[syzbot] [fs?] WARNING in nsproxy_ns_active_get
4 views
Skip to first unread message
syzbot
Nov 5, 2025, 8:35:30 PM (2 days ago) Nov 5
to bra...@kernel.org, ja...@suse.cz, linux-...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com, vi...@zeniv.linux.org.uk
Hello,
syzbot found the following issue on:
HEAD commit: 17490bd0527f Add linux-next specific files for 20251104
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1006532f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=9995c0d2611ab121
dashboard link: https://syzkaller.appspot.com/bug?extid=0a8655a80e189278487e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1406532f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1166ff34580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a4d318147846/disk-17490bd0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/86641a470170/vmlinux-17490bd0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/35c008a540c8/bzImage-17490bd0.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0a8655...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: ./include/linux/ns_common.h:288 at __ns_ref_active_get include/linux/ns_common.h:288 [inline], CPU#1: syz.0.20/6007
WARNING: ./include/linux/ns_common.h:288 at nsproxy_ns_active_get+0x8ab/0xcb0 fs/nsfs.c:690, CPU#1: syz.0.20/6007
Modules linked in:
CPU: 1 UID: 0 PID: 6007 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__ns_ref_active_get include/linux/ns_common.h:288 [inline]
RIP: 0010:nsproxy_ns_active_get+0x8ab/0xcb0 fs/nsfs.c:690
Code: 5f 5d e9 08 ca 18 09 cc e8 32 8c 77 ff 90 0f 0b 90 e9 ee f7 ff ff e8 24 8c 77 ff 90 0f 0b 90 e9 12 f8 ff ff e8 16 8c 77 ff 90 <0f> 0b 90 e9 dc f8 ff ff e8 08 8c 77 ff 90 0f 0b 90 e9 03 f9 ff ff
RSP: 0018:ffffc900039cfd40 EFLAGS: 00010293
RAX: ffffffff8249d07a RBX: ffff8880582bb680 RCX: ffff88806aeb5b80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00000000f0000301 R08: ffff88807ca21913 R09: 1ffff1100f944322
R10: dffffc0000000000 R11: ffffed100f944323 R12: dffffc0000000000
R13: 1ffff1100d52d683 R14: ffff88807ca21910 R15: ffff88807ca216c0
FS: 0000555570bd2500(0000) GS:ffff888125b92000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30163fff CR3: 000000007d256000 CR4: 00000000003526f0
Call Trace:
<TASK>
switch_task_namespaces+0x3e/0x110 kernel/nsproxy.c:240
commit_nsset kernel/nsproxy.c:555 [inline]
__do_sys_setns kernel/nsproxy.c:591 [inline]
__se_sys_setns+0x784/0x17d0 kernel/nsproxy.c:559
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc583f8f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd2014d848 EFLAGS: 00000246 ORIG_RAX: 0000000000000134
RAX: ffffffffffffffda RBX: 00007fc5841e5fa0 RCX: 00007fc583f8f6c9
RDX: 0000000000000000 RSI: 0000000024020000 RDI: 0000000000000003
RBP: 00007fc584011f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc5841e5fa0 R14: 00007fc5841e5fa0 R15: 0000000000000002
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 17490bd0527f Add linux-next specific files for 20251104
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1006532f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=9995c0d2611ab121
dashboard link: https://syzkaller.appspot.com/bug?extid=0a8655a80e189278487e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1406532f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1166ff34580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a4d318147846/disk-17490bd0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/86641a470170/vmlinux-17490bd0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/35c008a540c8/bzImage-17490bd0.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0a8655...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: ./include/linux/ns_common.h:288 at __ns_ref_active_get include/linux/ns_common.h:288 [inline], CPU#1: syz.0.20/6007
WARNING: ./include/linux/ns_common.h:288 at nsproxy_ns_active_get+0x8ab/0xcb0 fs/nsfs.c:690, CPU#1: syz.0.20/6007
Modules linked in:
CPU: 1 UID: 0 PID: 6007 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__ns_ref_active_get include/linux/ns_common.h:288 [inline]
RIP: 0010:nsproxy_ns_active_get+0x8ab/0xcb0 fs/nsfs.c:690
Code: 5f 5d e9 08 ca 18 09 cc e8 32 8c 77 ff 90 0f 0b 90 e9 ee f7 ff ff e8 24 8c 77 ff 90 0f 0b 90 e9 12 f8 ff ff e8 16 8c 77 ff 90 <0f> 0b 90 e9 dc f8 ff ff e8 08 8c 77 ff 90 0f 0b 90 e9 03 f9 ff ff
RSP: 0018:ffffc900039cfd40 EFLAGS: 00010293
RAX: ffffffff8249d07a RBX: ffff8880582bb680 RCX: ffff88806aeb5b80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00000000f0000301 R08: ffff88807ca21913 R09: 1ffff1100f944322
R10: dffffc0000000000 R11: ffffed100f944323 R12: dffffc0000000000
R13: 1ffff1100d52d683 R14: ffff88807ca21910 R15: ffff88807ca216c0
FS: 0000555570bd2500(0000) GS:ffff888125b92000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30163fff CR3: 000000007d256000 CR4: 00000000003526f0
Call Trace:
<TASK>
switch_task_namespaces+0x3e/0x110 kernel/nsproxy.c:240
commit_nsset kernel/nsproxy.c:555 [inline]
__do_sys_setns kernel/nsproxy.c:591 [inline]
__se_sys_setns+0x784/0x17d0 kernel/nsproxy.c:559
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc583f8f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd2014d848 EFLAGS: 00000246 ORIG_RAX: 0000000000000134
RAX: ffffffffffffffda RBX: 00007fc5841e5fa0 RCX: 00007fc583f8f6c9
RDX: 0000000000000000 RSI: 0000000024020000 RDI: 0000000000000003
RBP: 00007fc584011f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc5841e5fa0 R14: 00007fc5841e5fa0 R15: 0000000000000002
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
6:44 AM (12 hours ago) 6:44 AM
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: [PATCH] nsfs: skip active reference management on initial namespaces
Author: karti...@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
Initial namespaces (init_net, init_uts_ns, init_pid_ns, etc.) are
statically allocated and exist for the entire lifetime of the system.
They should not participate in active reference counting.
When operations involve initial namespaces, both ns_ref_active_get()
and ns_ref_active_put() were managing active references on them.
This caused the active reference count to become imbalanced, leading
to warnings in __ns_ref_active_get() and __ns_ref_active_put().
Fix by adding is_initial_namespace() checks in both the
ns_ref_active_get and ns_ref_active_put macros. Initial namespaces
are now completely excluded from active reference management,
treating them as permanent kernel resources.
Reported-by: syzbot+0a8655...@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
include/linux/ns_common.h | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index bd4492ef6ffc..b22c692b5f38 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -289,7 +289,10 @@ static __always_inline void __ns_ref_active_get(struct ns_common *ns)
VFS_WARN_ON_ONCE(is_initial_namespace(ns) && __ns_ref_active_read(ns) <= 0);
}
#define ns_ref_active_get(__ns) \
- do { if (__ns) __ns_ref_active_get(to_ns_common(__ns)); } while (0)
+ do { \
+ if ((__ns) && !is_initial_namespace(&(__ns)->ns)) \
+ __ns_ref_active_get(to_ns_common(__ns)); \
+ } while (0)
static __always_inline bool __ns_ref_active_get_not_zero(struct ns_common *ns)
{
@@ -314,7 +317,10 @@ static __always_inline void __ns_ref_active_put(struct ns_common *ns)
}
}
#define ns_ref_active_put(__ns) \
- do { if (__ns) __ns_ref_active_put(to_ns_common(__ns)); } while (0)
+ do { \
+ if ((__ns) && !is_initial_namespace(&(__ns)->ns)) \
+ __ns_ref_active_put(to_ns_common(__ns)); \
+ } while (0)
static __always_inline struct ns_common *__must_check ns_get_unless_inactive(struct ns_common *ns)
{
--
2.43.0
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: [PATCH] nsfs: skip active reference management on initial namespaces
Author: karti...@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
Initial namespaces (init_net, init_uts_ns, init_pid_ns, etc.) are
statically allocated and exist for the entire lifetime of the system.
They should not participate in active reference counting.
When operations involve initial namespaces, both ns_ref_active_get()
and ns_ref_active_put() were managing active references on them.
This caused the active reference count to become imbalanced, leading
to warnings in __ns_ref_active_get() and __ns_ref_active_put().
Fix by adding is_initial_namespace() checks in both the
ns_ref_active_get and ns_ref_active_put macros. Initial namespaces
are now completely excluded from active reference management,
treating them as permanent kernel resources.
Reported-by: syzbot+0a8655...@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
include/linux/ns_common.h | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index bd4492ef6ffc..b22c692b5f38 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -289,7 +289,10 @@ static __always_inline void __ns_ref_active_get(struct ns_common *ns)
VFS_WARN_ON_ONCE(is_initial_namespace(ns) && __ns_ref_active_read(ns) <= 0);
}
#define ns_ref_active_get(__ns) \
- do { if (__ns) __ns_ref_active_get(to_ns_common(__ns)); } while (0)
+ do { \
+ if ((__ns) && !is_initial_namespace(&(__ns)->ns)) \
+ __ns_ref_active_get(to_ns_common(__ns)); \
+ } while (0)
static __always_inline bool __ns_ref_active_get_not_zero(struct ns_common *ns)
{
@@ -314,7 +317,10 @@ static __always_inline void __ns_ref_active_put(struct ns_common *ns)
}
}
#define ns_ref_active_put(__ns) \
- do { if (__ns) __ns_ref_active_put(to_ns_common(__ns)); } while (0)
+ do { \
+ if ((__ns) && !is_initial_namespace(&(__ns)->ns)) \
+ __ns_ref_active_put(to_ns_common(__ns)); \
+ } while (0)
static __always_inline struct ns_common *__must_check ns_get_unless_inactive(struct ns_common *ns)
{
--
2.43.0
syzbot
9:16 AM (10 hours ago) 9:16 AM
to karti...@gmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
3.654920][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 2b1e50eda567f48aae3b59ba5ce868b06b486d7e'
[ 23.982352][ T1] zswap: loaded using pool 842
[ 23.991410][ T1] Demotion targets for Node 0: null
[ 23.996985][ T1] Demotion targets for Node 1: null
[ 24.002328][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 26.824926][ T1] Key type .fscrypt registered
[ 26.829883][ T1] Key type fscrypt-provisioning registered
[ 26.839281][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 26.865411][ T1] Btrfs loaded, assert=on, zoned=yes, fsverity=yes
[ 26.872528][ T1] Key type big_key registered
[ 26.877283][ T1] Key type encrypted registered
[ 26.882161][ T1] AppArmor: AppArmor sha256 policy hashing enabled
[ 26.888954][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 26.895372][ T1] Loading compiled-in module X.509 certificates
[ 26.922050][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 2b1e50eda567f48aae3b59ba5ce868b06b486d7e'
[ 26.932919][ T1] ima: Allocated hash algorithm: sha256
[ 26.938925][ T1] ima: No architecture policies found
[ 26.944865][ T1] evm: Initialising EVM extended attributes:
[ 26.950942][ T1] evm: security.selinux (disabled)
[ 26.956088][ T1] evm: security.SMACK64 (disabled)
[ 26.961183][ T1] evm: security.SMACK64EXEC (disabled)
[ 26.966630][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 26.972527][ T1] evm: security.SMACK64MMAP (disabled)
[ 26.978060][ T1] evm: security.apparmor
[ 26.982473][ T1] evm: security.ima
[ 26.986261][ T1] evm: security.capability
[ 26.990651][ T1] evm: HMAC attrs: 0x1
[ 26.997017][ T1] PM: Magic number: 1:107:131
[ 27.002026][ T1] video4linux video31: hash matches
[ 27.007554][ T1] block nbd10: hash matches
[ 27.012543][ T1] acpi device:06: hash matches
[ 27.017647][ T1] netconsole: network logging started
[ 27.023759][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 27.035896][ T1] rdma_rxe: loaded
[ 27.041816][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 27.052989][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 27.060977][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 27.072219][ T1] clk: Disabling unused clocks
[ 27.073861][ T63] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[ 27.077172][ T1] ALSA device list:
[ 27.087180][ T63] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[ 27.090785][ T1] #0: Dummy 1
[ 27.103854][ T1] #1: Loopback 1
[ 27.107903][ T1] #2: Virtual MIDI Card 1
[ 27.115574][ T1] check access for rdinit=/init failed: -2, ignoring
[ 27.122507][ T1] md: Waiting for all devices to be available before autodetect
[ 27.130224][ T1] md: If you don't use raid, use raid=noautodetect
[ 27.136785][ T1] md: Autodetecting RAID arrays.
[ 27.141856][ T1] md: autorun ...
[ 27.145572][ T1] md: ... autorun DONE.
[ 27.254350][ T1] EXT4-fs (sda1): orphan cleanup on readonly fs
[ 27.262975][ T1] EXT4-fs (sda1): mounted filesystem 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 ro with ordered data mode. Quota mode: none.
[ 27.275897][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 27.285690][ T1] devtmpfs: mounted
[ 27.362347][ T1] Freeing unused kernel image (initmem) memory: 26112K
[ 27.373258][ T1] Write protecting the kernel read-only data: 212992k
[ 27.392412][ T1] Freeing unused kernel image (text/rodata gap) memory: 1436K
[ 27.405281][ T1] Freeing unused kernel image (rodata/data gap) memory: 1240K
[ 27.510532][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 27.518752][ T1] x86/mm: Checking user space page tables
[ 27.608528][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 27.622261][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 27.632373][ T1] Run /sbin/init as init process
[ 27.899076][ T5159] mount (5159) used greatest stack depth: 23624 bytes left
[ 27.967399][ T5160] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 r/w.
mount: mounting devtmpfs on /dev failed: Device or resource busy
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 28.105113][ T5164] mount (5164) used greatest stack depth: 21672 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 29.176871][ T5194] udevd[5194]: starting version 3.2.14
[ 29.365166][ T5195] udevd[5195]: starting eudev-3.2.14
[ 29.367815][ T5194] udevd (5194) used greatest stack depth: 18696 bytes left
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-10.2.0 starting
[ 49.444742][ T5489] ------------[ cut here ]------------
[ 49.450246][ T5489] WARNING: ./include/linux/ns_common.h:314 at nsfs_evict+0x18e/0x200, CPU#1: dhcpcd/5489
[ 49.461849][ T5489] Modules linked in:
[ 49.465873][ T5489] CPU: 1 UID: 0 PID: 5489 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)
[ 49.475268][ T5489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 49.485891][ T5489] RIP: 0010:nsfs_evict+0x18e/0x200
[ 49.491026][ T5489] Code: 4d 8b 1e 48 89 df 5b 41 5c 41 5d 41 5e 41 5f 5d 41 ff e3 cc cc cc e8 01 c7 76 ff 90 0f 0b 90 e9 1f ff ff ff e8 f3 c6 76 ff 90 <0f> 0b 90 e9 42 ff ff ff e8 e5 c6 76 ff 90 0f 0b 90 e9 72 ff ff ff
[ 49.511222][ T5489] RSP: 0018:ffffc90003adfa28 EFLAGS: 00010293
[ 49.517709][ T5489] RAX: ffffffff824b0e3d RBX: ffffffff9a180fd8 RCX: ffff88802f9f5b80
[ 49.526255][ T5489] RDX: 0000000000000000 RSI: 00000000effffff8 RDI: 00000000effffff8
[ 49.535159][ T5489] RBP: 00000000effffff8 R08: ffffffff9a181093 R09: 1ffffffff3430212
[ 49.543377][ T5489] R10: dffffc0000000000 R11: fffffbfff3430213 R12: dffffc0000000000
[ 49.551608][ T5489] R13: 1ffffffff34301fe R14: ffff88807a78f740 R15: ffffffff9a180ff0
[ 49.559609][ T5489] FS: 00007f34c5e7d740(0000) GS:ffff888125b78000(0000) knlGS:0000000000000000
[ 49.568761][ T5489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.575391][ T5489] CR2: 000055fd54bd54a0 CR3: 0000000050a6a000 CR4: 00000000003526f0
[ 49.583450][ T5489] Call Trace:
[ 49.586856][ T5489] <TASK>
[ 49.589790][ T5489] ? __pfx_nsfs_evict+0x10/0x10
[ 49.594786][ T5489] evict+0x5f4/0xae0
[ 49.598708][ T5489] ? __pfx_evict+0x10/0x10
[ 49.603192][ T5489] ? _raw_spin_unlock+0x28/0x50
[ 49.608075][ T5489] ? iput+0xce7/0x1050
[ 49.612199][ T5489] __dentry_kill+0x209/0x660
[ 49.616894][ T5489] ? dput+0x37/0x2b0
[ 49.620853][ T5489] dput+0x19f/0x2b0
[ 49.625240][ T5489] path_put+0x39/0x60
[ 49.629332][ T5489] vfs_statx+0x36e/0x550
[ 49.633784][ T5489] ? __pfx_vfs_statx+0x10/0x10
[ 49.638565][ T5489] ? strncpy_from_user+0x150/0x2c0
[ 49.643871][ T5489] ? getname_flags+0x1e5/0x540
[ 49.648659][ T5489] vfs_fstatat+0x118/0x170
[ 49.653220][ T5489] __x64_sys_newfstatat+0x116/0x190
[ 49.658872][ T5489] ? __pfx___x64_sys_newfstatat+0x10/0x10
[ 49.664675][ T5489] ? do_syscall_64+0xbe/0xfa0
[ 49.669371][ T5489] do_syscall_64+0xfa/0xfa0
[ 49.674260][ T5489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 49.680359][ T5489] ? clear_bhb_loop+0x60/0xb0
[ 49.685201][ T5489] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 49.691150][ T5489] RIP: 0033:0x7f34c5f71b0a
[ 49.695754][ T5489] Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
[ 49.715431][ T5489] RSP: 002b:00007ffd494b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
[ 49.724018][ T5489] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f34c5f71b0a
[ 49.732166][ T5489] RDX: 00007ffd494b4030 RSI: 000055fd54bfd557 RDI: 00000000ffffff9c
[ 49.740133][ T5489] RBP: 00007ffd494b67c8 R08: 0000000000000000 R09: 0000000000000000
[ 49.748181][ T5489] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd494b51a0
[ 49.756207][ T5489] R13: 000055fd7bac88a0 R14: 0000000000001000 R15: 00007f34c5e7d6c8
[ 49.764232][ T5489] </TASK>
[ 49.767259][ T5489] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 49.774523][ T5489] CPU: 1 UID: 0 PID: 5489 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)
[ 49.783536][ T5489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 49.793664][ T5489] Call Trace:
[ 49.796937][ T5489] <TASK>
[ 49.799886][ T5489] dump_stack_lvl+0x99/0x250
[ 49.804503][ T5489] ? __asan_memcpy+0x40/0x70
[ 49.809232][ T5489] ? __pfx_dump_stack_lvl+0x10/0x10
[ 49.814434][ T5489] ? __pfx__printk+0x10/0x10
[ 49.819062][ T5489] vpanic+0x237/0x6d0
[ 49.823042][ T5489] ? __pfx_vpanic+0x10/0x10
[ 49.827540][ T5489] ? is_bpf_text_address+0x292/0x2b0
[ 49.832910][ T5489] ? is_bpf_text_address+0x26/0x2b0
[ 49.838109][ T5489] panic+0xb9/0xc0
[ 49.841907][ T5489] ? __pfx_panic+0x10/0x10
[ 49.846325][ T5489] __warn+0x334/0x4c0
[ 49.850307][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.854809][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.859319][ T5489] report_bug+0x2be/0x4f0
[ 49.863803][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.868590][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.873445][ T5489] ? nsfs_evict+0x190/0x200
[ 49.877981][ T5489] handle_bug+0x84/0x160
[ 49.882217][ T5489] exc_invalid_op+0x1a/0x50
[ 49.886826][ T5489] asm_exc_invalid_op+0x1a/0x20
[ 49.891681][ T5489] RIP: 0010:nsfs_evict+0x18e/0x200
[ 49.896878][ T5489] Code: 4d 8b 1e 48 89 df 5b 41 5c 41 5d 41 5e 41 5f 5d 41 ff e3 cc cc cc e8 01 c7 76 ff 90 0f 0b 90 e9 1f ff ff ff e8 f3 c6 76 ff 90 <0f> 0b 90 e9 42 ff ff ff e8 e5 c6 76 ff 90 0f 0b 90 e9 72 ff ff ff
[ 49.916792][ T5489] RSP: 0018:ffffc90003adfa28 EFLAGS: 00010293
[ 49.922856][ T5489] RAX: ffffffff824b0e3d RBX: ffffffff9a180fd8 RCX: ffff88802f9f5b80
[ 49.930820][ T5489] RDX: 0000000000000000 RSI: 00000000effffff8 RDI: 00000000effffff8
[ 49.938872][ T5489] RBP: 00000000effffff8 R08: ffffffff9a181093 R09: 1ffffffff3430212
[ 49.947351][ T5489] R10: dffffc0000000000 R11: fffffbfff3430213 R12: dffffc0000000000
[ 49.955403][ T5489] R13: 1ffffffff34301fe R14: ffff88807a78f740 R15: ffffffff9a180ff0
[ 49.963463][ T5489] ? nsfs_evict+0x18d/0x200
[ 49.969170][ T5489] ? nsfs_evict+0x18d/0x200
[ 49.973769][ T5489] ? __pfx_nsfs_evict+0x10/0x10
[ 49.978624][ T5489] evict+0x5f4/0xae0
[ 49.982525][ T5489] ? __pfx_evict+0x10/0x10
[ 49.986950][ T5489] ? _raw_spin_unlock+0x28/0x50
[ 49.992068][ T5489] ? iput+0xce7/0x1050
[ 49.996224][ T5489] __dentry_kill+0x209/0x660
[ 50.000806][ T5489] ? dput+0x37/0x2b0
[ 50.004864][ T5489] dput+0x19f/0x2b0
[ 50.008661][ T5489] path_put+0x39/0x60
[ 50.012634][ T5489] vfs_statx+0x36e/0x550
[ 50.016905][ T5489] ? __pfx_vfs_statx+0x10/0x10
[ 50.021714][ T5489] ? strncpy_from_user+0x150/0x2c0
[ 50.026926][ T5489] ? getname_flags+0x1e5/0x540
[ 50.031689][ T5489] vfs_fstatat+0x118/0x170
[ 50.036099][ T5489] __x64_sys_newfstatat+0x116/0x190
[ 50.041293][ T5489] ? __pfx___x64_sys_newfstatat+0x10/0x10
[ 50.047113][ T5489] ? do_syscall_64+0xbe/0xfa0
[ 50.051797][ T5489] do_syscall_64+0xfa/0xfa0
[ 50.056316][ T5489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 50.062385][ T5489] ? clear_bhb_loop+0x60/0xb0
[ 50.067083][ T5489] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 50.072967][ T5489] RIP: 0033:0x7f34c5f71b0a
[ 50.077370][ T5489] Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
[ 50.096988][ T5489] RSP: 002b:00007ffd494b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
[ 50.105404][ T5489] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f34c5f71b0a
[ 50.113378][ T5489] RDX: 00007ffd494b4030 RSI: 000055fd54bfd557 RDI: 00000000ffffff9c
[ 50.121341][ T5489] RBP: 00007ffd494b67c8 R08: 0000000000000000 R09: 0000000000000000
[ 50.129389][ T5489] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd494b51a0
[ 50.137355][ T5489] R13: 000055fd7bac88a0 R14: 0000000000001000 R15: 00007f34c5e7d6c8
[ 50.145417][ T5489] </TASK>
[ 50.148770][ T5489] Kernel Offset: disabled
[ 50.153141][ T5489] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3406885182=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at a6c9c731229
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea -X github.com/google/syzkaller/prog.gitRevisionDate=20251104-181356" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea -X github.com/google/syzkaller/prog.gitRevisionDate=20251104-181356" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea -X github.com/google/syzkaller/prog.gitRevisionDate=20251104-181356" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea\"
/usr/bin/ld: /tmp/cc7wkuO8.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12e510b4580000
Tested on:
commit: 9c0826a5 Add linux-next specific files for 20251107
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=4f8fcc6438a785e7
syzbot tried to test the proposed patch but the build/boot failed:
3.654920][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 2b1e50eda567f48aae3b59ba5ce868b06b486d7e'
[ 23.982352][ T1] zswap: loaded using pool 842
[ 23.991410][ T1] Demotion targets for Node 0: null
[ 23.996985][ T1] Demotion targets for Node 1: null
[ 24.002328][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 26.824926][ T1] Key type .fscrypt registered
[ 26.829883][ T1] Key type fscrypt-provisioning registered
[ 26.839281][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 26.865411][ T1] Btrfs loaded, assert=on, zoned=yes, fsverity=yes
[ 26.872528][ T1] Key type big_key registered
[ 26.877283][ T1] Key type encrypted registered
[ 26.882161][ T1] AppArmor: AppArmor sha256 policy hashing enabled
[ 26.888954][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 26.895372][ T1] Loading compiled-in module X.509 certificates
[ 26.922050][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 2b1e50eda567f48aae3b59ba5ce868b06b486d7e'
[ 26.932919][ T1] ima: Allocated hash algorithm: sha256
[ 26.938925][ T1] ima: No architecture policies found
[ 26.944865][ T1] evm: Initialising EVM extended attributes:
[ 26.950942][ T1] evm: security.selinux (disabled)
[ 26.956088][ T1] evm: security.SMACK64 (disabled)
[ 26.961183][ T1] evm: security.SMACK64EXEC (disabled)
[ 26.966630][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 26.972527][ T1] evm: security.SMACK64MMAP (disabled)
[ 26.978060][ T1] evm: security.apparmor
[ 26.982473][ T1] evm: security.ima
[ 26.986261][ T1] evm: security.capability
[ 26.990651][ T1] evm: HMAC attrs: 0x1
[ 26.997017][ T1] PM: Magic number: 1:107:131
[ 27.002026][ T1] video4linux video31: hash matches
[ 27.007554][ T1] block nbd10: hash matches
[ 27.012543][ T1] acpi device:06: hash matches
[ 27.017647][ T1] netconsole: network logging started
[ 27.023759][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 27.035896][ T1] rdma_rxe: loaded
[ 27.041816][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 27.052989][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 27.060977][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 27.072219][ T1] clk: Disabling unused clocks
[ 27.073861][ T63] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[ 27.077172][ T1] ALSA device list:
[ 27.087180][ T63] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[ 27.090785][ T1] #0: Dummy 1
[ 27.103854][ T1] #1: Loopback 1
[ 27.107903][ T1] #2: Virtual MIDI Card 1
[ 27.115574][ T1] check access for rdinit=/init failed: -2, ignoring
[ 27.122507][ T1] md: Waiting for all devices to be available before autodetect
[ 27.130224][ T1] md: If you don't use raid, use raid=noautodetect
[ 27.136785][ T1] md: Autodetecting RAID arrays.
[ 27.141856][ T1] md: autorun ...
[ 27.145572][ T1] md: ... autorun DONE.
[ 27.254350][ T1] EXT4-fs (sda1): orphan cleanup on readonly fs
[ 27.262975][ T1] EXT4-fs (sda1): mounted filesystem 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 ro with ordered data mode. Quota mode: none.
[ 27.275897][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 27.285690][ T1] devtmpfs: mounted
[ 27.362347][ T1] Freeing unused kernel image (initmem) memory: 26112K
[ 27.373258][ T1] Write protecting the kernel read-only data: 212992k
[ 27.392412][ T1] Freeing unused kernel image (text/rodata gap) memory: 1436K
[ 27.405281][ T1] Freeing unused kernel image (rodata/data gap) memory: 1240K
[ 27.510532][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 27.518752][ T1] x86/mm: Checking user space page tables
[ 27.608528][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 27.622261][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 27.632373][ T1] Run /sbin/init as init process
[ 27.899076][ T5159] mount (5159) used greatest stack depth: 23624 bytes left
[ 27.967399][ T5160] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 r/w.
mount: mounting devtmpfs on /dev failed: Device or resource busy
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 28.105113][ T5164] mount (5164) used greatest stack depth: 21672 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 29.176871][ T5194] udevd[5194]: starting version 3.2.14
[ 29.365166][ T5195] udevd[5195]: starting eudev-3.2.14
[ 29.367815][ T5194] udevd (5194) used greatest stack depth: 18696 bytes left
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-10.2.0 starting
[ 49.444742][ T5489] ------------[ cut here ]------------
[ 49.450246][ T5489] WARNING: ./include/linux/ns_common.h:314 at nsfs_evict+0x18e/0x200, CPU#1: dhcpcd/5489
[ 49.461849][ T5489] Modules linked in:
[ 49.465873][ T5489] CPU: 1 UID: 0 PID: 5489 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)
[ 49.475268][ T5489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 49.485891][ T5489] RIP: 0010:nsfs_evict+0x18e/0x200
[ 49.491026][ T5489] Code: 4d 8b 1e 48 89 df 5b 41 5c 41 5d 41 5e 41 5f 5d 41 ff e3 cc cc cc e8 01 c7 76 ff 90 0f 0b 90 e9 1f ff ff ff e8 f3 c6 76 ff 90 <0f> 0b 90 e9 42 ff ff ff e8 e5 c6 76 ff 90 0f 0b 90 e9 72 ff ff ff
[ 49.511222][ T5489] RSP: 0018:ffffc90003adfa28 EFLAGS: 00010293
[ 49.517709][ T5489] RAX: ffffffff824b0e3d RBX: ffffffff9a180fd8 RCX: ffff88802f9f5b80
[ 49.526255][ T5489] RDX: 0000000000000000 RSI: 00000000effffff8 RDI: 00000000effffff8
[ 49.535159][ T5489] RBP: 00000000effffff8 R08: ffffffff9a181093 R09: 1ffffffff3430212
[ 49.543377][ T5489] R10: dffffc0000000000 R11: fffffbfff3430213 R12: dffffc0000000000
[ 49.551608][ T5489] R13: 1ffffffff34301fe R14: ffff88807a78f740 R15: ffffffff9a180ff0
[ 49.559609][ T5489] FS: 00007f34c5e7d740(0000) GS:ffff888125b78000(0000) knlGS:0000000000000000
[ 49.568761][ T5489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.575391][ T5489] CR2: 000055fd54bd54a0 CR3: 0000000050a6a000 CR4: 00000000003526f0
[ 49.583450][ T5489] Call Trace:
[ 49.586856][ T5489] <TASK>
[ 49.589790][ T5489] ? __pfx_nsfs_evict+0x10/0x10
[ 49.594786][ T5489] evict+0x5f4/0xae0
[ 49.598708][ T5489] ? __pfx_evict+0x10/0x10
[ 49.603192][ T5489] ? _raw_spin_unlock+0x28/0x50
[ 49.608075][ T5489] ? iput+0xce7/0x1050
[ 49.612199][ T5489] __dentry_kill+0x209/0x660
[ 49.616894][ T5489] ? dput+0x37/0x2b0
[ 49.620853][ T5489] dput+0x19f/0x2b0
[ 49.625240][ T5489] path_put+0x39/0x60
[ 49.629332][ T5489] vfs_statx+0x36e/0x550
[ 49.633784][ T5489] ? __pfx_vfs_statx+0x10/0x10
[ 49.638565][ T5489] ? strncpy_from_user+0x150/0x2c0
[ 49.643871][ T5489] ? getname_flags+0x1e5/0x540
[ 49.648659][ T5489] vfs_fstatat+0x118/0x170
[ 49.653220][ T5489] __x64_sys_newfstatat+0x116/0x190
[ 49.658872][ T5489] ? __pfx___x64_sys_newfstatat+0x10/0x10
[ 49.664675][ T5489] ? do_syscall_64+0xbe/0xfa0
[ 49.669371][ T5489] do_syscall_64+0xfa/0xfa0
[ 49.674260][ T5489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 49.680359][ T5489] ? clear_bhb_loop+0x60/0xb0
[ 49.685201][ T5489] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 49.691150][ T5489] RIP: 0033:0x7f34c5f71b0a
[ 49.695754][ T5489] Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
[ 49.715431][ T5489] RSP: 002b:00007ffd494b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
[ 49.724018][ T5489] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f34c5f71b0a
[ 49.732166][ T5489] RDX: 00007ffd494b4030 RSI: 000055fd54bfd557 RDI: 00000000ffffff9c
[ 49.740133][ T5489] RBP: 00007ffd494b67c8 R08: 0000000000000000 R09: 0000000000000000
[ 49.748181][ T5489] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd494b51a0
[ 49.756207][ T5489] R13: 000055fd7bac88a0 R14: 0000000000001000 R15: 00007f34c5e7d6c8
[ 49.764232][ T5489] </TASK>
[ 49.767259][ T5489] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 49.774523][ T5489] CPU: 1 UID: 0 PID: 5489 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)
[ 49.783536][ T5489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 49.793664][ T5489] Call Trace:
[ 49.796937][ T5489] <TASK>
[ 49.799886][ T5489] dump_stack_lvl+0x99/0x250
[ 49.804503][ T5489] ? __asan_memcpy+0x40/0x70
[ 49.809232][ T5489] ? __pfx_dump_stack_lvl+0x10/0x10
[ 49.814434][ T5489] ? __pfx__printk+0x10/0x10
[ 49.819062][ T5489] vpanic+0x237/0x6d0
[ 49.823042][ T5489] ? __pfx_vpanic+0x10/0x10
[ 49.827540][ T5489] ? is_bpf_text_address+0x292/0x2b0
[ 49.832910][ T5489] ? is_bpf_text_address+0x26/0x2b0
[ 49.838109][ T5489] panic+0xb9/0xc0
[ 49.841907][ T5489] ? __pfx_panic+0x10/0x10
[ 49.846325][ T5489] __warn+0x334/0x4c0
[ 49.850307][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.854809][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.859319][ T5489] report_bug+0x2be/0x4f0
[ 49.863803][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.868590][ T5489] ? nsfs_evict+0x18e/0x200
[ 49.873445][ T5489] ? nsfs_evict+0x190/0x200
[ 49.877981][ T5489] handle_bug+0x84/0x160
[ 49.882217][ T5489] exc_invalid_op+0x1a/0x50
[ 49.886826][ T5489] asm_exc_invalid_op+0x1a/0x20
[ 49.891681][ T5489] RIP: 0010:nsfs_evict+0x18e/0x200
[ 49.896878][ T5489] Code: 4d 8b 1e 48 89 df 5b 41 5c 41 5d 41 5e 41 5f 5d 41 ff e3 cc cc cc e8 01 c7 76 ff 90 0f 0b 90 e9 1f ff ff ff e8 f3 c6 76 ff 90 <0f> 0b 90 e9 42 ff ff ff e8 e5 c6 76 ff 90 0f 0b 90 e9 72 ff ff ff
[ 49.916792][ T5489] RSP: 0018:ffffc90003adfa28 EFLAGS: 00010293
[ 49.922856][ T5489] RAX: ffffffff824b0e3d RBX: ffffffff9a180fd8 RCX: ffff88802f9f5b80
[ 49.930820][ T5489] RDX: 0000000000000000 RSI: 00000000effffff8 RDI: 00000000effffff8
[ 49.938872][ T5489] RBP: 00000000effffff8 R08: ffffffff9a181093 R09: 1ffffffff3430212
[ 49.947351][ T5489] R10: dffffc0000000000 R11: fffffbfff3430213 R12: dffffc0000000000
[ 49.955403][ T5489] R13: 1ffffffff34301fe R14: ffff88807a78f740 R15: ffffffff9a180ff0
[ 49.963463][ T5489] ? nsfs_evict+0x18d/0x200
[ 49.969170][ T5489] ? nsfs_evict+0x18d/0x200
[ 49.973769][ T5489] ? __pfx_nsfs_evict+0x10/0x10
[ 49.978624][ T5489] evict+0x5f4/0xae0
[ 49.982525][ T5489] ? __pfx_evict+0x10/0x10
[ 49.986950][ T5489] ? _raw_spin_unlock+0x28/0x50
[ 49.992068][ T5489] ? iput+0xce7/0x1050
[ 49.996224][ T5489] __dentry_kill+0x209/0x660
[ 50.000806][ T5489] ? dput+0x37/0x2b0
[ 50.004864][ T5489] dput+0x19f/0x2b0
[ 50.008661][ T5489] path_put+0x39/0x60
[ 50.012634][ T5489] vfs_statx+0x36e/0x550
[ 50.016905][ T5489] ? __pfx_vfs_statx+0x10/0x10
[ 50.021714][ T5489] ? strncpy_from_user+0x150/0x2c0
[ 50.026926][ T5489] ? getname_flags+0x1e5/0x540
[ 50.031689][ T5489] vfs_fstatat+0x118/0x170
[ 50.036099][ T5489] __x64_sys_newfstatat+0x116/0x190
[ 50.041293][ T5489] ? __pfx___x64_sys_newfstatat+0x10/0x10
[ 50.047113][ T5489] ? do_syscall_64+0xbe/0xfa0
[ 50.051797][ T5489] do_syscall_64+0xfa/0xfa0
[ 50.056316][ T5489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 50.062385][ T5489] ? clear_bhb_loop+0x60/0xb0
[ 50.067083][ T5489] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 50.072967][ T5489] RIP: 0033:0x7f34c5f71b0a
[ 50.077370][ T5489] Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
[ 50.096988][ T5489] RSP: 002b:00007ffd494b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
[ 50.105404][ T5489] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f34c5f71b0a
[ 50.113378][ T5489] RDX: 00007ffd494b4030 RSI: 000055fd54bfd557 RDI: 00000000ffffff9c
[ 50.121341][ T5489] RBP: 00007ffd494b67c8 R08: 0000000000000000 R09: 0000000000000000
[ 50.129389][ T5489] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd494b51a0
[ 50.137355][ T5489] R13: 000055fd7bac88a0 R14: 0000000000001000 R15: 00007f34c5e7d6c8
[ 50.145417][ T5489] </TASK>
[ 50.148770][ T5489] Kernel Offset: disabled
[ 50.153141][ T5489] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3406885182=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at a6c9c731229
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea -X github.com/google/syzkaller/prog.gitRevisionDate=20251104-181356" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea -X github.com/google/syzkaller/prog.gitRevisionDate=20251104-181356" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea -X github.com/google/syzkaller/prog.gitRevisionDate=20251104-181356" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"a6c9c7312290da5bca2fc1be4872a7aeefb6e3ea\"
/usr/bin/ld: /tmp/cc7wkuO8.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12e510b4580000
Tested on:
commit: 9c0826a5 Add linux-next specific files for 20251107
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=4f8fcc6438a785e7
dashboard link: https://syzkaller.appspot.com/bug?extid=0a8655a80e189278487e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=12c5e17c580000
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Reply all
Reply to author
Forward
0 new messages