[v6.1] BUG: unable to handle kernel paging request in kernfs_link_sibling

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0bc96de781b4 Linux 6.1.148
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=168f1462580000
kernel config: https://syzkaller.appspot.com/x/.config?x=483f799cd9933afc
dashboard link: https://syzkaller.appspot.com/bug?extid=6f4dfc6415949d366b60
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cd15350f801a/disk-0bc96de7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/789a5d74139d/vmlinux-0bc96de7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a1ef0a7e815a/Image-0bc96de7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6f4dfc...@syzkaller.appspotmail.com

device bridge_slave_0 entered promiscuous mode
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_1 entered promiscuous mode
Unable to handle kernel paging request at virtual address 001f7fe0001a162c
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[001f7fe0001a162c] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4708 Comm: syz-executor Not tainted 6.1.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : kernfs_name_compare fs/kernfs/dir.c:334 [inline]
pc : kernfs_sd_compare fs/kernfs/dir.c:348 [inline]
pc : kernfs_link_sibling+0xc4/0x364 fs/kernfs/dir.c:375
lr : kernfs_link_sibling+0x138/0x364 fs/kernfs/dir.c:369
sp : ffff800022f96a50
x29: ffff800022f96a50 x28: 0000000000000008 x27: ffff0000d8c91c40
x26: 68ffff0000d0b140 x25: 1fffe00019b9feb4 x24: dfff800000000000
x23: 68ffff0000d0b160 x22: ffff0000ccbe8a00 x21: 000000004b3111be
x20: ffff0000cdcff570 x19: ffff0000cdcff5a0 x18: 00000000dbaad652
x17: dfff800000000000 x16: ffff8000082cdba8 x15: 0000000000000000
x14: 000000001194919c x13: 1ffff00002a160b1 x12: 0000000000ff0100
x11: ff00800008bb5558 x10: 0000000000000000 x9 : 0000000000000003
x8 : 0d1fffe0001a162c x7 : ffff800008bb4dec x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082cdd9c
x2 : 0000000000000001 x1 : 0000000000498b7c x0 : 000000004b3111be
Call trace:
kernfs_name_compare fs/kernfs/dir.c:334 [inline]
kernfs_sd_compare fs/kernfs/dir.c:348 [inline]
kernfs_link_sibling+0xc4/0x364 fs/kernfs/dir.c:375
kernfs_add_one+0x25c/0x6cc fs/kernfs/dir.c:785
kernfs_create_link+0x13c/0x1e0 fs/kernfs/symlink.c:48
sysfs_do_create_link_sd+0x8c/0x120 fs/sysfs/symlink.c:44
sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
sysfs_create_link+0x74/0x94 fs/sysfs/symlink.c:92
device_add_class_symlinks drivers/base/core.c:3439 [inline]
device_add+0x7a0/0xf94 drivers/base/core.c:3645
netdev_register_kobject+0x158/0x2d4 net/core/net-sysfs.c:2013
register_netdevice+0xef8/0x15cc net/core/dev.c:10192
veth_newlink+0x44c/0xa24 drivers/net/veth.c:1724
rtnl_newlink_create net/core/rtnetlink.c:3422 [inline]
__rtnl_newlink net/core/rtnetlink.c:3642 [inline]
rtnl_newlink+0x102c/0x1a1c net/core/rtnetlink.c:3655
rtnetlink_rcv_msg+0x734/0xce4 net/core/rtnetlink.c:6153
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2511
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6171
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x60c/0x824 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1872
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
__sys_sendto+0x304/0x3fc net/socket.c:2153
__do_sys_sendto net/socket.c:2165 [inline]
__se_sys_sendto net/socket.c:2161 [inline]
__arm64_sys_sendto+0xd8/0xf8 net/socket.c:2161
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91008357 d343fee8 12000ae9 11000d29 (38f86908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 91008357 add x23, x26, #0x20
4: d343fee8 lsr x8, x23, #3
8: 12000ae9 and w9, w23, #0x7
c: 11000d29 add w9, w9, #0x3
* 10: 38f86908 ldrsb w8, [x8, x24] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup