* [syzbot] [netfs?] WARNING in netfs_writepages (3)
@ 2026-07-06 21:44 syzbot
2026-07-07 5:34 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2026-07-06 21:44 UTC (permalink / raw)
To: dhowells, linux-fsdevel, linux-kernel, netfs, pc, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 7404ce516372 Merge tag 's390-7.2-3' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=119f1661580000
kernel config: https://syzkaller.appspot.com/x/.config?x=48ef5c5c0f192153
dashboard link: https://syzkaller.appspot.com/bug?extid=0da43efa72f88bd3a8af
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1727ebde580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=172dbec1580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-7404ce51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e63433d84892/vmlinux-7404ce51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7542fae0615e/bzImage-7404ce51.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fe029a25fac R14: 00007fe029a25fa0 R15: 00007fe029a25fa0
</TASK>
------------[ cut here ]------------
folio != NULL
WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919
Modules linked in:
CPU: 3 UID: 0 PID: 5919 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603
Code: 48 89 df e8 3f 8b 7b ff 48 8b 4c 24 08 48 89 da 4c 89 e6 4c 89 f7 e8 ec 34 7f ff 48 85 c0 0f 84 c1 fe ff ff e8 0e c7 3d ff 90 <0f> 0b 90 e9 b3 fe ff ff e8 00 c7 3d ff 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000415f178 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffea00014f2580 RCX: ffffffff824b4bda
RDX: ffff88802bcea540 RSI: ffffffff82cc0992 RDI: ffff88802bcea540
RBP: fffffffffffffff4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc9000415f348
R13: ffff888046848bc0 R14: ffff888046848dd8 R15: dffffc0000000000
FS: 0000555567857500(0000) GS:ffff8880d60ec000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002901 CR3: 0000000025ac6000 CR4: 0000000000352ef0
Call Trace:
<TASK>
do_writepages+0x278/0x600 mm/page-writeback.c:2571
filemap_writeback+0x22d/0x2e0 mm/filemap.c:387
v9fs_mmap_vm_close fs/9p/vfs_file.c:496 [inline]
v9fs_mmap_vm_close+0x137/0x1e0 fs/9p/vfs_file.c:489
vma_close mm/internal.h:190 [inline]
vms_clean_up_area mm/vma.c:1318 [inline]
__mmap_setup mm/vma.c:2476 [inline]
__mmap_region+0x890/0x2db0 mm/vma.c:2756
mmap_region+0x527/0x620 mm/vma.c:2860
do_mmap+0xc63/0x12f0 mm/mmap.c:560
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x3cb/0x610 mm/mmap.c:606
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe02979de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff3ad0a858 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fe029a25fa0 RCX: 00007fe02979de59
RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000200000000000
RBP: 00007fff3ad0a8c0 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fe029a25fac R14: 00007fe029a25fa0 R15: 00007fe029a25fa0
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [overlayfs?] [ext4?] possible deadlock in lock_two_nondirectories (2)
@ 2026-06-04 21:33 syzbot
2026-06-08 15:46 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2026-06-04 21:33 UTC (permalink / raw)
To: amir73il, linux-ext4, linux-kernel, linux-unionfs, miklos,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: ba3e43a9e601 Merge tag 'soc-fixes-7.1-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1033aa56580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd38685893011045
dashboard link: https://syzkaller.appspot.com/bug?extid=ad6118a7584b607c67f2
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17e2f3ec580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=174c2a66580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8759ddf1bfa7/disk-ba3e43a9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e2f0e563c705/vmlinux-ba3e43a9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b40bdb37a0d7/bzImage-ba3e43a9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/4074e1f6d9f8/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1103db7e580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ad6118a7584b607c67f2@syzkaller.appspotmail.com
EXT4-fs: Ignoring removed bh option
EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.22/5968 is trying to acquire lock:
ffff88805aab44a0 (&ovl_i_mutex_key[depth]){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1029 [inline]
ffff88805aab44a0 (&ovl_i_mutex_key[depth]){+.+.}-{4:4}, at: lock_two_nondirectories+0xe7/0x180 fs/inode.c:1254
but task is already holding lock:
ffff88803ea9c480 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write_file+0x63/0x210 fs/namespace.c:537
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (sb_writers#4){.+.+}-{0:0}:
percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline]
percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline]
__sb_start_write include/linux/fs/super.h:19 [inline]
sb_start_write+0x4d/0x1c0 include/linux/fs/super.h:125
file_start_write include/linux/fs.h:2724 [inline]
vfs_iter_write+0x1f8/0x610 fs/read_write.c:982
do_backing_file_write_iter fs/backing-file.c:226 [inline]
backing_file_write_iter+0x5e7/0x950 fs/backing-file.c:274
ovl_write_iter+0x2fd/0x3d0 fs/overlayfs/file.c:370
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:688
ksys_pwrite64 fs/read_write.c:795 [inline]
__do_sys_pwrite64 fs/read_write.c:803 [inline]
__se_sys_pwrite64 fs/read_write.c:800 [inline]
__x64_sys_pwrite64+0x19c/0x230 fs/read_write.c:800
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ovl_i_mutex_key[depth]){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
down_write+0x3a/0x50 kernel/locking/rwsem.c:1625
inode_lock include/linux/fs.h:1029 [inline]
lock_two_nondirectories+0xe7/0x180 fs/inode.c:1254
ext4_move_extents+0x20f/0x3950 fs/ext4/move_extent.c:589
__ext4_ioctl fs/ext4/ioctl.c:1657 [inline]
ext4_ioctl+0x3092/0x4b40 fs/ext4/ioctl.c:1922
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(sb_writers#4);
lock(&ovl_i_mutex_key[depth]);
lock(sb_writers#4);
lock(&ovl_i_mutex_key[depth]);
*** DEADLOCK ***
1 lock held by syz.0.22/5968:
#0: ffff88803ea9c480 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write_file+0x63/0x210 fs/namespace.c:537
stack backtrace:
CPU: 0 UID: 0 PID: 5968 Comm: syz.0.22 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
down_write+0x3a/0x50 kernel/locking/rwsem.c:1625
inode_lock include/linux/fs.h:1029 [inline]
lock_two_nondirectories+0xe7/0x180 fs/inode.c:1254
ext4_move_extents+0x20f/0x3950 fs/ext4/move_extent.c:589
__ext4_ioctl fs/ext4/ioctl.c:1657 [inline]
ext4_ioctl+0x3092/0x4b40 fs/ext4/ioctl.c:1922
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb592a3ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc3443e838 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fb592cb5fa0 RCX: 00007fb592a3ce59
RDX: 0000200000000040 RSI: 00000000c028660f RDI: 0000000000000005
RBP: 00007fb592ad2d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb592cb5fac R14: 00007fb592cb5fa0 R15: 00007fb592cb5fa0
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* [syzbot] [block?] general protection fault in ublk_queue_rq
@ 2026-05-31 1:20 syzbot
2026-06-01 18:58 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2026-05-31 1:20 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs, tom.leiming
Hello,
syzbot found the following issue on:
HEAD commit: 4b4362973b6f Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=165f17a6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f52fb4a6d220c448
dashboard link: https://syzkaller.appspot.com/bug?extid=415b9ec753cd2a196087
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15a33a0e580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=115f17a6580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cdc9dd8cab69/disk-4b436297.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bb74747f86d/vmlinux-4b436297.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a20d7153214f/Image-4b436297.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+415b9ec753cd2a196087@syzkaller.appspotmail.com
Unable to handle kernel paging request at virtual address dfff800000000003
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000003] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4778 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: events ublk_partition_scan_work
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ublk_queue_cmd drivers/block/ublk_drv.c:2095 [inline]
pc : ublk_queue_rq+0x114/0x1dc drivers/block/ublk_drv.c:2223
lr : ublk_queue_cmd drivers/block/ublk_drv.c:2092 [inline]
lr : ublk_queue_rq+0xec/0x1dc drivers/block/ublk_drv.c:2223
sp : ffff800099646b10
x29: ffff800099646b20 x28: ffff7000132c8d80 x27: ffff0000c610b280
x26: ffff0000c610b2c8 x25: 1fffe00018c21652 x24: dfff800000000000
x23: 0000000000000004 x22: 0000000000000002 x21: 0000000000000000
x20: ffff0000c610b280 x19: 0000000000000000 x18: 00000000ffffffff
x17: ffff80008a186c80 x16: ffff80008a4b54f8 x15: ffff0000d9c0c550
x14: ffff0000d9c0c530 x13: 0000000000000001 x12: 0000000000000000
x11: ffff80008a3fcd08 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000003 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800082559f20
x2 : 0000000000000004 x1 : ffff0000d9c0ba00 x0 : 0000000000000018
Call trace:
ublk_queue_cmd drivers/block/ublk_drv.c:2095 [inline] (P)
ublk_queue_rq+0x114/0x1dc drivers/block/ublk_drv.c:2223 (P)
blk_mq_dispatch_rq_list+0x3bc/0x13a4 block/blk-mq.c:2148
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
__blk_mq_sched_dispatch_requests+0xa40/0x10bc block/blk-mq-sched.c:307
blk_mq_sched_dispatch_requests+0xa4/0x154 block/blk-mq-sched.c:329
blk_mq_run_hw_queue+0x3c0/0x4dc block/blk-mq.c:2386
blk_mq_dispatch_list+0xa2c/0xb2c block/blk-mq.c:-1
blk_mq_flush_plug_list+0x3a4/0x484 block/blk-mq.c:2997
__blk_flush_plug+0x338/0x410 block/blk-core.c:1230
blk_finish_plug block/blk-core.c:1257 [inline]
__submit_bio+0x39c/0x478 block/blk-core.c:649
__submit_bio_noacct_mq block/blk-core.c:722 [inline]
submit_bio_noacct_nocheck+0x284/0xa98 block/blk-core.c:753
submit_bio_noacct+0xd90/0x1814 block/blk-core.c:884
submit_bio+0x38c/0x528 block/blk-core.c:926
blk_crypto_submit_bio include/linux/blk-crypto.h:203 [inline]
submit_bh_wbc+0x4b0/0x594 fs/buffer.c:2737
submit_bh fs/buffer.c:2742 [inline]
block_read_full_folio+0x69c/0x734 fs/buffer.c:2358
blkdev_read_folio+0x28/0x38 block/fops.c:494
filemap_read_folio+0xf0/0x2fc mm/filemap.c:2502
do_read_cache_folio+0x368/0x5b8 mm/filemap.c:4107
read_cache_folio+0x68/0x84 mm/filemap.c:4139
read_mapping_folio include/linux/pagemap.h:1017 [inline]
read_part_sector+0xcc/0x708 block/partitions/core.c:724
adfspart_check_ICS+0xa4/0x6fc block/partitions/acorn.c:356
check_partition block/partitions/core.c:143 [inline]
blk_add_partitions block/partitions/core.c:591 [inline]
bdev_disk_changed+0x6fc/0x11c8 block/partitions/core.c:695
ublk_partition_scan_work+0x74/0xf4 drivers/block/ublk_drv.c:2467
process_one_work kernel/workqueue.c:3314 [inline]
process_scheduled_works+0x79c/0x1098 kernel/workqueue.c:3397
worker_thread+0x754/0xba0 kernel/workqueue.c:3478
kthread+0x2f8/0x3c8 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: 979832c3 f94002b5 910062a0 d343fc08 (38786908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 979832c3 bl 0xfffffffffe60cb0c
4: f94002b5 ldr x21, [x21]
8: 910062a0 add x0, x21, #0x18
c: d343fc08 lsr x8, x0, #3
* 10: 38786908 ldrb w8, [x8, x24] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [net?] possible deadlock in __sk_receive_skb
@ 2026-05-19 18:53 syzbot
2026-05-20 2:05 ` Forwarded: test syzbot
` (3 more replies)
0 siblings, 4 replies; 22+ messages in thread
From: syzbot @ 2026-05-19 18:53 UTC (permalink / raw)
To: courmisch, davem, edumazet, horms, kuba, linux-kernel, netdev,
pabeni, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 97e797263a5e Add linux-next specific files for 20260420
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17c62c36580000
kernel config: https://syzkaller.appspot.com/x/.config?x=354b135d724a721f
dashboard link: https://syzkaller.appspot.com/bug?extid=9f4a135646b66c509935
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10f622d2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f88e6a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bfe08255b02b/disk-97e79726.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/70874e341331/vmlinux-97e79726.xz
kernel image: https://storage.googleapis.com/syzbot-assets/68352f7fca94/bzImage-97e79726.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9f4a135646b66c509935@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/6130 is trying to acquire lock:
ffff88803976da20 (slock-AF_PHONET/1){+.+.}-{3:3}, at: __sk_receive_skb+0x1bf/0x9e0 net/core/sock.c:563
but task is already holding lock:
ffff88803976e2e0 (slock-AF_PHONET){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
ffff88803976e2e0 (slock-AF_PHONET){+...}-{3:3}, at: __sk_receive_skb+0x1f1/0x9e0 net/core/sock.c:565
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (slock-AF_PHONET){+...}-{3:3}:
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
__sk_receive_skb+0x1f1/0x9e0 net/core/sock.c:565
sk_receive_skb include/net/sock.h:2022 [inline]
phonet_rcv+0x781/0xc40 net/phonet/af_phonet.c:-1
__netif_receive_skb_one_core net/core/dev.c:6210 [inline]
__netif_receive_skb net/core/dev.c:6323 [inline]
process_backlog+0x5e1/0xc60 net/core/dev.c:6674
__napi_poll+0xab/0x550 net/core/dev.c:7738
napi_poll net/core/dev.c:7801 [inline]
net_rx_action+0x696/0xe00 net/core/dev.c:7958
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
netif_rx+0xb9/0xf0 net/core/dev.c:5776
pn_send+0x62a/0x8e0 net/phonet/af_phonet.c:188
pn_skb_send+0x218/0x530 net/phonet/af_phonet.c:275
pep_indicate net/phonet/pep.c:123 [inline]
pipe_snd_status+0x1f1/0x320 net/phonet/pep.c:221
pipe_grant_credits net/phonet/pep.c:244 [inline]
pipe_do_rcv+0xf15/0x16a0 net/phonet/pep.c:433
sk_backlog_rcv include/net/sock.h:1190 [inline]
__sk_receive_skb+0x962/0x9e0 net/core/sock.c:572
sk_receive_skb include/net/sock.h:2022 [inline]
pep_do_rcv+0x685/0xaa0 net/phonet/pep.c:675
sk_backlog_rcv include/net/sock.h:1190 [inline]
__release_sock+0x2a9/0x3d0 net/core/sock.c:3216
release_sock+0x1be/0x290 net/core/sock.c:3815
pep_sock_accept+0xd47/0x11e0 net/phonet/pep.c:879
pn_socket_accept+0xc1/0x310 net/phonet/socket.c:303
do_accept+0x6ca/0x930 net/socket.c:2062
__sys_accept4_file net/socket.c:2096 [inline]
__sys_accept4+0x139/0x230 net/socket.c:2118
__do_sys_accept4 net/socket.c:2125 [inline]
__se_sys_accept4 net/socket.c:2122 [inline]
__x64_sys_accept4+0x9a/0xb0 net/socket.c:2122
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (slock-AF_PHONET/1){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3167 [inline]
check_prevs_add kernel/locking/lockdep.c:3286 [inline]
validate_chain kernel/locking/lockdep.c:3910 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5239
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5870
rt_spin_lock_nested+0x81/0x3f0 kernel/locking/spinlock_rt.c:64
__sk_receive_skb+0x1bf/0x9e0 net/core/sock.c:563
sk_receive_skb include/net/sock.h:2022 [inline]
pep_do_rcv+0x685/0xaa0 net/phonet/pep.c:675
sk_backlog_rcv include/net/sock.h:1190 [inline]
__sk_receive_skb+0x962/0x9e0 net/core/sock.c:572
sk_receive_skb include/net/sock.h:2022 [inline]
phonet_rcv+0x781/0xc40 net/phonet/af_phonet.c:-1
__netif_receive_skb_one_core net/core/dev.c:6210 [inline]
__netif_receive_skb net/core/dev.c:6323 [inline]
process_backlog+0x5e1/0xc60 net/core/dev.c:6674
__napi_poll+0xab/0x550 net/core/dev.c:7738
napi_poll net/core/dev.c:7801 [inline]
net_rx_action+0x696/0xe00 net/core/dev.c:7958
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
netif_rx+0xb9/0xf0 net/core/dev.c:5776
pn_send+0x62a/0x8e0 net/phonet/af_phonet.c:188
pn_skb_send+0x218/0x530 net/phonet/af_phonet.c:275
pipe_skb_send+0x2f7/0x540 net/phonet/pep.c:1130
pep_sendmsg+0x9ca/0xb00 net/phonet/pep.c:1206
pn_socket_sendmsg+0x1e5/0x250 net/phonet/socket.c:424
sock_sendmsg_nosec+0x112/0x150 net/socket.c:797
__sock_sendmsg net/socket.c:812 [inline]
sock_write_iter+0x308/0x410 net/socket.c:1269
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:688
ksys_write+0x156/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(slock-AF_PHONET);
lock(slock-AF_PHONET/1);
lock(slock-AF_PHONET);
lock(slock-AF_PHONET/1);
*** DEADLOCK ***
6 locks held by syz.0.17/6130:
#0: ffff88803aded218 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff88803aded218 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: pep_sendmsg+0x7b6/0xb00 net/phonet/pep.c:1199
#1: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#2: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 net/core/dev.c:6673
#3: ffff88803976e2e0 (slock-AF_PHONET){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88803976e2e0 (slock-AF_PHONET){+...}-{3:3}, at: __sk_receive_skb+0x1f1/0x9e0 net/core/sock.c:565
#4: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8e3c8140 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffff88803976e398 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: sk_receive_skb include/net/sock.h:2022 [inline]
#5: ffff88803976e398 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: phonet_rcv+0x781/0xc40 net/phonet/af_phonet.c:-1
stack backtrace:
CPU: 0 UID: 0 PID: 6130 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2045
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2177
check_prev_add kernel/locking/lockdep.c:3167 [inline]
check_prevs_add kernel/locking/lockdep.c:3286 [inline]
validate_chain kernel/locking/lockdep.c:3910 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5239
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5870
rt_spin_lock_nested+0x81/0x3f0 kernel/locking/spinlock_rt.c:64
__sk_receive_skb+0x1bf/0x9e0 net/core/sock.c:563
sk_receive_skb include/net/sock.h:2022 [inline]
pep_do_rcv+0x685/0xaa0 net/phonet/pep.c:675
sk_backlog_rcv include/net/sock.h:1190 [inline]
__sk_receive_skb+0x962/0x9e0 net/core/sock.c:572
sk_receive_skb include/net/sock.h:2022 [inline]
phonet_rcv+0x781/0xc40 net/phonet/af_phonet.c:-1
__netif_receive_skb_one_core net/core/dev.c:6210 [inline]
__netif_receive_skb net/core/dev.c:6323 [inline]
process_backlog+0x5e1/0xc60 net/core/dev.c:6674
__napi_poll+0xab/0x550 net/core/dev.c:7738
napi_poll net/core/dev.c:7801 [inline]
net_rx_action+0x696/0xe00 net/core/dev.c:7958
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
netif_rx+0xb9/0xf0 net/core/dev.c:5776
pn_send+0x62a/0x8e0 net/phonet/af_phonet.c:188
pn_skb_send+0x218/0x530 net/phonet/af_phonet.c:275
pipe_skb_send+0x2f7/0x540 net/phonet/pep.c:1130
pep_sendmsg+0x9ca/0xb00 net/phonet/pep.c:1206
pn_socket_sendmsg+0x1e5/0x250 net/phonet/socket.c:424
sock_sendmsg_nosec+0x112/0x150 net/socket.c:797
__sock_sendmsg net/socket.c:812 [inline]
sock_write_iter+0x308/0x410 net/socket.c:1269
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:688
ksys_write+0x156/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd74410c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd743745028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fd744386090 RCX: 00007fd74410c819
RDX: 00000000000003db RSI: 0000200000000480 RDI: 0000000000000006
RBP: 00007fd7441a2c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd744386128 R14: 00007fd744386090 R15: 00007fff7efc5418
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* Forwarded: test
2026-05-19 18:53 [syzbot] [net?] possible deadlock in __sk_receive_skb syzbot
@ 2026-05-20 2:05 ` syzbot
2026-05-20 9:15 ` syzbot
` (2 subsequent siblings)
3 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2026-05-20 2:05 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: test
Author: yun.zhou@windriver.com
#syz test
^ permalink raw reply [flat|nested] 22+ messages in thread* Forwarded: test
2026-05-19 18:53 [syzbot] [net?] possible deadlock in __sk_receive_skb syzbot
2026-05-20 2:05 ` Forwarded: test syzbot
@ 2026-05-20 9:15 ` syzbot
2026-05-20 10:27 ` syzbot
2026-05-20 14:33 ` syzbot
3 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2026-05-20 9:15 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: test
Author: yun.zhou@windriver.com
#syz test
^ permalink raw reply [flat|nested] 22+ messages in thread
* Forwarded: test
2026-05-19 18:53 [syzbot] [net?] possible deadlock in __sk_receive_skb syzbot
2026-05-20 2:05 ` Forwarded: test syzbot
2026-05-20 9:15 ` syzbot
@ 2026-05-20 10:27 ` syzbot
2026-05-20 14:33 ` syzbot
3 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2026-05-20 10:27 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: test
Author: yun.zhou@windriver.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 22+ messages in thread
* Forwarded: test
2026-05-19 18:53 [syzbot] [net?] possible deadlock in __sk_receive_skb syzbot
` (2 preceding siblings ...)
2026-05-20 10:27 ` syzbot
@ 2026-05-20 14:33 ` syzbot
3 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2026-05-20 14:33 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: test
Author: yun.zhou@windriver.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [net?] WARNING in netif_rx_mode_run
@ 2026-05-19 11:56 syzbot
2026-05-19 12:49 ` Forwarded: test syzbot
2026-05-20 9:34 ` syzbot
0 siblings, 2 replies; 22+ messages in thread
From: syzbot @ 2026-05-19 11:56 UTC (permalink / raw)
To: davem, edumazet, horms, kuba, linux-kernel, netdev, pabeni,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: c8993263ffd3 bpf: Add Jiayuan Chen to sockmap maintainers
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=156e9bce580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4caf64b1ee83dac0
dashboard link: https://syzkaller.appspot.com/bug?extid=f2421634072a4b47071e
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=121aee36580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=136e9bce580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bd0898114f61/disk-c8993263.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2b3988a1716d/vmlinux-c8993263.xz
kernel image: https://storage.googleapis.com/syzbot-assets/eedc9b64bb9f/bzImage-c8993263.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f2421634072a4b47071e@syzkaller.appspotmail.com
RSP: 002b:00007ffde2b3c518 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fece9c15fa0 RCX: 00007fece999ce59
RDX: 0000200000000000 RSI: 0000000000008931 RDI: 0000000000000003
RBP: 00007ffde2b3c580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fece9c15fac R14: 00007fece9c15fa0 R15: 00007fece9c15fa0
</TASK>
------------[ cut here ]------------
netdevice: dummy0: failed to sync uc/mc addresses
WARNING: net/core/dev_addr_lists.c:1278 at netif_rx_mode_run+0xd55/0x1290 net/core/dev_addr_lists.c:1278, CPU#1: syz.0.17/5854
Modules linked in:
CPU: 1 UID: 0 PID: 5854 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:netif_rx_mode_run+0xe82/0x1290 net/core/dev_addr_lists.c:1278
Code: 3a 48 c7 c2 a0 ec dd 8c eb 1a e8 e9 8a 43 f8 48 c7 c2 20 eb dd 8c eb 0c e8 db 8a 43 f8 48 c7 c2 20 ec dd 8c 4c 89 f7 4c 89 fe <67> 48 0f b9 3a 48 8b 5c 24 38 48 8b 7c 24 48 e8 da be 29 02 42 c7
RSP: 0018:ffffc90002e2f9e0 EFLAGS: 00010293
RAX: ffffffff898241b7 RBX: 0000000000000001 RCX: ffff88802dcd5c40
RDX: ffffffff8cddeb20 RSI: ffff888025bb6120 RDI: ffffffff903fb9d0
RBP: ffffc90002e2fbb8 R08: ffff88802dcd5c40 R09: 0000000000000006
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888025bb6120
R13: dffffc0000000000 R14: ffffffff903fb9d0 R15: ffff888025bb6120
FS: 000055556040b500(0000) GS:ffff888125388000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 0000000033696000 CR4: 00000000003526f0
Call Trace:
<TASK>
netif_rx_mode_sync+0x171/0x1e0 net/core/dev_addr_lists.c:1428
dev_ifsioc+0xf51/0x1330 net/core/dev_ioctl.c:596
dev_ioctl+0x7b4/0x1150 net/core/dev_ioctl.c:816
sock_do_ioctl+0x23e/0x320 net/socket.c:1327
sock_ioctl+0x5c6/0x7f0 net/socket.c:1434
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fece999ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffde2b3c518 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fece9c15fa0 RCX: 00007fece999ce59
RDX: 0000200000000000 RSI: 0000000000008931 RDI: 0000000000000003
RBP: 00007ffde2b3c580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fece9c15fac R14: 00007fece9c15fa0 R15: 00007fece9c15fa0
</TASK>
----------------
Code disassembly (best guess):
0: 3a 48 c7 cmp -0x39(%rax),%cl
3: c2 a0 ec ret $0xeca0
6: dd 8c eb 1a e8 e9 8a fisttpll -0x751617e6(%rbx,%rbp,8)
d: 43 f8 rex.XB clc
f: 48 c7 c2 20 eb dd 8c mov $0xffffffff8cddeb20,%rdx
16: eb 0c jmp 0x24
18: e8 db 8a 43 f8 call 0xf8438af8
1d: 48 c7 c2 20 ec dd 8c mov $0xffffffff8cddec20,%rdx
24: 4c 89 f7 mov %r14,%rdi
27: 4c 89 fe mov %r15,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 48 8b 5c 24 38 mov 0x38(%rsp),%rbx
34: 48 8b 7c 24 48 mov 0x48(%rsp),%rdi
39: e8 da be 29 02 call 0x229bf18
3e: 42 rex.X
3f: c7 .byte 0xc7
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [media?] KASAN: slab-use-after-free Read in dvb_frontend_open
@ 2026-05-18 1:17 syzbot
2026-05-18 11:19 ` Forwarded: test syzbot
2026-05-19 0:36 ` syzbot
0 siblings, 2 replies; 22+ messages in thread
From: syzbot @ 2026-05-18 1:17 UTC (permalink / raw)
To: linux-kernel, linux-media, mchehab, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 5cbb61bf4168 arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=14614fce580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127e5636580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/04156ec16593/disk-5cbb61bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bfa041e2c79/vmlinux-5cbb61bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a92d82d8a79e/Image-5cbb61bf.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com
i2c i2c-0: dvb_frontend_start: failed to start kthread (-4)
==================================================================
BUG: KASAN: slab-use-after-free in dvb_frontend_open+0xdac/0x105c drivers/media/dvb-core/dvb_frontend.c:2892
Read of size 4 at addr ffff0000cc9e9c3c by task syz.4.109/5364
CPU: 1 UID: 0 PID: 5364 Comm: syz.4.109 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
__asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380
dvb_frontend_open+0xdac/0x105c drivers/media/dvb-core/dvb_frontend.c:2892
dvb_device_open+0x1f4/0x250 drivers/media/dvb-core/dvbdev.c:109
chrdev_open+0x398/0x3e8 fs/char_dev.c:411
do_dentry_open+0x5c8/0x10dc fs/open.c:947
vfs_open+0x44/0x2d4 fs/open.c:1079
do_open fs/namei.c:4699 [inline]
path_openat+0x2234/0x2a6c fs/namei.c:4858
do_file_open+0x1c4/0x2e4 fs/namei.c:4887
do_sys_openat2+0x114/0x1e8 fs/open.c:1364
do_sys_open+0xac/0xdc fs/open.c:1370
__do_sys_openat fs/open.c:1386 [inline]
__se_sys_openat fs/open.c:1381 [inline]
__arm64_sys_openat+0x9c/0xb8 fs/open.c:1381
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Allocated by task 1:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x284/0x56c mm/slub.c:5415
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
dvb_register_device+0x1ac/0x16ec drivers/media/dvb-core/dvbdev.c:472
dvb_register_frontend+0x464/0x698 drivers/media/dvb-core/dvb_frontend.c:3051
vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline]
vidtv_bridge_probe+0x57c/0xa24 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510
platform_probe+0xfc/0x198 drivers/base/platform.c:1418
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2a8/0x7e8 drivers/base/dd.c:709
__driver_probe_device+0x1e0/0x33c drivers/base/dd.c:871
driver_probe_device+0x6c/0x19c drivers/base/dd.c:901
__driver_attach+0x164/0x374 drivers/base/dd.c:1295
bus_for_each_dev+0x128/0x1b4 drivers/base/bus.c:383
driver_attach+0x4c/0x5c drivers/base/dd.c:1313
bus_add_driver+0x208/0x4fc drivers/base/bus.c:756
driver_register+0x220/0x30c drivers/base/driver.c:249
__platform_driver_register+0x6c/0x80 drivers/base/platform.c:910
vidtv_bridge_init+0x34/0x5c drivers/media/test-drivers/vidtv/vidtv_bridge.c:600
do_one_initcall+0x274/0xc20 init/main.c:1392
do_initcall_level+0x128/0x1c4 init/main.c:1454
do_initcalls+0x70/0xd0 init/main.c:1470
do_basic_setup+0x7c/0x90 init/main.c:1490
kernel_init_freeable+0x268/0x3a8 init/main.c:1703
kernel_init+0x24/0x1dc init/main.c:1593
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Freed by task 5364:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6246 [inline]
kfree+0x188/0x5e4 mm/slub.c:6561
dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline]
kref_put include/linux/kref.h:65 [inline]
dvb_device_put+0x64/0xd0 drivers/media/dvb-core/dvbdev.c:629
dvb_generic_release+0xec/0x154 drivers/media/dvb-core/dvbdev.c:169
dvb_frontend_open+0x9b8/0x105c drivers/media/dvb-core/dvb_frontend.c:2890
dvb_device_open+0x1f4/0x250 drivers/media/dvb-core/dvbdev.c:109
chrdev_open+0x398/0x3e8 fs/char_dev.c:411
do_dentry_open+0x5c8/0x10dc fs/open.c:947
vfs_open+0x44/0x2d4 fs/open.c:1079
do_open fs/namei.c:4699 [inline]
path_openat+0x2234/0x2a6c fs/namei.c:4858
do_file_open+0x1c4/0x2e4 fs/namei.c:4887
do_sys_openat2+0x114/0x1e8 fs/open.c:1364
do_sys_open+0xac/0xdc fs/open.c:1370
__do_sys_openat fs/open.c:1386 [inline]
__se_sys_openat fs/open.c:1381 [inline]
__arm64_sys_openat+0x9c/0xb8 fs/open.c:1381
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
The buggy address belongs to the object at ffff0000cc9e9c00
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 60 bytes inside of
freed 256-byte region [ffff0000cc9e9c00, ffff0000cc9e9d00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000cc9e9200 pfn:0x10c9e8
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000240 ffff0000c0001b40 fffffdffc333d590 fffffdffc3064090
raw: ffff0000cc9e9200 000000080010000f 00000000f5000000 0000000000000000
head: 05ffc00000000240 ffff0000c0001b40 fffffdffc333d590 fffffdffc3064090
head: ffff0000cc9e9200 000000080010000f 00000000f5000000 0000000000000000
head: 05ffc00000000001 fffffdffc3327a01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000cc9e9b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000cc9e9b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000cc9e9c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000cc9e9c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000cc9e9d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28, CPU#1: syz.4.109/5364
Modules linked in:
CPU: 1 UID: 0 PID: 5364 Comm: syz.4.109 Tainted: G B syzkaller #0 PREEMPT
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28
lr : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28
sp : ffff80009bdd7540
x29: ffff80009bdd7540 x28: ffff0000dbdcc748 x27: dfff800000000000
x26: 1fffe0001b7b98e9 x25: dfff800000000000 x24: ffff0000cc649068
x23: ffff0000dbdcc748 x22: ffff800083949be4 x21: 0000000000000000
x20: ffff0000cc9e9c10 x19: ffff800089f06000 x18: 0000000000000000
x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d
x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000b4e x10: 0000000000ff0100 x9 : 9ef5470fdd42bb00
x8 : 9ef5470fdd42bb00 x7 : 0000000000000000 x6 : ffff8000804886d0
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f13b0
x2 : 0000000100000000 x1 : ffff0000d7dc8000 x0 : 0000000000000000
Call trace:
refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28 (P)
__refcount_sub_and_test include/linux/refcount.h:400 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
kref_put include/linux/kref.h:64 [inline]
dvb_device_put+0xac/0xd0 drivers/media/dvb-core/dvbdev.c:629
dvb_device_open+0x238/0x250 drivers/media/dvb-core/dvbdev.c:113
chrdev_open+0x398/0x3e8 fs/char_dev.c:411
do_dentry_open+0x5c8/0x10dc fs/open.c:947
vfs_open+0x44/0x2d4 fs/open.c:1079
do_open fs/namei.c:4699 [inline]
path_openat+0x2234/0x2a6c fs/namei.c:4858
do_file_open+0x1c4/0x2e4 fs/namei.c:4887
do_sys_openat2+0x114/0x1e8 fs/open.c:1364
do_sys_open+0xac/0xdc fs/open.c:1370
__do_sys_openat fs/open.c:1386 [inline]
__se_sys_openat fs/open.c:1381 [inline]
__arm64_sys_openat+0x9c/0xb8 fs/open.c:1381
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
irq event stamp: 562843
hardirqs last enabled at (562843): [<ffff8000867248cc>] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:515 [inline]
hardirqs last enabled at (562843): [<ffff8000867248cc>] arm64_exit_to_kernel_mode+0x7c/0x90 arch/arm64/kernel/entry-common.c:62
hardirqs last disabled at (562842): [<ffff800086720b00>] __el1_irq arch/arm64/kernel/entry-common.c:493 [inline]
hardirqs last disabled at (562842): [<ffff800086720b00>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:509
softirqs last enabled at (562784): [<ffff800080139e6c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (562782): [<ffff800080139e38>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* [syzbot] [ext4?] possible deadlock in ext4_xattr_set_handle (7)
@ 2025-11-13 8:08 syzbot
2026-06-09 8:41 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2025-11-13 8:08 UTC (permalink / raw)
To: adilger.kernel, linux-ext4, linux-kernel, syzkaller-bugs, tytso
Hello,
syzbot found the following issue on:
HEAD commit: 7bb4d6512545 Merge tag 'v6.18rc4-SMB-client-fixes' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=170350b4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e46b8a1c645465a9
dashboard link: https://syzkaller.appspot.com/bug?extid=f0b58a1f5075a90dd9a5
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ad654d5866e3/disk-7bb4d651.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7ad4d94f39b6/vmlinux-7bb4d651.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1fa5516b633d/bzImage-7bb4d651.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f0b58a1f5075a90dd9a5@syzkaller.appspotmail.com
EXT4-fs (loop8): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
ext4 filesystem being mounted at /81/mnt supports timestamps until 2038-01-19 (0x7fffffff)
fscrypt: AES-256-XTS using implementation "xts-aes-vaes-avx2"
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.8.1928/14101 is trying to acquire lock:
ffff8880494b9d78 (&ei->xattr_sem){++++}-{4:4}, at: ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ffff8880494b9d78 (&ei->xattr_sem){++++}-{4:4}, at: ext4_xattr_set_handle+0x165/0x1590 fs/ext4/xattr.c:2367
but task is already holding lock:
ffff888031d78b98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_write fs/ext4/ext4.h:1808 [inline]
ffff888031d78b98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_ext_migrate+0x2f3/0x1010 fs/ext4/migrate.c:438
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&sbi->s_writepages_rwsem){++++}-{0:0}:
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
percpu_down_read_internal+0x48/0x1c0 include/linux/percpu-rwsem.h:53
percpu_down_read include/linux/percpu-rwsem.h:77 [inline]
ext4_writepages_down_read fs/ext4/ext4.h:1796 [inline]
ext4_writepages+0x1cc/0x350 fs/ext4/inode.c:3024
do_writepages+0x32e/0x550 mm/page-writeback.c:2604
__writeback_single_inode+0x145/0xff0 fs/fs-writeback.c:1719
writeback_single_inode+0x1f9/0x6a0 fs/fs-writeback.c:1840
write_inode_now+0x160/0x1d0 fs/fs-writeback.c:2903
iput_final fs/inode.c:1901 [inline]
iput+0x830/0xc50 fs/inode.c:1966
ext4_xattr_block_set+0x1fce/0x2ac0 fs/ext4/xattr.c:2199
ext4_xattr_move_to_block fs/ext4/xattr.c:2664 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2739 [inline]
ext4_expand_extra_isize_ea+0x12da/0x1ea0 fs/ext4/xattr.c:2827
__ext4_expand_extra_isize+0x30d/0x400 fs/ext4/inode.c:6364
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6407 [inline]
__ext4_mark_inode_dirty+0x46c/0x700 fs/ext4/inode.c:6485
ext4_evict_inode+0x80d/0xee0 fs/ext4/inode.c:254
evict+0x504/0x9c0 fs/inode.c:810
ext4_orphan_cleanup+0xc20/0x1460 fs/ext4/orphan.c:470
__ext4_fill_super fs/ext4/super.c:5617 [inline]
ext4_fill_super+0x5920/0x61e0 fs/ext4/super.c:5736
get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1691
vfs_get_tree+0x92/0x2b0 fs/super.c:1751
fc_mount fs/namespace.c:1208 [inline]
do_new_mount_fc fs/namespace.c:3651 [inline]
do_new_mount+0x302/0xa10 fs/namespace.c:3727
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount+0x313/0x410 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ei->xattr_sem){++++}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908
__lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ext4_xattr_set_handle+0x165/0x1590 fs/ext4/xattr.c:2367
ext4_set_context+0x21b/0x550 fs/ext4/crypto.c:166
fscrypt_set_context+0x38a/0x460 fs/crypto/policy.c:791
__ext4_new_inode+0x3143/0x3cb0 fs/ext4/ialloc.c:1315
ext4_ext_migrate+0x69f/0x1010 fs/ext4/migrate.c:456
ext4_ioctl_setflags fs/ext4/ioctl.c:705 [inline]
ext4_fileattr_set+0xeaf/0x1630 fs/ext4/ioctl.c:1024
vfs_fileattr_set+0x932/0xb90 fs/file_attr.c:298
ioctl_setflags+0x180/0x1e0 fs/file_attr.c:334
do_vfs_ioctl+0x8ed/0x1430 fs/ioctl.c:560
__do_sys_ioctl fs/ioctl.c:595 [inline]
__se_sys_ioctl+0x82/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sbi->s_writepages_rwsem);
lock(&ei->xattr_sem);
lock(&sbi->s_writepages_rwsem);
lock(&ei->xattr_sem);
*** DEADLOCK ***
3 locks held by syz.8.1928/14101:
#0: ffff888031d7e420 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write_file+0x60/0x200 fs/namespace.c:552
#1: ffff8880494bd9f0 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#1: ffff8880494bd9f0 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: vfs_fileattr_set+0x14e/0xb90 fs/file_attr.c:278
#2: ffff888031d78b98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_write fs/ext4/ext4.h:1808 [inline]
#2: ffff888031d78b98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_ext_migrate+0x2f3/0x1010 fs/ext4/migrate.c:438
stack backtrace:
CPU: 0 UID: 0 PID: 14101 Comm: syz.8.1928 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043
check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908
__lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ext4_xattr_set_handle+0x165/0x1590 fs/ext4/xattr.c:2367
ext4_set_context+0x21b/0x550 fs/ext4/crypto.c:166
fscrypt_set_context+0x38a/0x460 fs/crypto/policy.c:791
__ext4_new_inode+0x3143/0x3cb0 fs/ext4/ialloc.c:1315
ext4_ext_migrate+0x69f/0x1010 fs/ext4/migrate.c:456
ext4_ioctl_setflags fs/ext4/ioctl.c:705 [inline]
ext4_fileattr_set+0xeaf/0x1630 fs/ext4/ioctl.c:1024
vfs_fileattr_set+0x932/0xb90 fs/file_attr.c:298
ioctl_setflags+0x180/0x1e0 fs/file_attr.c:334
do_vfs_ioctl+0x8ed/0x1430 fs/ioctl.c:560
__do_sys_ioctl fs/ioctl.c:595 [inline]
__se_sys_ioctl+0x82/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1f39f8f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1f3ade0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1f3a1e5fa0 RCX: 00007f1f39f8f6c9
RDX: 0000200000000080 RSI: 0000000040086602 RDI: 0000000000000004
RBP: 00007f1f3a011f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1f3a1e6038 R14: 00007f1f3a1e5fa0 R15: 00007fffb7f49f38
</TASK>
EXT4-fs error (device loop8): ext4_validate_block_bitmap:423: comm syz.8.1928: bg 0: bad block bitmap checksum
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* [syzbot] [jfs?] general protection fault in txCommit (2)
@ 2025-11-07 7:29 syzbot
2025-11-14 13:48 ` Forwarded: test syzbot
2025-11-14 14:36 ` syzbot
0 siblings, 2 replies; 22+ messages in thread
From: syzbot @ 2025-11-07 7:29 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 8bb886cb8f3a Merge tag 'edac_urgent_for_v6.18_rc5' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1207c114580000
kernel config: https://syzkaller.appspot.com/x/.config?x=41ad820f608cb833
dashboard link: https://syzkaller.appspot.com/bug?extid=9489c9f9f3d437221ea2
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1033d012580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11ea1bcd980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/393661e2054b/disk-8bb886cb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ba628b757c6a/vmlinux-8bb886cb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/15255c2cc8ad/bzImage-8bb886cb.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/5ffcac92a4cf/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=125bf932580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9489c9f9f3d437221ea2@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
UFO tlock:0xffffc900034fa[ 113.512606][ T5985] UFO tlock:0xffffc900034fa1b0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 5985 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:txLog fs/jfs/jfs_txnmgr.c:1390 [inline]
RIP: 0010:txCommit+0xafb/0x5430 fs/jfs/jfs_txnmgr.c:1265
Code: 3c 10 00 74 12 4c 89 f7 e8 f2 cb e2 fe 48 ba 00 00 00 00 00 fc ff df 4c 89 74 24 68 4d 8b 36 4d 8d 7e 28 4c 89 f8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 ff e8 c7 cb e2 fe 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90003fc74e0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000948 RCX: 1ffff9200069fd48
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003fc76b0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1dac5ef R12: 0000000000000002
R13: ffffc900034fa000 R14: 0000000000000000 R15: 0000000000000028
FS: 0000555570e52500(0000) GS:ffff888126df9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000038f28000 CR4: 00000000003526f0
Call Trace:
<TASK>
jfs_create+0x865/0xa80 fs/jfs/namei.c:156
lookup_open fs/namei.c:3796 [inline]
open_last_lookups fs/namei.c:3895 [inline]
path_openat+0x1500/0x3840 fs/namei.c:4131
do_filp_open+0x1fa/0x410 fs/namei.c:4161
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_creat fs/open.c:1530 [inline]
__se_sys_creat fs/open.c:1524 [inline]
__x64_sys_creat+0x8f/0xc0 fs/open.c:1524
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f575dbcf6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff260cfb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f575de25fa0 RCX: 00007f575dbcf6c9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580
RBP: 00007f575dc51f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f575de25fa0 R14: 00007f575de25fa0 R15: 0000000000000002
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:txLog fs/jfs/jfs_txnmgr.c:1390 [inline]
RIP: 0010:txCommit+0xafb/0x5430 fs/jfs/jfs_txnmgr.c:1265
Code: 3c 10 00 74 12 4c 89 f7 e8 f2 cb e2 fe 48 ba 00 00 00 00 00 fc ff df 4c 89 74 24 68 4d 8b 36 4d 8d 7e 28 4c 89 f8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 ff e8 c7 cb e2 fe 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90003fc74e0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000948 RCX: 1ffff9200069fd48
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003fc76b0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1dac5ef R12: 0000000000000002
R13: ffffc900034fa000 R14: 0000000000000000 R15: 0000000000000028
FS: 0000555570e52500(0000) GS:ffff888126df9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000038f28000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 3c 10 cmp $0x10,%al
2: 00 74 12 4c add %dh,0x4c(%rdx,%rdx,1)
6: 89 f7 mov %esi,%edi
8: e8 f2 cb e2 fe call 0xfee2cbff
d: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
14: fc ff df
17: 4c 89 74 24 68 mov %r14,0x68(%rsp)
1c: 4d 8b 36 mov (%r14),%r14
1f: 4d 8d 7e 28 lea 0x28(%r14),%r15
23: 4c 89 f8 mov %r15,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) <-- trapping instruction
2e: 74 12 je 0x42
30: 4c 89 ff mov %r15,%rdi
33: e8 c7 cb e2 fe call 0xfee2cbff
38: 48 rex.W
39: ba 00 00 00 00 mov $0x0,%edx
3e: 00 fc add %bh,%ah
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* [syzbot] [jfs?] stack segment fault in dbUpdatePMap
@ 2025-11-01 17:24 syzbot
2025-11-10 11:30 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2025-11-01 17:24 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: ba36dd5ee6fd Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1145ae14580000
kernel config: https://syzkaller.appspot.com/x/.config?x=41ad820f608cb833
dashboard link: https://syzkaller.appspot.com/bug?extid=f5a5b157b7336d1fda1d
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b151a6a8b947/disk-ba36dd5e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ddc072fd4513/vmlinux-ba36dd5e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7cdcc5b6e230/bzImage-ba36dd5e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f5a5b157b7336d1fda1d@syzkaller.appspotmail.com
Oops: stack segment: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 122 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__list_add_valid_or_report+0x3e/0x130 lib/list_debug.c:29
Code: 00 00 00 48 89 d3 48 85 d2 0f 84 93 00 00 00 49 89 f6 49 89 ff 49 bd 00 00 00 00 00 fc ff df 4c 8d 63 08 4c 89 e5 48 c1 ed 03 <42> 80 7c 2d 00 00 74 08 4c 89 e7 e8 32 c4 9d fd 4d 39 34 24 75 71
RSP: 0018:ffffc900031f7a20 EFLAGS: 00010a06
RAX: 0000000000000000 RBX: dead000000000100 RCX: ffff88801dbc9e00
RDX: dead000000000100 RSI: ffffc9000323a140 RDI: ffff88802f4c9898
RBP: 1bd5a00000000021 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1dac5cf R12: dead000000000108
R13: dffffc0000000000 R14: ffffc9000323a140 R15: ffff88802f4c9898
FS: 0000000000000000(0000) GS:ffff888126ef9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555586d63608 CR3: 0000000038d96000 CR4: 00000000003526f0
Call Trace:
<TASK>
__list_add_valid include/linux/list.h:96 [inline]
__list_add include/linux/list.h:158 [inline]
list_add include/linux/list.h:177 [inline]
dbUpdatePMap+0x7e4/0xeb0 fs/jfs/jfs_dmap.c:577
txAllocPMap+0x57d/0x6b0 fs/jfs/jfs_txnmgr.c:2426
txUpdateMap+0x2a2/0x9c0 fs/jfs/jfs_txnmgr.c:2309
txLazyCommit fs/jfs/jfs_txnmgr.c:2665 [inline]
jfs_lazycommit+0x3f1/0xa10 fs/jfs/jfs_txnmgr.c:2734
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0x3e/0x130 lib/list_debug.c:29
Code: 00 00 00 48 89 d3 48 85 d2 0f 84 93 00 00 00 49 89 f6 49 89 ff 49 bd 00 00 00 00 00 fc ff df 4c 8d 63 08 4c 89 e5 48 c1 ed 03 <42> 80 7c 2d 00 00 74 08 4c 89 e7 e8 32 c4 9d fd 4d 39 34 24 75 71
RSP: 0018:ffffc900031f7a20 EFLAGS: 00010a06
RAX: 0000000000000000 RBX: dead000000000100 RCX: ffff88801dbc9e00
RDX: dead000000000100 RSI: ffffc9000323a140 RDI: ffff88802f4c9898
RBP: 1bd5a00000000021 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1dac5cf R12: dead000000000108
R13: dffffc0000000000 R14: ffffc9000323a140 R15: ffff88802f4c9898
FS: 0000000000000000(0000) GS:ffff888126ef9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555586d63608 CR3: 0000000038d96000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 48 89 add %cl,-0x77(%rax)
5: d3 48 85 rorl %cl,-0x7b(%rax)
8: d2 0f rorb %cl,(%rdi)
a: 84 93 00 00 00 49 test %dl,0x49000000(%rbx)
10: 89 f6 mov %esi,%esi
12: 49 89 ff mov %rdi,%r15
15: 49 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%r13
1c: fc ff df
1f: 4c 8d 63 08 lea 0x8(%rbx),%r12
23: 4c 89 e5 mov %r12,%rbp
26: 48 c1 ed 03 shr $0x3,%rbp
* 2a: 42 80 7c 2d 00 00 cmpb $0x0,0x0(%rbp,%r13,1) <-- trapping instruction
30: 74 08 je 0x3a
32: 4c 89 e7 mov %r12,%rdi
35: e8 32 c4 9d fd call 0xfd9dc46c
3a: 4d 39 34 24 cmp %r14,(%r12)
3e: 75 71 jne 0xb1
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* [syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp
@ 2025-09-30 20:29 syzbot
2025-11-06 19:28 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2025-09-30 20:29 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 1896ce8eb6c6 Merge tag 'fsverity-for-linus' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=153d0092580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6eca10e0cdef44f
dashboard link: https://syzkaller.appspot.com/bug?extid=938fcd548c303fe33c1a
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d0fbab3c0b62/disk-1896ce8e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/71c7b444e106/vmlinux-1896ce8e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/96a4aa63999d/bzImage-1896ce8e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com
netlink: 8 bytes leftover after parsing attributes in process `syz.8.3246'.
=====================================================
BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]
BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
hex_byte_pack include/linux/hex.h:13 [inline]
ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509
ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633
pointer+0xc09/0x1bd0 lib/vsprintf.c:2542
vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930
vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279
vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426
vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465
vprintk+0x36/0x50 kernel/printk/printk_safe.c:82
_printk+0x17e/0x1b0 kernel/printk/printk.c:2475
ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]
ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x333/0x3d0 net/socket.c:729
____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617
___sys_sendmsg+0x271/0x3b0 net/socket.c:2671
__sys_sendmsg+0x1aa/0x300 net/socket.c:2703
__compat_sys_sendmsg net/compat.c:346 [inline]
__do_compat_sys_sendmsg net/compat.c:353 [inline]
__se_compat_sys_sendmsg net/compat.c:350 [inline]
__ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350
ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306
do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
Local variable gid.i created at:
ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:102 [inline]
ib_nl_handle_ip_res_resp+0x254/0x9d0 drivers/infiniband/core/addr.c:141
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
CPU: 0 UID: 0 PID: 17455 Comm: syz.8.3246 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbSplit (3)
@ 2025-04-30 21:08 syzbot
2025-11-19 2:55 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2025-04-30 21:08 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: f1a3944c860b Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10d550d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=90837c100b88a636
dashboard link: https://syzkaller.appspot.com/bug?extid=4c1966e88c28fa96e053
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1250a270580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14d550d4580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-f1a3944c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fbe8c2bb0602/vmlinux-f1a3944c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b4268e0ec733/bzImage-f1a3944c.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/10b2c382300e/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=14f49d74580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4c1966e88c28fa96e053@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 32768
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2629:11
shift exponent 110 is too large for 32-bit type 'int'
CPU: 0 UID: 0 PID: 5303 Comm: syz-executor956 Not tainted 6.15.0-rc3-syzkaller-00283-gf1a3944c860b #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_shift_out_of_bounds+0x386/0x410 lib/ubsan.c:492
dbSplit+0x1f8/0x200 fs/jfs/jfs_dmap.c:2629
dbAdjCtl+0x34c/0xa20 fs/jfs/jfs_dmap.c:2521
dbAllocDmap fs/jfs/jfs_dmap.c:2032 [inline]
dbAllocNear+0x2ee/0x3d0 fs/jfs/jfs_dmap.c:1243
dbAlloc+0x933/0xba0 fs/jfs/jfs_dmap.c:828
ea_write+0x374/0xdd0 fs/jfs/xattr.c:232
ea_put fs/jfs/xattr.c:619 [inline]
__jfs_setxattr+0xa01/0x1120 fs/jfs/xattr.c:792
__jfs_xattr_set+0xda/0x170 fs/jfs/xattr.c:941
__vfs_setxattr+0x439/0x480 fs/xattr.c:200
__vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234
vfs_setxattr+0x16b/0x2f0 fs/xattr.c:321
do_setxattr fs/xattr.c:636 [inline]
filename_setxattr+0x274/0x600 fs/xattr.c:665
path_setxattrat+0x364/0x3a0 fs/xattr.c:713
__do_sys_lsetxattr fs/xattr.c:754 [inline]
__se_sys_lsetxattr fs/xattr.c:750 [inline]
__x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:750
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdaa19996b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe3d43d28 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 0000200000000200 RCX: 00007fdaa19996b9
RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000200000000040
RBP: 00002000000000c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000040
R13: 0031656c69662f2e R14: 0000000000000001 R15: 0000000000000001
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [jfs?] UBSAN: shift-out-of-bounds in jfs_statfs (3)
@ 2025-04-30 13:26 syzbot
2025-11-20 15:15 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2025-04-30 13:26 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: c72692105976 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=16b1f574580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a6efb1b6b7e84ef
dashboard link: https://syzkaller.appspot.com/bug?extid=13ba7f3e9a17f77250fe
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bc4c947b6a4c/disk-c7269210.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/26198601f51b/vmlinux-c7269210.xz
kernel image: https://storage.googleapis.com/syzbot-assets/426ac395cf1d/Image-c7269210.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+13ba7f3e9a17f77250fe@syzkaller.appspotmail.com
... Log Wrap ... Log Wrap ... Log Wrap ...
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/jfs/super.c:140:14
shift exponent 770 is too large for 64-bit type 's64' (aka 'long long')
CPU: 1 UID: 0 PID: 6605 Comm: syz.1.10 Not tainted 6.15.0-rc2-syzkaller-gc72692105976 #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
ubsan_epilogue+0x14/0x48 lib/ubsan.c:231
__ubsan_handle_shift_out_of_bounds+0x2b0/0x34c lib/ubsan.c:492
jfs_statfs+0x400/0x484 fs/jfs/super.c:140
statfs_by_dentry fs/statfs.c:66 [inline]
vfs_statfs+0x13c/0x2b0 fs/statfs.c:90
ovl_check_namelen fs/overlayfs/super.c:388 [inline]
ovl_get_upper fs/overlayfs/super.c:506 [inline]
ovl_fill_super+0x5b8/0x2bac fs/overlayfs/super.c:1387
vfs_get_super fs/super.c:1280 [inline]
get_tree_nodev+0xb4/0x144 fs/super.c:1299
ovl_get_tree+0x28/0x38 fs/overlayfs/params.c:701
vfs_get_tree+0x90/0x28c fs/super.c:1759
do_new_mount+0x228/0x814 fs/namespace.c:3879
path_mount+0x5b4/0xde0 fs/namespace.c:4206
do_mount fs/namespace.c:4219 [inline]
__do_sys_mount fs/namespace.c:4430 [inline]
__se_sys_mount fs/namespace.c:4407 [inline]
__arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4407
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
---[ end trace ]---
read_mapping_page failed!
ERROR: (device loop1): txAbort:
ERROR: (device loop1): remounting filesystem as read-only
overlayfs: failed to create directory ./file0/work (errno: 5); mounting read-only
overlayfs: failed to set uuid (/file2, err=-30); falling back to uuid=null.
netlink: 277 bytes leftover after parsing attributes in process `syz.1.10'.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtInsertEntry
@ 2024-10-03 19:10 syzbot
2025-11-18 14:11 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2024-10-03 19:10 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: e7ed34365879 Merge tag 'mailbox-v6.12' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=164e8127980000
kernel config: https://syzkaller.appspot.com/x/.config?x=84a3f3ed29aaafa0
dashboard link: https://syzkaller.appspot.com/bug?extid=5f7f0caf9979e9d09ff8
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eb021424c7db/disk-e7ed3436.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2f5f0d22ea96/vmlinux-e7ed3436.xz
kernel image: https://storage.googleapis.com/syzbot-assets/47176809b11c/bzImage-e7ed3436.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5f7f0caf9979e9d09ff8@syzkaller.appspotmail.com
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:3632:9
index 27 is out of range for type 'struct lv[20]'
CPU: 1 UID: 0 PID: 5469 Comm: syz.1.37 Not tainted 6.11.0-syzkaller-12113-ge7ed34365879 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:231 [inline]
__ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429
dtInsertEntry+0x174e/0x1780 fs/jfs/jfs_dtree.c:3632
dtSplitPage+0x2d99/0x3ed0 fs/jfs/jfs_dtree.c:1595
dtSplitUp fs/jfs/jfs_dtree.c:1091 [inline]
dtInsert+0x14bd/0x6c10 fs/jfs/jfs_dtree.c:870
jfs_create+0x7ba/0xbb0 fs/jfs/namei.c:137
lookup_open fs/namei.c:3595 [inline]
open_last_lookups fs/namei.c:3694 [inline]
path_openat+0x1c03/0x3590 fs/namei.c:3930
do_filp_open+0x235/0x490 fs/namei.c:3960
do_sys_openat2+0x13e/0x1d0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_creat fs/open.c:1506 [inline]
__se_sys_creat fs/open.c:1500 [inline]
__x64_sys_creat+0x123/0x170 fs/open.c:1500
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2c1f97dff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2c20746038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f2c1fb35f80 RCX: 00007f2c1f97dff9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000e00
RBP: 00007f2c1f9f0296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f2c1fb35f80 R15: 00007ffdc44cf8d8
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [nbd?] INFO: task hung in nbd_queue_rq
@ 2024-08-28 0:09 syzbot
2026-07-07 11:25 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2024-08-28 0:09 UTC (permalink / raw)
To: axboe, josef, linux-block, linux-kernel, nbd, netdev,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4186c8d9e6af net: ftgmac100: Ensure tx descriptor updates ..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=14c293a3980000
kernel config: https://syzkaller.appspot.com/x/.config?x=df2f0ed7e30a639d
dashboard link: https://syzkaller.appspot.com/bug?extid=30c16035531e3248dcbc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b1898c8f2a37/disk-4186c8d9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3316a5f48942/vmlinux-4186c8d9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d209b04373d6/bzImage-4186c8d9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+30c16035531e3248dcbc@syzkaller.appspotmail.com
INFO: task udevd:5231 blocked for more than 143 seconds.
Not tainted 6.11.0-rc4-syzkaller-00139-g4186c8d9e6af #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D stack:21400 pid:5231 tgid:5231 ppid:1 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5188 [inline]
__schedule+0x1800/0x4a60 kernel/sched/core.c:6529
__schedule_loop kernel/sched/core.c:6606 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6621
schedule_timeout+0x1be/0x310 kernel/time/timer.c:2581
wait_for_reconnect drivers/block/nbd.c:1023 [inline]
nbd_handle_cmd drivers/block/nbd.c:1065 [inline]
nbd_queue_rq+0x7cd/0x2f70 drivers/block/nbd.c:1123
blk_mq_dispatch_rq_list+0xb89/0x1b30 block/blk-mq.c:2032
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
__blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309
blk_mq_sched_dispatch_requests+0xcb/0x140 block/blk-mq-sched.c:331
blk_mq_run_hw_queue+0x576/0xae0 block/blk-mq.c:2245
blk_mq_flush_plug_list+0x1115/0x1880 block/blk-mq.c:2794
__blk_flush_plug+0x420/0x500 block/blk-core.c:1198
blk_finish_plug block/blk-core.c:1225 [inline]
__submit_bio+0x422/0x560 block/blk-core.c:623
__submit_bio_noacct_mq block/blk-core.c:696 [inline]
submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:725
submit_bh fs/buffer.c:2829 [inline]
block_read_full_folio+0x93b/0xcd0 fs/buffer.c:2456
filemap_read_folio+0x1a0/0x790 mm/filemap.c:2355
do_read_cache_folio+0x134/0x820 mm/filemap.c:3789
read_mapping_folio include/linux/pagemap.h:913 [inline]
read_part_sector+0xb3/0x330 block/partitions/core.c:712
adfspart_check_ICS+0xd9/0x9a0 block/partitions/acorn.c:360
check_partition block/partitions/core.c:138 [inline]
blk_add_partitions block/partitions/core.c:579 [inline]
bdev_disk_changed+0x72c/0x13d0 block/partitions/core.c:683
blkdev_get_whole+0x2d2/0x450 block/bdev.c:700
bdev_open+0x2d4/0xc60 block/bdev.c:909
blkdev_open+0x3e8/0x570 block/fops.c:630
do_dentry_open+0x970/0x1440 fs/open.c:959
vfs_open+0x3e/0x330 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2b3e/0x3470 fs/namei.c:3886
do_filp_open+0x235/0x490 fs/namei.c:3913
do_sys_openat2+0x13e/0x1d0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff5279169a4
RSP: 002b:00007fff30a69670 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055d33c0dfe10 RCX: 00007ff5279169a4
RDX: 00000000000a0800 RSI: 000055d33c0f5570 RDI: 00000000ffffff9c
RBP: 000055d33c0f5570 R08: 0000000000000001 R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000a0800
R13: 000055d33c0c7a90 R14: 0000000000000002 R15: 000055d33c0be910
</TASK>
INFO: task udevd:5245 blocked for more than 144 seconds.
Not tainted 6.11.0-rc4-syzkaller-00139-g4186c8d9e6af #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D stack:21632 pid:5245 tgid:5245 ppid:1 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5188 [inline]
__schedule+0x1800/0x4a60 kernel/sched/core.c:6529
__schedule_loop kernel/sched/core.c:6606 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6621
schedule_timeout+0x1be/0x310 kernel/time/timer.c:2581
wait_for_reconnect drivers/block/nbd.c:1023 [inline]
nbd_handle_cmd drivers/block/nbd.c:1065 [inline]
nbd_queue_rq+0x7cd/0x2f70 drivers/block/nbd.c:1123
blk_mq_dispatch_rq_list+0xb89/0x1b30 block/blk-mq.c:2032
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
__blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309
blk_mq_sched_dispatch_requests+0xcb/0x140 block/blk-mq-sched.c:331
blk_mq_run_hw_queue+0x576/0xae0 block/blk-mq.c:2245
blk_mq_flush_plug_list+0x1115/0x1880 block/blk-mq.c:2794
__blk_flush_plug+0x420/0x500 block/blk-core.c:1198
blk_finish_plug block/blk-core.c:1225 [inline]
__submit_bio+0x422/0x560 block/blk-core.c:623
__submit_bio_noacct_mq block/blk-core.c:696 [inline]
submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:725
submit_bh fs/buffer.c:2829 [inline]
block_read_full_folio+0x93b/0xcd0 fs/buffer.c:2456
filemap_read_folio+0x1a0/0x790 mm/filemap.c:2355
do_read_cache_folio+0x134/0x820 mm/filemap.c:3789
read_mapping_folio include/linux/pagemap.h:913 [inline]
read_part_sector+0xb3/0x330 block/partitions/core.c:712
adfspart_check_ICS+0xd9/0x9a0 block/partitions/acorn.c:360
check_partition block/partitions/core.c:138 [inline]
blk_add_partitions block/partitions/core.c:579 [inline]
bdev_disk_changed+0x72c/0x13d0 block/partitions/core.c:683
blkdev_get_whole+0x2d2/0x450 block/bdev.c:700
bdev_open+0x2d4/0xc60 block/bdev.c:909
blkdev_open+0x3e8/0x570 block/fops.c:630
do_dentry_open+0x970/0x1440 fs/open.c:959
vfs_open+0x3e/0x330 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2b3e/0x3470 fs/namei.c:3886
do_filp_open+0x235/0x490 fs/namei.c:3913
do_sys_openat2+0x13e/0x1d0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff5279169a4
RSP: 002b:00007fff30a69670 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055d33c0dfe10 RCX: 00007ff5279169a4
RDX: 00000000000a0800 RSI: 000055d33c0d2640 RDI: 00000000ffffff9c
RBP: 000055d33c0d2640 R08: 0000000000000001 R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000a0800
R13: 000055d33c0d3540 R14: 0000000000000002 R15: 000055d33c0be910
</TASK>
INFO: task udevd:5757 blocked for more than 145 seconds.
Not tainted 6.11.0-rc4-syzkaller-00139-g4186c8d9e6af #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D stack:21848 pid:5757 tgid:5757 ppid:1 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5188 [inline]
__schedule+0x1800/0x4a60 kernel/sched/core.c:6529
__schedule_loop kernel/sched/core.c:6606 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6621
schedule_timeout+0x1be/0x310 kernel/time/timer.c:2581
wait_for_reconnect drivers/block/nbd.c:1023 [inline]
nbd_handle_cmd drivers/block/nbd.c:1065 [inline]
nbd_queue_rq+0x7cd/0x2f70 drivers/block/nbd.c:1123
blk_mq_dispatch_rq_list+0xb89/0x1b30 block/blk-mq.c:2032
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
__blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309
blk_mq_sched_dispatch_requests+0xcb/0x140 block/blk-mq-sched.c:331
blk_mq_run_hw_queue+0x576/0xae0 block/blk-mq.c:2245
blk_mq_flush_plug_list+0x1115/0x1880 block/blk-mq.c:2794
__blk_flush_plug+0x420/0x500 block/blk-core.c:1198
blk_finish_plug block/blk-core.c:1225 [inline]
__submit_bio+0x422/0x560 block/blk-core.c:623
__submit_bio_noacct_mq block/blk-core.c:696 [inline]
submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:725
submit_bh fs/buffer.c:2829 [inline]
block_read_full_folio+0x93b/0xcd0 fs/buffer.c:2456
filemap_read_folio+0x1a0/0x790 mm/filemap.c:2355
do_read_cache_folio+0x134/0x820 mm/filemap.c:3789
read_mapping_folio include/linux/pagemap.h:913 [inline]
read_part_sector+0xb3/0x330 block/partitions/core.c:712
adfspart_check_ICS+0xd9/0x9a0 block/partitions/acorn.c:360
check_partition block/partitions/core.c:138 [inline]
blk_add_partitions block/partitions/core.c:579 [inline]
bdev_disk_changed+0x72c/0x13d0 block/partitions/core.c:683
blkdev_get_whole+0x2d2/0x450 block/bdev.c:700
bdev_open+0x2d4/0xc60 block/bdev.c:909
blkdev_open+0x3e8/0x570 block/fops.c:630
do_dentry_open+0x970/0x1440 fs/open.c:959
vfs_open+0x3e/0x330 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2b3e/0x3470 fs/namei.c:3886
do_filp_open+0x235/0x490 fs/namei.c:3913
do_sys_openat2+0x13e/0x1d0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff5279169a4
RSP: 002b:00007fff30a69670 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055d33c0f6020 RCX: 00007ff5279169a4
RDX: 00000000000a0800 RSI: 000055d33c0bf700 RDI: 00000000ffffff9c
RBP: 000055d33c0bf700 R08: 0000000000000001 R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000a0800
R13: 000055d33c0c7a90 R14: 0000000000000002 R15: 000055d33c0be910
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6626
3 locks held by kworker/0:2/59:
#0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffff8880b9228948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x441/0x770 kernel/sched/psi.c:989
#2: ffff8880b922a718 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x112/0x240 kernel/time/timer.c:1051
2 locks held by getty/4989:
#0: ffff88802aaca0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ac/0x1e00 drivers/tty/n_tty.c:2211
3 locks held by udevd/5231:
#0: ffff888020a0e4c8 (&disk->open_mutex){+.+.}-{3:3}, at: bdev_open+0xf0/0xc60 block/bdev.c:897
#1: ffff88801f6b3a10 (set->srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:151 [inline]
#1: ffff88801f6b3a10 (set->srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:250 [inline]
#1: ffff88801f6b3a10 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x54d/0xae0 block/blk-mq.c:2245
#2: ffff888020b30180 (&cmd->lock){+.+.}-{3:3}, at: nbd_queue_rq+0xfc/0x2f70 drivers/block/nbd.c:1115
3 locks held by udevd/5245:
#0: ffff8880206be4c8 (&disk->open_mutex){+.+.}-{3:3}, at: bdev_open+0xf0/0xc60 block/bdev.c:897
#1: ffff88801fc48410 (set->srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:151 [inline]
#1: ffff88801fc48410 (set->srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:250 [inline]
#1: ffff88801fc48410 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x54d/0xae0 block/blk-mq.c:2245
#2: ffff888020bb0180 (&cmd->lock){+.+.}-{3:3}, at: nbd_queue_rq+0xfc/0x2f70 drivers/block/nbd.c:1115
3 locks held by udevd/5757:
#0: ffff888020ab24c8 (&disk->open_mutex){+.+.}-{3:3}, at: bdev_open+0xf0/0xc60 block/bdev.c:897
#1: ffff88801f705110 (set->srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:151 [inline]
#1: ffff88801f705110 (set->srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:250 [inline]
#1: ffff88801f705110 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x54d/0xae0 block/blk-mq.c:2245
#2: ffff888021000180 (&cmd->lock){+.+.}-{3:3}, at: nbd_queue_rq+0xfc/0x2f70 drivers/block/nbd.c:1115
3 locks held by kworker/u8:9/6349:
#0: ffff88802a3f4948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff88802a3f4948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc90019d2fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc90019d2fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
#2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xd0/0x16f0 net/ipv6/addrconf.c:4194
2 locks held by syz.3.565/6932:
#0: ffffffff8fce9d30 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffffffff8ec07228 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_nl_listener_set_doit+0x12d/0x1a90 fs/nfsd/nfsctl.c:1956
1 lock held by syz-executor/9823:
#0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:328 [inline]
#0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:958
3 locks held by syz-executor/9925:
#0: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
#0: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
#1: ffff88802ca9d428 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x22d/0x420 drivers/net/wireguard/device.c:50
#2: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:296 [inline]
#2: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x381/0x830 kernel/rcu/tree_exp.h:958
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc4-syzkaller-00139-g4186c8d9e6af #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xff4/0x1040 kernel/hung_task.c:379
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 9925 Comm: syz-executor Not tainted 6.11.0-rc4-syzkaller-00139-g4186c8d9e6af #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:__lock_release kernel/locking/lockdep.c:5413 [inline]
RIP: 0010:lock_release+0x1c3/0xa30 kernel/locking/lockdep.c:5780
Code: 80 3c 3b 00 74 08 4c 89 f7 e8 a9 d6 8a 00 48 8b 9c 24 b0 00 00 00 fa 48 c7 c7 40 e2 0a 8c e8 e4 f2 46 0a 65 ff 05 fd 93 92 7e <48> 8d 94 24 80 00 00 00 48 c1 ea 03 42 0f b6 04 3a 84 c0 0f 85 6e
RSP: 0018:ffffc90000a18ce0 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 0000000000000046 RCX: ffffffff816ff570
RDX: 0000000000000000 RSI: ffffffff8c0ae240 RDI: ffffffff8c606d40
RBP: ffffc90000a18e10 R08: ffffffff9017f32f R09: 1ffffffff202fe65
R10: dffffc0000000000 R11: fffffbfff202fe66 R12: 1ffff920001431a8
R13: ffffffff8180ca80 R14: ffffc90000a18d90 R15: dffffc0000000000
FS: 000055558a9d4500(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3fd4ce8178 CR3: 000000007e6b8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<IRQ>
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
_raw_spin_unlock_irqrestore+0x79/0x140 kernel/locking/spinlock.c:194
hrtimer_interrupt+0x540/0x990 kernel/time/hrtimer.c:1825
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
__sysvec_apic_timer_interrupt+0x110/0x3f0 arch/x86/kernel/apic/apic.c:1049
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2010 [inline]
RIP: 0010:vprintk_emit+0x5ac/0x7c0 kernel/printk/printk.c:2347
Code: 06 20 00 4c 21 e3 0f 85 3a 01 00 00 e8 1d 01 20 00 4d 89 ec 4d 85 ff 75 07 e8 10 01 20 00 eb 06 e8 09 01 20 00 fb 44 8b 3c 24 <48> c7 c7 20 3d 81 8e 31 f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00
RSP: 0018:ffffc900169deb20 EFLAGS: 00000293
RAX: ffffffff81738a37 RBX: 0000000000000000 RCX: ffff888063078000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900169dec10 R08: ffffffff81738a15 R09: 1ffffffff26e6909
R10: dffffc0000000000 R11: fffffbfff26e690a R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffffff81738895 R15: 000000000000003e
dev_vprintk_emit+0x2ae/0x330 drivers/base/core.c:4912
dev_printk_emit+0xdd/0x120 drivers/base/core.c:4923
_dev_printk+0x135/0x180 drivers/base/core.c:4952
ieee80211_init_rate_ctrl_alg+0x5a2/0x620 net/mac80211/rate.c:1006
ieee80211_register_hw+0x2c73/0x3e10 net/mac80211/main.c:1519
mac80211_hwsim_new_radio+0x2a9f/0x4a90 drivers/net/wireless/virtual/mac80211_hwsim.c:5519
hwsim_new_radio_nl+0xece/0x2290 drivers/net/wireless/virtual/mac80211_hwsim.c:6203
genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
__sys_sendto+0x3a4/0x4f0 net/socket.c:2204
__do_sys_sendto net/socket.c:2216 [inline]
__se_sys_sendto net/socket.c:2212 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2212
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f40bc77bd0c
Code: 2a 5a 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5a 02 00 48 8b
RSP: 002b:00007ffde70ed440 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f40bd444620 RCX: 00007f40bc77bd0c
RDX: 0000000000000024 RSI: 00007f40bd444670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffde70ed494 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f40bd444670 R15: 0000000000000000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* [syzbot] possible deadlock in br_multicast_rcv (3)
@ 2023-01-16 16:40 syzbot
2026-04-23 16:10 ` Forwarded: test syzbot
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2023-01-16 16:40 UTC (permalink / raw)
To: axboe, bridge, davem, edumazet, hch, ivecera, jiri, kbusch, kuba,
lengchao, linux-kernel, linux-nvme, llvm, nathan, ndesaulniers,
netdev, pabeni, razor, roopa, sagi, syzkaller-bugs, trix
Hello,
syzbot found the following issue on:
HEAD commit: 60d86034b14e Merge tag 'mlx5-updates-2023-01-10' of git://..
git tree: net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1745e1ce480000
kernel config: https://syzkaller.appspot.com/x/.config?x=de2f853811ba4e08
dashboard link: https://syzkaller.appspot.com/bug?extid=d7b7f1412c02134efa6d
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16aa9b6e480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16645fd6480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b5b394a217aa/disk-60d86034.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f129c2da4b3a/vmlinux-60d86034.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6dbc96a4303d/bzImage-60d86034.xz
The issue was bisected to:
commit dda3248e7fc306e0ce3612ae96bdd9a36e2ab04f
Author: Chao Leng <lengchao@huawei.com>
Date: Thu Feb 4 07:55:11 2021 +0000
nvme: introduce a nvme_host_path_error helper
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1564ba0e480000
final oops: https://syzkaller.appspot.com/x/report.txt?x=1764ba0e480000
console output: https://syzkaller.appspot.com/x/log.txt?x=1364ba0e480000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d7b7f1412c02134efa6d@syzkaller.appspotmail.com
Fixes: dda3248e7fc3 ("nvme: introduce a nvme_host_path_error helper")
============================================
WARNING: possible recursive locking detected
6.2.0-rc2-syzkaller-00378-g60d86034b14e #0 Not tainted
--------------------------------------------
ksoftirqd/0/15 is trying to acquire lock:
ffff88814b52d338 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline]
ffff88814b52d338 (&br->multicast_lock){+.-.}-{2:2}, at: br_ip6_multicast_query net/bridge/br_multicast.c:3351 [inline]
ffff88814b52d338 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_ipv6_rcv net/bridge/br_multicast.c:3747 [inline]
ffff88814b52d338 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_rcv+0x2019/0x6830 net/bridge/br_multicast.c:3802
but task is already holding lock:
ffff88807ac21338 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline]
ffff88807ac21338 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x61/0x360 net/bridge/br_multicast.c:1752
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&br->multicast_lock);
lock(&br->multicast_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
5 locks held by ksoftirqd/0/15:
#0: ffffc90000147c50 ((&pmctx->ip6_own_query.timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:31 [inline]
#0: ffffc90000147c50 ((&pmctx->ip6_own_query.timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x7c0 kernel/time/timer.c:1690
#1: ffff88807ac21338 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline]
#1: ffff88807ac21338 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x61/0x360 net/bridge/br_multicast.c:1752
#2: ffffffff8c791b20 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x237/0x3ba0 net/core/dev.c:4166
#3: ffffffff8c791b20 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x237/0x3ba0 net/core/dev.c:4166
#4: ffffffff8c791b80 (rcu_read_lock){....}-{1:2}, at: br_dev_xmit+0x4/0x1620 net/bridge/br_device.c:29
stack backtrace:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.2.0-rc2-syzkaller-00378-g60d86034b14e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_deadlock_bug kernel/locking/lockdep.c:2990 [inline]
check_deadlock kernel/locking/lockdep.c:3033 [inline]
validate_chain kernel/locking/lockdep.c:3818 [inline]
__lock_acquire.cold+0x116/0x3a7 kernel/locking/lockdep.c:5055
lock_acquire kernel/locking/lockdep.c:5668 [inline]
lock_acquire+0x1e3/0x630 kernel/locking/lockdep.c:5633
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:350 [inline]
br_ip6_multicast_query net/bridge/br_multicast.c:3351 [inline]
br_multicast_ipv6_rcv net/bridge/br_multicast.c:3747 [inline]
br_multicast_rcv+0x2019/0x6830 net/bridge/br_multicast.c:3802
br_dev_xmit+0x726/0x1620 net/bridge/br_device.c:89
__netdev_start_xmit include/linux/netdevice.h:4865 [inline]
netdev_start_xmit include/linux/netdevice.h:4879 [inline]
xmit_one net/core/dev.c:3583 [inline]
dev_hard_start_xmit+0x1c2/0x990 net/core/dev.c:3599
__dev_queue_xmit+0x2cdf/0x3ba0 net/core/dev.c:4249
dev_queue_xmit include/linux/netdevice.h:3035 [inline]
vlan_dev_hard_start_xmit+0x1bc/0x5c0 net/8021q/vlan_dev.c:124
__netdev_start_xmit include/linux/netdevice.h:4865 [inline]
netdev_start_xmit include/linux/netdevice.h:4879 [inline]
xmit_one net/core/dev.c:3583 [inline]
dev_hard_start_xmit+0x1c2/0x990 net/core/dev.c:3599
__dev_queue_xmit+0x2cdf/0x3ba0 net/core/dev.c:4249
dev_queue_xmit include/linux/netdevice.h:3035 [inline]
br_dev_queue_push_xmit+0x26e/0x740 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:302 [inline]
__br_multicast_send_query+0x11c6/0x3b70 net/bridge/br_multicast.c:1656
br_multicast_send_query+0x266/0x4b0 net/bridge/br_multicast.c:1735
br_multicast_port_query_expired+0x2c3/0x360 net/bridge/br_multicast.c:1760
call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1700
expire_timers+0x2c6/0x5c0 kernel/time/timer.c:1751
__run_timers kernel/time/timer.c:2022 [inline]
__run_timers kernel/time/timer.c:1995 [inline]
run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
__do_softirq+0x1fb/0xadc kernel/softirq.c:571
run_ksoftirqd kernel/softirq.c:934 [inline]
run_ksoftirqd+0x31/0x60 kernel/softirq.c:926
smpboot_thread_fn+0x659/0xa20 kernel/smpboot.c:164
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2026-07-07 11:25 UTC | newest]
Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-06 21:44 [syzbot] [netfs?] WARNING in netfs_writepages (3) syzbot
2026-07-07 5:34 ` Forwarded: test syzbot
-- strict thread matches above, loose matches on Subject: below --
2026-06-04 21:33 [syzbot] [overlayfs?] [ext4?] possible deadlock in lock_two_nondirectories (2) syzbot
2026-06-08 15:46 ` Forwarded: test syzbot
2026-05-31 1:20 [syzbot] [block?] general protection fault in ublk_queue_rq syzbot
2026-06-01 18:58 ` Forwarded: test syzbot
2026-05-19 18:53 [syzbot] [net?] possible deadlock in __sk_receive_skb syzbot
2026-05-20 2:05 ` Forwarded: test syzbot
2026-05-20 9:15 ` syzbot
2026-05-20 10:27 ` syzbot
2026-05-20 14:33 ` syzbot
2026-05-19 11:56 [syzbot] [net?] WARNING in netif_rx_mode_run syzbot
2026-05-19 12:49 ` Forwarded: test syzbot
2026-05-20 9:34 ` syzbot
2026-05-18 1:17 [syzbot] [media?] KASAN: slab-use-after-free Read in dvb_frontend_open syzbot
2026-05-18 11:19 ` Forwarded: test syzbot
2026-05-19 0:36 ` syzbot
2025-11-13 8:08 [syzbot] [ext4?] possible deadlock in ext4_xattr_set_handle (7) syzbot
2026-06-09 8:41 ` Forwarded: test syzbot
2025-11-07 7:29 [syzbot] [jfs?] general protection fault in txCommit (2) syzbot
2025-11-14 13:48 ` Forwarded: test syzbot
2025-11-14 14:36 ` syzbot
2025-11-01 17:24 [syzbot] [jfs?] stack segment fault in dbUpdatePMap syzbot
2025-11-10 11:30 ` Forwarded: test syzbot
2025-09-30 20:29 [syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp syzbot
2025-11-06 19:28 ` Forwarded: test syzbot
2025-04-30 21:08 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbSplit (3) syzbot
2025-11-19 2:55 ` Forwarded: test syzbot
2025-04-30 13:26 [syzbot] [jfs?] UBSAN: shift-out-of-bounds in jfs_statfs (3) syzbot
2025-11-20 15:15 ` Forwarded: test syzbot
2024-10-03 19:10 [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtInsertEntry syzbot
2025-11-18 14:11 ` Forwarded: test syzbot
2024-08-28 0:09 [syzbot] [nbd?] INFO: task hung in nbd_queue_rq syzbot
2026-07-07 11:25 ` Forwarded: test syzbot
2023-01-16 16:40 [syzbot] possible deadlock in br_multicast_rcv (3) syzbot
2026-04-23 16:10 ` Forwarded: test syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox