mm/slub.c:4513
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4148 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x1be/0x3d0 mm/slub.c:4354
kmalloc_noprof include/linux/slab.h:905 [inline]
tomoyo_print_header security/tomoyo/audit.c:156 [inline]
tomoyo_init_log+0x183/0x1f70 security/tomoyo/audit.c:255
tomoyo_supervisor+0x340/0x1480 security/tomoyo/common.c:2198
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission+0x25a/0x380 security/tomoyo/file.c:587
tomoyo_check_open_permission+0x24d/0x3b0 security/tomoyo/file.c:777
security_file_open+0xb1/0x270 security/security.c:3114
do_dentry_open+0x35e/0x1970 fs/open.c:941
vfs_open+0x3b/0x340 fs/open.c:1094
do_open fs/namei.c:3887 [inline]
path_openat+0x2ee5/0x3830 fs/namei.c:4046
Memory state around the buggy address:
ffff88803377df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88803377df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88803377e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88803377e080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88803377e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] WARNING in bch2_fs_journal_start
@ 2025-05-31 18:28 syzbot
2025-07-20 17:30 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-05-31 18:28 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: b1456f6dc167 Merge tag 'timers-core-2025-05-25' of git://g..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17256df4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e178ebeb0aded44c
dashboard link: https://syzkaller.appspot.com/bug?extid=527519da96e15b411c73
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15600482580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1409a6d4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/501bf321b156/disk-b1456f6d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d3c8e81517e2/vmlinux-b1456f6d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e6e8960905fd/bzImage-b1456f6d.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/674711f8120d/mount_0.gz
The issue was bisected to:
commit 521f9584c2bd48198ac9d9b99a372b1306f3bb97
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Fri May 23 18:03:06 2025 +0000
bcachefs: Ensure we don't use a blacklisted journal seq
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=170266d4580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=148266d4580000
console output: https://syzkaller.appspot.com/x/log.txt?x=108266d4580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+527519da96e15b411c73@syzkaller.appspotmail.com
Fixes: 521f9584c2bd ("bcachefs: Ensure we don't use a blacklisted journal seq")
bcachefs (loop0): Version upgrade required:
Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete
Doing incompatible version upgrade from 0.24: unwritten_extents to 1.28: inode_has_case_insensitive
running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,check_rebalance_work,set_fs_needs_rebalance
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5823 at mm/slub.c:5024 __kvmalloc_node_noprof+0x4ca/0x600 mm/slub.c:5024
Modules linked in:
CPU: 1 UID: 0 PID: 5823 Comm: syz-executor230 Not tainted 6.15.0-syzkaller-02198-gb1456f6dc167 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__kvmalloc_node_noprof+0x4ca/0x600 mm/slub.c:5024
Code: 0f 85 36 fc ff ff 31 c0 41 f6 c5 10 0f 94 c0 4c 8d 34 45 01 00 00 00 e9 20 fc ff ff 41 f7 c0 00 20 00 00 0f 85 8f fe ff ff 90 <0f> 0b 90 31 db e9 f2 fe ff ff 48 c7 c7 80 86 04 8e 48 89 de e8 0d
RSP: 0018:ffffc900043af1d8 EFLAGS: 00010246
RAX: 0000000000000360 RBX: 0000000000000000 RCX: 72c1c7b072d25100
RDX: 000001b000000000 RSI: ffffffff8bc17920 RDI: ffffffff8bc178e0
RBP: ffffffff843fb660 R08: 0000000000000cc0 R09: 00000000ffffffff
R10: ffffc900043af080 R11: fffff52000875e15 R12: 000001b000000000
R13: 0000000000012cc0 R14: ffffffff843fb660 R15: 00000000ffffffff
FS: 0000555588a53380(0000) GS:ffff8881261c7000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca09dfed4 CR3: 0000000034b80000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bch2_fs_journal_start+0x480/0x1500 fs/bcachefs/journal.c:1459
bch2_fs_recovery+0x20ca/0x3970 fs/bcachefs/recovery.c:953
bch2_fs_start+0xa43/0xd30 fs/bcachefs/super.c:1206
bch2_fs_get_tree+0xbfc/0x15f0 fs/bcachefs/fs.c:2479
vfs_get_tree+0x92/0x2b0 fs/super.c:1809
do_new_mount+0x24a/0xa40 fs/namespace.c:3882
do_mount fs/namespace.c:4222 [inline]
__do_sys_mount fs/namespace.c:4433 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4410
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa56d6f7faa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe2a8b108 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fffe2a8b120 RCX: 00007fa56d6f7faa
RDX: 0000200000000040 RSI: 0000200000000000 RDI: 00007fffe2a8b120
RBP: 0000200000000000 R08: 00007fffe2a8b160 R09: 00000000000059d1
R10: 0000000000800000 R11: 0000000000000282 R12: 0000200000000040
R13: 00007fffe2a8b160 R14: 0000000000000003 R15: 0000000000800000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [block?] [bcachefs?] kernel BUG in blk_mq_end_request
@ 2025-05-24 1:52 syzbot
2025-07-20 14:44 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-05-24 1:52 UTC (permalink / raw)
To: axboe, kent.overstreet, linux-bcachefs, linux-block, linux-kernel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: a5806cd506af Linux 6.15-rc7
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=131bde70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a1de0d8596cea805
dashboard link: https://syzkaller.appspot.com/bug?extid=a8f903ba15921696861d
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bb32d4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=142351f4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d72f8f4a220d/disk-a5806cd5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6567d0e5a4d8/vmlinux-a5806cd5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/66e79750c483/bzImage-a5806cd5.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7fdb68bab5ea/mount_0.gz
The issue was bisected to:
commit f5095b9f85a1674a92d00e7ab466499a8ba49ce1
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Tue Jan 2 00:42:37 2024 +0000
bcachefs: dev_usage updated by new accounting
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14897e70580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=16897e70580000
console output: https://syzkaller.appspot.com/x/log.txt?x=12897e70580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a8f903ba15921696861d@syzkaller.appspotmail.com
Fixes: f5095b9f85a1 ("bcachefs: dev_usage updated by new accounting")
------------[ cut here ]------------
kernel BUG at block/blk-mq.c:1146!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:blk_mq_end_request+0x6c/0x70 block/blk-mq.c:1146
Code: e8 79 f1 2b fd 48 89 df 89 ee 5b 5d e9 bd f9 ff ff 89 f9 80 e1 07 80 c1 03 38 c1 7c ce e8 ec c5 8b fd eb c7 e8 55 f1 2b fd 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc90000147bb8 EFLAGS: 00010246
RAX: ffffffff8493ff8b RBX: ffff8880242d1200 RCX: ffff88801c6d3c00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88801c6d3c00 R09: 0000000000000003
R10: 0000000000000009 R11: 0000000000000100 R12: dffffc0000000000
R13: 0000000000000005 R14: ffff8880242d1200 R15: ffffffff8be81688
FS: 0000000000000000(0000) GS:ffff8881260f6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000007cdd8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
blk_complete_reqs block/blk-mq.c:1220 [inline]
blk_done_softirq+0x10a/0x160 block/blk-mq.c:1225
handle_softirqs+0x283/0x870 kernel/softirq.c:579
run_ksoftirqd+0x9b/0x100 kernel/softirq.c:968
smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:164
kthread+0x711/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:blk_mq_end_request+0x6c/0x70 block/blk-mq.c:1146
Code: e8 79 f1 2b fd 48 89 df 89 ee 5b 5d e9 bd f9 ff ff 89 f9 80 e1 07 80 c1 03 38 c1 7c ce e8 ec c5 8b fd eb c7 e8 55 f1 2b fd 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc90000147bb8 EFLAGS: 00010246
RAX: ffffffff8493ff8b RBX: ffff8880242d1200 RCX: ffff88801c6d3c00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88801c6d3c00 R09: 0000000000000003
R10: 0000000000000009 R11: 0000000000000100 R12: dffffc0000000000
R13: 0000000000000005 R14: ffff8880242d1200 R15: ffffffff8be81688
FS: 0000000000000000(0000) GS:ffff8881260f6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000007cdd8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] possible deadlock in __bch2_folio_reservation_get (2)
@ 2025-05-12 20:55 syzbot
2025-07-22 18:22 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-05-12 20:55 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: c32f8dc5aaf9 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=143862f4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ea4635ffd6ad5b4a
dashboard link: https://syzkaller.appspot.com/bug?extid=bfdc0e00ec47a6f7f6a5
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b921498959d4/disk-c32f8dc5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/04e6ad946c4b/vmlinux-c32f8dc5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d4f0d8db50ee/Image-c32f8dc5.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bfdc0e00ec47a6f7f6a5@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 Not tainted
------------------------------------------------------
syz.1.118/7224 is trying to acquire lock:
ffff0000dde633b8 (&inode->ei_quota_lock){+.+.}-{4:4}, at: bch2_quota_reservation_add fs/bcachefs/fs-io.h:97 [inline]
ffff0000dde633b8 (&inode->ei_quota_lock){+.+.}-{4:4}, at: __bch2_folio_reservation_get+0x5c0/0xa00 fs/bcachefs/fs-io-pagecache.c:460
but task is already holding lock:
ffff0000d5030518 (sb_pagefaults#3){.+.+}-{0:0}, at: do_page_mkwrite+0x138/0x2b8 mm/memory.c:3287
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #8 (sb_pagefaults#3){.+.+}-{0:0}:
percpu_down_read include/linux/percpu-rwsem.h:52 [inline]
__sb_start_write include/linux/fs.h:1783 [inline]
sb_start_pagefault include/linux/fs.h:1948 [inline]
bch2_page_mkwrite+0x260/0xd60 fs/bcachefs/fs-io-pagecache.c:614
do_page_mkwrite+0x138/0x2b8 mm/memory.c:3287
do_shared_fault mm/memory.c:5594 [inline]
do_fault mm/memory.c:5656 [inline]
do_pte_missing mm/memory.c:4160 [inline]
handle_pte_fault mm/memory.c:5997 [inline]
__handle_mm_fault mm/memory.c:6140 [inline]
handle_mm_fault+0x1998/0x4cec mm/memory.c:6309
do_page_fault+0x598/0x1554 arch/arm64/mm/fault.c:690
do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:783
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:919
el0_da+0x64/0x160 arch/arm64/kernel/entry-common.c:627
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:789
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
-> #7 (&mm->mmap_lock){++++}-{4:4}:
__might_fault+0xc4/0x124 mm/memory.c:7151
drm_mode_object_get_properties+0x1f0/0x524 drivers/gpu/drm/drm_mode_object.c:407
drm_mode_getconnector+0xd78/0x1254 drivers/gpu/drm/drm_connector.c:3399
drm_ioctl_kernel+0x238/0x310 drivers/gpu/drm/drm_ioctl.c:796
drm_ioctl+0x65c/0xa5c drivers/gpu/drm/drm_ioctl.c:893
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:892
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
-> #6 (crtc_ww_class_mutex){+.+.}-{4:4}:
ww_acquire_init include/linux/ww_mutex.h:162 [inline]
drm_modeset_acquire_init+0x1d8/0x374 drivers/gpu/drm/drm_modeset_lock.c:250
drmm_mode_config_init+0xb0c/0x10d8 drivers/gpu/drm/drm_mode_config.c:462
vkms_modeset_init drivers/gpu/drm/vkms/vkms_drv.c:146 [inline]
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:207 [inline]
vkms_init+0x2c0/0x5ac drivers/gpu/drm/vkms/vkms_drv.c:242
do_one_initcall+0x250/0x990 init/main.c:1257
do_initcall_level+0x154/0x214 init/main.c:1319
do_initcalls+0x84/0xf4 init/main.c:1335
do_basic_setup+0x8c/0xa0 init/main.c:1354
kernel_init_freeable+0x2dc/0x444 init/main.c:1567
kernel_init+0x24/0x1dc init/main.c:1457
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
-> #5 (crtc_ww_class_acquire){+.+.}-{0:0}:
ww_acquire_init include/linux/ww_mutex.h:161 [inline]
drm_modeset_acquire_init+0x1b8/0x374 drivers/gpu/drm/drm_modeset_lock.c:250
drm_client_modeset_commit_atomic+0xcc/0x6ac drivers/gpu/drm/drm_client_modeset.c:1018
drm_client_modeset_commit_locked+0xd0/0x4a0 drivers/gpu/drm/drm_client_modeset.c:1182
drm_client_modeset_commit+0x50/0x7c drivers/gpu/drm/drm_client_modeset.c:1208
__drm_fb_helper_restore_fbdev_mode_unlocked+0x94/0x198 drivers/gpu/drm/drm_fb_helper.c:237
drm_fb_helper_set_par+0xa4/0x108 drivers/gpu/drm/drm_fb_helper.c:1359
fbcon_init+0xe4c/0x1d18 drivers/video/fbdev/core/fbcon.c:1112
visual_init+0x27c/0x540 drivers/tty/vt/vt.c:1011
do_bind_con_driver+0x7b8/0xdd8 drivers/tty/vt/vt.c:3831
do_take_over_console+0x824/0x97c drivers/tty/vt/vt.c:4397
do_fbcon_takeover+0x158/0x25c drivers/video/fbdev/core/fbcon.c:548
do_fb_registered drivers/video/fbdev/core/fbcon.c:2989 [inline]
fbcon_fb_registered+0x354/0x4c8 drivers/video/fbdev/core/fbcon.c:3009
do_register_framebuffer drivers/video/fbdev/core/fbmem.c:449 [inline]
register_framebuffer+0x44c/0x5ec drivers/video/fbdev/core/fbmem.c:515
__drm_fb_helper_initial_config_and_unlock+0x103c/0x159c drivers/gpu/drm/drm_fb_helper.c:1851
drm_fb_helper_initial_config+0x3c/0x58 drivers/gpu/drm/drm_fb_helper.c:1916
drm_fbdev_client_hotplug+0x154/0x22c drivers/gpu/drm/clients/drm_fbdev_client.c:52
drm_client_register+0x13c/0x1d4 drivers/gpu/drm/drm_client.c:140
drm_fbdev_client_setup+0x194/0x3d0 drivers/gpu/drm/clients/drm_fbdev_client.c:159
drm_client_setup+0x78/0x140 drivers/gpu/drm/clients/drm_client_setup.c:39
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:218 [inline]
vkms_init+0x4b8/0x5ac drivers/gpu/drm/vkms/vkms_drv.c:242
do_one_initcall+0x250/0x990 init/main.c:1257
do_initcall_level+0x154/0x214 init/main.c:1319
do_initcalls+0x84/0xf4 init/main.c:1335
do_basic_setup+0x8c/0xa0 init/main.c:1354
kernel_init_freeable+0x2dc/0x444 init/main.c:1567
kernel_init+0x24/0x1dc init/main.c:1457
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
-> #4 (&client->modeset_mutex){+.+.}-{4:4}:
__mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601
__mutex_lock kernel/locking/mutex.c:746 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798
drm_client_modeset_probe+0x2f0/0x4e88 drivers/gpu/drm/drm_client_modeset.c:843
__drm_fb_helper_initial_config_and_unlock+0xf0/0x159c drivers/gpu/drm/drm_fb_helper.c:1828
drm_fb_helper_initial_config+0x3c/0x58 drivers/gpu/drm/drm_fb_helper.c:1916
drm_fbdev_client_hotplug+0x154/0x22c drivers/gpu/drm/clients/drm_fbdev_client.c:52
drm_client_register+0x13c/0x1d4 drivers/gpu/drm/drm_client.c:140
drm_fbdev_client_setup+0x194/0x3d0 drivers/gpu/drm/clients/drm_fbdev_client.c:159
drm_client_setup+0x78/0x140 drivers/gpu/drm/clients/drm_client_setup.c:39
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:218 [inline]
vkms_init+0x4b8/0x5ac drivers/gpu/drm/vkms/vkms_drv.c:242
do_one_initcall+0x250/0x990 init/main.c:1257
do_initcall_level+0x154/0x214 init/main.c:1319
do_initcalls+0x84/0xf4 init/main.c:1335
do_basic_setup+0x8c/0xa0 init/main.c:1354
kernel_init_freeable+0x2dc/0x444 init/main.c:1567
kernel_init+0x24/0x1dc init/main.c:1457
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
-> #3 (&helper->lock){+.+.}-{4:4}:
__mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601
__mutex_lock kernel/locking/mutex.c:746 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798
__drm_fb_helper_restore_fbdev_mode_unlocked+0x74/0x198 drivers/gpu/drm/drm_fb_helper.c:228
drm_fb_helper_set_par+0xa4/0x108 drivers/gpu/drm/drm_fb_helper.c:1359
fbcon_init+0xe4c/0x1d18 drivers/video/fbdev/core/fbcon.c:1112
visual_init+0x27c/0x540 drivers/tty/vt/vt.c:1011
do_bind_con_driver+0x7b8/0xdd8 drivers/tty/vt/vt.c:3831
do_take_over_console+0x824/0x97c drivers/tty/vt/vt.c:4397
do_fbcon_takeover+0x158/0x25c drivers/video/fbdev/core/fbcon.c:548
do_fb_registered drivers/video/fbdev/core/fbcon.c:2989 [inline]
fbcon_fb_registered+0x354/0x4c8 drivers/video/fbdev/core/fbcon.c:3009
do_register_framebuffer drivers/video/fbdev/core/fbmem.c:449 [inline]
register_framebuffer+0x44c/0x5ec drivers/video/fbdev/core/fbmem.c:515
__drm_fb_helper_initial_config_and_unlock+0x103c/0x159c drivers/gpu/drm/drm_fb_helper.c:1851
drm_fb_helper_initial_config+0x3c/0x58 drivers/gpu/drm/drm_fb_helper.c:1916
drm_fbdev_client_hotplug+0x154/0x22c drivers/gpu/drm/clients/drm_fbdev_client.c:52
drm_client_register+0x13c/0x1d4 drivers/gpu/drm/drm_client.c:140
drm_fbdev_client_setup+0x194/0x3d0 drivers/gpu/drm/clients/drm_fbdev_client.c:159
drm_client_setup+0x78/0x140 drivers/gpu/drm/clients/drm_client_setup.c:39
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:218 [inline]
vkms_init+0x4b8/0x5ac drivers/gpu/drm/vkms/vkms_drv.c:242
do_one_initcall+0x250/0x990 init/main.c:1257
do_initcall_level+0x154/0x214 init/main.c:1319
do_initcalls+0x84/0xf4 init/main.c:1335
do_basic_setup+0x8c/0xa0 init/main.c:1354
kernel_init_freeable+0x2dc/0x444 init/main.c:1567
kernel_init+0x24/0x1dc init/main.c:1457
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
-> #2 (console_lock){+.+.}-{0:0}:
console_lock+0x194/0x1ec kernel/printk/printk.c:2849
__bch2_print_string_as_lines fs/bcachefs/util.c:267 [inline]
bch2_print_string_as_lines+0x34/0x150 fs/bcachefs/util.c:286
__bch2_fsck_err+0xb5c/0xdd0 fs/bcachefs/error.c:562
__need_discard_or_freespace_err+0x14c/0x1cc fs/bcachefs/alloc_background.c:678
bch2_bucket_do_index+0x320/0x490 fs/bcachefs/alloc_background.c:729
bch2_trigger_alloc+0xd1c/0x2d54 fs/bcachefs/alloc_background.c:885
bch2_key_trigger fs/bcachefs/bkey_methods.h:88 [inline]
bch2_key_trigger_new fs/bcachefs/bkey_methods.h:116 [inline]
run_one_trans_trigger fs/bcachefs/btree_trans_commit.c:516 [inline]
bch2_trans_commit_run_triggers fs/bcachefs/btree_trans_commit.c:550 [inline]
__bch2_trans_commit+0x634/0x62d0 fs/bcachefs/btree_trans_commit.c:990
bch2_trans_commit fs/bcachefs/btree_update.h:195 [inline]
btree_update_nodes_written fs/bcachefs/btree_update_interior.c:705 [inline]
btree_interior_update_work+0xb80/0x1cfc fs/bcachefs/btree_update_interior.c:843
process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3400
kthread+0x5fc/0x75c kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
-> #1 (&c->fsck_error_msgs_lock){+.+.}-{4:4}:
__mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601
__mutex_lock kernel/locking/mutex.c:746 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798
__bch2_count_fsck_err+0x58/0x98 fs/bcachefs/error.c:385
__bch2_i_sectors_acct+0x328/0x3c4 fs/bcachefs/fs-io.c:155
bch2_i_sectors_acct fs/bcachefs/fs-io.h:138 [inline]
bchfs_truncate+0x684/0xa70 fs/bcachefs/fs-io.c:510
bch2_setattr+0x198/0x20c fs/bcachefs/fs.c:1245
notify_change+0x9a4/0xc50 fs/attr.c:552
do_truncate+0x178/0x1f0 fs/open.c:65
handle_truncate fs/namei.c:3501 [inline]
do_open fs/namei.c:3884 [inline]
path_openat+0x25a0/0x2c40 fs/namei.c:4039
do_filp_open+0x18c/0x36c fs/namei.c:4066
do_sys_openat2+0x11c/0x1b4 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__arm64_sys_openat+0x120/0x158 fs/open.c:1455
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
-> #0 (&inode->ei_quota_lock){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3166 [inline]
check_prevs_add kernel/locking/lockdep.c:3285 [inline]
validate_chain kernel/locking/lockdep.c:3909 [inline]
__lock_acquire+0x1728/0x3058 kernel/locking/lockdep.c:5235
lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5866
__mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601
__mutex_lock kernel/locking/mutex.c:746 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798
bch2_quota_reservation_add fs/bcachefs/fs-io.h:97 [inline]
__bch2_folio_reservation_get+0x5c0/0xa00 fs/bcachefs/fs-io-pagecache.c:460
bch2_folio_reservation_get fs/bcachefs/fs-io-pagecache.c:477 [inline]
bch2_page_mkwrite+0xa48/0xd60 fs/bcachefs/fs-io-pagecache.c:637
do_page_mkwrite+0x138/0x2b8 mm/memory.c:3287
do_shared_fault mm/memory.c:5594 [inline]
do_fault mm/memory.c:5656 [inline]
do_pte_missing mm/memory.c:4160 [inline]
handle_pte_fault mm/memory.c:5997 [inline]
__handle_mm_fault mm/memory.c:6140 [inline]
handle_mm_fault+0x1998/0x4cec mm/memory.c:6309
do_page_fault+0x598/0x1554 arch/arm64/mm/fault.c:690
do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:783
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:919
el0_da+0x64/0x160 arch/arm64/kernel/entry-common.c:627
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:789
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
other info that might help us debug this:
Chain exists of:
&inode->ei_quota_lock --> &mm->mmap_lock --> sb_pagefaults#3
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(sb_pagefaults#3);
lock(&mm->mmap_lock);
lock(sb_pagefaults#3);
lock(&inode->ei_quota_lock);
*** DEADLOCK ***
2 locks held by syz.1.118/7224:
#0: ffff0000cdb392d0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:203 [inline]
#0: ffff0000cdb392d0 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/memory.c:6346 [inline]
#0: ffff0000cdb392d0 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x38/0x2d8 mm/memory.c:6406
#1: ffff0000d5030518 (sb_pagefaults#3){.+.+}-{0:0}, at: do_page_mkwrite+0x138/0x2b8 mm/memory.c:3287
stack backtrace:
CPU: 1 UID: 0 PID: 7224 Comm: syz.1.118 Not tainted 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_circular_bug+0x324/0x32c kernel/locking/lockdep.c:2079
check_noncircular+0x154/0x174 kernel/locking/lockdep.c:2211
check_prev_add kernel/locking/lockdep.c:3166 [inline]
check_prevs_add kernel/locking/lockdep.c:3285 [inline]
validate_chain kernel/locking/lockdep.c:3909 [inline]
__lock_acquire+0x1728/0x3058 kernel/locking/lockdep.c:5235
lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5866
__mutex_lock_common+0x1d0/0x2190 kernel/locking/mutex.c:601
__mutex_lock kernel/locking/mutex.c:746 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:798
bch2_quota_reservation_add fs/bcachefs/fs-io.h:97 [inline]
__bch2_folio_reservation_get+0x5c0/0xa00 fs/bcachefs/fs-io-pagecache.c:460
bch2_folio_reservation_get fs/bcachefs/fs-io-pagecache.c:477 [inline]
bch2_page_mkwrite+0xa48/0xd60 fs/bcachefs/fs-io-pagecache.c:637
do_page_mkwrite+0x138/0x2b8 mm/memory.c:3287
do_shared_fault mm/memory.c:5594 [inline]
do_fault mm/memory.c:5656 [inline]
do_pte_missing mm/memory.c:4160 [inline]
handle_pte_fault mm/memory.c:5997 [inline]
__handle_mm_fault mm/memory.c:6140 [inline]
handle_mm_fault+0x1998/0x4cec mm/memory.c:6309
do_page_fault+0x598/0x1554 arch/arm64/mm/fault.c:690
do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:783
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:919
el0_da+0x64/0x160 arch/arm64/kernel/entry-common.c:627
el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:789
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_checksum
@ 2025-05-11 12:57 syzbot
2025-07-20 14:55 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-05-11 12:57 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: d76bb1ebb558 Merge tag 'erofs-for-6.15-rc6-fixes' of git:/..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1594e4f4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b9683d529ec1b880
dashboard link: https://syzkaller.appspot.com/bug?extid=7d5c34b9ec9fe139fc0c
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123544d4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11870768580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8c8c524d8686/disk-d76bb1eb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c89d5e1e7d6f/vmlinux-d76bb1eb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/923d0906d02c/bzImage-d76bb1eb.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/af55279b702f/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7d5c34b9ec9fe139fc0c@syzkaller.appspotmail.com
node offset 8/40 bset u64s 375: checksum error, type chacha20_poly1305_128: got eb21ae8bf0ac3fa53472f8290f6e6780 should be 61ec379a8789477e76ff1a5280fd6dbd, fixing
==================================================================
BUG: KASAN: use-after-free in poly1305_update include/crypto/poly1305.h:83 [inline]
BUG: KASAN: use-after-free in bch2_checksum+0x209/0x490 fs/bcachefs/checksum.c:157
Read of size 8 at addr ffff888070915af0 by task syz-executor367/5826
CPU: 1 UID: 0 PID: 5826 Comm: syz-executor367 Not tainted 6.15.0-rc5-syzkaller-00043-gd76bb1ebb558 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xb4/0x290 mm/kasan/report.c:521
kasan_report+0x118/0x150 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x29a/0x2b0 mm/kasan/generic.c:189
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
poly1305_update include/crypto/poly1305.h:83 [inline]
bch2_checksum+0x209/0x490 fs/bcachefs/checksum.c:157
bch2_btree_node_read_done+0x1003/0x5470 fs/bcachefs/btree_io.c:1132
btree_node_read_work+0x565/0xef0 fs/bcachefs/btree_io.c:1366
bch2_btree_node_read+0x2151/0x27a0 fs/bcachefs/btree_io.c:-1
__bch2_btree_root_read fs/bcachefs/btree_io.c:1797 [inline]
bch2_btree_root_read+0x5e7/0x750 fs/bcachefs/btree_io.c:1819
read_btree_roots+0x2cb/0x800 fs/bcachefs/recovery.c:582
bch2_fs_recovery+0x2356/0x37b0 fs/bcachefs/recovery.c:929
bch2_fs_start+0x70b/0xae0 fs/bcachefs/super.c:1091
bch2_fs_get_tree+0xd99/0x13a0 fs/bcachefs/fs.c:2570
vfs_get_tree+0x8f/0x2b0 fs/super.c:1759
do_new_mount+0x24a/0xa40 fs/namespace.c:3884
do_mount fs/namespace.c:4224 [inline]
__do_sys_mount fs/namespace.c:4435 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4412
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff05760c2fa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff0575c1088 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ff0575c10a0 RCX: 00007ff05760c2fa
RDX: 000020000000f640 RSI: 0000200000000080 RDI: 00007ff0575c10a0
RBP: 0000200000000080 R08: 00007ff0575c10e0 R09: 000000000000f5fe
R10: 0000000000010000 R11: 0000000000000282 R12: 000020000000f640
R13: 00007ff0575c10e0 R14: 0000000000000003 R15: 0000000000010000
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70915
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 5, migratetype Reclaimable, gfp_mask 0x452cd0(GFP_KERNEL_ACCOUNT|__GFP_RECLAIMABLE|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5826, tgid 5825 (syz-executor367), ts 88234860937, free_ts 88442709891
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1718
prep_new_page mm/page_alloc.c:1726 [inline]
get_page_from_freelist+0x21c7/0x22a0 mm/page_alloc.c:3688
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4970
__alloc_pages_noprof+0xa/0x30 mm/page_alloc.c:5004
__alloc_pages_node_noprof include/linux/gfp.h:284 [inline]
alloc_pages_node_noprof include/linux/gfp.h:311 [inline]
___kmalloc_large_node+0x85/0x200 mm/slub.c:4271
__kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4299
__do_kmalloc_node mm/slub.c:4315 [inline]
__kvmalloc_node_noprof+0x74/0x5e0 mm/slub.c:5012
btree_node_data_alloc+0xd5/0x260 fs/bcachefs/btree_cache.c:156
__bch2_btree_node_mem_alloc+0x1ed/0x410 fs/bcachefs/btree_cache.c:201
bch2_fs_btree_cache_init+0x2c9/0x680 fs/bcachefs/btree_cache.c:656
bch2_fs_alloc fs/bcachefs/super.c:909 [inline]
bch2_fs_open+0x235e/0x2820 fs/bcachefs/super.c:2205
bch2_fs_get_tree+0x45d/0x13a0 fs/bcachefs/fs.c:2489
vfs_get_tree+0x8f/0x2b0 fs/super.c:1759
do_new_mount+0x24a/0xa40 fs/namespace.c:3884
do_mount fs/namespace.c:4224 [inline]
__do_sys_mount fs/namespace.c:4435 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4412
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
page last free pid 5826 tgid 5825 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1262 [inline]
__free_pages_ok+0x910/0xac0 mm/page_alloc.c:1438
__folio_put+0x21b/0x2c0 mm/swap.c:112
folio_put include/linux/mm.h:1580 [inline]
free_large_kmalloc+0x145/0x200 mm/slub.c:4767
btree_bounce_free fs/bcachefs/btree_io.c:112 [inline]
bch2_btree_node_read_done+0x3450/0x5470 fs/bcachefs/btree_io.c:1245
btree_node_read_work+0x565/0xef0 fs/bcachefs/btree_io.c:1366
bch2_btree_node_read+0x2151/0x27a0 fs/bcachefs/btree_io.c:-1
__bch2_btree_root_read fs/bcachefs/btree_io.c:1797 [inline]
bch2_btree_root_read+0x5e7/0x750 fs/bcachefs/btree_io.c:1819
read_btree_roots+0x2cb/0x800 fs/bcachefs/recovery.c:582
bch2_fs_recovery+0x2356/0x37b0 fs/bcachefs/recovery.c:929
bch2_fs_start+0x70b/0xae0 fs/bcachefs/super.c:1091
bch2_fs_get_tree+0xd99/0x13a0 fs/bcachefs/fs.c:2570
vfs_get_tree+0x8f/0x2b0 fs/super.c:1759
do_new_mount+0x24a/0xa40 fs/namespace.c:3884
do_mount fs/namespace.c:4224 [inline]
__do_sys_mount fs/namespace.c:4435 [inline]
__se_sys_mount+0x317/0x410 fs/namespace.c:4412
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888070915980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888070915a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888070915a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888070915b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888070915b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [jfs?] WARNING in jfs_rename
@ 2025-05-09 4:43 syzbot
2025-10-12 16:19 ` Forwarded: syzbot
2025-10-12 17:45 ` Forwarded: syzbot
0 siblings, 2 replies; 85+ messages in thread
From: syzbot @ 2025-05-09 4:43 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 14c55b7bb0a8 Merge tag 'perf-tools-fixes-for-v6.15-2025-05..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=178078d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a42a9d552788177b
dashboard link: https://syzkaller.appspot.com/bug?extid=9131ddfd7870623b719f
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16845a70580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1681d0f4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3edd34cd2f74/disk-14c55b7b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a6d9796beefe/vmlinux-14c55b7b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/90e0c0a88995/bzImage-14c55b7b.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/cb4a6659212d/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=167008f4580000)
Bisection is inconclusive: the issue happens on the oldest tested release.
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14935a70580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=16935a70580000
console output: https://syzkaller.appspot.com/x/log.txt?x=12935a70580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5815 at fs/inode.c:417 drop_nlink+0xc5/0x110 fs/inode.c:417
Modules linked in:
CPU: 0 UID: 0 PID: 5815 Comm: syz-executor240 Not tainted 6.15.0-rc4-syzkaller-00319-g14c55b7bb0a8 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
RIP: 0010:drop_nlink+0xc5/0x110 fs/inode.c:417
Code: 70 07 00 00 be 08 00 00 00 e8 b7 84 e8 ff f0 48 ff 83 70 07 00 00 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc e8 0c b3 88 ff 90 <0f> 0b 90 eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5b ff ff ff
RSP: 0018:ffffc9000403f8b0 EFLAGS: 00010293
RAX: ffffffff82371c54 RBX: ffff88807ab92910 RCX: ffff888068d38000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffea0001ebfef7 R09: 1ffffd40003d7fde
R10: dffffc0000000000 R11: fffff940003d7fdf R12: 1ffff1100f57252b
R13: 1ffff92000807f28 R14: ffff88807ab92958 R15: dffffc0000000000
FS: 0000555585560380(0000) GS:ffff8881260fd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000066c7e0 CR3: 000000007eb1a000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
jfs_rename+0xbb3/0x1610 fs/jfs/namei.c:1247
vfs_rename+0xb99/0xec0 fs/namei.c:5121
do_renameat2+0x878/0xc50 fs/namei.c:5270
__do_sys_rename fs/namei.c:5317 [inline]
__se_sys_rename fs/namei.c:5315 [inline]
__x64_sys_rename+0x82/0x90 fs/namei.c:5315
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff16a8d0639
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc9b984ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007ffc9b984c98 RCX: 00007ff16a8d0639
RDX: 0000000000000000 RSI: 0000200000000780 RDI: 00002000000003c0
RBP: 00007ff16a949610 R08: 0000000000006221 R09: 0000000000000000
R10: 00007ffc9b984980 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc9b984c88 R14: 0000000000000001 R15: 0000000000000001
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-05-09 4:43 [syzbot] [jfs?] WARNING in jfs_rename syzbot
@ 2025-10-12 16:19 ` syzbot
2025-10-12 17:45 ` Forwarded: syzbot
1 sibling, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-12 16:19 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/namei.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..37cd16a423c5 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
jfs_err("jfs_rename: dtInsert returned -EIO");
goto out_tx;
}
- if (S_ISDIR(old_ip->i_mode))
+ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
inc_nlink(new_dir);
}
/*
@@ -1244,8 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
goto out_tx;
}
if (S_ISDIR(old_ip->i_mode)) {
- drop_nlink(old_dir);
if (old_dir != new_dir) {
+ drop_nlink(old_dir);
+
/*
* Change inode number of parent for moved directory
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-05-09 4:43 [syzbot] [jfs?] WARNING in jfs_rename syzbot
2025-10-12 16:19 ` Forwarded: syzbot
@ 2025-10-12 17:45 ` syzbot
1 sibling, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-12 17:45 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/jfs/namei.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..7879c049632b 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
jfs_err("jfs_rename: dtInsert returned -EIO");
goto out_tx;
}
- if (S_ISDIR(old_ip->i_mode))
+ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
inc_nlink(new_dir);
}
/*
@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
goto out_tx;
}
if (S_ISDIR(old_ip->i_mode)) {
- drop_nlink(old_dir);
+ if (new_ip || old_dir != new_dir)
+ drop_nlink(old_dir);
+
if (old_dir != new_dir) {
/*
* Change inode number of parent for moved directory
--
2.51.0
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [block?] [bcachefs?] kernel panic: KASAN: panic_on_warn set ...
@ 2025-04-19 8:36 syzbot
2025-07-22 17:56 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-04-19 8:36 UTC (permalink / raw)
To: brauner, jack, kent.overstreet, linux-bcachefs, linux-block,
linux-fsdevel, linux-kernel, syzkaller-bugs, viro
Hello,
syzbot found the following issue on:
HEAD commit: 3088d26962e8 Merge tag 'x86-urgent-2025-04-18' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17aed470580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a31f7155996562
dashboard link: https://syzkaller.appspot.com/bug?extid=4eb503ec2b8156835f24
compiler: Debian clang version 15.0.6, Debian LLD 15.0.6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-3088d269.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5ec84510bfc9/vmlinux-3088d269.xz
kernel image: https://storage.googleapis.com/syzbot-assets/af58d0bee0a4/bzImage-3088d269.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4eb503ec2b8156835f24@syzkaller.appspotmail.com
Kernel panic - not syncing: KASAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 47 Comm: kworker/u4:3 Not tainted 6.15.0-rc2-syzkaller-00400-g3088d26962e8 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: loop0 loop_workfn
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
panic+0x349/0x880 kernel/panic.c:354
check_panic_on_warn+0x86/0xb0 kernel/panic.c:243
end_report+0x77/0x160 mm/kasan/report.c:227
kasan_report+0x154/0x180 mm/kasan/report.c:636
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x28f/0x2a0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
put_bh include/linux/buffer_head.h:301 [inline]
end_buffer_read_sync+0xc1/0xd0 fs/buffer.c:161
end_bio_bh_io_sync+0xbf/0x120 fs/buffer.c:2748
blk_update_request+0x5e5/0x1160 block/blk-mq.c:983
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1145
lo_rw_aio_do_completion drivers/block/loop.c:317 [inline]
lo_rw_aio_complete drivers/block/loop.c:325 [inline]
lo_rw_aio+0xdfd/0xf80 drivers/block/loop.c:398
do_req_filebacked drivers/block/loop.c:-1 [inline]
loop_handle_cmd drivers/block/loop.c:1866 [inline]
loop_process_work+0x8e3/0x11f0 drivers/block/loop.c:1901
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd50 kernel/workqueue.c:3400
kthread+0x7b7/0x940 kernel/kthread.c:464
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_alloc_sectors_start_trans (2)
@ 2025-04-16 17:47 syzbot
2025-07-23 10:59 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-04-16 17:47 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 1a1d569a75f3 Merge tag 'edac_urgent_for_v6.15_rc3' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=157c6470580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e30b69a28cc940e1
dashboard link: https://syzkaller.appspot.com/bug?extid=2caec1f3fc52004d4f3c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e7fecf1a4718/disk-1a1d569a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7823b994817c/vmlinux-1a1d569a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7ce169c73b39/bzImage-1a1d569a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2caec1f3fc52004d4f3c@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in __writepoint_find include/linux/rcupdate.h:-1 [inline]
BUG: KMSAN: uninit-value in writepoint_find fs/bcachefs/alloc_foreground.c:1248 [inline]
BUG: KMSAN: uninit-value in bch2_alloc_sectors_start_trans+0x44a/0x32d0 fs/bcachefs/alloc_foreground.c:1348
__writepoint_find include/linux/rcupdate.h:-1 [inline]
writepoint_find fs/bcachefs/alloc_foreground.c:1248 [inline]
bch2_alloc_sectors_start_trans+0x44a/0x32d0 fs/bcachefs/alloc_foreground.c:1348
__bch2_write+0x7bd/0x6a10 fs/bcachefs/io_write.c:1494
bch2_write+0xdfe/0x1b30 fs/bcachefs/io_write.c:1681
closure_queue include/linux/closure.h:270 [inline]
closure_call include/linux/closure.h:432 [inline]
bch2_writepage_do_io fs/bcachefs/fs-io-buffered.c:494 [inline]
bch2_writepages+0x24a/0x3c0 fs/bcachefs/fs-io-buffered.c:677
do_writepages+0x427/0xc30 mm/page-writeback.c:2656
__writeback_single_inode+0x103/0x1290 fs/fs-writeback.c:1680
writeback_sb_inodes+0xac4/0x1c90 fs/fs-writeback.c:1976
wb_writeback+0x4df/0xcb0 fs/fs-writeback.c:2156
wb_do_writeback fs/fs-writeback.c:2303 [inline]
wb_workfn+0x40b/0x1970 fs/fs-writeback.c:2343
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xc1d/0x1e80 kernel/workqueue.c:3319
worker_thread+0xea3/0x1500 kernel/workqueue.c:3400
kthread+0x6ce/0xf10 kernel/kthread.c:464
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Uninit was stored to memory at:
bch2_writepage_io_alloc fs/bcachefs/fs-io-buffered.c:522 [inline]
__bch2_writepage+0x3754/0x3ab0 fs/bcachefs/fs-io-buffered.c:644
write_cache_pages+0xc9/0x280 mm/page-writeback.c:2613
bch2_writepages+0x11f/0x3c0 fs/bcachefs/fs-io-buffered.c:675
do_writepages+0x427/0xc30 mm/page-writeback.c:2656
__writeback_single_inode+0x103/0x1290 fs/fs-writeback.c:1680
writeback_sb_inodes+0xac4/0x1c90 fs/fs-writeback.c:1976
wb_writeback+0x4df/0xcb0 fs/fs-writeback.c:2156
wb_do_writeback fs/fs-writeback.c:2303 [inline]
wb_workfn+0x40b/0x1970 fs/fs-writeback.c:2343
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xc1d/0x1e80 kernel/workqueue.c:3319
worker_thread+0xea3/0x1500 kernel/workqueue.c:3400
kthread+0x6ce/0xf10 kernel/kthread.c:464
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4157 [inline]
slab_alloc_node mm/slub.c:4200 [inline]
kmem_cache_alloc_lru_noprof+0x92d/0xe30 mm/slub.c:4219
__bch2_new_inode+0x98/0x450 fs/bcachefs/fs.c:438
__bch2_create+0x284/0x1700 fs/bcachefs/fs.c:541
bch2_mknod fs/bcachefs/fs.c:728 [inline]
bch2_create+0xc0/0x1d0 fs/bcachefs/fs.c:742
lookup_open fs/namei.c:3666 [inline]
open_last_lookups fs/namei.c:3765 [inline]
path_openat+0x2efe/0x6280 fs/namei.c:4001
do_filp_open+0x26b/0x610 fs/namei.c:4031
do_sys_openat2+0x1ca/0x300 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x2a1/0x310 fs/open.c:1455
x64_sys_call+0x1fe/0x3c80 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 1 UID: 0 PID: 3648 Comm: kworker/u8:11 Not tainted 6.15.0-rc2-syzkaller-00042-g1a1d569a75f3 #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: writeback wb_workfn (flush-bcachefs-66)
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [afs?] WARNING: ODEBUG bug in delete_node (3)
@ 2025-03-30 8:27 syzbot
2025-07-24 15:32 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-03-30 8:27 UTC (permalink / raw)
To: dhowells, linux-afs, linux-kernel, linux-trace-kernel,
marc.dionne, mathieu.desnoyers, mhiramat, rostedt, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 2df0c02dab82 x86 boot build: make git ignore stale 'tools'..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=14e3aa4c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5f1762820c18874b
dashboard link: https://syzkaller.appspot.com/bug?extid=ab13429207fe1c8c92e8
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12985804580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1749a198580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/93b59f97f896/disk-2df0c02d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f0ade1042ab8/vmlinux-2df0c02d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7c64e746afbb/bzImage-2df0c02d.xz
The issue was bisected to:
commit e2c2cb8ef07affd9f69497ea128fa801240fdf32
Author: David Howells <dhowells@redhat.com>
Date: Mon Feb 24 16:06:03 2025 +0000
afs: Simplify cell record handling
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15f1e198580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=17f1e198580000
console output: https://syzkaller.appspot.com/x/log.txt?x=13f1e198580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ab13429207fe1c8c92e8@syzkaller.appspotmail.com
Fixes: e2c2cb8ef07a ("afs: Simplify cell record handling")
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object: ffff888025e8e118 object type: rcu_head hint: 0x0
WARNING: CPU: 1 PID: 5839 at lib/debugobjects.c:615 debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 5839 Comm: strace-static-x Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
Code: e8 8b a3 2d fd 4c 8b 0b 48 c7 c7 40 24 80 8c 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f8 ff 34 24 e8 5b 2a 87 fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 48 c6 40 0b 48 83 c4 10 5b 41 5c 41 5d 41 5e 41
RSP: 0018:ffffc90000a08838 EFLAGS: 00010282
RAX: bc12de5074ab4600 RBX: ffffffff8c2bc520 RCX: ffff88802edfda00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff8c8025c0 R08: ffffffff81826ce2 R09: fffffbfff1d3a71c
R10: dffffc0000000000 R11: fffffbfff1d3a71c R12: 0000000000000001
R13: ffffffff8c8024d8 R14: dffffc0000000000 R15: ffff888025e8e118
FS: 00000000101f03c0(0000) GS:ffff88812535a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555db2c838 CR3: 000000007bba6000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
debug_object_activate+0x350/0x5c0 lib/debugobjects.c:842
debug_rcu_head_queue kernel/rcu/rcu.h:224 [inline]
__call_rcu_common kernel/rcu/tree.c:3067 [inline]
call_rcu+0x99/0xad0 kernel/rcu/tree.c:3202
radix_tree_node_free lib/radix-tree.c:310 [inline]
delete_node+0x1b2/0x780 lib/radix-tree.c:573
radix_tree_delete_item+0x2e6/0x3f0 lib/radix-tree.c:1430
afs_cell_destroy+0x175/0x2c0 fs/afs/cell.c:522
rcu_do_batch kernel/rcu/tree.c:2568 [inline]
rcu_core+0xaac/0x17a0 kernel/rcu/tree.c:2824
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xfb/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline]
RIP: 0010:rcu_is_watching+0x9/0xb0 kernel/rcu/tree.c:735
Code: 03 eb cd 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 53 <65> ff 05 f0 cc 93 11 e8 6b 3a 6a 0a 89 c3 83 f8 08 73 7a 49 bf 00
RSP: 0018:ffffc90003fc78c8 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff8880591cbc00 RCX: ffff88802edfda00
RDX: ffff88802edfda00 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff818c7bf9 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff933c6020 R14: ffffffff818c7bc8 R15: 0000000000000000
rcu_read_lock include/linux/rcupdate.h:842 [inline]
__task_pid_nr_ns+0x62/0x460 kernel/pid.c:518
task_pid_vnr include/linux/pid.h:242 [inline]
wait_task_stopped kernel/exit.c:1359 [inline]
wait_consider_task+0x1fab/0x30e0 kernel/exit.c:1529
ptrace_do_wait kernel/exit.c:1569 [inline]
__do_wait+0x205/0x850 kernel/exit.c:1677
do_wait+0x1e9/0x550 kernel/exit.c:1707
kernel_wait4+0x2ac/0x3c0 kernel/exit.c:1866
__do_sys_wait4 kernel/exit.c:1894 [inline]
__se_sys_wait4 kernel/exit.c:1890 [inline]
__x64_sys_wait4+0x136/0x1e0 kernel/exit.c:1890
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x4d6ad6
Code: 00 00 00 90 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 49 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 90 48 83 ec 28 89 54 24 14 48 89 74 24
RSP: 002b:00007ffeafb16778 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004d6ad6
RDX: 0000000040000000 RSI: 00007ffeafb1679c RDI: 00000000ffffffff
RBP: 0000000000000000 R08: 0000000000000017 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000101f8f40
R13: 00007ffeafb1679c R14: 00000000101f28b0 R15: 000000000063f160
</TASK>
----------------
Code disassembly (best guess):
0: 03 eb add %ebx,%ebp
2: cd 66 int $0x66
4: 66 66 66 66 2e 0f 1f data16 data16 data16 cs nopw 0x0(%rax,%rax,1)
b: 84 00 00 00 00 00
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: f3 0f 1e fa endbr64
25: 41 57 push %r15
27: 41 56 push %r14
29: 53 push %rbx
* 2a: 65 ff 05 f0 cc 93 11 incl %gs:0x1193ccf0(%rip) # 0x1193cd21 <-- trapping instruction
31: e8 6b 3a 6a 0a call 0xa6a3aa1
36: 89 c3 mov %eax,%ebx
38: 83 f8 08 cmp $0x8,%eax
3b: 73 7a jae 0xb7
3d: 49 rex.WB
3e: bf .byte 0xbf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] INFO: task hung in __bch2_fsck_err
@ 2025-03-25 5:16 syzbot
2025-07-20 14:42 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-03-25 5:16 UTC (permalink / raw)
To: anna-maria, frederic, kent.overstreet, linux-bcachefs,
linux-kernel, syzkaller-bugs, tglx
Hello,
syzbot found the following issue on:
HEAD commit: 5fc319360819 Merge tag 'net-6.14-rc8' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10105e98580000
kernel config: https://syzkaller.appspot.com/x/.config?x=27515cfdbafbb90d
dashboard link: https://syzkaller.appspot.com/bug?extid=6f4fcb1aecbaa2aa6825
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110133b0580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-5fc31936.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/85179a8915f2/vmlinux-5fc31936.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cc4a866b3260/bzImage-5fc31936.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7a8c0330a7ea/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6f4fcb1aecbaa2aa6825@syzkaller.appspotmail.com
INFO: task syz.0.40:5746 blocked for more than 143 seconds.
Not tainted 6.14.0-rc7-syzkaller-00137-g5fc319360819 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.40 state:D stack:8536 pid:5746 tgid:5745 ppid:5473 task_flags:0x440140 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0x190e/0x4c90 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6857
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
___down_common kernel/locking/semaphore.c:229 [inline]
__down_common+0x375/0x820 kernel/locking/semaphore.c:250
down+0x84/0xc0 kernel/locking/semaphore.c:64
console_lock+0x145/0x1b0 kernel/printk/printk.c:2833
__bch2_print_string_as_lines fs/bcachefs/util.c:267 [inline]
bch2_print_string_as_lines+0x20/0xc0 fs/bcachefs/util.c:286
__bch2_fsck_err+0x1044/0x1420 fs/bcachefs/error.c:426
check_snapshot fs/bcachefs/snapshot.c:774 [inline]
bch2_check_snapshots+0x1ee1/0x3eb0 fs/bcachefs/snapshot.c:831
bch2_run_recovery_pass+0xf0/0x1e0 fs/bcachefs/recovery_passes.c:226
bch2_run_recovery_passes+0x2ad/0xa90 fs/bcachefs/recovery_passes.c:291
bch2_fs_recovery+0x265a/0x3de0 fs/bcachefs/recovery.c:936
bch2_fs_start+0x37c/0x610 fs/bcachefs/super.c:1041
bch2_fs_get_tree+0xdb7/0x17a0 fs/bcachefs/fs.c:2203
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f514938e90a
RSP: 002b:00007f514a2b2e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f514a2b2ef0 RCX: 00007f514938e90a
RDX: 00002000000000c0 RSI: 0000200000000000 RDI: 00007f514a2b2eb0
RBP: 00002000000000c0 R08: 00007f514a2b2ef0 R09: 0000000000800000
R10: 0000000000800000 R11: 0000000000000246 R12: 0000200000000000
R13: 00007f514a2b2eb0 R14: 0000000000005903 R15: 0000200000000200
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/26:
#0: ffffffff8eb393e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8eb393e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8eb393e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746
2 locks held by getty/5106:
#0: ffff88801aef10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000019b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211
4 locks held by kworker/0:0/5372:
2 locks held by kworker/0:5/5483:
4 locks held by syz.0.40/5746:
#0: ffff888053680278 (&c->state_lock){+.+.}-{4:4}, at: bch2_fs_start+0x45/0x610 fs/bcachefs/super.c:1010
#1: ffff888053684378 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:164 [inline]
#1: ffff888053684378 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:256 [inline]
#1: ffff888053684378 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x7e4/0xd30 fs/bcachefs/btree_iter.c:3408
#2: ffff88804e5d4140 (bcachefs_btree){+.+.}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:164 [inline]
#2: ffff88804e5d4140 (bcachefs_btree){+.+.}-{0:0}, at: srcu_read_lock include/linux/srcu.h:256 [inline]
#2: ffff88804e5d4140 (bcachefs_btree){+.+.}-{0:0}, at: __bch2_trans_get+0x7e4/0xd30 fs/bcachefs/btree_iter.c:3408
#3: ffff8880536e1548 (&c->fsck_error_msgs_lock){+.+.}-{4:4}, at: __bch2_fsck_err+0x3b0/0x1420 fs/bcachefs/error.c:309
1 lock held by syz.5.468/6650:
2 locks held by syz.2.470/6654:
2 locks held by syz.3.471/6656:
2 locks held by syz.1.472/6658:
2 locks held by syz.4.473/6660:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 26 Comm: khungtaskd Not tainted 6.14.0-rc7-syzkaller-00137-g5fc319360819 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
watchdog+0x1058/0x10a0 kernel/hung_task.c:399
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [mm?] [bcachefs?] general protection fault in xas_create
@ 2025-03-16 18:05 syzbot
2025-07-20 4:03 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-03-16 18:05 UTC (permalink / raw)
To: akpm, hughd, kent.overstreet, linux-bcachefs, linux-kernel,
linux-mm, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 0fed89a961ea Merge tag 'hyperv-fixes-signed-20250311' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17ea1874580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31c94a07ddad0b00
dashboard link: https://syzkaller.appspot.com/bug?extid=85a56f124ac1ea0ac0cb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16124c78580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-0fed89a9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9e4d0fd4258e/vmlinux-0fed89a9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ea186f3b1240/bzImage-0fed89a9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2c3be83f8b9f/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+85a56f124ac1ea0ac0cb@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0x7d0034f00001880: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5719 Comm: syz.4.37 Not tainted 6.14.0-rc6-syzkaller-00016-g0fed89a961ea #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:get_freepointer mm/slub.c:504 [inline]
RIP: 0010:get_freepointer_safe mm/slub.c:532 [inline]
RIP: 0010:__slab_alloc_node mm/slub.c:3993 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:4152 [inline]
RIP: 0010:kmem_cache_alloc_lru_noprof+0xed/0x390 mm/slub.c:4183
Code: 0f 84 8e 01 00 00 41 83 f8 ff 74 1a 48 8b 03 48 83 f8 ff 0f 84 97 02 00 00 48 c1 e8 3a 41 39 c0 0f 85 6e 01 00 00 41 8b 47 28 <4a> 8b 1c 20 49 8d 4d 08 49 8b 37 4c 89 e0 4c 89 ea 65 48 0f c7 0e
RSP: 0018:ffffc9000d037478 EFLAGS: 00010046
RAX: 0000000000000240 RBX: ffffea0000ecb880 RCX: 0000000000043ba0
RDX: 0000000000000001 RSI: 0000000000000240 RDI: ffffffff8ec54460
RBP: ffffffff8c06a1c0 R08: 00000000ffffffff R09: fffff52001a06ea8
R10: dffffc0000000000 R11: fffff52001a06ea8 R12: 07d0034f00001640
R13: 0000000000016220 R14: 0000000000402800 R15: ffff88801b04fdc0
FS: 00007fd8409fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa6ac013000 CR3: 0000000012b64000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
xas_alloc lib/xarray.c:377 [inline]
xas_create+0x10d0/0x1ae0 lib/xarray.c:684
xas_store+0x96/0x1870 lib/xarray.c:794
shmem_add_to_page_cache+0x89d/0xcc0 mm/shmem.c:897
shmem_alloc_and_add_folio+0x968/0x1090 mm/shmem.c:1928
shmem_get_folio_gfp+0x621/0x1840 mm/shmem.c:2545
shmem_get_folio mm/shmem.c:2651 [inline]
shmem_write_begin+0x165/0x350 mm/shmem.c:3301
generic_perform_write+0x346/0x990 mm/filemap.c:4188
shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3477
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0xacf/0xd10 fs/read_write.c:679
ksys_write+0x18f/0x2b0 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd84178bc1f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fd8409fddf0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00007fd84178bc1f
RDX: 0000000001000000 RSI: 00007fd838400000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000590c
R10: 0000000000000002 R11: 0000000000000293 R12: 0000000000000003
R13: 00007fd8409fdef0 R14: 00007fd8409fdeb0 R15: 00007fd838400000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:get_freepointer mm/slub.c:504 [inline]
RIP: 0010:get_freepointer_safe mm/slub.c:532 [inline]
RIP: 0010:__slab_alloc_node mm/slub.c:3993 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:4152 [inline]
RIP: 0010:kmem_cache_alloc_lru_noprof+0xed/0x390 mm/slub.c:4183
Code: 0f 84 8e 01 00 00 41 83 f8 ff 74 1a 48 8b 03 48 83 f8 ff 0f 84 97 02 00 00 48 c1 e8 3a 41 39 c0 0f 85 6e 01 00 00 41 8b 47 28 <4a> 8b 1c 20 49 8d 4d 08 49 8b 37 4c 89 e0 4c 89 ea 65 48 0f c7 0e
RSP: 0018:ffffc9000d037478 EFLAGS: 00010046
RAX: 0000000000000240 RBX: ffffea0000ecb880 RCX: 0000000000043ba0
RDX: 0000000000000001 RSI: 0000000000000240 RDI: ffffffff8ec54460
RBP: ffffffff8c06a1c0 R08: 00000000ffffffff R09: fffff52001a06ea8
R10: dffffc0000000000 R11: fffff52001a06ea8 R12: 07d0034f00001640
R13: 0000000000016220 R14: 0000000000402800 R15: ffff88801b04fdc0
FS: 00007fd8409fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa6ac013000 CR3: 0000000012b64000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 0f 84 8e 01 00 00 je 0x194
6: 41 83 f8 ff cmp $0xffffffff,%r8d
a: 74 1a je 0x26
c: 48 8b 03 mov (%rbx),%rax
f: 48 83 f8 ff cmp $0xffffffffffffffff,%rax
13: 0f 84 97 02 00 00 je 0x2b0
19: 48 c1 e8 3a shr $0x3a,%rax
1d: 41 39 c0 cmp %eax,%r8d
20: 0f 85 6e 01 00 00 jne 0x194
26: 41 8b 47 28 mov 0x28(%r15),%eax
* 2a: 4a 8b 1c 20 mov (%rax,%r12,1),%rbx <-- trapping instruction
2e: 49 8d 4d 08 lea 0x8(%r13),%rcx
32: 49 8b 37 mov (%r15),%rsi
35: 4c 89 e0 mov %r12,%rax
38: 4c 89 ea mov %r13,%rdx
3b: 65 48 0f c7 0e cmpxchg16b %gs:(%rsi)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [mm?] [bcachefs?] KASAN: slab-out-of-bounds Read in folio_try_get
@ 2025-02-14 19:59 syzbot
2025-07-20 4:04 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-02-14 19:59 UTC (permalink / raw)
To: akpm, hughd, kent.overstreet, linux-bcachefs, linux-kernel,
linux-mm, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: ab68d7eb7b1a Merge tag 'loongarch-fixes-6.14-1' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10550f18580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3c2347dd6174fbe2
dashboard link: https://syzkaller.appspot.com/bug?extid=2110ef46097c323451eb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14550f18580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=170061a4580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-ab68d7eb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c21c98f96a97/vmlinux-ab68d7eb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d84966ad5d14/bzImage-ab68d7eb.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/156e52e4f0ef/mount_2.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2110ef46097c323451eb@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-out-of-bounds in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-out-of-bounds in page_ref_count include/linux/page_ref.h:67 [inline]
BUG: KASAN: slab-out-of-bounds in page_ref_add_unless include/linux/page_ref.h:237 [inline]
BUG: KASAN: slab-out-of-bounds in folio_ref_add_unless include/linux/page_ref.h:248 [inline]
BUG: KASAN: slab-out-of-bounds in folio_try_get+0xde/0x350 include/linux/page_ref.h:264
Read of size 4 at addr ffff88804f904b34 by task syz-executor127/5388
CPU: 0 UID: 0 PID: 5388 Comm: syz-executor127 Not tainted 6.14.0-rc2-syzkaller-00056-gab68d7eb7b1a #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
page_ref_count include/linux/page_ref.h:67 [inline]
page_ref_add_unless include/linux/page_ref.h:237 [inline]
folio_ref_add_unless include/linux/page_ref.h:248 [inline]
folio_try_get+0xde/0x350 include/linux/page_ref.h:264
filemap_get_entry+0x240/0x3b0 mm/filemap.c:1870
shmem_get_folio_gfp+0x285/0x1840 mm/shmem.c:2446
shmem_get_folio mm/shmem.c:2628 [inline]
shmem_write_begin+0x165/0x350 mm/shmem.c:3278
generic_perform_write+0x346/0x990 mm/filemap.c:4189
shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3454
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0xacf/0xd10 fs/read_write.c:679
ksys_write+0x18f/0x2b0 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb60d00ef1f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 81 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 6c 81 02 00 48
RSP: 002b:00007fb60c7b9fb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fb60c7b9ff0 RCX: 00007fb60d00ef1f
RDX: 0000000001000000 RSI: 00007fb604200000 RDI: 0000000000000003
RBP: 00007fb60d0976e0 R08: 0000000000000000 R09: 000000000000590c
R10: 0000000000000002 R11: 0000000000000293 R12: 00007fb60d0976ec
R13: 00007fb60c7ba030 R14: 0000000000000003 R15: 00007ffe9f1d73d8
</TASK>
The buggy address belongs to the object at ffff88804f904b00
which belongs to the cache radix_tree_node of size 576
The buggy address is located 52 bytes inside of
allocated 576-byte region [ffff88804f904b00, ffff88804f904d40)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f904
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88804054b581
flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000040 ffff88801ac4fdc0 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800b000b 00000000f5000000 ffff88804054b581
head: 04fff00000000040 ffff88801ac4fdc0 dead000000000122 0000000000000000
head: 0000000000000000 00000000800b000b 00000000f5000000 ffff88804054b581
head: 04fff00000000001 ffffea00013e4101 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x52810(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_RECLAIMABLE), pid 5382, tgid 5381 (syz-executor127), ts 127092553802, free_ts 126870415360
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
prep_new_page mm/page_alloc.c:1559 [inline]
get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3477
__alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
alloc_slab_page mm/slub.c:2423 [inline]
allocate_slab+0x8f/0x3a0 mm/slub.c:2587
new_slab mm/slub.c:2640 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3826
__slab_alloc+0x58/0xa0 mm/slub.c:3916
__slab_alloc_node mm/slub.c:3991 [inline]
slab_alloc_node mm/slub.c:4152 [inline]
kmem_cache_alloc_lru_noprof+0x26c/0x390 mm/slub.c:4183
xas_alloc lib/xarray.c:377 [inline]
xas_create+0x10d0/0x1ae0 lib/xarray.c:684
xas_store+0x96/0x1870 lib/xarray.c:794
shmem_add_to_page_cache+0x89d/0xcc0 mm/shmem.c:897
shmem_alloc_and_add_folio+0x968/0x1090 mm/shmem.c:1928
shmem_get_folio_gfp+0x621/0x1840 mm/shmem.c:2522
shmem_get_folio mm/shmem.c:2628 [inline]
shmem_write_begin+0x165/0x350 mm/shmem.c:3278
generic_perform_write+0x346/0x990 mm/filemap.c:4189
shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3454
page last free pid 5392 tgid 5392 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
__free_pages_ok+0xbbf/0xe40 mm/page_alloc.c:1271
__folio_put+0x2b3/0x360 mm/swap.c:112
folio_put include/linux/mm.h:1489 [inline]
free_large_kmalloc+0xfe/0x180 mm/slub.c:4728
kfree+0x212/0x430 mm/slub.c:4751
btree_bounce_free fs/bcachefs/btree_io.c:111 [inline]
bch2_btree_node_read_done+0x3b1f/0x5f70 fs/bcachefs/btree_io.c:1243
btree_node_read_work+0x6dc/0x1380 fs/bcachefs/btree_io.c:1358
bch2_btree_node_read+0x2433/0x29f0
bch2_btree_node_fill+0xca6/0x1370 fs/bcachefs/btree_cache.c:993
bch2_btree_node_get_noiter+0x9d5/0xf70 fs/bcachefs/btree_cache.c:1260
found_btree_node_is_readable fs/bcachefs/btree_node_scan.c:84 [inline]
try_read_btree_node fs/bcachefs/btree_node_scan.c:213 [inline]
read_btree_nodes_worker+0x1355/0x21f0 fs/bcachefs/btree_node_scan.c:262
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffff88804f904a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88804f904a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88804f904b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88804f904b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88804f904c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] kernel BUG in bch2_journal_keys_peek_max
@ 2025-02-12 11:52 syzbot
2025-07-21 17:37 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-02-12 11:52 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 69b54314c975 Merge tag 'kbuild-fixes-v6.14' of git://git.k..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12213b18580000
kernel config: https://syzkaller.appspot.com/x/.config?x=147b7d49d83b8036
dashboard link: https://syzkaller.appspot.com/bug?extid=9b22c314d51cfbcd1ddc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1580c2a4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17026bdf980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4c15b70890a6/disk-69b54314.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0db5658a86a2/vmlinux-69b54314.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f6a408104f8b/bzImage-69b54314.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/1c7e787a9111/mount_0.gz
The issue was bisected to:
commit 7e5b8e00e2631ee1fa72edeb420e7393ad078ab3
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Fri Oct 25 02:12:37 2024 +0000
bcachefs: Implement bch2_btree_iter_prev_min()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11572b18580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=13572b18580000
console output: https://syzkaller.appspot.com/x/log.txt?x=15572b18580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9b22c314d51cfbcd1ddc@syzkaller.appspotmail.com
Fixes: 7e5b8e00e263 ("bcachefs: Implement bch2_btree_iter_prev_min()")
------------[ cut here ]------------
kernel BUG at fs/bcachefs/btree_journal_iter.c:83!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 5820 Comm: syz-executor138 Not tainted 6.14.0-rc1-syzkaller-00276-g69b54314c975 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:bch2_journal_keys_peek_max+0x164f/0x1660 fs/bcachefs/btree_journal_iter.c:83
Code: 10 48 8d 5c 08 18 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 ff b1 e1 fd 4c 8b 33 e9 d7 fe ff ff e8 12 a0 7d fd 90 <0f> 0b e8 2a 49 ac 07 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
RSP: 0018:ffffc90003fae620 EFLAGS: 00010293
RAX: ffffffff8441af2e RBX: 000000000000003b RCX: ffff88807f1c1e00
RDX: 0000000000000000 RSI: 000000000000003b RDI: ffffffffffffffff
RBP: ffffc90003fae7e0 R08: ffffffff84419a25 R09: 0000000000000000
R10: 00000001ffffffff R11: 2000000000000000 R12: dffffc0000000000
R13: ffff888074e00000 R14: ffffffffffffffff R15: ffffc90003faf018
FS: 000055558406b380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffdf737ed0 CR3: 0000000076148000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bch2_btree_journal_peek fs/bcachefs/btree_iter.c:2137 [inline]
btree_trans_peek_journal+0x342/0x5a0 fs/bcachefs/btree_iter.c:2166
__bch2_btree_iter_peek fs/bcachefs/btree_iter.c:2303 [inline]
bch2_btree_iter_peek_max+0x1502/0x6320 fs/bcachefs/btree_iter.c:2367
bch2_btree_iter_peek_slot+0xe0a/0x27c0 fs/bcachefs/btree_iter.c:2820
bch2_btree_iter_peek_prev_min+0x1f3/0x6390 fs/bcachefs/btree_iter.c:2606
__bch2_resume_logged_op_finsert+0xd5c/0x3650 fs/bcachefs/io_misc.c:431
bch2_fcollapse_finsert+0x257/0x380 fs/bcachefs/io_misc.c:535
bchfs_fcollapse_finsert+0x3a8/0x630 fs/bcachefs/fs-io.c:594
bch2_fallocate_dispatch+0x3c9/0x540
vfs_fallocate+0x623/0x7a0 fs/open.c:338
ksys_fallocate fs/open.c:362 [inline]
__do_sys_fallocate fs/open.c:367 [inline]
__se_sys_fallocate fs/open.c:365 [inline]
__x64_sys_fallocate+0xbc/0x110 fs/open.c:365
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff945c437d9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff0aa22888 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007fff0aa22890 RCX: 00007ff945c437d9
RDX: 0000000000000000 RSI: 0000000000000020 RDI: 0000000000000004
RBP: 0000400000000000 R08: 6c616b7a79732f2e R09: 6c616b7a79732f2e
R10: 0000000007000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff0aa22a78 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_journal_keys_peek_max+0x164f/0x1660 fs/bcachefs/btree_journal_iter.c:83
Code: 10 48 8d 5c 08 18 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 ff b1 e1 fd 4c 8b 33 e9 d7 fe ff ff e8 12 a0 7d fd 90 <0f> 0b e8 2a 49 ac 07 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
RSP: 0018:ffffc90003fae620 EFLAGS: 00010293
RAX: ffffffff8441af2e RBX: 000000000000003b RCX: ffff88807f1c1e00
RDX: 0000000000000000 RSI: 000000000000003b RDI: ffffffffffffffff
RBP: ffffc90003fae7e0 R08: ffffffff84419a25 R09: 0000000000000000
R10: 00000001ffffffff R11: 2000000000000000 R12: dffffc0000000000
R13: ffff888074e00000 R14: ffffffffffffffff R15: ffffc90003faf018
FS: 000055558406b380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005572817bb0e8 CR3: 0000000076148000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [mm?] [bcachefs?] UBSAN: shift-out-of-bounds in xas_reload
@ 2025-02-06 17:01 syzbot
2025-07-20 4:05 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-02-06 17:01 UTC (permalink / raw)
To: akpm, hughd, kent.overstreet, linux-bcachefs, linux-kernel,
linux-mm, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 92514ef226f5 Merge tag 'for-6.14-rc1-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14761318580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1909f2f0d8e641ce
dashboard link: https://syzkaller.appspot.com/bug?extid=8ae0902c29b15a27a4ee
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17df01b0580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-92514ef2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c4d8b91f8769/vmlinux-92514ef2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c24ec4365966/bzImage-92514ef2.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2f20c9ca14a0/mount_2.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8ae0902c29b15a27a4ee@syzkaller.appspotmail.com
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in ./include/linux/xarray.h:1604:27
shift exponent 192 is too large for 64-bit type 'unsigned long'
CPU: 0 UID: 0 PID: 5696 Comm: syz.4.33 Not tainted 6.14.0-rc1-syzkaller-00034-g92514ef226f5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:231 [inline]
__ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
xas_reload+0x434/0x470 include/linux/xarray.h:1604
find_get_entry mm/filemap.c:2032 [inline]
find_lock_entries+0x2d4/0xbb0 mm/filemap.c:2119
shmem_undo_range+0x2d4/0x1820 mm/shmem.c:1094
shmem_truncate_range mm/shmem.c:1224 [inline]
shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1352
evict+0x4e8/0x9a0 fs/inode.c:796
__dentry_kill+0x20d/0x630 fs/dcache.c:643
dput+0x19f/0x2b0 fs/dcache.c:885
__fput+0x60b/0x9f0 fs/file_table.c:456
__do_sys_close fs/open.c:1579 [inline]
__se_sys_close fs/open.c:1564 [inline]
__x64_sys_close+0x7f/0x110 fs/open.c:1564
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4dd9f8ba4a
Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 43 91 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 a3 91 02 00 8b 44 24
RSP: 002b:00007f4ddae87e00 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f4dd9f8ba4a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000005939
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000004
R13: 00007f4ddae87ef0 R14: 00007f4ddae87eb0 R15: 00007f4dd0c00000
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [net?] general protection fault in ip6_pol_route (3)
@ 2025-02-04 14:07 syzbot
2025-07-20 4:02 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-02-04 14:07 UTC (permalink / raw)
To: davem, dsahern, edumazet, horms, kuba, linux-kernel, netdev,
pabeni, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: f1b785f4c787 Merge tag 'for_linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=100bc1a7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d2aeec8c0b2e420c
dashboard link: https://syzkaller.appspot.com/bug?extid=3201be560ebfa39bc6bd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1209e4c0580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-f1b785f4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3d6bd514fd25/vmlinux-f1b785f4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bf9273b213e1/bzImage-f1b785f4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/d332161a8efa/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3201be560ebfa39bc6bd@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
CPU: 0 UID: 0 PID: 24 Comm: kworker/u4:2 Not tainted 6.12.0-rc7-syzkaller-00042-gf1b785f4c787 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound macvlan_process_broadcast
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1408 [inline]
RIP: 0010:ip6_pol_route+0x4d1/0x15d0 net/ipv6/route.c:2264
Code: 93 f7 48 8b 03 65 4c 8b 30 31 ff 4c 89 f6 e8 86 b4 29 f7 4d 85 f6 0f 84 da 00 00 00 49 8d 9e 98 00 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 12 0f 00 00 44 8b 3b 31 ff 44 89 fe e8
RSP: 0018:ffffc900000073a0 EFLAGS: 00010202
RAX: 0000000000000013 RBX: 0000000000000099 RCX: ffff88801bb0c880
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900000074f0 R08: ffffffff8a6b3a6a R09: ffff888012677b40
R10: dffffc0000000000 R11: fffffbfff203a13e R12: ffffc90000007470
R13: 1ffff92000000e8e R14: 0000000000000001 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7b9a67e000 CR3: 000000003ea02000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x58c/0x790 net/ipv6/fib6_rules.c:117
ip6_route_input_lookup net/ipv6/route.c:2300 [inline]
ip6_route_input+0x859/0xd90 net/ipv6/route.c:2596
ip6_rcv_finish+0x144/0x180 net/ipv6/ip6_input.c:77
NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
__netif_receive_skb_one_core net/core/dev.c:5670 [inline]
__netif_receive_skb+0x1ea/0x650 net/core/dev.c:5783
process_backlog+0x662/0x15b0 net/core/dev.c:6115
__napi_poll+0xcb/0x490 net/core/dev.c:6779
napi_poll net/core/dev.c:6848 [inline]
net_rx_action+0x89b/0x1240 net/core/dev.c:6970
handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
do_softirq+0x11b/0x1e0 kernel/softirq.c:455
</IRQ>
<TASK>
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
local_bh_enable include/linux/bottom_half.h:33 [inline]
netif_rx+0x83/0x90 net/core/dev.c:5255
macvlan_broadcast+0x3c4/0x670 drivers/net/macvlan.c:290
macvlan_process_broadcast+0x50e/0x7f0 drivers/net/macvlan.c:338
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1408 [inline]
RIP: 0010:ip6_pol_route+0x4d1/0x15d0 net/ipv6/route.c:2264
Code: 93 f7 48 8b 03 65 4c 8b 30 31 ff 4c 89 f6 e8 86 b4 29 f7 4d 85 f6 0f 84 da 00 00 00 49 8d 9e 98 00 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 12 0f 00 00 44 8b 3b 31 ff 44 89 fe e8
RSP: 0018:ffffc900000073a0 EFLAGS: 00010202
RAX: 0000000000000013 RBX: 0000000000000099 RCX: ffff88801bb0c880
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900000074f0 R08: ffffffff8a6b3a6a R09: ffff888012677b40
R10: dffffc0000000000 R11: fffffbfff203a13e R12: ffffc90000007470
R13: 1ffff92000000e8e R14: 0000000000000001 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7b9a67e000 CR3: 000000003ea02000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 93 xchg %eax,%ebx
1: f7 48 8b 03 65 4c 8b testl $0x8b4c6503,-0x75(%rax)
8: 30 31 xor %dh,(%rcx)
a: ff 4c 89 f6 decl -0xa(%rcx,%rcx,4)
e: e8 86 b4 29 f7 call 0xf729b499
13: 4d 85 f6 test %r14,%r14
16: 0f 84 da 00 00 00 je 0xf6
1c: 49 8d 9e 98 00 00 00 lea 0x98(%r14),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 12 0f 00 00 jne 0xf49
37: 44 8b 3b mov (%rbx),%r15d
3a: 31 ff xor %edi,%edi
3c: 44 89 fe mov %r15d,%esi
3f: e8 .byte 0xe8
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] possible deadlock in bch2_trans_begin
@ 2025-01-20 2:27 syzbot
2025-07-22 18:23 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2025-01-20 2:27 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 619f0b6fad52 Merge tag 'seccomp-v6.13-rc8' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=154ac9df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=8f9c94814c0235823861
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/820c5fcece46/disk-619f0b6f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/22a2cbc89593/vmlinux-619f0b6f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09df72182529/bzImage-619f0b6f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f9c94814c0235823861@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 Not tainted
------------------------------------------------------
syz.1.4054/25525 is trying to acquire lock:
ffff8880577fc128 (bcachefs_btree){+.+.}-{0:0}, at: trans_set_locked fs/bcachefs/btree_locking.h:194 [inline]
ffff8880577fc128 (bcachefs_btree){+.+.}-{0:0}, at: bch2_trans_begin+0x9b0/0x1bf0 fs/bcachefs/btree_iter.c:3125
but task is already holding lock:
ffff8880545f3ee8 (mapping.invalidate_lock#6){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
ffff8880545f3ee8 (mapping.invalidate_lock#6){.+.+}-{4:4}, at: page_cache_ra_order+0x326/0xb60 mm/readahead.c:488
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #8 (mapping.invalidate_lock#6){.+.+}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524
filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
filemap_fault+0x615/0x1490 mm/filemap.c:3323
bch2_page_fault+0x52c/0x960 fs/bcachefs/fs-io-pagecache.c:594
__do_fault+0x137/0x390 mm/memory.c:4907
do_read_fault mm/memory.c:5322 [inline]
do_fault mm/memory.c:5456 [inline]
do_pte_missing mm/memory.c:3979 [inline]
handle_pte_fault+0x39eb/0x5ed0 mm/memory.c:5801
__handle_mm_fault mm/memory.c:5944 [inline]
handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x2b9/0x8b0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
fault_in_readable+0x111/0x2d0
fault_in_iov_iter_readable+0x229/0x280 lib/iov_iter.c:94
bch2_buffered_write fs/bcachefs/fs-io-buffered.c:983 [inline]
bch2_write_iter+0x528/0x2c10 fs/bcachefs/fs-io-buffered.c:1054
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0xaed/0xd30 fs/read_write.c:679
ksys_write+0x18f/0x2b0 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #7 (&mm->mmap_lock){++++}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__might_fault+0xc6/0x120 mm/memory.c:6751
drm_mode_atomic_ioctl+0x5d4/0x1410 drivers/gpu/drm/drm_atomic_uapi.c:1437
drm_ioctl_kernel+0x339/0x440 drivers/gpu/drm/drm_ioctl.c:796
drm_ioctl+0x60e/0xad0 drivers/gpu/drm/drm_ioctl.c:893
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf7/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #6 (crtc_ww_class_mutex){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
ww_acquire_init include/linux/ww_mutex.h:162 [inline]
drm_modeset_acquire_init+0x20b/0x3d0 drivers/gpu/drm/drm_modeset_lock.c:250
drmm_mode_config_init+0xe05/0x1800 drivers/gpu/drm/drm_mode_config.c:453
vkms_modeset_init drivers/gpu/drm/vkms/vkms_drv.c:158 [inline]
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:219 [inline]
vkms_init+0x380/0x720 drivers/gpu/drm/vkms/vkms_drv.c:256
do_one_initcall+0x24a/0x870 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #5 (crtc_ww_class_acquire){+.+.}-{0:0}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
ww_acquire_init include/linux/ww_mutex.h:161 [inline]
drm_modeset_acquire_init+0x1ee/0x3d0 drivers/gpu/drm/drm_modeset_lock.c:250
drm_client_modeset_commit_atomic+0xcf/0x7d0 drivers/gpu/drm/drm_client_modeset.c:1009
drm_client_modeset_commit_locked+0xe0/0x520 drivers/gpu/drm/drm_client_modeset.c:1173
drm_client_modeset_commit+0x4a/0x70 drivers/gpu/drm/drm_client_modeset.c:1199
__drm_fb_helper_restore_fbdev_mode_unlocked+0xc3/0x170 drivers/gpu/drm/drm_fb_helper.c:237
drm_fb_helper_set_par+0xaf/0x100 drivers/gpu/drm/drm_fb_helper.c:1351
fbcon_init+0x112d/0x2100 drivers/video/fbdev/core/fbcon.c:1113
visual_init+0x2e9/0x660 drivers/tty/vt/vt.c:1011
do_bind_con_driver+0x863/0xf60 drivers/tty/vt/vt.c:3833
do_take_over_console+0x5e7/0x750 drivers/tty/vt/vt.c:4399
do_fbcon_takeover+0x11a/0x200 drivers/video/fbdev/core/fbcon.c:549
do_fb_registered drivers/video/fbdev/core/fbcon.c:2988 [inline]
fbcon_fb_registered+0x364/0x620 drivers/video/fbdev/core/fbcon.c:3008
do_register_framebuffer drivers/video/fbdev/core/fbmem.c:449 [inline]
register_framebuffer+0x654/0x810 drivers/video/fbdev/core/fbmem.c:515
__drm_fb_helper_initial_config_and_unlock+0x1697/0x1cc0 drivers/gpu/drm/drm_fb_helper.c:1841
drm_fbdev_client_hotplug+0x16e/0x230 drivers/gpu/drm/drm_fbdev_client.c:51
drm_client_register+0x181/0x210 drivers/gpu/drm/drm_client.c:140
drm_fbdev_client_setup+0x1a9/0x3b0 drivers/gpu/drm/drm_fbdev_client.c:158
drm_client_setup+0x1d/0x90 drivers/gpu/drm/drm_client_setup.c:29
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:230 [inline]
vkms_init+0x5eb/0x720 drivers/gpu/drm/vkms/vkms_drv.c:256
do_one_initcall+0x24a/0x870 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #4 (&client->modeset_mutex){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
drm_client_modeset_probe+0x3ab/0x5490 drivers/gpu/drm/drm_client_modeset.c:834
__drm_fb_helper_initial_config_and_unlock+0x11e/0x1cc0 drivers/gpu/drm/drm_fb_helper.c:1818
drm_fbdev_client_hotplug+0x16e/0x230 drivers/gpu/drm/drm_fbdev_client.c:51
drm_client_register+0x181/0x210 drivers/gpu/drm/drm_client.c:140
drm_fbdev_client_setup+0x1a9/0x3b0 drivers/gpu/drm/drm_fbdev_client.c:158
drm_client_setup+0x1d/0x90 drivers/gpu/drm/drm_client_setup.c:29
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:230 [inline]
vkms_init+0x5eb/0x720 drivers/gpu/drm/vkms/vkms_drv.c:256
do_one_initcall+0x24a/0x870 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #3 (&helper->lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
__drm_fb_helper_restore_fbdev_mode_unlocked+0xa2/0x170 drivers/gpu/drm/drm_fb_helper.c:228
drm_fb_helper_set_par+0xaf/0x100 drivers/gpu/drm/drm_fb_helper.c:1351
fbcon_init+0x112d/0x2100 drivers/video/fbdev/core/fbcon.c:1113
visual_init+0x2e9/0x660 drivers/tty/vt/vt.c:1011
do_bind_con_driver+0x863/0xf60 drivers/tty/vt/vt.c:3833
do_take_over_console+0x5e7/0x750 drivers/tty/vt/vt.c:4399
do_fbcon_takeover+0x11a/0x200 drivers/video/fbdev/core/fbcon.c:549
do_fb_registered drivers/video/fbdev/core/fbcon.c:2988 [inline]
fbcon_fb_registered+0x364/0x620 drivers/video/fbdev/core/fbcon.c:3008
do_register_framebuffer drivers/video/fbdev/core/fbmem.c:449 [inline]
register_framebuffer+0x654/0x810 drivers/video/fbdev/core/fbmem.c:515
__drm_fb_helper_initial_config_and_unlock+0x1697/0x1cc0 drivers/gpu/drm/drm_fb_helper.c:1841
drm_fbdev_client_hotplug+0x16e/0x230 drivers/gpu/drm/drm_fbdev_client.c:51
drm_client_register+0x181/0x210 drivers/gpu/drm/drm_client.c:140
drm_fbdev_client_setup+0x1a9/0x3b0 drivers/gpu/drm/drm_fbdev_client.c:158
drm_client_setup+0x1d/0x90 drivers/gpu/drm/drm_client_setup.c:29
vkms_create drivers/gpu/drm/vkms/vkms_drv.c:230 [inline]
vkms_init+0x5eb/0x720 drivers/gpu/drm/vkms/vkms_drv.c:256
do_one_initcall+0x24a/0x870 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #2 (console_lock){+.+.}-{0:0}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
console_lock+0x164/0x1b0 kernel/printk/printk.c:2833
__bch2_print_string_as_lines fs/bcachefs/util.c:267 [inline]
bch2_print_string_as_lines+0x20/0xc0 fs/bcachefs/util.c:286
__bch2_fsck_err+0x104d/0x1570 fs/bcachefs/error.c:411
bch2_bucket_ref_update+0x89e/0x12d0 fs/bcachefs/buckets.c:469
__mark_pointer fs/bcachefs/buckets.c:551 [inline]
bch2_trigger_pointer fs/bcachefs/buckets.c:590 [inline]
__trigger_extent+0x1173/0x4fa0 fs/bcachefs/buckets.c:740
bch2_trigger_extent+0x585/0xaa0 fs/bcachefs/buckets.c:869
bch2_key_trigger fs/bcachefs/bkey_methods.h:87 [inline]
bch2_key_trigger_old fs/bcachefs/bkey_methods.h:101 [inline]
run_one_trans_trigger fs/bcachefs/btree_trans_commit.c:512 [inline]
run_btree_triggers+0xb39/0x1270 fs/bcachefs/btree_trans_commit.c:540
bch2_trans_commit_run_triggers fs/bcachefs/btree_trans_commit.c:572 [inline]
__bch2_trans_commit+0x369/0x93c0 fs/bcachefs/btree_trans_commit.c:1057
bch2_trans_commit fs/bcachefs/btree_update.h:184 [inline]
bch2_inode_delete_keys+0xae6/0x1440 fs/bcachefs/inode.c:986
bch2_inode_rm+0x17d/0xf60 fs/bcachefs/inode.c:1015
bch2_evict_inode+0x20a/0x3f0 fs/bcachefs/fs.c:1836
evict+0x4ea/0x9a0 fs/inode.c:796
do_unlinkat+0x512/0x830 fs/namei.c:4594
__do_sys_unlink fs/namei.c:4635 [inline]
__se_sys_unlink fs/namei.c:4633 [inline]
__x64_sys_unlink+0x47/0x50 fs/namei.c:4633
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&c->fsck_error_msgs_lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
__bch2_fsck_err+0x3d4/0x1570 fs/bcachefs/error.c:282
bch2_bucket_ref_update+0x89e/0x12d0 fs/bcachefs/buckets.c:469
__mark_pointer fs/bcachefs/buckets.c:551 [inline]
bch2_trigger_pointer fs/bcachefs/buckets.c:590 [inline]
__trigger_extent+0x1173/0x4fa0 fs/bcachefs/buckets.c:740
bch2_trigger_extent+0x585/0xaa0 fs/bcachefs/buckets.c:869
bch2_key_trigger fs/bcachefs/bkey_methods.h:87 [inline]
bch2_key_trigger_old fs/bcachefs/bkey_methods.h:101 [inline]
run_one_trans_trigger fs/bcachefs/btree_trans_commit.c:512 [inline]
run_btree_triggers+0xb39/0x1270 fs/bcachefs/btree_trans_commit.c:540
bch2_trans_commit_run_triggers fs/bcachefs/btree_trans_commit.c:572 [inline]
__bch2_trans_commit+0x369/0x93c0 fs/bcachefs/btree_trans_commit.c:1057
bch2_trans_commit fs/bcachefs/btree_update.h:184 [inline]
bch2_inode_delete_keys+0xae6/0x1440 fs/bcachefs/inode.c:986
bch2_inode_rm+0x17d/0xf60 fs/bcachefs/inode.c:1015
bch2_evict_inode+0x20a/0x3f0 fs/bcachefs/fs.c:1836
evict+0x4ea/0x9a0 fs/inode.c:796
do_unlinkat+0x512/0x830 fs/namei.c:4594
__do_sys_unlink fs/namei.c:4635 [inline]
__se_sys_unlink fs/namei.c:4633 [inline]
__x64_sys_unlink+0x47/0x50 fs/namei.c:4633
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (bcachefs_btree){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
trans_set_locked fs/bcachefs/btree_locking.h:194 [inline]
bch2_trans_begin+0x9c5/0x1bf0 fs/bcachefs/btree_iter.c:3125
bchfs_read+0x1e0/0x2b10 fs/bcachefs/fs-io-buffered.c:161
bch2_readahead+0xdce/0x11e0 fs/bcachefs/fs-io-buffered.c:277
read_pages+0x178/0x750 mm/readahead.c:160
page_cache_ra_order+0x7e3/0xb60 mm/readahead.c:512
do_sync_mmap_readahead+0x499/0x970
filemap_fault+0x8a9/0x1490 mm/filemap.c:3335
bch2_page_fault+0x52c/0x960 fs/bcachefs/fs-io-pagecache.c:594
__do_fault+0x137/0x390 mm/memory.c:4907
do_read_fault mm/memory.c:5322 [inline]
do_fault mm/memory.c:5456 [inline]
do_pte_missing mm/memory.c:3979 [inline]
handle_pte_fault+0x39eb/0x5ed0 mm/memory.c:5801
__handle_mm_fault mm/memory.c:5944 [inline]
handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
faultin_page mm/gup.c:1196 [inline]
__get_user_pages+0x1c82/0x49e0 mm/gup.c:1494
populate_vma_page_range+0x264/0x330 mm/gup.c:1932
__mm_populate+0x27a/0x460 mm/gup.c:2035
mm_populate include/linux/mm.h:3397 [inline]
vm_mmap_pgoff+0x2c3/0x3d0 mm/util.c:580
ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:546
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
bcachefs_btree --> &mm->mmap_lock --> mapping.invalidate_lock#6
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(mapping.invalidate_lock#6);
lock(&mm->mmap_lock);
lock(mapping.invalidate_lock#6);
lock(bcachefs_btree);
*** DEADLOCK ***
1 lock held by syz.1.4054/25525:
#0: ffff8880545f3ee8 (mapping.invalidate_lock#6){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
#0: ffff8880545f3ee8 (mapping.invalidate_lock#6){.+.+}-{4:4}, at: page_cache_ra_order+0x326/0xb60 mm/readahead.c:488
stack backtrace:
CPU: 0 UID: 0 PID: 25525 Comm: syz.1.4054 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
trans_set_locked fs/bcachefs/btree_locking.h:194 [inline]
bch2_trans_begin+0x9c5/0x1bf0 fs/bcachefs/btree_iter.c:3125
bchfs_read+0x1e0/0x2b10 fs/bcachefs/fs-io-buffered.c:161
bch2_readahead+0xdce/0x11e0 fs/bcachefs/fs-io-buffered.c:277
read_pages+0x178/0x750 mm/readahead.c:160
page_cache_ra_order+0x7e3/0xb60 mm/readahead.c:512
do_sync_mmap_readahead+0x499/0x970
filemap_fault+0x8a9/0x1490 mm/filemap.c:3335
bch2_page_fault+0x52c/0x960 fs/bcachefs/fs-io-pagecache.c:594
__do_fault+0x137/0x390 mm/memory.c:4907
do_read_fault mm/memory.c:5322 [inline]
do_fault mm/memory.c:5456 [inline]
do_pte_missing mm/memory.c:3979 [inline]
handle_pte_fault+0x39eb/0x5ed0 mm/memory.c:5801
__handle_mm_fault mm/memory.c:5944 [inline]
handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
faultin_page mm/gup.c:1196 [inline]
__get_user_pages+0x1c82/0x49e0 mm/gup.c:1494
populate_vma_page_range+0x264/0x330 mm/gup.c:1932
__mm_populate+0x27a/0x460 mm/gup.c:2035
mm_populate include/linux/mm.h:3397 [inline]
vm_mmap_pgoff+0x2c3/0x3d0 mm/util.c:580
ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:546
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbe7b185d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbe7c04d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fbe7b376080 RCX: 00007fbe7b185d29
RDX: 00000000027ffff7 RSI: 0000000000600000 RDI: 0000000020000000
RBP: 00007fbe7b201b08 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000004012011 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fbe7b376080 R15: 00007ffd12016ca8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [fs?] WARNING in minix_rmdir
@ 2025-01-08 12:17 syzbot
2025-10-14 13:36 ` Forwarded: syzbot
2025-11-02 12:47 ` Forwarded: syzbot
0 siblings, 2 replies; 85+ messages in thread
From: syzbot @ 2025-01-08 12:17 UTC (permalink / raw)
To: linux-fsdevel, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 8155b4ef3466 Add linux-next specific files for 20241220
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=115656f8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9c90bb7161a56c88
dashboard link: https://syzkaller.appspot.com/bug?extid=4e49728ec1cbaf3b91d2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16726edf980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17535418580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98a974fc662d/disk-8155b4ef.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2dea9b72f624/vmlinux-8155b4ef.xz
kernel image: https://storage.googleapis.com/syzbot-assets/593a42b9eb34/bzImage-8155b4ef.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7d86236cea0c/mount_0.gz
Bisection is inconclusive: the issue happens on the oldest tested release.
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=122c7418580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=112c7418580000
console output: https://syzkaller.appspot.com/x/log.txt?x=162c7418580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4e49728ec1cbaf3b91d2@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5830 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407
Modules linked in:
CPU: 0 UID: 0 PID: 5830 Comm: syz-executor235 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:drop_nlink+0xc4/0x110 fs/inode.c:407
Code: bb 70 07 00 00 be 08 00 00 00 e8 87 15 e7 ff f0 48 ff 83 70 07 00 00 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc e8 4d 97 80 ff 90 <0f> 0b 90 eb 83 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 5c ff ff ff
RSP: 0018:ffffc90003ecfd30 EFLAGS: 00010293
RAX: ffffffff823e8cd3 RBX: 1ffff1100ef7ca0c RCX: ffff88803493bc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff823e8c53 R09: 1ffffffff203563e
R10: dffffc0000000000 R11: fffffbfff203563f R12: ffff888077be5060
R13: ffff8880792a5a70 R14: ffff888077be5018 R15: dffffc0000000000
FS: 0000555592c31380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe52599f9c CR3: 0000000076e2e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
inode_dec_link_count include/linux/fs.h:2567 [inline]
minix_rmdir+0xa5/0xc0 fs/minix/namei.c:170
vfs_rmdir+0x3a3/0x510 fs/namei.c:4394
do_rmdir+0x3b5/0x580 fs/namei.c:4453
__do_sys_rmdir fs/namei.c:4472 [inline]
__se_sys_rmdir fs/namei.c:4470 [inline]
__x64_sys_rmdir+0x47/0x50 fs/namei.c:4470
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb0206e3d47
Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe52599f88 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb0206e3d47
RDX: 0000000000008890 RSI: 0000000000000000 RDI: 00007ffe5259b130
RBP: 0000000000000065 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffe5259b130
R13: 0000555592c42740 R14: 431bde82d7b634db R15: 00007ffe5259d2b0
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2025-01-08 12:17 [syzbot] [fs?] WARNING in minix_rmdir syzbot
@ 2025-10-14 13:36 ` syzbot
2025-11-02 12:47 ` Forwarded: syzbot
1 sibling, 0 replies; 85+ messages in thread
From: syzbot @ 2025-10-14 13:36 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/inode.c | 14 ++++++++++++++
fs/minix/namei.c | 22 ++++++++++++++--------
2 files changed, 28 insertions(+), 8 deletions(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EIO;
+
+ if (dir->i_nlink <= 2)
+ goto out;
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
}
+out:
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 85+ messages in thread* Forwarded:
2025-01-08 12:17 [syzbot] [fs?] WARNING in minix_rmdir syzbot
2025-10-14 13:36 ` Forwarded: syzbot
@ 2025-11-02 12:47 ` syzbot
1 sibling, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-02 12:47 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/minix.h | 2 ++
fs/minix/namei.c | 26 ++++++++++++++++++--------
2 files changed, 20 insertions(+), 8 deletions(-)
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..a8d5a7e22b7b 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,25 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EFSCORRUPTED;
+
+ if (dir->i_nlink <= 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out;
}
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
+ }
+
+out:
return err;
}
--
2.51.1.dirty
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_peek_slot
@ 2024-11-29 12:12 syzbot
2025-07-19 22:03 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-11-29 12:12 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 65ae975e97d5 Merge tag 'net-6.13-rc1' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14794d30580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3891b550f14aea0f
dashboard link: https://syzkaller.appspot.com/bug?extid=3ebaf90b49bd97e920ee
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-65ae975e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/53fd215a7a86/vmlinux-65ae975e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/589c729ff0b2/bzImage-65ae975e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3ebaf90b49bd97e920ee@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/bcachefs/btree_iter.c:1816!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 4683 Comm: kworker/u5:1 Not tainted 6.12.0-syzkaller-10681-g65ae975e97d5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: bcachefs bch2_write_point_do_index_updates
RIP: 0010:bch2_btree_path_peek_slot+0xf50/0xf90 fs/bcachefs/btree_iter.c:1816
Code: f7 ff ff 48 89 34 24 be 08 00 00 00 44 89 44 24 08 e8 c4 fa e3 fd 48 8b 34 24 44 8b 44 24 08 e9 50 f7 ff ff e8 51 12 79 fd 90 <0f> 0b e8 49 12 79 fd 90 0f 0b e8 21 4a b6 07 e8 3c 12 79 fd 90 0f
RSP: 0018:ffffc9000de4c0a0 EFLAGS: 00010293
RAX: ffffffff841cd22f RBX: 0000000000002164 RCX: ffff88801f290000
RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffffc9000de4c1b0 R08: ffffffff841cc410 R09: 0000000000000000
R10: ffffc9000de4c300 R11: fffff52001bc9862 R12: dffffc0000000000
R13: 1ffff1100adc228d R14: ffff888056e11448 R15: 1ffff1100adc228c
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe0e030d38 CR3: 000000004f5d2000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bch2_btree_iter_peek_slot+0xa2f/0x2550 fs/bcachefs/btree_iter.c:2658
__bch2_bkey_get_iter fs/bcachefs/btree_iter.h:575 [inline]
bch2_bkey_get_iter fs/bcachefs/btree_iter.h:589 [inline]
try_alloc_bucket fs/bcachefs/alloc_foreground.c:305 [inline]
bch2_bucket_alloc_freelist fs/bcachefs/alloc_foreground.c:525 [inline]
bch2_bucket_alloc_trans+0x1997/0x3a50 fs/bcachefs/alloc_foreground.c:648
bch2_bucket_alloc_set_trans+0x517/0xd30 fs/bcachefs/alloc_foreground.c:808
__open_bucket_add_buckets+0x13d0/0x1ec0 fs/bcachefs/alloc_foreground.c:1057
open_bucket_add_buckets+0x33a/0x410 fs/bcachefs/alloc_foreground.c:1101
bch2_alloc_sectors_start_trans+0xce9/0x2030
__bch2_btree_node_alloc fs/bcachefs/btree_update_interior.c:339 [inline]
bch2_btree_reserve_get+0x612/0x1890 fs/bcachefs/btree_update_interior.c:549
bch2_btree_update_start+0xe56/0x14e0 fs/bcachefs/btree_update_interior.c:1247
bch2_btree_split_leaf+0x123/0x840 fs/bcachefs/btree_update_interior.c:1856
bch2_trans_commit_error+0x212/0x1390 fs/bcachefs/btree_trans_commit.c:942
__bch2_trans_commit+0x7ead/0x93c0 fs/bcachefs/btree_trans_commit.c:1140
bch2_trans_commit fs/bcachefs/btree_update.h:184 [inline]
btree_key_cache_flush_pos fs/bcachefs/btree_key_cache.c:432 [inline]
bch2_btree_key_cache_journal_flush+0x97d/0xe70 fs/bcachefs/btree_key_cache.c:512
journal_flush_pins+0x5f7/0xb20 fs/bcachefs/journal_reclaim.c:565
__bch2_journal_reclaim+0x789/0xdc0 fs/bcachefs/journal_reclaim.c:698
__journal_res_get+0x1de3/0x2670 fs/bcachefs/journal.c:581
bch2_journal_res_get_slowpath+0xe6/0x710 fs/bcachefs/journal.c:606
bch2_journal_res_get fs/bcachefs/journal.h:382 [inline]
bch2_trans_journal_res_get fs/bcachefs/btree_trans_commit.c:350 [inline]
bch2_trans_commit_error+0xd91/0x1390 fs/bcachefs/btree_trans_commit.c:962
__bch2_trans_commit+0x7ead/0x93c0 fs/bcachefs/btree_trans_commit.c:1140
bch2_trans_commit fs/bcachefs/btree_update.h:184 [inline]
__bch2_data_update_index_update+0x56bb/0x77f0 fs/bcachefs/data_update.c:368
bch2_data_update_index_update+0x63/0x90 fs/bcachefs/data_update.c:414
__bch2_write_index+0x16d1/0x2140 fs/bcachefs/io_write.c:527
bch2_write_point_do_index_updates+0x32e/0x690 fs/bcachefs/io_write.c:635
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_btree_path_peek_slot+0xf50/0xf90 fs/bcachefs/btree_iter.c:1816
Code: f7 ff ff 48 89 34 24 be 08 00 00 00 44 89 44 24 08 e8 c4 fa e3 fd 48 8b 34 24 44 8b 44 24 08 e9 50 f7 ff ff e8 51 12 79 fd 90 <0f> 0b e8 49 12 79 fd 90 0f 0b e8 21 4a b6 07 e8 3c 12 79 fd 90 0f
RSP: 0018:ffffc9000de4c0a0 EFLAGS: 00010293
RAX: ffffffff841cd22f RBX: 0000000000002164 RCX: ffff88801f290000
RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffffc9000de4c1b0 R08: ffffffff841cc410 R09: 0000000000000000
R10: ffffc9000de4c300 R11: fffff52001bc9862 R12: dffffc0000000000
R13: 1ffff1100adc228d R14: ffff888056e11448 R15: 1ffff1100adc228c
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe0e030d38 CR3: 000000004f5d2000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] general protection fault in bch2_prt_vprintf
@ 2024-11-29 8:43 syzbot
2025-07-22 16:18 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-11-29 8:43 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 65ae975e97d5 Merge tag 'net-6.13-rc1' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1478df5f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=3891b550f14aea0f
dashboard link: https://syzkaller.appspot.com/bug?extid=03b7bb8ca037d17926dc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=140d100f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123b4d30580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-65ae975e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/53fd215a7a86/vmlinux-65ae975e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/589c729ff0b2/bzImage-65ae975e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/3e4078bce33b/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+03b7bb8ca037d17926dc@syzkaller.appspotmail.com
bi_fields_set=0
bi_dir=4096
bi_dir_offset=2695648408715017799
bi_subvol=0
bi_parent_subvol=0
bi_nocow=0, fixing
Oops: general protection fault, probably for non-canonical address 0xec6408ae4eae6c2e: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x6320657275736170-0x6320657275736177]
CPU: 0 UID: 0 PID: 5321 Comm: syz-executor191 Not tainted 6.12.0-syzkaller-10681-g65ae975e97d5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:string_nocheck lib/vsprintf.c:646 [inline]
RIP: 0010:string+0x1a5/0x2b0 lib/vsprintf.c:728
Code: 85 c0 0f 84 db 00 00 00 4c 89 7c 24 08 49 89 c7 49 ff cf 31 db 49 8d 3c 1c 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 75 5d 4c 8d 6c 1d 00 41 0f b6 2c 1c 31 ff 89 ee
RSP: 0018:ffffc9000d116570 EFLAGS: 00010206
RAX: 0c640cae4eae6c2e RBX: 0000000000000000 RCX: dffffc0000000000
RDX: ffff88801f26a440 RSI: ffffffffffffffff RDI: 6320657275736172
RBP: 0000000000000020 R08: ffffffff8bcc7827 R09: ffffffff8bcc3ec4
R10: 0000000000000012 R11: ffff88801f26a440 R12: 6320657275736172
R13: 0000000000000000 R14: 0000000000000020 R15: fffffffffffffffe
FS: 000055555da89380(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c1e8516098 CR3: 000000003c578000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
vsnprintf+0x1101/0x1da0 lib/vsprintf.c:2848
bch2_prt_vprintf+0x1a2/0x700 fs/bcachefs/printbuf.c:166
__bch2_fsck_err+0x2c2/0x1570 fs/bcachefs/error.c:266
check_dirent_inode_dirent+0xf3b/0x1a30 fs/bcachefs/fsck.c:2214
check_dirent_target+0x117/0xf70 fs/bcachefs/fsck.c:2244
check_dirent fs/bcachefs/fsck.c:2518 [inline]
bch2_check_dirents+0x12e9/0x2570 fs/bcachefs/fsck.c:2552
bch2_run_recovery_pass+0xf0/0x1e0 fs/bcachefs/recovery_passes.c:191
bch2_run_recovery_passes+0x3a7/0x880 fs/bcachefs/recovery_passes.c:244
bch2_fs_recovery+0x25cc/0x39d0 fs/bcachefs/recovery.c:861
bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1037
bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8e3858cdea
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe695cd7a8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe695cd7c0 RCX: 00007f8e3858cdea
RDX: 00000000200058c0 RSI: 0000000020000000 RDI: 00007ffe695cd7c0
RBP: 0000000000000004 R08: 00007ffe695cd800 R09: 00000000000059aa
R10: 0000000000010040 R11: 0000000000000282 R12: 0000000000010040
R13: 00007ffe695cd800 R14: 0000000000000003 R15: 0000000001000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:string_nocheck lib/vsprintf.c:646 [inline]
RIP: 0010:string+0x1a5/0x2b0 lib/vsprintf.c:728
Code: 85 c0 0f 84 db 00 00 00 4c 89 7c 24 08 49 89 c7 49 ff cf 31 db 49 8d 3c 1c 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 75 5d 4c 8d 6c 1d 00 41 0f b6 2c 1c 31 ff 89 ee
RSP: 0018:ffffc9000d116570 EFLAGS: 00010206
RAX: 0c640cae4eae6c2e RBX: 0000000000000000 RCX: dffffc0000000000
RDX: ffff88801f26a440 RSI: ffffffffffffffff RDI: 6320657275736172
RBP: 0000000000000020 R08: ffffffff8bcc7827 R09: ffffffff8bcc3ec4
R10: 0000000000000012 R11: ffff88801f26a440 R12: 6320657275736172
R13: 0000000000000000 R14: 0000000000000020 R15: fffffffffffffffe
FS: 000055555da89380(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c1e8516098 CR3: 000000003c578000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 85 c0 test %eax,%eax
2: 0f 84 db 00 00 00 je 0xe3
8: 4c 89 7c 24 08 mov %r15,0x8(%rsp)
d: 49 89 c7 mov %rax,%r15
10: 49 ff cf dec %r15
13: 31 db xor %ebx,%ebx
15: 49 8d 3c 1c lea (%r12,%rbx,1),%rdi
19: 48 89 f8 mov %rdi,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 75 5d jne 0x8f
32: 4c 8d 6c 1d 00 lea 0x0(%rbp,%rbx,1),%r13
37: 41 0f b6 2c 1c movzbl (%r12,%rbx,1),%ebp
3c: 31 ff xor %edi,%edi
3e: 89 ee mov %ebp,%esi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_btree_node_read_done
@ 2024-11-25 13:27 syzbot
2025-07-20 14:54 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-11-25 13:27 UTC (permalink / raw)
To: bfoster, kent.overstreet, linux-bcachefs, linux-kernel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 228a1157fb9f Merge tag '6.13-rc-part1-SMB3-client-fixes' o..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16300530580000
kernel config: https://syzkaller.appspot.com/x/.config?x=402159daa216c89d
dashboard link: https://syzkaller.appspot.com/bug?extid=92e65e9b7a42d379f92e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=159bfb78580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=170169c0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d32a8e8c5aae/disk-228a1157.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/28d5c070092e/vmlinux-228a1157.xz
kernel image: https://storage.googleapis.com/syzbot-assets/45af4bfd9e8e/bzImage-228a1157.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/4b641b27822f/mount_0.gz
The issue was bisected to:
commit 03ef80b469d5d83530ce1ce15be78a40e5300f9b
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Sat Sep 23 22:41:51 2023 +0000
bcachefs: Ignore unknown mount options
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11388778580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=13388778580000
console output: https://syzkaller.appspot.com/x/log.txt?x=15388778580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+92e65e9b7a42d379f92e@syzkaller.appspotmail.com
Fixes: 03ef80b469d5 ("bcachefs: Ignore unknown mount options")
node offset 8/24 bset u64s 375 bset byte offset 184: keys out of order: u64s 11 type alloc_v4 0:32:0 len 0 ver 0 > u64s 11 type alloc_v4 0:2:0 len 0 ver 0, fixing
bcachefs (loop0): btree_node_read_work: rewriting btree node at btree=alloc level=0 SPOS_MAX due to error
==================================================================
BUG: KASAN: use-after-free in bch2_btree_node_read_done+0xfbe/0x5e90 fs/bcachefs/btree_io.c:1087
Read of size 8 at addr ffff888076abc010 by task syz-executor345/5842
CPU: 1 UID: 0 PID: 5842 Comm: syz-executor345 Not tainted 6.12.0-syzkaller-08446-g228a1157fb9f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
bch2_btree_node_read_done+0xfbe/0x5e90 fs/bcachefs/btree_io.c:1087
btree_node_read_work+0x68b/0x1260 fs/bcachefs/btree_io.c:1323
bch2_btree_node_read+0x2433/0x2a10
__bch2_btree_root_read fs/bcachefs/btree_io.c:1749 [inline]
bch2_btree_root_read+0x617/0x7a0 fs/bcachefs/btree_io.c:1771
read_btree_roots+0x296/0x840 fs/bcachefs/recovery.c:523
bch2_fs_recovery+0x2585/0x39d0 fs/bcachefs/recovery.c:853
bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1037
bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc4572667ea
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 3e 06 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd22484098 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4572667ea
RDX: 00000000200000c0 RSI: 0000000020000180 RDI: 00007ffd224840f0
RBP: 0000000000000004 R08: 00007ffd22484130 R09: 000000000000593e
R10: 0000000000000010 R11: 0000000000000282 R12: 00007ffd22484130
R13: 0000000001000000 R14: 0000000000000003 R15: 0000000000000010
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76abc
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001ca0108 ffff8880b87447e0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x452cd0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_RECLAIMABLE), pid 5842, tgid 5842 (syz-executor345), ts 64163821991, free_ts 64389007908
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0x363e/0x3790 mm/page_alloc.c:3474
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4209
__kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4236
__do_kmalloc_node mm/slub.c:4252 [inline]
__kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4270
__kvmalloc_node_noprof+0x72/0x190 mm/util.c:658
btree_node_data_alloc+0xdb/0x260 fs/bcachefs/btree_cache.c:153
__bch2_btree_node_mem_alloc+0x1d8/0x3e0 fs/bcachefs/btree_cache.c:198
bch2_fs_btree_cache_init+0x26f/0x630 fs/bcachefs/btree_cache.c:653
bch2_fs_alloc fs/bcachefs/super.c:917 [inline]
bch2_fs_open+0x2aa4/0x2f80 fs/bcachefs/super.c:2065
bch2_fs_get_tree+0x738/0x1710 fs/bcachefs/fs.c:2157
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
page last free pid 5842 tgid 5842 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0xded/0x1130 mm/page_alloc.c:2657
__folio_put+0x2c7/0x440 mm/swap.c:112
folio_put include/linux/mm.h:1490 [inline]
free_large_kmalloc+0x105/0x1c0 mm/slub.c:4698
kfree+0x21c/0x440 mm/slub.c:4721
btree_bounce_free fs/bcachefs/btree_io.c:112 [inline]
bch2_btree_node_read_done+0x3c8a/0x5e90 fs/bcachefs/btree_io.c:1209
btree_node_read_work+0x68b/0x1260 fs/bcachefs/btree_io.c:1323
bch2_btree_node_read+0x2433/0x2a10
__bch2_btree_root_read fs/bcachefs/btree_io.c:1749 [inline]
bch2_btree_root_read+0x617/0x7a0 fs/bcachefs/btree_io.c:1771
read_btree_roots+0x296/0x840 fs/bcachefs/recovery.c:523
bch2_fs_recovery+0x2585/0x39d0 fs/bcachefs/recovery.c:853
bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1037
bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
Memory state around the buggy address:
ffff888076abbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888076abbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888076abc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888076abc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888076abc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [kvm?] WARNING: locking bug in kvm_xen_set_evtchn_fast
@ 2024-11-21 15:03 syzbot
2026-03-15 13:58 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-11-21 15:03 UTC (permalink / raw)
To: bp, dave.hansen, dwmw2, hpa, kvm, linux-kernel, mingo, paul,
pbonzini, seanjc, syzkaller-bugs, tglx, x86
Hello,
syzbot found the following issue on:
HEAD commit: 8f7c8b88bda4 Merge tag 'sched_ext-for-6.13' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=103d275f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b2ddebc25a60ddb
dashboard link: https://syzkaller.appspot.com/bug?extid=919877893c9d28162dc2
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-8f7c8b88.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a91bdc4cdb5d/vmlinux-8f7c8b88.xz
kernel image: https://storage.googleapis.com/syzbot-assets/35264fa8c070/bzImage-8f7c8b88.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+919877893c9d28162dc2@syzkaller.appspotmail.com
=============================
[ BUG: Invalid wait context ]
6.12.0-syzkaller-01892-g8f7c8b88bda4 #0 Not tainted
-----------------------------
kworker/u32:4/73 is trying to lock:
ffffc90003a90460 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x248/0xe00 arch/x86/kvm/xen.c:1755
other info that might help us debug this:
context-{2:2}
7 locks held by kworker/u32:4/73:
#0: ffff88810628e948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204
#1: ffffc90000fbfd80 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
#2: ffffffff8feec868 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0xcf/0x14d0 net/ipv6/addrconf.c:4196
#3: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#3: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x864/0x1c30 net/ipv6/ndisc.c:507
#4: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#4: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#4: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x3da/0x1a50 net/ipv6/ip6_output.c:126
#5: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: local_lock_release include/linux/local_lock_internal.h:38 [inline]
#5: ffffffff8e1bb1c0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3f1/0x15f0 net/core/dev.c:6113
#6: ffffc90003a908c8 (&kvm->srcu){.?.?}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:158 [inline]
#6: ffffc90003a908c8 (&kvm->srcu){.?.?}-{0:0}, at: srcu_read_lock include/linux/srcu.h:249 [inline]
#6: ffffc90003a908c8 (&kvm->srcu){.?.?}-{0:0}, at: kvm_xen_set_evtchn_fast+0x22e/0xe00 arch/x86/kvm/xen.c:1753
stack backtrace:
CPU: 1 UID: 0 PID: 73 Comm: kworker/u32:4 Not tainted 6.12.0-syzkaller-01892-g8f7c8b88bda4 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
check_wait_context kernel/locking/lockdep.c:4898 [inline]
__lock_acquire+0x878/0x3c40 kernel/locking/lockdep.c:5176
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x248/0xe00 arch/x86/kvm/xen.c:1755
xen_timer_callback+0x1dd/0x2a0 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x5fb/0xae0 kernel/time/hrtimer.c:1803
hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1865
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 26 dc 41 f6 48 89 df e8 9e 5b 42 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 35 52 33 f6 65 8b 05 36 f8 da 74 85 c0 74 16 5b
RSP: 0018:ffffc900008b0758 EFLAGS: 00000246
RAX: 0000000000000012 RBX: ffffffff9a9e1520 RCX: 1ffffffff2dc9676
RDX: 0000000000000000 RSI: ffffffff8b6cd740 RDI: ffffffff8bd1db00
RBP: 0000000000000286 R08: 0000000000000001 R09: fffffbfff2dc8999
R10: ffffffff96e44ccf R11: 0000000000000006 R12: ffffffff9a9e1518
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88801eec3040
__debug_check_no_obj_freed lib/debugobjects.c:1108 [inline]
debug_check_no_obj_freed+0x327/0x600 lib/debugobjects.c:1129
slab_free_hook mm/slub.c:2273 [inline]
slab_free mm/slub.c:4579 [inline]
kmem_cache_free+0x29c/0x4b0 mm/slub.c:4681
kfree_skbmem+0x1a4/0x1f0 net/core/skbuff.c:1148
__kfree_skb net/core/skbuff.c:1205 [inline]
sk_skb_reason_drop+0x136/0x1a0 net/core/skbuff.c:1242
kfree_skb_reason include/linux/skbuff.h:1262 [inline]
__netif_receive_skb_core.constprop.0+0x592/0x4330 net/core/dev.c:5644
__netif_receive_skb_one_core+0xb1/0x1e0 net/core/dev.c:5668
__netif_receive_skb+0x1d/0x160 net/core/dev.c:5783
process_backlog+0x443/0x15f0 net/core/dev.c:6115
__napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6779
napi_poll net/core/dev.c:6848 [inline]
net_rx_action+0xa92/0x1010 net/core/dev.c:6970
handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
do_softirq kernel/softirq.c:455 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:442
</IRQ>
<TASK>
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]
__dev_queue_xmit+0x887/0x4350 net/core/dev.c:4459
dev_queue_xmit include/linux/netdevice.h:3094 [inline]
neigh_connected_output+0x45c/0x630 net/core/neighbour.c:1594
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0x6a7/0x1a50 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:215 [inline]
ip6_finish_output+0x3f9/0x1300 net/ipv6/ip6_output.c:226
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247
dst_output include/net/dst.h:450 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xa2d/0x1c30 net/ipv6/ndisc.c:511
ndisc_send_ns+0xc7/0x150 net/ipv6/ndisc.c:669
addrconf_dad_work+0xc80/0x14d0 net/ipv6/addrconf.c:4284
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 26 dc 41 f6 call 0xf641dc39
13: 48 89 df mov %rbx,%rdi
16: e8 9e 5b 42 f6 call 0xf6425bb9
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 35 52 33 f6 call 0xf6335269
34: 65 8b 05 36 f8 da 74 mov %gs:0x74daf836(%rip),%eax # 0x74daf871
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* Forwarded:
2024-11-21 15:03 [syzbot] [kvm?] WARNING: locking bug in kvm_xen_set_evtchn_fast syzbot
@ 2026-03-15 13:58 ` syzbot
0 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2026-03-15 13:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: klnm1908v@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index 91fd3673c09a..e588a188f50a 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -126,23 +126,10 @@ static enum hrtimer_restart
xen_timer_callback(struct hrtimer *timer)
{
struct kvm_vcpu *vcpu = container_of(timer, struct kvm_vcpu,
arch.xen.timer);
- struct kvm_xen_evtchn e;
- int rc;
if (atomic_read(&vcpu->arch.xen.timer_pending))
return HRTIMER_NORESTART;
- e.vcpu_id = vcpu->vcpu_id;
- e.vcpu_idx = vcpu->vcpu_idx;
- e.port = vcpu->arch.xen.timer_virq;
- e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
-
- rc = kvm_xen_set_evtchn_fast(&e, vcpu->kvm);
- if (rc != -EWOULDBLOCK) {
- vcpu->arch.xen.timer_expires = 0;
- return HRTIMER_NORESTART;
- }
-
atomic_inc(&vcpu->arch.xen.timer_pending);
kvm_make_request(KVM_REQ_UNBLOCK, vcpu);
kvm_vcpu_kick(vcpu);
^ permalink raw reply related [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] possible deadlock in bch2_symlink
@ 2024-09-29 7:31 syzbot
2025-08-04 23:12 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-09-29 7:31 UTC (permalink / raw)
To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: ad46e8f95e93 Merge tag 'pm-6.12-rc1-2' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17eb9e80580000
kernel config: https://syzkaller.appspot.com/x/.config?x=62086b2fd100a029
dashboard link: https://syzkaller.appspot.com/bug?extid=7836a68852a10ec3d790
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-ad46e8f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72b7539cbeb1/vmlinux-ad46e8f9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/73c9b9cebaf4/bzImage-ad46e8f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,compression=lz4,nojournal_transaction_names
bcachefs (loop0): recovering from clean shutdown, journal seq 7
bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.12: rebalance_work_acct_fix
running recovery passes: check_allocations
invalid bkey u64s 11 type alloc_v4 0:14:0 len 0 ver 0:
gen 0 oldest_gen 0 data_type journal
journal_seq 1
need_discard 1
need_inc_gen 1
dirty_sectors 256
stripe_sectors 0
cached_sectors 0
stripe 67108864
stripe_redundancy 0
io_time[READ] 1
io_time[WRITE] 1
fragmentation 0
bp_start 8
invalid data type (got 2 should be 7): delete?, fixing
bcachefs (loop0): accounting_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): stripes_read... done
bcachefs (loop0): snapshots_read... done
bcachefs (loop0): check_allocations...
btree ptr not marked in member info btree allocated bitmap
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 75277f57b0c8c24 written 32 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing
btree ptr not marked in member info btree allocated bitmap
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 19bc58a6c09b6540 written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing
btree ptr not marked in member info btree allocated bitmap
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c18f4a4face03c6 written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing
btree ptr not marked in member info btree allocated bitmap
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7675f41d391e5d36 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0, fixing
btree ptr not marked in member info btree allocated bitmap
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq bcb9905dfb2993d5 written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0, fixing
btree ptr not marked in member info btree allocated bitmap
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9a831b4a3f983356 written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0, fixing
bucket 0:14 gen 0 has wrong data_type: got free, should be journal, fixing
bucket 0:14 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
done
bcachefs (loop0): going read-write
bcachefs (loop0): journal_replay... done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): done starting filesystem
============================================
WARNING: possible recursive locking detected
6.11.0-syzkaller-11728-gad46e8f95e93 #0 Not tainted
--------------------------------------------
syz.0.0/5107 is trying to acquire lock:
ffff888012fadae8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
ffff888012fadae8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: bch2_symlink+0x176/0x310 fs/bcachefs/fs.c:700
but task is already holding lock:
ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_copy_up_workdir fs/overlayfs/copy_up.c:783 [inline]
ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_do_copy_up fs/overlayfs/copy_up.c:1002 [inline]
ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_copy_up_one fs/overlayfs/copy_up.c:1203 [inline]
ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_copy_up_flags+0x1900/0x46f0 fs/overlayfs/copy_up.c:1258
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&sb->s_type->i_mutex_key#19);
lock(&sb->s_type->i_mutex_key#19);
*** DEADLOCK ***
May be due to missing lock nesting notation
6 locks held by syz.0.0/5107:
#0: ffff88804e2a6420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
#1: ffff888040e71e50 (&ovl_i_mutex_dir_key[depth]/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:850 [inline]
#1: ffff888040e71e50 (&ovl_i_mutex_dir_key[depth]/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:4026
#2: ffff888040e72418 (&ovl_i_mutex_key[depth]){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
#2: ffff888040e72418 (&ovl_i_mutex_key[depth]){+.+.}-{3:3}, at: vfs_link+0x3b2/0x6e0 fs/namei.c:4730
#3: ffff888040e727d0 (&ovl_i_lock_key[depth]){+.+.}-{3:3}, at: ovl_inode_lock_interruptible fs/overlayfs/overlayfs.h:657 [inline]
#3: ffff888040e727d0 (&ovl_i_lock_key[depth]){+.+.}-{3:3}, at: ovl_copy_up_start+0x53/0x310 fs/overlayfs/util.c:719
#4: ffff88804e256420 (sb_writers#11){.+.+}-{0:0}, at: ovl_copy_up_workdir fs/overlayfs/copy_up.c:782 [inline]
#4: ffff88804e256420 (sb_writers#11){.+.+}-{0:0}, at: ovl_do_copy_up fs/overlayfs/copy_up.c:1002 [inline]
#4: ffff88804e256420 (sb_writers#11){.+.+}-{0:0}, at: ovl_copy_up_one fs/overlayfs/copy_up.c:1203 [inline]
#4: ffff88804e256420 (sb_writers#11){.+.+}-{0:0}, at: ovl_copy_up_flags+0x18e9/0x46f0 fs/overlayfs/copy_up.c:1258
#5: ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
#5: ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_copy_up_workdir fs/overlayfs/copy_up.c:783 [inline]
#5: ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_do_copy_up fs/overlayfs/copy_up.c:1002 [inline]
#5: ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_copy_up_one fs/overlayfs/copy_up.c:1203 [inline]
#5: ffff888012facbf8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: ovl_copy_up_flags+0x1900/0x46f0 fs/overlayfs/copy_up.c:1258
stack backtrace:
CPU: 0 UID: 0 PID: 5107 Comm: syz.0.0 Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3034
check_deadlock kernel/locking/lockdep.c:3086 [inline]
validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3888
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5199
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
down_write+0x99/0x220 kernel/locking/rwsem.c:1579
inode_lock include/linux/fs.h:815 [inline]
bch2_symlink+0x176/0x310 fs/bcachefs/fs.c:700
vfs_symlink+0x137/0x2e0 fs/namei.c:4615
ovl_do_symlink+0x85/0xd0 fs/overlayfs/overlayfs.h:267
ovl_create_real+0x346/0x550 fs/overlayfs/dir.c:206
ovl_copy_up_workdir fs/overlayfs/copy_up.c:784 [inline]
ovl_do_copy_up fs/overlayfs/copy_up.c:1002 [inline]
ovl_copy_up_one fs/overlayfs/copy_up.c:1203 [inline]
ovl_copy_up_flags+0x193c/0x46f0 fs/overlayfs/copy_up.c:1258
ovl_link+0x85/0x320 fs/overlayfs/dir.c:716
vfs_link+0x4f0/0x6e0 fs/namei.c:4739
do_linkat+0x555/0x6f0 fs/namei.c:4809
__do_sys_link fs/namei.c:4843 [inline]
__se_sys_link fs/namei.c:4841 [inline]
__x64_sys_link+0x82/0x90 fs/namei.c:4841
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9772d7dff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9773bdf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000056
RAX: ffffffffffffffda RBX: 00007f9772f36058 RCX: 00007f9772d7dff9
RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000020000200
RBP: 00007f9772df0296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9772f36058 R15: 00007fff2ceaaba8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] BUG: unable to handle kernel paging request in bch2_dirent_to_text
@ 2024-07-18 1:20 syzbot
2025-07-21 17:30 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-07-18 1:20 UTC (permalink / raw)
To: bfoster, kent.overstreet, linux-bcachefs, linux-kernel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 0434dbe32053 Merge tag 'linux_kselftest-next-6.11-rc1' of ..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10fdb731980000
kernel config: https://syzkaller.appspot.com/x/.config?x=4b8bd5292e033239
dashboard link: https://syzkaller.appspot.com/bug?extid=1a11884d9c9f1353942d
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=122c7efd980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14a7a5e9980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3766752b5090/disk-0434dbe3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e3608abc3f91/vmlinux-0434dbe3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c133560ad498/bzImage-0434dbe3.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2eb208d556bd/mount_0.gz
The issue was bisected to:
commit 03ef80b469d5d83530ce1ce15be78a40e5300f9b
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Sat Sep 23 22:41:51 2023 +0000
bcachefs: Ignore unknown mount options
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=152480b1980000
final oops: https://syzkaller.appspot.com/x/report.txt?x=172480b1980000
console output: https://syzkaller.appspot.com/x/log.txt?x=132480b1980000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1a11884d9c9f1353942d@syzkaller.appspotmail.com
Fixes: 03ef80b469d5 ("bcachefs: Ignore unknown mount options")
loop0: detected capacity change from 0 to 32768
BUG: unable to handle page fault for address: ffffed110a6e4959
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffee067 P4D 23ffee067 PUD 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 PID: 5092 Comm: syz-executor341 Not tainted 6.10.0-syzkaller-02711-g0434dbe32053 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:bch2_dirent_name_bytes fs/bcachefs/dirent.c:23 [inline]
RIP: 0010:bch2_dirent_get_name fs/bcachefs/dirent.c:37 [inline]
RIP: 0010:bch2_dirent_to_text+0xba/0x2f0 fs/bcachefs/dirent.c:153
Code: bf 09 00 00 00 48 89 de e8 03 ce 78 fd 48 83 fb 08 77 09 e8 18 c9 78 fd 31 d2 eb 53 8d 45 fa 49 8d 1c c4 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 e7 4e db fd c1 e5 03 48 8b 1b 31
RSP: 0018:ffffc90002d3ed90 EFLAGS: 00010a06
RAX: 1ffff1110a6e4959 RBX: ffff888853724ac8 RCX: ffff888026263c00
RDX: 0000000000000000 RSI: ffffffffffffffd8 RDI: 0000000000000009
RBP: 0000000000000000 R08: ffffffff841d92fd R09: 0000000000000020
R10: dffffc0000000000 R11: ffffffff841d9260 R12: ffff888053724af8
R13: dffffc0000000000 R14: ffffc90002d3f540 R15: ffff888053724ad2
FS: 0000555572e1d380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed110a6e4959 CR3: 00000000795e8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
journal_entry_btree_keys_to_text+0x1d7/0x390 fs/bcachefs/journal_io.c:439
bch2_sb_clean_to_text+0x138/0x240 fs/bcachefs/sb-clean.c:313
bch2_sb_field_validate+0x201/0x2e0 fs/bcachefs/super-io.c:1229
bch2_sb_validate+0xa69/0xe00 fs/bcachefs/super-io.c:468
__bch2_read_super+0xc1b/0x1370 fs/bcachefs/super-io.c:823
bch2_fs_open+0x246/0xdf0 fs/bcachefs/super.c:2082
bch2_mount+0x6b0/0x13c0 fs/bcachefs/fs.c:1931
legacy_get_tree+0xee/0x190 fs/fs_context.c:662
vfs_get_tree+0x90/0x2a0 fs/super.c:1789
do_new_mount+0x2be/0xb40 fs/namespace.c:3472
do_mount fs/namespace.c:3812 [inline]
__do_sys_mount fs/namespace.c:4020 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f28ce8ed0aa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe11d678d8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe11d678f0 RCX: 00007f28ce8ed0aa
RDX: 0000000020011a00 RSI: 0000000020000000 RDI: 00007ffe11d678f0
RBP: 0000000000000004 R08: 00007ffe11d67930 R09: 00000000000119f7
R10: 0000000001200014 R11: 0000000000000282 R12: 0000000001200014
R13: 00007ffe11d67930 R14: 0000000000000003 R15: 0000000001000000
</TASK>
Modules linked in:
CR2: ffffed110a6e4959
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_dirent_name_bytes fs/bcachefs/dirent.c:23 [inline]
RIP: 0010:bch2_dirent_get_name fs/bcachefs/dirent.c:37 [inline]
RIP: 0010:bch2_dirent_to_text+0xba/0x2f0 fs/bcachefs/dirent.c:153
Code: bf 09 00 00 00 48 89 de e8 03 ce 78 fd 48 83 fb 08 77 09 e8 18 c9 78 fd 31 d2 eb 53 8d 45 fa 49 8d 1c c4 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 e7 4e db fd c1 e5 03 48 8b 1b 31
RSP: 0018:ffffc90002d3ed90 EFLAGS: 00010a06
RAX: 1ffff1110a6e4959 RBX: ffff888853724ac8 RCX: ffff888026263c00
RDX: 0000000000000000 RSI: ffffffffffffffd8 RDI: 0000000000000009
RBP: 0000000000000000 R08: ffffffff841d92fd R09: 0000000000000020
R10: dffffc0000000000 R11: ffffffff841d9260 R12: ffff888053724af8
R13: dffffc0000000000 R14: ffffc90002d3f540 R15: ffff888053724ad2
FS: 0000555572e1d380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed110a6e4959 CR3: 00000000795e8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: bf 09 00 00 00 mov $0x9,%edi
5: 48 89 de mov %rbx,%rsi
8: e8 03 ce 78 fd call 0xfd78ce10
d: 48 83 fb 08 cmp $0x8,%rbx
11: 77 09 ja 0x1c
13: e8 18 c9 78 fd call 0xfd78c930
18: 31 d2 xor %edx,%edx
1a: eb 53 jmp 0x6f
1c: 8d 45 fa lea -0x6(%rbp),%eax
1f: 49 8d 1c c4 lea (%r12,%rax,8),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 e7 4e db fd call 0xfddb4f20
39: c1 e5 03 shl $0x3,%ebp
3c: 48 8b 1b mov (%rbx),%rbx
3f: 31 .byte 0x31
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] INFO: task hung in __bch2_fs_stop
@ 2024-06-15 9:58 syzbot
2025-07-23 1:56 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-06-15 9:58 UTC (permalink / raw)
To: bfoster, kent.overstreet, linux-bcachefs, linux-kernel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 83a7eefedc9b Linux 6.10-rc3
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=164ac82e980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c79815c08cc14227
dashboard link: https://syzkaller.appspot.com/bug?extid=6d3e28b33490b3085412
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1653cfba980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1316587a980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b45273014a8f/disk-83a7eefe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94cd5708292e/vmlinux-83a7eefe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a89698812e8b/bzImage-83a7eefe.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/3ef828450a9b/mount_0.gz
The issue was bisected to:
commit 267b801fda10b70eca4001a819fcac07f023df6b
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Mon Dec 4 18:45:33 2023 +0000
bcachefs: BCH_IOCTL_FSCK_ONLINE
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15166a54980000
final oops: https://syzkaller.appspot.com/x/report.txt?x=17166a54980000
console output: https://syzkaller.appspot.com/x/log.txt?x=13166a54980000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6d3e28b33490b3085412@syzkaller.appspotmail.com
Fixes: 267b801fda10 ("bcachefs: BCH_IOCTL_FSCK_ONLINE")
INFO: task syz-executor427:5081 blocked for more than 143 seconds.
Not tainted 6.10.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor427 state:D stack:22048 pid:5081 tgid:5081 ppid:5078 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0x1796/0x49d0 kernel/sched/core.c:6745
__schedule_loop kernel/sched/core.c:6822 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6837
__bch2_fs_stop+0x35b/0x540 fs/bcachefs/super.c:628
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
bch2_kill_sb+0x41/0x50 fs/bcachefs/fs.c:2034
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f70db0df3c7
RSP: 002b:00007ffd58b093d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f70db0df3c7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd58b09490
RBP: 00007ffd58b09490 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffd58b0a4f0
R13: 000055558a2c86c0 R14: 0000000000000019 R15: 431bde82d7b634db
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#0: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614
2 locks held by kworker/u8:7/1105:
1 lock held by klogd/4526:
2 locks held by getty/4836:
#0: ffff88802f6310a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002f162f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2201
1 lock held by syz-executor427/5081:
#0: ffff88807e8180e0 (&type->s_umount_key#44){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88807e8180e0 (&type->s_umount_key#44){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88807e8180e0 (&type->s_umount_key#44){+.+.}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 30 Comm: khungtaskd Not tainted 6.10.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xfde/0x1020 kernel/hung_task.c:379
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1105 Comm: kworker/u8:7 Not tainted 6.10.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:PagePoisoned include/linux/page-flags.h:296 [inline]
RIP: 0010:PageReserved include/linux/page-flags.h:536 [inline]
RIP: 0010:__text_poke+0x187/0xd30 arch/x86/kernel/alternative.c:1864
Code: 00 00 00 00 00 ea ff ff 4c 89 ff e8 13 33 0d 00 49 89 c4 49 c1 ec 06 49 83 e4 c0 49 01 dc 4c 89 e3 48 c1 eb 03 42 80 3c 2b 00 <74> 08 4c 89 e7 e8 ff 88 c3 00 4d 8b 34 24 48 c7 c7 ff ff ff ff 4c
RSP: 0018:ffffc900043f7740 EFLAGS: 00000246
RAX: 0000000001ed289c RBX: 1ffffd400000f690 RCX: ffff888022338000
RDX: 0000000000000000 RSI: 0000000001ed289c RDI: 000000001fffffff
RBP: ffffc900043f7910 R08: ffffffff81424c05 R09: 1ffffffff1f583d5
R10: dffffc0000000000 R11: fffffbfff1f583d6 R12: ffffea000007b480
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffff81ed289c
FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005622c0cea600 CR3: 000000000e132000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
text_poke arch/x86/kernel/alternative.c:1968 [inline]
text_poke_bp_batch+0x8cd/0xb30 arch/x86/kernel/alternative.c:2357
text_poke_flush arch/x86/kernel/alternative.c:2470 [inline]
text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2477
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
static_key_enable_cpuslocked+0x136/0x260 kernel/jump_label.c:205
static_key_enable+0x1a/0x20 kernel/jump_label.c:218
toggle_allocation_gate+0xb5/0x250 mm/kfence/core.c:826
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.167 msecs
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] INFO: task hung in bch2_copygc_stop
@ 2024-05-31 8:43 syzbot
2025-07-23 1:17 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-05-31 8:43 UTC (permalink / raw)
To: bfoster, kent.overstreet, linux-bcachefs, linux-kernel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: e0cce98fe279 Merge tag 'tpmdd-next-6.10-rc2' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1783e2fc980000
kernel config: https://syzkaller.appspot.com/x/.config?x=47d282ddffae809f
dashboard link: https://syzkaller.appspot.com/bug?extid=c6fd966ebbdea1e8ff08
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/830865207351/disk-e0cce98f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2b2afbee0859/vmlinux-e0cce98f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a2eaac9c0eb1/bzImage-e0cce98f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c6fd966ebbdea1e8ff08@syzkaller.appspotmail.com
INFO: task syz-executor.0:28112 blocked for more than 143 seconds.
Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0 state:D stack:20592 pid:28112 tgid:28112 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5408 [inline]
__schedule+0x1796/0x49d0 kernel/sched/core.c:6745
__schedule_loop kernel/sched/core.c:6822 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6837
schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
kthread_stop+0x19e/0x630 kernel/kthread.c:710
bch2_copygc_stop+0x4f/0x150 fs/bcachefs/movinggc.c:399
__bch2_fs_read_only+0x47/0x430 fs/bcachefs/super.c:266
bch2_fs_read_only+0xb52/0x1210 fs/bcachefs/super.c:356
__bch2_fs_stop+0x105/0x540 fs/bcachefs/super.c:613
generic_shutdown_super+0x136/0x2d0 fs/super.c:642
bch2_kill_sb+0x41/0x50 fs/bcachefs/fs.c:2026
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [arm?] [crypto?] [bcachefs?] KASAN: slab-use-after-free Read in neon_poly1305_update
@ 2024-05-17 3:31 syzbot
2025-07-19 22:01 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-05-17 3:31 UTC (permalink / raw)
To: catalin.marinas, davem, herbert, kent.overstreet,
linux-arm-kernel, linux-bcachefs, linux-crypto, linux-kernel,
syzkaller-bugs, will
Hello,
syzbot found the following issue on:
HEAD commit: fda5695d692c Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15d0f600980000
kernel config: https://syzkaller.appspot.com/x/.config?x=95dc1de8407c7270
dashboard link: https://syzkaller.appspot.com/bug?extid=6d3021bf0c4cb4ffac17
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12c834d0980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1776a07c980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/07f3214ff0d9/disk-fda5695d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/70e2e2c864e8/vmlinux-fda5695d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b259942a16dc/Image-fda5695d.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/aade2af8a508/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6d3021bf0c4cb4ffac17@syzkaller.appspotmail.com
bcachefs (loop0): mounting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,nojournal_transaction_names
bcachefs (loop0): recovering from clean shutdown, journal seq 10
==================================================================
BUG: KASAN: slab-use-after-free in neon_poly1305_do_update arch/arm64/crypto/poly1305-glue.c:107 [inline]
BUG: KASAN: slab-use-after-free in neon_poly1305_update+0x2e0/0xb34 arch/arm64/crypto/poly1305-glue.c:119
Read of size 8 at addr ffff0000dd021790 by task syz-executor319/6238
CPU: 0 PID: 6238 Comm: syz-executor319 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x198/0x538 mm/kasan/report.c:488
kasan_report+0xd8/0x138 mm/kasan/report.c:601
kasan_check_range+0x268/0x2a8 mm/kasan/generic.c:189
__asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
neon_poly1305_do_update arch/arm64/crypto/poly1305-glue.c:107 [inline]
neon_poly1305_update+0x2e0/0xb34 arch/arm64/crypto/poly1305-glue.c:119
crypto_shash_update+0x90/0xa8 crypto/shash.c:70
bch2_checksum+0x690/0x770 fs/bcachefs/checksum.c:228
bch2_btree_node_read_done+0xccc/0x45f0 fs/bcachefs/btree_io.c:1096
btree_node_read_work+0x4e8/0xe9c fs/bcachefs/btree_io.c:1324
bch2_btree_node_read+0x210c/0x28e4 fs/bcachefs/btree_io.c:1709
__bch2_btree_root_read fs/bcachefs/btree_io.c:1748 [inline]
bch2_btree_root_read+0x2a8/0x534 fs/bcachefs/btree_io.c:1772
read_btree_roots+0x21c/0x730 fs/bcachefs/recovery.c:457
bch2_fs_recovery+0x2dac/0x4854 fs/bcachefs/recovery.c:785
bch2_fs_start+0x30c/0x53c fs/bcachefs/super.c:1043
bch2_fs_open+0x8b4/0xb64 fs/bcachefs/super.c:2102
bch2_mount+0x558/0xe10 fs/bcachefs/fs.c:1903
legacy_get_tree+0xd4/0x16c fs/fs_context.c:662
vfs_get_tree+0x90/0x288 fs/super.c:1779
do_new_mount+0x278/0x900 fs/namespace.c:3352
path_mount+0x590/0xe04 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount fs/namespace.c:3875 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3875
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Allocated by task 6093:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:68
kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc+0x1dc/0x3c0 mm/slub.c:3852
skb_clone+0x1c8/0x330 net/core/skbuff.c:2063
dev_queue_xmit_nit+0x360/0x9c0 net/core/dev.c:2264
xmit_one net/core/dev.c:3527 [inline]
dev_hard_start_xmit+0x12c/0x938 net/core/dev.c:3547
sch_direct_xmit+0x244/0x57c net/sched/sch_generic.c:343
__dev_xmit_skb net/core/dev.c:3760 [inline]
__dev_queue_xmit+0x148c/0x33fc net/core/dev.c:4307
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
neigh_hh_output include/net/neighbour.h:526 [inline]
neigh_output include/net/neighbour.h:540 [inline]
ip_finish_output2+0xdd8/0x13b4 net/ipv4/ip_output.c:235
__ip_finish_output+0x1b0/0x458
ip_finish_output+0x44/0x2e4 net/ipv4/ip_output.c:323
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip_output+0x1a8/0x21c net/ipv4/ip_output.c:433
dst_output include/net/dst.h:450 [inline]
ip_local_out net/ipv4/ip_output.c:129 [inline]
__ip_queue_xmit+0xe10/0x1874 net/ipv4/ip_output.c:535
ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:549
__tcp_transmit_skb+0x1930/0x34a0 net/ipv4/tcp_output.c:1462
tcp_transmit_skb net/ipv4/tcp_output.c:1480 [inline]
tcp_write_xmit+0x11c0/0x4bac net/ipv4/tcp_output.c:2792
__tcp_push_pending_frames+0x98/0x228 net/ipv4/tcp_output.c:2977
tcp_push+0x454/0x694 net/ipv4/tcp.c:738
tcp_sendmsg_locked+0x34dc/0x3d90 net/ipv4/tcp.c:1310
tcp_sendmsg+0x40/0x64 net/ipv4/tcp.c:1342
inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:851
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
sock_write_iter+0x2d8/0x448 net/socket.c:1160
call_write_iter include/linux/fs.h:2110 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0x968/0xc3c fs/read_write.c:590
ksys_write+0x15c/0x26c fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:652
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Freed by task 6093:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:68
kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:579
poison_slab_object+0x124/0x18c mm/kasan/common.c:240
__kasan_slab_free+0x3c/0x70 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kmem_cache_free+0x168/0x3f0 mm/slub.c:4344
kfree_skbmem+0x15c/0x1ec
__kfree_skb net/core/skbuff.c:1217 [inline]
kfree_skb_reason+0x1cc/0x4a8 net/core/skbuff.c:1252
packet_rcv+0x13c/0x1118 net/packet/af_packet.c:2230
dev_queue_xmit_nit+0x88c/0x9c0 net/core/dev.c:2296
xmit_one net/core/dev.c:3527 [inline]
dev_hard_start_xmit+0x12c/0x938 net/core/dev.c:3547
sch_direct_xmit+0x244/0x57c net/sched/sch_generic.c:343
__dev_xmit_skb net/core/dev.c:3760 [inline]
__dev_queue_xmit+0x148c/0x33fc net/core/dev.c:4307
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
neigh_hh_output include/net/neighbour.h:526 [inline]
neigh_output include/net/neighbour.h:540 [inline]
ip_finish_output2+0xdd8/0x13b4 net/ipv4/ip_output.c:235
__ip_finish_output+0x1b0/0x458
ip_finish_output+0x44/0x2e4 net/ipv4/ip_output.c:323
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip_output+0x1a8/0x21c net/ipv4/ip_output.c:433
dst_output include/net/dst.h:450 [inline]
ip_local_out net/ipv4/ip_output.c:129 [inline]
__ip_queue_xmit+0xe10/0x1874 net/ipv4/ip_output.c:535
ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:549
__tcp_transmit_skb+0x1930/0x34a0 net/ipv4/tcp_output.c:1462
tcp_transmit_skb net/ipv4/tcp_output.c:1480 [inline]
tcp_write_xmit+0x11c0/0x4bac net/ipv4/tcp_output.c:2792
__tcp_push_pending_frames+0x98/0x228 net/ipv4/tcp_output.c:2977
tcp_push+0x454/0x694 net/ipv4/tcp.c:738
tcp_sendmsg_locked+0x34dc/0x3d90 net/ipv4/tcp.c:1310
tcp_sendmsg+0x40/0x64 net/ipv4/tcp.c:1342
inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:851
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
sock_write_iter+0x2d8/0x448 net/socket.c:1160
call_write_iter include/linux/fs.h:2110 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0x968/0xc3c fs/read_write.c:590
ksys_write+0x15c/0x26c fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:652
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
The buggy address belongs to the object at ffff0000dd021780
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 16 bytes inside of
freed 240-byte region [ffff0000dd021780, ffff0000dd021870)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d021
flags: 0x5ffc00000000800(slab|node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 05ffc00000000800 ffff0000c1bc4780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000dd021680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000dd021700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
>ffff0000dd021780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000dd021800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff0000dd021880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
==================================================================
bcachefs (loop0): error validating btree node on loop0 at btree lru level 0/0
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq a11787a6b9c68820 written 16 min_key POS_MIN durability: 1 ptr: 0:28:0 gen 0
node offset 8/16 bset u64s 49390: checksum error, type chacha20_poly1305_128: got 5e7d73dbe54d11175c32a6907d11332e should be 7ecf2f3506fda339523b45cdbfcbcdbd, shutting down
bcachefs (loop0): inconsistency detected - emergency read only at journal seq 10
bcachefs (loop0): flagging btree lru lost data
error reading btree root lru l=0: btree_node_read_error, shutting down
bcachefs (loop0): bch2_fs_recovery(): error fsck_errors_not_fixed
bcachefs (loop0): bch2_fs_start(): error starting filesystem fsck_errors_not_fixed
bcachefs (loop0): shutting down
bcachefs (loop0): shutdown complete
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] [bcachefs?] WARNING in bch2_printbuf_make_room
@ 2024-05-14 10:38 syzbot
2025-07-19 23:27 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-05-14 10:38 UTC (permalink / raw)
To: bfoster, kent.overstreet, linux-bcachefs, linux-kernel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: cf87f46fd34d Merge tag 'drm-fixes-2024-05-11' of https://g..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=11e4d598980000
kernel config: https://syzkaller.appspot.com/x/.config?x=7144b4fe7fbf5900
dashboard link: https://syzkaller.appspot.com/bug?extid=52eec578b7504cf32002
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=153d4878980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12813878980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f9ed1ac24b43/disk-cf87f46f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4934308925bc/vmlinux-cf87f46f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e19a148ec56c/bzImage-cf87f46f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6df3bd28499c/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52eec578b7504cf32002@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5075 at mm/page_alloc.c:4551 __alloc_pages+0x1fce/0x2460 mm/page_alloc.c:4551
Modules linked in:
CPU: 1 PID: 5075 Comm: syz-executor362 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:__alloc_pages+0x1fce/0x2460 mm/page_alloc.c:4551
Code: ef e8 36 8e 0b 00 e9 ef f2 ff ff e8 2c 8e 0b 00 e9 1b f3 ff ff 4c 89 f7 e8 1f 8e 0b 00 e9 f6 f2 ff ff c6 05 44 6a cb 0d 01 90 <0f> 0b 90 e9 81 e4 ff ff 49 8d bc 24 40 09 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc9000314eb68 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000800000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040cc0
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000040cc0
R13: 1ffff92000629d81 R14: 0000000000000cc0 R15: 00000000ffffffff
FS: 000055555685a380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e69851e000 CR3: 00000000662c8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
__kmalloc_large_node+0x7f/0x1a0 mm/slub.c:3917
__do_kmalloc_node mm/slub.c:3960 [inline]
__kmalloc_node_track_caller.cold+0x5/0x5f mm/slub.c:3992
__do_krealloc mm/slab_common.c:1192 [inline]
krealloc+0x5d/0x100 mm/slab_common.c:1225
bch2_printbuf_make_room+0x195/0x2a0 fs/bcachefs/printbuf.c:38
bch2_prt_printf+0x223/0x3d0 fs/bcachefs/printbuf.c:78
journal_entry_btree_keys_to_text+0x11b/0x250 fs/bcachefs/journal_io.c:409
bch2_journal_entry_to_text+0x119/0x170 fs/bcachefs/journal_io.c:835
bch2_sb_clean_to_text+0x109/0x210 fs/bcachefs/sb-clean.c:316
__bch2_sb_field_to_text+0x123/0x1e0 fs/bcachefs/super-io.c:1245
bch2_sb_field_validate+0x248/0x2d0 fs/bcachefs/super-io.c:1228
bch2_sb_validate.isra.0+0x6d8/0xce0 fs/bcachefs/super-io.c:468
__bch2_read_super+0x93c/0x12a0 fs/bcachefs/super-io.c:822
bch2_fs_open+0x3e5/0x1110 fs/bcachefs/super.c:2052
bch2_mount+0xdcc/0x1130 fs/bcachefs/fs.c:1903
legacy_get_tree+0x109/0x220 fs/fs_context.c:662
vfs_get_tree+0x8f/0x380 fs/super.c:1779
do_new_mount fs/namespace.c:3352 [inline]
path_mount+0x14e6/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount fs/namespace.c:3875 [inline]
__x64_sys_mount+0x297/0x320 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa562243dea
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc4bfcc738 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc4bfcc750 RCX: 00007fa562243dea
RDX: 0000000020011a00 RSI: 00000000200000c0 RDI: 00007ffc4bfcc750
RBP: 0000000000000004 R08: 00007ffc4bfcc790 R09: 00000000000119fd
R10: 0000000001200014 R11: 0000000000000282 R12: 0000000001200014
R13: 00007ffc4bfcc790 R14: 0000000000000003 R15: 0000000001000000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] BUG: Bad rss-counter state (5)
@ 2024-05-13 10:19 syzbot
2025-07-22 18:31 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-05-13 10:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: cf87f46fd34d Merge tag 'drm-fixes-2024-05-11' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17e54084980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6d14c12b661fb43
dashboard link: https://syzkaller.appspot.com/bug?extid=f2bbbb592debc978d46d
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1aa5ad92dfce/disk-cf87f46f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/67c336f7c1c7/vmlinux-cf87f46f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bb5b717bd2b8/bzImage-cf87f46f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f2bbbb592debc978d46d@syzkaller.appspotmail.com
BUG: Bad rss-counter state mm:ffff888079dd9300 type:MM_SWAPENTS val:6
loop2: detected capacity change from 0 to 256
exFAT-fs (loop2): failed to load upcase table (idx : 0x00017f3e, chksum : 0x0b83170a, utbl_chksum : 0xe619d30d)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [gfs2?] WARNING in gfs2_ri_update (2)
@ 2024-05-09 14:45 syzbot
2025-09-18 19:46 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-05-09 14:45 UTC (permalink / raw)
To: agruenba, gfs2, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: b9158815de52 Merge tag 'char-misc-6.9-rc7' of git://git.ke..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a4c440980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d2f00edef461175
dashboard link: https://syzkaller.appspot.com/bug?extid=7567dc5c8aa8f68bde74
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14834e4b180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1059c0a8980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/23a6adc6f595/disk-b9158815.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c2b325947833/vmlinux-b9158815.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cd750d88d728/bzImage-b9158815.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/4b403095e3ca/mount_0.gz
Bisection is inconclusive: the issue happens on the oldest tested release.
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13b2a774980000
final oops: https://syzkaller.appspot.com/x/report.txt?x=1072a774980000
console output: https://syzkaller.appspot.com/x/log.txt?x=17b2a774980000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7567dc5c8aa8f68bde74@syzkaller.appspotmail.com
gfs2: fsid=.: Now mounting FS (format 1801)...
gfs2: fsid=..0: journal 0 mapped with 18 extents in 0ms
gfs2: fsid=..0: first mount done, others may mount
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5074 at mm/page_alloc.c:4551 __alloc_pages+0x36a/0x6c0 mm/page_alloc.c:4551
Modules linked in:
CPU: 1 PID: 5074 Comm: syz-executor409 Not tainted 6.9.0-rc6-syzkaller-00290-gb9158815de52 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:__alloc_pages+0x36a/0x6c0 mm/page_alloc.c:4551
Code: a9 00 00 08 00 0f 85 12 01 00 00 44 89 e9 81 e1 7f ff ff ff a9 00 00 04 00 44 0f 45 e9 e9 02 01 00 00 c6 05 28 e5 a7 0d 01 90 <0f> 0b 90 83 fb 0a 0f 86 6c fd ff ff 45 31 ed 48 c7 44 24 20 0e 36
RSP: 0018:ffffc900035f7420 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 000000000000000b RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900035f74a8
RBP: ffffc900035f7530 R08: ffffc900035f74a7 R09: 0000000000000000
R10: ffffc900035f7480 R11: fffff520006bee95 R12: 1ffff920006bee8c
R13: 0000000000040d40 R14: dffffc0000000000 R15: 1ffff920006bee88
FS: 000055557175d380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffacbd3000 CR3: 000000007a07a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
__kmalloc_large_node+0x91/0x1f0 mm/slub.c:3911
__do_kmalloc_node mm/slub.c:3954 [inline]
__kmalloc+0x320/0x4a0 mm/slub.c:3979
kmalloc_array include/linux/slab.h:665 [inline]
kcalloc include/linux/slab.h:696 [inline]
compute_bitstructs fs/gfs2/rgrp.c:766 [inline]
read_rindex_entry fs/gfs2/rgrp.c:931 [inline]
gfs2_ri_update+0x549/0x1830 fs/gfs2/rgrp.c:1001
gfs2_rindex_update+0x304/0x3d0 fs/gfs2/rgrp.c:1051
init_inodes+0x24d/0x320 fs/gfs2/ops_fstype.c:912
gfs2_fill_super+0x1edb/0x26c0 fs/gfs2/ops_fstype.c:1263
get_tree_bdev+0x3f7/0x570 fs/super.c:1614
gfs2_get_tree+0x54/0x220 fs/gfs2/ops_fstype.c:1341
vfs_get_tree+0x90/0x2a0 fs/super.c:1779
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd426e0c93a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffacbd27d8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fffacbd27e0 RCX: 00007fd426e0c93a
RDX: 0000000020000040 RSI: 0000000020000100 RDI: 00007fffacbd27e0
RBP: 0000000000000004 R08: 00007fffacbd2820 R09: 00000000000127be
R10: 0000000000008cd3 R11: 0000000000000282 R12: 00007fffacbd2820
R13: 0000000000000003 R14: 0000000001000000 R15: 0000000000000001
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] WARNING in bchfs_truncate
@ 2024-05-04 7:58 syzbot
2025-07-23 1:21 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-05-04 7:58 UTC (permalink / raw)
To: bfoster, kent.overstreet, linux-bcachefs, linux-fsdevel,
linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 3d25a941ea50 Merge tag 'block-6.9-20240503' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10e71b9b180000
kernel config: https://syzkaller.appspot.com/x/.config?x=3310e643b6ef5d69
dashboard link: https://syzkaller.appspot.com/bug?extid=247ac87eabcb1f8fa990
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a743748c2da4/disk-3d25a941.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9a51bb4cf9ba/vmlinux-3d25a941.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f4a1ba4b268a/bzImage-3d25a941.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+247ac87eabcb1f8fa990@syzkaller.appspotmail.com
------------[ cut here ]------------
truncate spotted in mem i_size < btree i_size: 4 < 65536
WARNING: CPU: 0 PID: 29645 at fs/bcachefs/fs-io.c:434 bchfs_truncate+0x7ad/0xd70 fs/bcachefs/fs-io.c:434
Modules linked in:
CPU: 0 PID: 29645 Comm: syz-executor.3 Not tainted 6.9.0-rc6-syzkaller-00227-g3d25a941ea50 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:bchfs_truncate+0x7ad/0xd70 fs/bcachefs/fs-io.c:434
Code: 24 38 84 c0 0f 85 d3 fc ff ff e8 7e 4b 8e fd c6 05 91 7f 89 0b 01 90 48 c7 c7 80 52 5f 8b 4c 89 ea 4c 89 fe e8 14 b6 50 fd 90 <0f> 0b 90 90 48 b8 00 00 00 00 00 fc ff df 48 8b 54 24 48 48 c1 ea
RSP: 0018:ffffc900032d7758 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888064756cf8 RCX: ffffc9000c7d0000
RDX: 0000000000040000 RSI: ffffffff81503286 RDI: 0000000000000001
RBP: ffffc900032d7920 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000008d6b8 R12: ffff8880647567b0
R13: 0000000000010000 R14: ffffc900032d7a18 R15: 0000000000000004
FS: 00007fb75c3de6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020ee5000 CR3: 000000002ac62000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bch2_setattr+0x1ab/0x250 fs/bcachefs/fs.c:882
notify_change+0x742/0x11c0 fs/attr.c:497
do_truncate+0x15c/0x220 fs/open.c:65
handle_truncate fs/namei.c:3300 [inline]
do_open fs/namei.c:3646 [inline]
path_openat+0x24b9/0x2990 fs/namei.c:3799
do_filp_open+0x1dc/0x430 fs/namei.c:3826
do_sys_openat2+0x17a/0x1e0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_open fs/open.c:1429 [inline]
__se_sys_open fs/open.c:1425 [inline]
__x64_sys_open+0x154/0x1e0 fs/open.c:1425
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb75c87dca9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb75c3de0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fb75c9ac050 RCX: 00007fb75c87dca9
RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000000020000180
RBP: 00007fb75c8c947e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007fb75c9ac050 R15: 00007ffdfe29fbb8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] [bcachefs?] INFO: task hung in __closure_sync
@ 2024-05-03 17:32 syzbot
2025-07-23 1:18 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2024-05-03 17:32 UTC (permalink / raw)
To: bfoster, kent.overstreet, linux-bcachefs, linux-fsdevel,
linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: f03359bca01b Merge tag 'for-6.9-rc6-tag' of git://git.kern..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1298e660980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d2f00edef461175
dashboard link: https://syzkaller.appspot.com/bug?extid=7bf808f7fe4a6549f36e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12a7c31f180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16109450980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e3ee5200440e/disk-f03359bc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c651e70b4ae3/vmlinux-f03359bc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/196f43b316ad/bzImage-f03359bc.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/883314a64ffe/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7bf808f7fe4a6549f36e@syzkaller.appspotmail.com
INFO: task syz-executor334:5078 blocked for more than 143 seconds.
Not tainted 6.9.0-rc6-syzkaller-00131-gf03359bca01b #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor334 state:D stack:15856 pid:5078 tgid:5078 ppid:5075 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0x1796/0x4a00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6838
__closure_sync+0x259/0x2f0 lib/closure.c:135
closure_sync include/linux/closure.h:194 [inline]
__bch2_write+0x5458/0x5bd0 fs/bcachefs/io_write.c:1486
bch2_write+0x947/0x1590 fs/bcachefs/io_write.c:1610
closure_queue include/linux/closure.h:257 [inline]
closure_call include/linux/closure.h:390 [inline]
bch2_dio_write_loop fs/bcachefs/fs-io-direct.c:531 [inline]
bch2_direct_write+0x1a52/0x3050 fs/bcachefs/fs-io-direct.c:652
bch2_write_iter+0x206/0x2840 fs/bcachefs/fs-io-buffered.c:1143
call_write_iter include/linux/fs.h:2110 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa84/0xcb0 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f42713dfdf9
RSP: 002b:00007ffdf34d9c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f42713dfdf9
RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000555500000000 R09: 0000555500000000
R10: 0000555500000000 R11: 0000000000000246 R12: 00000000000f4240
R13: 00007ffdf34d9ec8 R14: 0000000000000001 R15: 00007ffdf34d9c90
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/29:
#0: ffffffff8e334da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8e334da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#0: ffffffff8e334da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614
1 lock held by kworker/u8:3/50:
#0: ffff8880b953e658 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
2 locks held by getty/4827:
#0: ffff88802aba90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002f162f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2201
2 locks held by syz-executor334/5078:
#0: ffff8880730de420 (sb_writers#9){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2855 [inline]
#0: ffff8880730de420 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x233/0xcb0 fs/read_write.c:586
#1: ffff8880779f88b8 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:795 [inline]
#1: ffff8880779f88b8 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: bch2_direct_write+0x243/0x3050 fs/bcachefs/fs-io-direct.c:598
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted 6.9.0-rc6-syzkaller-00131-gf03359bca01b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xfde/0x1020 kernel/hung_task.c:380
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 85+ messages in thread* [syzbot] kernel BUG in hfs_write_inode
@ 2022-11-25 9:45 syzbot
2026-03-09 23:04 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2022-11-25 9:45 UTC (permalink / raw)
To: damien.lemoal, jlayton, linux-fsdevel, linux-kernel,
syzkaller-bugs, willy
Hello,
syzbot found the following issue on:
HEAD commit: 65762d97e6fa Merge branch 'for-next/perf' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=14e324e3880000
kernel config: https://syzkaller.appspot.com/x/.config?x=56d0c7c3a2304e8f
dashboard link: https://syzkaller.appspot.com/bug?extid=97e301b4b82ae803d21b
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10983553880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13315ebb880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/52f702197b30/disk-65762d97.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72189c2789ce/vmlinux-65762d97.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ec0349196c98/Image-65762d97.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6bfea2266b7f/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+97e301b4b82ae803d21b@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/hfs/inode.c:446!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 347 Comm: kworker/u4:3 Not tainted 6.1.0-rc6-syzkaller-32653-g65762d97e6fa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Workqueue: writeback wb_workfn (flush-7:0)
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfs_write_inode+0x44c/0x450 fs/hfs/inode.c:446
lr : hfs_write_inode+0x44c/0x450 fs/hfs/inode.c:446
sp : ffff800012f9b960
x29: ffff800012f9ba10 x28: ffff0000cb9013e0 x27: ffff0000cb901358
x26: 0000000000000021 x25: 0000000000000007 x24: ffff0000cb9013e0
x23: 0000000000000003 x22: 0000000000000000 x21: ffff800012f9b9a0
x20: 0000000000000000 x19: ffff0000cb901358 x18: 00000000000000c0
x17: ffff80000dda8198 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000004 x12: ffff80000d51b008
x11: ff80800008903460 x10: 0000000000000000 x9 : ffff800008903460
x8 : ffff0000c4048000 x7 : ffff80000862d114 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000001 x1 : ffff80000d51afe0 x0 : 0000000000000000
Call trace:
hfs_write_inode+0x44c/0x450 fs/hfs/inode.c:446
write_inode fs/fs-writeback.c:1440 [inline]
__writeback_single_inode+0x240/0x2e4 fs/fs-writeback.c:1652
writeback_sb_inodes+0x3e4/0x85c fs/fs-writeback.c:1870
wb_writeback+0x198/0x328 fs/fs-writeback.c:2044
wb_do_writeback+0xc8/0x384 fs/fs-writeback.c:2187
wb_workfn+0x70/0x15c fs/fs-writeback.c:2227
process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
worker_thread+0x340/0x610 kernel/workqueue.c:2436
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
Code: d4210000 17ffff98 94ddff99 97e6893f (d4210000)
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 85+ messages in thread
* [syzbot] UBSAN: shift-out-of-bounds in minix_statfs
@ 2021-12-13 7:17 syzbot
2025-11-17 18:53 ` Forwarded: syzbot
0 siblings, 1 reply; 85+ messages in thread
From: syzbot @ 2021-12-13 7:17 UTC (permalink / raw)
To: akpm, christian.brauner, gregkh, jack, jamorris, linux-kernel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: b8a98b6bf66a Merge tag 'pci-v5.16-fixes-2' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1342c069b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=221ffc09e39ebbd1
dashboard link: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15e8a551b00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=176da9b9b00000
Bisection is inconclusive: the issue happens on the oldest tested release.
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17e8a7bdb00000
final oops: https://syzkaller.appspot.com/x/report.txt?x=1418a7bdb00000
console output: https://syzkaller.appspot.com/x/log.txt?x=1018a7bdb00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 272
================================================================================
UBSAN: shift-out-of-bounds in fs/minix/inode.c:380:57
shift exponent 65510 is too large for 64-bit type 'long unsigned int'
CPU: 0 PID: 3601 Comm: syz-executor657 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:330
minix_statfs.cold+0x17/0x1c fs/minix/inode.c:380
statfs_by_dentry+0x133/0x210 fs/statfs.c:66
vfs_statfs fs/statfs.c:90 [inline]
fd_statfs+0x66/0x100 fs/statfs.c:120
__do_sys_fstatfs+0x7a/0xf0 fs/statfs.c:216
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f33e4f00e09
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeedacabd8 EFLAGS: 00000246 ORIG_RAX: 000000000000008a
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f33e4f00e09
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007f33e4ec06a0 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffeedacaa90 R11: 0000000000000246 R12: 00007f33e4ec0730
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
================================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 85+ messages in thread
* Forwarded:
2021-12-13 7:17 [syzbot] UBSAN: shift-out-of-bounds in minix_statfs syzbot
@ 2025-11-17 18:53 ` syzbot
0 siblings, 0 replies; 85+ messages in thread
From: syzbot @ 2025-11-17 18:53 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/inode.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 7897f5123b3d..bee191c50010 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -171,7 +171,15 @@ static bool minix_check_superblock(struct super_block *sb)
{
struct minix_sb_info *sbi = minix_sb(sb);
- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+ if (sbi->s_log_zone_size != 0) {
+ printk("minix-fs error: zone size must equal block size. "
+ "s_log_zone_size > 0 is not supported.\n");
+ return false;
+ }
+
+ if (sbi->s_imap_blocks < 1 || sbi->s_zmap_blocks < 1 ||
+ sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
+ sbi->s_firstdatazone >= sbi->s_nzones)
return false;
/*
--
2.51.2
^ permalink raw reply related [flat|nested] 85+ messages in thread
end of thread, other threads:[~2026-03-15 13:58 UTC | newest]
Thread overview: 85+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-07 17:05 [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
2025-09-17 10:45 ` Forwarded: syzbot
2025-09-17 13:13 ` Forwarded: Re: [syzbot] [net?] [nfc?] KMSAN: uninit-value in nci_dev_up (2) syzbot
2025-09-18 16:41 ` syzbot
2025-09-25 9:11 ` syzbot
2026-02-18 8:46 ` Forwarded: Re: [PATCH net v6] net: nfc: nci: Fix parameter validation for packet data syzbot
-- strict thread matches above, loose matches on Subject: below --
2025-12-07 6:24 [syzbot] [block?] kernel BUG in bio_chain syzbot
2025-12-12 12:17 ` Forwarded: syzbot
2025-11-13 4:38 [syzbot] [input?] [usb?] memory leak in dualshock4_get_calibration_data syzbot
2025-11-15 1:12 ` Forwarded: syzbot
2025-11-15 1:44 ` Forwarded: syzbot
2025-11-13 4:26 [syzbot] [kernel?] memory leak in do_timer_create syzbot
2025-11-14 1:20 ` Forwarded: syzbot
2025-11-14 3:54 ` Forwarded: syzbot
2025-11-14 4:17 ` Forwarded: syzbot
2025-11-04 9:17 [syzbot] linux-next build error (24) syzbot
2025-12-17 13:51 ` Forwarded: syzbot
2025-11-02 23:48 [syzbot] [nbd?] KASAN: slab-use-after-free Write in recv_work (3) syzbot
2025-11-05 14:40 ` Forwarded: syzbot
2025-10-29 0:12 [syzbot] [ntfs3?] WARNING in ntfs_fill_super (2) syzbot
2025-11-02 16:40 ` Forwarded: syzbot
2025-11-03 13:28 ` Forwarded: syzbot
2025-10-24 23:10 [syzbot] [jfs?] general protection fault in inode_set_ctime_current syzbot
2025-10-27 23:06 ` Forwarded: syzbot
2025-10-28 17:25 ` Forwarded: syzbot
2025-10-28 18:02 ` Forwarded: Al Viro
2025-10-28 20:53 ` Forwarded: syzbot
2025-10-23 5:35 [syzbot] [hfs?] kernel BUG in hfs_new_inode syzbot
2025-11-02 18:07 ` Forwarded: syzbot
2025-11-02 19:22 ` Forwarded: syzbot
2025-11-03 12:27 ` Forwarded: syzbot
2025-10-17 5:53 [syzbot] [net?] kernel BUG in set_ipsecrequest syzbot
2025-10-20 11:19 ` Forwarded: syzbot
2025-10-05 23:30 [syzbot] [ntfs3?] WARNING in indx_insert_into_buffer (3) syzbot
2025-10-07 21:52 ` Forwarded: syzbot
2025-09-17 22:55 [syzbot] [ntfs3?] KMSAN: uninit-value in ntfs_read_hdr (3) syzbot
2025-10-26 15:54 ` Forwarded: syzbot
2025-09-17 22:54 [syzbot] [bfs?] INFO: task hung in bfs_lookup (6) syzbot
2025-10-20 18:09 ` Forwarded: syzbot
2025-09-03 17:36 [syzbot] [kernel?] KASAN: slab-out-of-bounds Read in change_page_attr_set_clr syzbot
2025-09-29 7:50 ` Forwarded: syzbot
2025-08-16 3:08 [syzbot] [usb?] UBSAN: shift-out-of-bounds in ax88772_bind syzbot
2025-08-17 19:42 ` Forwarded: syzbot
2025-08-16 3:08 [syzbot] [overlayfs?] WARNING in shmem_unlink syzbot
2025-08-17 19:52 ` Forwarded: syzbot
2025-08-13 8:00 [syzbot] [sound?] linux-next test error: general protection fault in snd_seq_oss_midi_check_new_port syzbot
2025-09-01 8:48 ` Forwarded: syzbot
2025-08-04 7:18 [syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_accounting_validate syzbot
2025-08-04 22:56 ` Forwarded: syzbot
2025-08-01 7:54 [syzbot] [dri?] upstream test error: WARNING in __ww_mutex_wound syzbot
2025-09-01 8:51 ` Forwarded: syzbot
2025-07-31 9:11 [syzbot] [bcachefs?] kernel BUG in bch2_btree_repair_topology_recurse syzbot
2025-08-01 23:03 ` Forwarded: syzbot
2025-07-30 21:21 [syzbot] [bcachefs?] kernel panic: in transaction restart: transaction_restart_relock, last restarted by syzbot
2025-08-03 18:30 ` Forwarded: syzbot
2025-07-17 19:14 [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea syzbot
2025-07-19 7:57 ` Forwarded: syzbot
2025-07-20 6:54 ` Forwarded: syzbot
2025-07-20 7:29 ` Forwarded: syzbot
2025-07-14 17:53 [syzbot] [gfs2?] UBSAN: shift-out-of-bounds in gfs2_dir_read (2) syzbot
2025-07-15 14:15 ` Forwarded: syzbot
2025-07-15 14:29 ` Forwarded: syzbot
2025-07-16 6:28 ` Forwarded: syzbot
2025-07-14 17:09 [syzbot] [bluetooth?] [bcachefs?] KASAN: slab-use-after-free Read in hci_uart_write_work syzbot
2025-07-20 17:34 ` Forwarded: syzbot
2025-07-06 21:30 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in __bch2_alloc_to_v4 syzbot
2025-07-19 22:04 ` Forwarded: syzbot
2025-07-01 12:30 [syzbot] [fs?] linux-next test error: WARNING: suspicious RCU usage in proc_sys_compare syzbot
2025-09-01 8:49 ` Forwarded: syzbot
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-10-13 13:38 ` Forwarded: syzbot
2025-10-14 15:24 ` Forwarded: syzbot
2025-11-02 14:41 ` Forwarded: syzbot
2025-11-02 14:56 ` Forwarded: syzbot
2025-11-02 15:50 ` Forwarded: syzbot
2025-11-02 16:58 ` Forwarded: syzbot
2025-06-10 19:15 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in bch2_sb_members_v1_to_text syzbot
2025-07-20 4:06 ` Forwarded: syzbot
2025-05-31 18:28 [syzbot] [bcachefs?] WARNING in bch2_fs_journal_start syzbot
2025-07-20 17:30 ` Forwarded: syzbot
2025-05-24 1:52 [syzbot] [block?] [bcachefs?] kernel BUG in blk_mq_end_request syzbot
2025-07-20 14:44 ` Forwarded: syzbot
2025-05-12 20:55 [syzbot] [bcachefs?] possible deadlock in __bch2_folio_reservation_get (2) syzbot
2025-07-22 18:22 ` Forwarded: syzbot
2025-05-11 12:57 [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_checksum syzbot
2025-07-20 14:55 ` Forwarded: syzbot
2025-05-09 4:43 [syzbot] [jfs?] WARNING in jfs_rename syzbot
2025-10-12 16:19 ` Forwarded: syzbot
2025-10-12 17:45 ` Forwarded: syzbot
2025-04-19 8:36 [syzbot] [block?] [bcachefs?] kernel panic: KASAN: panic_on_warn set syzbot
2025-07-22 17:56 ` Forwarded: syzbot
2025-04-16 17:47 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_alloc_sectors_start_trans (2) syzbot
2025-07-23 10:59 ` Forwarded: syzbot
2025-03-30 8:27 [syzbot] [afs?] WARNING: ODEBUG bug in delete_node (3) syzbot
2025-07-24 15:32 ` Forwarded: syzbot
2025-03-25 5:16 [syzbot] [bcachefs?] INFO: task hung in __bch2_fsck_err syzbot
2025-07-20 14:42 ` Forwarded: syzbot
2025-03-16 18:05 [syzbot] [mm?] [bcachefs?] general protection fault in xas_create syzbot
2025-07-20 4:03 ` Forwarded: syzbot
2025-02-14 19:59 [syzbot] [mm?] [bcachefs?] KASAN: slab-out-of-bounds Read in folio_try_get syzbot
2025-07-20 4:04 ` Forwarded: syzbot
2025-02-12 11:52 [syzbot] [bcachefs?] kernel BUG in bch2_journal_keys_peek_max syzbot
2025-07-21 17:37 ` Forwarded: syzbot
2025-02-06 17:01 [syzbot] [mm?] [bcachefs?] UBSAN: shift-out-of-bounds in xas_reload syzbot
2025-07-20 4:05 ` Forwarded: syzbot
2025-02-04 14:07 [syzbot] [net?] general protection fault in ip6_pol_route (3) syzbot
2025-07-20 4:02 ` Forwarded: syzbot
2025-01-20 2:27 [syzbot] [bcachefs?] possible deadlock in bch2_trans_begin syzbot
2025-07-22 18:23 ` Forwarded: syzbot
2025-01-08 12:17 [syzbot] [fs?] WARNING in minix_rmdir syzbot
2025-10-14 13:36 ` Forwarded: syzbot
2025-11-02 12:47 ` Forwarded: syzbot
2024-11-29 12:12 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_peek_slot syzbot
2025-07-19 22:03 ` Forwarded: syzbot
2024-11-29 8:43 [syzbot] [bcachefs?] general protection fault in bch2_prt_vprintf syzbot
2025-07-22 16:18 ` Forwarded: syzbot
2024-11-25 13:27 [syzbot] [bcachefs?] KASAN: use-after-free Read in bch2_btree_node_read_done syzbot
2025-07-20 14:54 ` Forwarded: syzbot
2024-11-21 15:03 [syzbot] [kvm?] WARNING: locking bug in kvm_xen_set_evtchn_fast syzbot
2026-03-15 13:58 ` Forwarded: syzbot
2024-09-29 7:31 [syzbot] [bcachefs?] possible deadlock in bch2_symlink syzbot
2025-08-04 23:12 ` Forwarded: syzbot
2024-07-18 1:20 [syzbot] [bcachefs?] BUG: unable to handle kernel paging request in bch2_dirent_to_text syzbot
2025-07-21 17:30 ` Forwarded: syzbot
2024-06-15 9:58 [syzbot] [bcachefs?] INFO: task hung in __bch2_fs_stop syzbot
2025-07-23 1:56 ` Forwarded: syzbot
2024-05-31 8:43 [syzbot] [bcachefs?] INFO: task hung in bch2_copygc_stop syzbot
2025-07-23 1:17 ` Forwarded: syzbot
2024-05-17 3:31 [syzbot] [arm?] [crypto?] [bcachefs?] KASAN: slab-use-after-free Read in neon_poly1305_update syzbot
2025-07-19 22:01 ` Forwarded: syzbot
2024-05-14 10:38 [syzbot] [bcachefs?] WARNING in bch2_printbuf_make_room syzbot
2025-07-19 23:27 ` Forwarded: syzbot
2024-05-13 10:19 [syzbot] BUG: Bad rss-counter state (5) syzbot
2025-07-22 18:31 ` Forwarded: syzbot
2024-05-09 14:45 [syzbot] [gfs2?] WARNING in gfs2_ri_update (2) syzbot
2025-09-18 19:46 ` Forwarded: syzbot
2024-05-04 7:58 [syzbot] [bcachefs?] WARNING in bchfs_truncate syzbot
2025-07-23 1:21 ` Forwarded: syzbot
2024-05-03 17:32 [syzbot] [bcachefs?] INFO: task hung in __closure_sync syzbot
2025-07-23 1:18 ` Forwarded: syzbot
2022-11-25 9:45 [syzbot] kernel BUG in hfs_write_inode syzbot
2026-03-09 23:04 ` Forwarded: syzbot
2021-12-13 7:17 [syzbot] UBSAN: shift-out-of-bounds in minix_statfs syzbot
2025-11-17 18:53 ` Forwarded: syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox