[v6.6] general protection fault in lock_sock_nested
3 views
Skip to first unread message
syzbot
Jun 19, 2025, 12:51:32 AM6/19/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c2603c511feb Linux 6.6.93
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16166370580000
kernel config: https://syzkaller.appspot.com/x/.config?x=486bade17c8c30b9
dashboard link: https://syzkaller.appspot.com/bug?extid=aeda1232b2d36276f64e
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8754f950a6e7/disk-c2603c51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b19332dbf63/vmlinux-c2603c51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb245e836038/bzImage-c2603c51.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeda12...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
CPU: 0 PID: 5843 Comm: kworker/0:5 Not tainted 6.6.93-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 4f dd e2 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d be c9 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 d1 3c 77 00 48 8b
RSP: 0000:ffffc900048df600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200091bee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900048df848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c934ee R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802bb93c00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c24a84d CR3: 0000000065f6c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3510
lock_sock include/net/sock.h:1731 [inline]
l2cap_sock_ready_cb+0x45/0x130 net/bluetooth/l2cap_sock.c:1658
l2cap_chan_ready net/bluetooth/l2cap_core.c:1263 [inline]
l2cap_conn_start+0x753/0xe40 net/bluetooth/l2cap_core.c:1512
l2cap_info_timeout+0x68/0xa0 net/bluetooth/l2cap_core.c:1669
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 4f dd e2 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d be c9 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 d1 3c 77 00 48 8b
RSP: 0000:ffffc900048df600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200091bee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900048df848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c934ee R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802bb93c00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c24a84d CR3: 0000000065f6c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 85 dc test %ebx,%esp
2: 66 00 00 data16 add %al,(%rax)
5: 83 3d 4f dd e2 0c 00 cmpl $0x0,0xce2dd4f(%rip) # 0xce2dd5b
c: 48 89 9c 24 f0 00 00 mov %rbx,0xf0(%rsp)
13: 00
14: 0f 84 11 10 00 00 je 0x102b
1a: 83 3d be c9 58 0b 00 cmpl $0x0,0xb58c9be(%rip) # 0xb58c9df
21: 74 36 je 0x59
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 00 00 cmpb $0x0,(%rax,%r8,1) <-- trapping instruction
2f: 74 1f je 0x50
31: 48 8b bc 24 88 00 00 mov 0x88(%rsp),%rdi
38: 00
39: e8 d1 3c 77 00 call 0x773d0f
3e: 48 rex.W
3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: c2603c511feb Linux 6.6.93
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16166370580000
kernel config: https://syzkaller.appspot.com/x/.config?x=486bade17c8c30b9
dashboard link: https://syzkaller.appspot.com/bug?extid=aeda1232b2d36276f64e
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8754f950a6e7/disk-c2603c51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b19332dbf63/vmlinux-c2603c51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb245e836038/bzImage-c2603c51.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeda12...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
CPU: 0 PID: 5843 Comm: kworker/0:5 Not tainted 6.6.93-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 4f dd e2 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d be c9 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 d1 3c 77 00 48 8b
RSP: 0000:ffffc900048df600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200091bee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900048df848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c934ee R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802bb93c00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c24a84d CR3: 0000000065f6c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3510
lock_sock include/net/sock.h:1731 [inline]
l2cap_sock_ready_cb+0x45/0x130 net/bluetooth/l2cap_sock.c:1658
l2cap_chan_ready net/bluetooth/l2cap_core.c:1263 [inline]
l2cap_conn_start+0x753/0xe40 net/bluetooth/l2cap_core.c:1512
l2cap_info_timeout+0x68/0xa0 net/bluetooth/l2cap_core.c:1669
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 4f dd e2 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d be c9 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 d1 3c 77 00 48 8b
RSP: 0000:ffffc900048df600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200091bee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900048df848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c934ee R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802bb93c00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c24a84d CR3: 0000000065f6c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 85 dc test %ebx,%esp
2: 66 00 00 data16 add %al,(%rax)
5: 83 3d 4f dd e2 0c 00 cmpl $0x0,0xce2dd4f(%rip) # 0xce2dd5b
c: 48 89 9c 24 f0 00 00 mov %rbx,0xf0(%rsp)
13: 00
14: 0f 84 11 10 00 00 je 0x102b
1a: 83 3d be c9 58 0b 00 cmpl $0x0,0xb58c9be(%rip) # 0xb58c9df
21: 74 36 je 0x59
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 00 00 cmpb $0x0,(%rax,%r8,1) <-- trapping instruction
2f: 74 1f je 0x50
31: 48 8b bc 24 88 00 00 mov 0x88(%rsp),%rdi
38: 00
39: e8 d1 3c 77 00 call 0x773d0f
3e: 48 rex.W
3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 27, 2025, 8:19:38 AM8/27/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: bb9c90ab9c5a Linux 6.6.102
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16365ef0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7b989b97a0687b0a
dashboard link: https://syzkaller.appspot.com/bug?extid=aeda1232b2d36276f64e
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172bc634580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/44e2224124c3/disk-bb9c90ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/33e0aef7ff42/vmlinux-bb9c90ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0515bc436228/bzImage-bb9c90ab.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeda12...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
CPU: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.6.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RSP: 0018:ffffc900000d7600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200001aee4 RCX: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c95106 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88801a645a00 R15: 0000000000000000
RSP: 0018:ffffc900000d7600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200001aee4 RCX: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c95106 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88801a645a00 R15: 0000000000000000
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: bb9c90ab9c5a Linux 6.6.102
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16365ef0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7b989b97a0687b0a
dashboard link: https://syzkaller.appspot.com/bug?extid=aeda1232b2d36276f64e
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172bc634580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/44e2224124c3/disk-bb9c90ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/33e0aef7ff42/vmlinux-bb9c90ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0515bc436228/bzImage-bb9c90ab.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeda12...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 2f b8 e3 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d 3e c8 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 71 cd 75 00 48 8b
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
RSP: 0018:ffffc900000d7600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200001aee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900000d7848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c95106 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88801a645a00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe5c39d020 CR3: 0000000030645000 CR4: 00000000003506f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Call Trace:
<TASK>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3510
lock_sock include/net/sock.h:1731 [inline]
l2cap_sock_ready_cb+0x45/0x130 net/bluetooth/l2cap_sock.c:1658
l2cap_chan_ready net/bluetooth/l2cap_core.c:1263 [inline]
l2cap_conn_start+0x753/0xe40 net/bluetooth/l2cap_core.c:1512
l2cap_info_timeout+0x68/0xa0 net/bluetooth/l2cap_core.c:1669
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 2f b8 e3 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d 3e c8 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 71 cd 75 00 48 8b
<TASK>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3510
lock_sock include/net/sock.h:1731 [inline]
l2cap_sock_ready_cb+0x45/0x130 net/bluetooth/l2cap_sock.c:1658
l2cap_chan_ready net/bluetooth/l2cap_core.c:1263 [inline]
l2cap_conn_start+0x753/0xe40 net/bluetooth/l2cap_core.c:1512
l2cap_info_timeout+0x68/0xa0 net/bluetooth/l2cap_core.c:1669
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
RSP: 0018:ffffc900000d7600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff9200001aee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900000d7848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c95106 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88801a645a00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe5c39d020 CR3: 0000000030645000 CR4: 00000000003506f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
----------------
Code disassembly (best guess):
0: 85 dc test %ebx,%esp
2: 66 00 00 data16 add %al,(%rax)
5: 83 3d 2f b8 e3 0c 00 cmpl $0x0,0xce3b82f(%rip) # 0xce3b83b
Code disassembly (best guess):
0: 85 dc test %ebx,%esp
2: 66 00 00 data16 add %al,(%rax)
c: 48 89 9c 24 f0 00 00 mov %rbx,0xf0(%rsp)
13: 00
14: 0f 84 11 10 00 00 je 0x102b
1a: 83 3d 3e c8 58 0b 00 cmpl $0x0,0xb58c83e(%rip) # 0xb58c85f
13: 00
14: 0f 84 11 10 00 00 je 0x102b
21: 74 36 je 0x59
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 00 00 cmpb $0x0,(%rax,%r8,1) <-- trapping instruction
2f: 74 1f je 0x50
31: 48 8b bc 24 88 00 00 mov 0x88(%rsp),%rdi
38: 00
39: e8 71 cd 75 00 call 0x75cdaf
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 00 00 cmpb $0x0,(%rax,%r8,1) <-- trapping instruction
2f: 74 1f je 0x50
31: 48 8b bc 24 88 00 00 mov 0x88(%rsp),%rdi
38: 00
3e: 48 rex.W
3f: 8b .byte 0x8b
---
If you want syzbot to run the reproducer, reply with:
3f: 8b .byte 0x8b
---
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Oct 16, 2025, 6:28:37 PM10/16/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 0bbbd97a442d Linux 6.6.112
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1363e5e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=aeda1232b2d36276f64e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15c8ec58580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10718492580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7e387d57d751/disk-0bbbd97a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/810d42505365/vmlinux-0bbbd97a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d2fe115c227/bzImage-0bbbd97a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeda12...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
CPU: 0 PID: 5954 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RSP: 0018:ffffc900045bf4c0 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff920008b7ebc RCX: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c950ae R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802b850000 R15: 0000000000000000
FS: 000055555dc4d500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
lock_sock include/net/sock.h:1767 [inline]
rose_kill_by_device net/rose/af_rose.c:210 [inline]
rose_device_event+0x36a/0x670 net/rose/af_rose.c:244
notifier_call_chain+0x197/0x390 kernel/notifier.c:93
call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
call_netdevice_notifiers net/core/dev.c:2078 [inline]
__dev_notify_flags+0x18e/0x2e0 net/core/dev.c:-1
dev_change_flags+0xe8/0x1a0 net/core/dev.c:8762
dev_ifsioc+0x6a7/0xe20 net/core/dev_ioctl.c:529
dev_ioctl+0x7e2/0x1170 net/core/dev_ioctl.c:786
sock_do_ioctl+0x226/0x2f0 net/socket.c:1236
sock_ioctl+0x623/0x7a0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5bb458eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcab3f9938 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5bb47e5fa0 RCX: 00007f5bb458eec9
RDX: 0000200000000300 RSI: 0000000000008914 RDI: 0000000000000004
RBP: 00007f5bb4611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5bb47e5fa0 R14: 00007f5bb47e5fa0 R15: 0000000000000003
RSP: 0018:ffffc900045bf4c0 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff920008b7ebc RCX: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c950ae R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802b850000 R15: 0000000000000000
FS: 000055555dc4d500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
HEAD commit: 0bbbd97a442d Linux 6.6.112
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1363e5e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=aeda1232b2d36276f64e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15c8ec58580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10718492580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7e387d57d751/disk-0bbbd97a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/810d42505365/vmlinux-0bbbd97a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d2fe115c227/bzImage-0bbbd97a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeda12...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 2f c0 e3 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d fe d5 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 b1 e9 75 00 48 8b
RSP: 0018:ffffc900045bf4c0 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff920008b7ebc RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900045bf708 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c950ae R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802b850000 R15: 0000000000000000
FS: 000055555dc4d500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000002c0 CR3: 0000000076ade000 CR4: 00000000003506f0
Call Trace:
<TASK>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3532
<TASK>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
lock_sock include/net/sock.h:1767 [inline]
rose_kill_by_device net/rose/af_rose.c:210 [inline]
rose_device_event+0x36a/0x670 net/rose/af_rose.c:244
notifier_call_chain+0x197/0x390 kernel/notifier.c:93
call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
call_netdevice_notifiers net/core/dev.c:2078 [inline]
__dev_notify_flags+0x18e/0x2e0 net/core/dev.c:-1
dev_change_flags+0xe8/0x1a0 net/core/dev.c:8762
dev_ifsioc+0x6a7/0xe20 net/core/dev_ioctl.c:529
dev_ioctl+0x7e2/0x1170 net/core/dev_ioctl.c:786
sock_do_ioctl+0x226/0x2f0 net/socket.c:1236
sock_ioctl+0x623/0x7a0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5bb458eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcab3f9938 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5bb47e5fa0 RCX: 00007f5bb458eec9
RDX: 0000200000000300 RSI: 0000000000008914 RDI: 0000000000000004
RBP: 00007f5bb4611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5bb47e5fa0 R14: 00007f5bb47e5fa0 R15: 0000000000000003
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d 2f c0 e3 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d fe d5 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 b1 e9 75 00 48 8b
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
RSP: 0018:ffffc900045bf4c0 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff920008b7ebc RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc900045bf708 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c950ae R12: 0000000000000001
R13: 0000000000000000 R14: ffff88802b850000 R15: 0000000000000000
FS: 000055555dc4d500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000002c0 CR3: 0000000076ade000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: 85 dc test %ebx,%esp
2: 66 00 00 data16 add %al,(%rax)
5: 83 3d 2f c0 e3 0c 00 cmpl $0x0,0xce3c02f(%rip) # 0xce3c03b
Code disassembly (best guess):
0: 85 dc test %ebx,%esp
2: 66 00 00 data16 add %al,(%rax)
c: 48 89 9c 24 f0 00 00 mov %rbx,0xf0(%rsp)
13: 00
14: 0f 84 11 10 00 00 je 0x102b
1a: 83 3d fe d5 58 0b 00 cmpl $0x0,0xb58d5fe(%rip) # 0xb58d61f
13: 00
14: 0f 84 11 10 00 00 je 0x102b
21: 74 36 je 0x59
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 00 00 cmpb $0x0,(%rax,%r8,1) <-- trapping instruction
2f: 74 1f je 0x50
31: 48 8b bc 24 88 00 00 mov 0x88(%rsp),%rdi
38: 00
39: e8 b1 e9 75 00 call 0x75e9ef
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 00 00 cmpb $0x0,(%rax,%r8,1) <-- trapping instruction
2f: 74 1f je 0x50
31: 48 8b bc 24 88 00 00 mov 0x88(%rsp),%rdi
38: 00
3e: 48 rex.W
3f: 8b .byte 0x8b
---
3f: 8b .byte 0x8b
---
Reply all
Reply to author
Forward
0 new messages