[v6.6] kernel BUG in hfs_write_inode
2 views
Skip to first unread message
syzbot
Jun 16, 2025, 2:04:31 PM6/16/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c2603c511feb Linux 6.6.93
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=164d15d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=486bade17c8c30b9
dashboard link: https://syzkaller.appspot.com/bug?extid=905e5e4c2be48752878c
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8754f950a6e7/disk-c2603c51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b19332dbf63/vmlinux-c2603c51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb245e836038/bzImage-c2603c51.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+905e5e...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/hfs/inode.c:449!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1028 Comm: kworker/u4:5 Not tainted 6.6.93-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: writeback wb_workfn (flush-7:2)
RIP: 0010:hfs_write_inode+0x7c4/0x7d0 fs/hfs/inode.c:449
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RSP: 0000:ffffc9000421f360 EFLAGS: 00010293
RAX: ffffffff825832b4 RBX: ffff88801dbb1528 RCX: ffff888023960000
RDX: 0000000000000000 RSI: ffffffff8cf39e60 RDI: 0000000000000005
RBP: ffffc9000421f4f0 R08: ffff888023960000 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff92000843e70 R14: ffff88801dbb14d8 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c24ecdb CR3: 0000000022d4d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
write_inode fs/fs-writeback.c:1473 [inline]
__writeback_single_inode+0x705/0xee0 fs/fs-writeback.c:1690
writeback_sb_inodes+0x77c/0xef0 fs/fs-writeback.c:1916
wb_writeback+0x450/0xba0 fs/fs-writeback.c:2095
wb_do_writeback fs/fs-writeback.c:2242 [inline]
wb_workfn+0x3ff/0xe20 fs/fs-writeback.c:2282
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hfs_write_inode+0x7c4/0x7d0 fs/hfs/inode.c:449
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RSP: 0000:ffffc9000421f360 EFLAGS: 00010293
RAX: ffffffff825832b4 RBX: ffff88801dbb1528 RCX: ffff888023960000
RDX: 0000000000000000 RSI: ffffffff8cf39e60 RDI: 0000000000000005
RBP: ffffc9000421f4f0 R08: ffff888023960000 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff92000843e70 R14: ffff88801dbb14d8 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f99a4e7f990 CR3: 000000005703d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: c2603c511feb Linux 6.6.93
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=164d15d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=486bade17c8c30b9
dashboard link: https://syzkaller.appspot.com/bug?extid=905e5e4c2be48752878c
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8754f950a6e7/disk-c2603c51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b19332dbf63/vmlinux-c2603c51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb245e836038/bzImage-c2603c51.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+905e5e...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/hfs/inode.c:449!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1028 Comm: kworker/u4:5 Not tainted 6.6.93-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: writeback wb_workfn (flush-7:2)
RIP: 0010:hfs_write_inode+0x7c4/0x7d0 fs/hfs/inode.c:449
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RSP: 0000:ffffc9000421f360 EFLAGS: 00010293
RAX: ffffffff825832b4 RBX: ffff88801dbb1528 RCX: ffff888023960000
RDX: 0000000000000000 RSI: ffffffff8cf39e60 RDI: 0000000000000005
RBP: ffffc9000421f4f0 R08: ffff888023960000 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff92000843e70 R14: ffff88801dbb14d8 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c24ecdb CR3: 0000000022d4d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
write_inode fs/fs-writeback.c:1473 [inline]
__writeback_single_inode+0x705/0xee0 fs/fs-writeback.c:1690
writeback_sb_inodes+0x77c/0xef0 fs/fs-writeback.c:1916
wb_writeback+0x450/0xba0 fs/fs-writeback.c:2095
wb_do_writeback fs/fs-writeback.c:2242 [inline]
wb_workfn+0x3ff/0xe20 fs/fs-writeback.c:2282
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hfs_write_inode+0x7c4/0x7d0 fs/hfs/inode.c:449
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RSP: 0000:ffffc9000421f360 EFLAGS: 00010293
RAX: ffffffff825832b4 RBX: ffff88801dbb1528 RCX: ffff888023960000
RDX: 0000000000000000 RSI: ffffffff8cf39e60 RDI: 0000000000000005
RBP: ffffc9000421f4f0 R08: ffff888023960000 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff92000843e70 R14: ffff88801dbb14d8 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f99a4e7f990 CR3: 000000005703d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jun 17, 2025, 2:56:30 PM6/17/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: c2603c511feb Linux 6.6.93
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=125f350c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=165f350c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8754f950a6e7/disk-c2603c51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b19332dbf63/vmlinux-c2603c51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb245e836038/bzImage-c2603c51.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/d47a13ed5c31/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+905e5e...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/hfs/inode.c:449!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 2940 Comm: kworker/u4:8 Not tainted 6.6.93-syzkaller #0
RAX: ffffffff825832b4 RBX: ffff88802f8e9ba8 RCX: ffff88802c5a9e00
RAX: ffffffff825832b4 RBX: ffff88802f8e9ba8 RCX: ffff88802c5a9e00
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: c2603c511feb Linux 6.6.93
git tree: linux-6.6.y
kernel config: https://syzkaller.appspot.com/x/.config?x=486bade17c8c30b9
dashboard link: https://syzkaller.appspot.com/bug?extid=905e5e4c2be48752878c
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11b5c370580000
dashboard link: https://syzkaller.appspot.com/bug?extid=905e5e4c2be48752878c
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=165f350c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8754f950a6e7/disk-c2603c51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b19332dbf63/vmlinux-c2603c51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb245e836038/bzImage-c2603c51.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+905e5e...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/hfs/inode.c:449!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:hfs_write_inode+0x7c4/0x7d0 fs/hfs/inode.c:449
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RSP: 0018:ffffc9000bbe7360 EFLAGS: 00010293
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RAX: ffffffff825832b4 RBX: ffff88802f8e9ba8 RCX: ffff88802c5a9e00
RDX: 0000000000000000 RSI: ffffffff8cf39e60 RDI: 0000000000000005
RBP: ffffc9000bbe74f0 R08: ffff88802c5a9e00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff9200177ce70 R14: ffff88802f8e9b58 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7544e31130 CR3: 000000000cb30000 CR4: 00000000003506e0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
write_inode fs/fs-writeback.c:1473 [inline]
__writeback_single_inode+0x705/0xee0 fs/fs-writeback.c:1690
writeback_sb_inodes+0x77c/0xef0 fs/fs-writeback.c:1916
wb_writeback+0x450/0xba0 fs/fs-writeback.c:2095
wb_do_writeback fs/fs-writeback.c:2242 [inline]
wb_workfn+0x3ff/0xe20 fs/fs-writeback.c:2282
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hfs_write_inode+0x7c4/0x7d0 fs/hfs/inode.c:449
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RSP: 0018:ffffc9000bbe7360 EFLAGS: 00010293
<TASK>
write_inode fs/fs-writeback.c:1473 [inline]
__writeback_single_inode+0x705/0xee0 fs/fs-writeback.c:1690
writeback_sb_inodes+0x77c/0xef0 fs/fs-writeback.c:1916
wb_writeback+0x450/0xba0 fs/fs-writeback.c:2095
wb_do_writeback fs/fs-writeback.c:2242 [inline]
wb_workfn+0x3ff/0xe20 fs/fs-writeback.c:2282
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hfs_write_inode+0x7c4/0x7d0 fs/hfs/inode.c:449
Code: c7 c1 00 e3 ec 96 80 e1 07 80 c1 03 38 c1 0f 8c 7d fe ff ff 48 c7 c7 00 e3 ec 96 e8 06 09 86 ff e9 6c fe ff ff e8 2c 64 2d ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 41 57 41 56 41
RAX: ffffffff825832b4 RBX: ffff88802f8e9ba8 RCX: ffff88802c5a9e00
RDX: 0000000000000000 RSI: ffffffff8cf39e60 RDI: 0000000000000005
RBP: ffffc9000bbe74f0 R08: ffff88802c5a9e00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff9200177ce70 R14: ffff88802f8e9b58 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557997f40980 CR3: 000000000cb30000 CR4: 00000000003506f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Dec 31, 2025, 2:03:05 PM12/31/25
to syzkaller...@googlegroups.com
syzbot suspects this issue could be fixed by backporting the following commit:
commit 42b0ef01e6b5e9c77b383d32c25a0ec2a735d08a
git tree: upstream
Author: Arnd Bergmann <ar...@arndb.de>
Date: Fri Jul 11 08:46:51 2025 +0000
block: fix FS_IOC_GETLBMD_CAP parsing in blkdev_common_ioctl()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=100a4a9a580000
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 42b0ef01e6b5e9c77b383d32c25a0ec2a735d08a
git tree: upstream
Author: Arnd Bergmann <ar...@arndb.de>
Date: Fri Jul 11 08:46:51 2025 +0000
block: fix FS_IOC_GETLBMD_CAP parsing in blkdev_common_ioctl()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=100a4a9a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=486bade17c8c30b9
dashboard link: https://syzkaller.appspot.com/bug?extid=905e5e4c2be48752878c
dashboard link: https://syzkaller.appspot.com/bug?extid=905e5e4c2be48752878c
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11b5c370580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=165f350c580000
Please keep in mind that other backports might be required as well.
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=165f350c580000
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages