[v5.15] general protection fault in i915_pci_probe
2 views
Skip to first unread message
syzbot
Aug 4, 2026, 5:46:34 PM (2 days ago) Aug 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1765fc9e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=6755b1b4bc8ee75fcba4
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6755b1...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 PID: 4266 Comm: kworker/0:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90003d4fae0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88801e55d940
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff888141db6000
RBP: ffffc90003d4fbd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920007a9f64
R13: ffff888141db6000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c28749d CR3: 000000005fdda000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
local_pci_probe+0xc5/0x150 drivers/pci/pci-driver.c:323
work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5217
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace a90cd83599c05873 ]---
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90003d4fae0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88801e55d940
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff888141db6000
RBP: ffffc90003d4fbd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920007a9f64
R13: ffff888141db6000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe1db2e8d58 CR3: 000000002a8cd000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: fd std
1: fc cld
2: 49 8d 5e 18 lea 0x18(%r14),%rbx
6: 48 89 d8 mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 5d 83 42 fd call 0xfd428379
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 28 add $0x28,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 e0 02 00 00 jne 0x317
37: 0f b7 1b movzwl (%rbx),%ebx
3a: 89 de mov %ebx,%esi
3c: 83 e6 04 and $0x4,%esi
3f: 31 .byte 0x31
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1765fc9e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=6755b1b4bc8ee75fcba4
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6755b1...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 PID: 4266 Comm: kworker/0:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90003d4fae0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88801e55d940
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff888141db6000
RBP: ffffc90003d4fbd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920007a9f64
R13: ffff888141db6000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c28749d CR3: 000000005fdda000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
local_pci_probe+0xc5/0x150 drivers/pci/pci-driver.c:323
work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5217
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace a90cd83599c05873 ]---
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90003d4fae0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88801e55d940
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff888141db6000
RBP: ffffc90003d4fbd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920007a9f64
R13: ffff888141db6000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe1db2e8d58 CR3: 000000002a8cd000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: fd std
1: fc cld
2: 49 8d 5e 18 lea 0x18(%r14),%rbx
6: 48 89 d8 mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 5d 83 42 fd call 0xfd428379
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 28 add $0x28,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 e0 02 00 00 jne 0x317
37: 0f b7 1b movzwl (%rbx),%ebx
3a: 89 de mov %ebx,%esi
3c: 83 e6 04 and $0x4,%esi
3f: 31 .byte 0x31
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 4, 2026, 7:47:37 PM (2 days ago) Aug 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
syzbot found the following issue on:
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11fb4bb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=1cf59a49c4b7f302073e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9a6fe2a54d0f/disk-fb28aa72.raw.xz
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
vmlinux: https://storage.googleapis.com/syzbot-assets/742b23a1d931/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b3f257c16d2e/bzImage-fb28aa72.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:i915_pci_probe+0x56/0x470 drivers/gpu/drm/i915/i915_pci.c:1330
Workqueue: events work_for_cpu_fn
Code: 7b 18 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 ec 4f 23 fd 4d 8b 3f 49 8d 5f 11 4d 8d 6f 14 49 89 dc 49 c1 ec 03 <43> 0f b6 04 34 84 c0 0f 85 ad 02 00 00 4c 89 e8 48 c1 e8 03 42 0f
RSP: 0018:ffffc900000c7b90 EFLAGS: 00010202
RAX: 1ffffffff15c74b3 RBX: 0000000000000011 RCX: ffff88813fe6bc00
RDX: 0000000000000000 RSI: ffffffff8ae3a580 RDI: ffff88801d6c6000
RBP: dffffc0000000000 R08: ffffffff90b1028f R09: 1ffffffff2162051
R10: dffffc0000000000 R11: fffffbfff2162052 R12: 0000000000000002
R13: 0000000000000014 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c389b38 CR3: 0000000025e61000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
local_pci_probe+0xc5/0x150 drivers/pci/pci-driver.c:324
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5184
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:i915_pci_probe+0x56/0x470 drivers/gpu/drm/i915/i915_pci.c:1330
Code: 7b 18 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 ec 4f 23 fd 4d 8b 3f 49 8d 5f 11 4d 8d 6f 14 49 89 dc 49 c1 ec 03 <43> 0f b6 04 34 84 c0 0f 85 ad 02 00 00 4c 89 e8 48 c1 e8 03 42 0f
RSP: 0018:ffffc900000c7b90 EFLAGS: 00010202
RAX: 1ffffffff15c74b3 RBX: 0000000000000011 RCX: ffff88813fe6bc00
RDX: 0000000000000000 RSI: ffffffff8ae3a580 RDI: ffff88801d6c6000
RBP: dffffc0000000000 R08: ffffffff90b1028f R09: 1ffffffff2162051
R10: dffffc0000000000 R11: fffffbfff2162052 R12: 0000000000000002
R13: 0000000000000014 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdc68c27dac CR3: 000000005c5ef000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 7b 18 jnp 0x1a
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
2: 4c 89 f8 mov %r15,%rax
5: 48 c1 e8 03 shr $0x3,%rax
9: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
e: 74 08 je 0x18
10: 4c 89 ff mov %r15,%rdi
13: e8 ec 4f 23 fd call 0xfd235004
18: 4d 8b 3f mov (%r15),%r15
1b: 49 8d 5f 11 lea 0x11(%r15),%rbx
1f: 4d 8d 6f 14 lea 0x14(%r15),%r13
23: 49 89 dc mov %rbx,%r12
26: 49 c1 ec 03 shr $0x3,%r12
* 2a: 43 0f b6 04 34 movzbl (%r12,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 ad 02 00 00 jne 0x2e4
37: 4c 89 e8 mov %r13,%rax
3a: 48 c1 e8 03 shr $0x3,%rax
3e: 42 rex.X
3f: 0f .byte 0xf
syzbot
Aug 4, 2026, 8:26:39 PM (2 days ago) Aug 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: aa0e49877a2e Linux 6.6.148
syzbot found the following issue on:
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17eb5bb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=e7feb57aef2b39e39f20
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f83b390cfc1f/disk-aa0e4987.raw.xz
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
vmlinux: https://storage.googleapis.com/syzbot-assets/1d4bdb338edd/vmlinux-aa0e4987.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3f57c1d51ee3/bzImage-aa0e4987.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 0 PID: 173 Comm: kworker/0:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:i915_pci_probe+0x58/0x470 drivers/gpu/drm/i915/i915_pci.c:1017
Workqueue: events work_for_cpu_fn
Code: 7b 18 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 0a 2b 03 fd 4d 8b 3f 49 8d 5f 1c 4d 8d 6f 23 49 89 dc 49 c1 ec 03 <43> 0f b6 04 34 84 c0 0f 85 b9 02 00 00 4c 89 e8 48 c1 e8 03 42 0f
RSP: 0000:ffffc90002e57b10 EFLAGS: 00010207
RAX: 1ffffffff164230f RBX: 000000000000001c RCX: ffff88801bba3c00
RDX: 0000000000000000 RSI: ffffffff8b211860 RDI: ffff888019ad6000
RBP: ffff888019ad6000 R08: ffffffff911eb557 R09: 1ffffffff223d6aa
R10: dffffc0000000000 R11: fffffbfff223d6ab R12: 0000000000000003
R13: 0000000000000023 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f44a80214c0 CR3: 0000000064a37000 CR4: 00000000003506f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Call Trace:
<TASK>
local_pci_probe+0xc9/0x150 drivers/pci/pci-driver.c:324
work_for_cpu_fn+0x54/0x80 kernel/workqueue.c:5704
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:i915_pci_probe+0x58/0x470 drivers/gpu/drm/i915/i915_pci.c:1017
Modules linked in:
---[ end trace 0000000000000000 ]---
Code: 7b 18 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 0a 2b 03 fd 4d 8b 3f 49 8d 5f 1c 4d 8d 6f 23 49 89 dc 49 c1 ec 03 <43> 0f b6 04 34 84 c0 0f 85 b9 02 00 00 4c 89 e8 48 c1 e8 03 42 0f
RSP: 0000:ffffc90002e57b10 EFLAGS: 00010207
RAX: 1ffffffff164230f RBX: 000000000000001c RCX: ffff88801bba3c00
RDX: 0000000000000000 RSI: ffffffff8b211860 RDI: ffff888019ad6000
RBP: ffff888019ad6000 R08: ffffffff911eb557 R09: 1ffffffff223d6aa
R10: dffffc0000000000 R11: fffffbfff223d6ab R12: 0000000000000003
R13: 0000000000000023 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555e45886950 CR3: 000000005cb13000 CR4: 00000000003506f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
----------------
Code disassembly (best guess):
0: 7b 18 jnp 0x1a
2: 4c 89 f8 mov %r15,%rax
5: 48 c1 e8 03 shr $0x3,%rax
9: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
e: 74 08 je 0x18
10: 4c 89 ff mov %r15,%rdi
13: e8 0a 2b 03 fd call 0xfd032b22
Code disassembly (best guess):
0: 7b 18 jnp 0x1a
2: 4c 89 f8 mov %r15,%rax
5: 48 c1 e8 03 shr $0x3,%rax
9: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
e: 74 08 je 0x18
10: 4c 89 ff mov %r15,%rdi
18: 4d 8b 3f mov (%r15),%r15
1b: 49 8d 5f 1c lea 0x1c(%r15),%rbx
1f: 4d 8d 6f 23 lea 0x23(%r15),%r13
23: 49 89 dc mov %rbx,%r12
26: 49 c1 ec 03 shr $0x3,%r12
* 2a: 43 0f b6 04 34 movzbl (%r12,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 b9 02 00 00 jne 0x2f0
26: 49 c1 ec 03 shr $0x3,%r12
* 2a: 43 0f b6 04 34 movzbl (%r12,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
syzbot
Aug 6, 2026, 9:46:29 AM (18 hours ago) Aug 6
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=102d729e580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171b8132580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6755b1...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted syzkaller #0
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88813fe20000
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff88801bc6e000
RBP: ffffc90000d27bd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920001a4f64
R13: ffff88801bc6e000 R14: ffffffff8a7ed380 R15: dffffc0000000000
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88813fe20000
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff88801bc6e000
RBP: ffffc90000d27bd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920001a4f64
R13: ffff88801bc6e000 R14: ffffffff8a7ed380 R15: dffffc0000000000
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=6755b1b4bc8ee75fcba4
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12fb6e49580000
dashboard link: https://syzkaller.appspot.com/bug?extid=6755b1b4bc8ee75fcba4
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171b8132580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6755b1...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90000d27ae0 EFLAGS: 00010206
Workqueue: events work_for_cpu_fn
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88813fe20000
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff88801bc6e000
RBP: ffffc90000d27bd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920001a4f64
R13: ffff88801bc6e000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a4169aee20 CR3: 00000000767e4000 CR4: 00000000003506f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
local_pci_probe+0xc5/0x150 drivers/pci/pci-driver.c:323
work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5217
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace 0d9e3800050f992f ]---
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
local_pci_probe+0xc5/0x150 drivers/pci/pci-driver.c:323
work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5217
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90000d27ae0 EFLAGS: 00010206
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88813fe20000
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff88801bc6e000
RBP: ffffc90000d27bd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920001a4f64
R13: ffff88801bc6e000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a4169aee20 CR3: 000000002ab5f000 CR4: 00000000003506f0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages