[syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4ea7c1717f3f Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17346c12580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143f5c12580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17c9a7cd980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1f8cf51c9042/disk-4ea7c171.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6f227246b5b7/vmlinux-4ea7c171.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f935766a00b3/bzImage-4ea7c171.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/bee9311f4026/mount_4.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ad45f8...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff888111778c00 (size 512):
comm "syz.0.17", pid 6092, jiffies 4294942644
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc eb1d7412):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
alloc_fs_context+0x214/0x430 fs/fs_context.c:315
do_new_mount fs/namespace.c:3707 [inline]
path_mount+0x93c/0x12e0 fs/namespace.c:4037
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount fs/namespace.c:4215 [inline]
__x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a2e8800 (size 512):
comm "syz.0.18", pid 6098, jiffies 4294942646
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc eb1d7412):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
alloc_fs_context+0x214/0x430 fs/fs_context.c:315
do_new_mount fs/namespace.c:3707 [inline]
path_mount+0x93c/0x12e0 fs/namespace.c:4037
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount fs/namespace.c:4215 [inline]
__x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a2e8e00 (size 512):
comm "syz.0.19", pid 6102, jiffies 4294942648
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc eb1d7412):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
alloc_fs_context+0x214/0x430 fs/fs_context.c:315
do_new_mount fs/namespace.c:3707 [inline]
path_mount+0x93c/0x12e0 fs/namespace.c:4037
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount fs/namespace.c:4215 [inline]
__x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881263ed600 (size 512):
comm "syz.0.20", pid 6125, jiffies 4294943177
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc eb1d7412):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
alloc_fs_context+0x214/0x430 fs/fs_context.c:315
do_new_mount fs/namespace.c:3707 [inline]
path_mount+0x93c/0x12e0 fs/namespace.c:4037
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount fs/namespace.c:4215 [inline]
__x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810db18c00 (size 512):
comm "syz.0.21", pid 6127, jiffies 4294943179
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc eb1d7412):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
hfs_init_fs_context+0x24/0xd0 fs/hfs/super.c:411
alloc_fs_context+0x214/0x430 fs/fs_context.c:315
do_new_mount fs/namespace.c:3707 [inline]
path_mount+0x93c/0x12e0 fs/namespace.c:4037
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount fs/namespace.c:4215 [inline]
__x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Viacheslav Dubeyko]

Issue has been created:
https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/239

Thanks,
Slava.

--
Viacheslav Dubeyko <Slava....@ibm.com>

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkall...@googlegroups.com.

***

Subject:
Author: mehdi.benh...@gmail.com

#syz test

diff --git a/fs/super.c b/fs/super.c
index 5bab94fb7e03..a9112b17b79f 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -484,6 +484,7 @@ void deactivate_locked_super(struct super_block *s)

put_filesystem(fs);
put_super(s);
+ kfree(s->s_fs_info);
} else {
super_unlock_excl(s);
}
--
2.51.2

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

ocol family
[ 12.356386][ T1] 9pnet: Installing 9P2000 support
[ 12.357387][ T1] NET: Registered PF_CAIF protocol family
[ 12.359598][ T1] NET: Registered PF_IEEE802154 protocol family
[ 12.360820][ T1] Key type dns_resolver registered
[ 12.362055][ T1] Key type ceph registered
[ 12.362972][ T1] libceph: loaded (mon/osd proto 15/24)
[ 12.364812][ T1] batman_adv: B.A.T.M.A.N. advanced 2025.4 (compatibility version 15) loaded
[ 12.366182][ T1] openvswitch: Open vSwitch switching datapath
[ 12.367782][ T1] NET: Registered PF_VSOCK protocol family
[ 12.368848][ T1] mpls_gso: MPLS GSO support
[ 12.392435][ T1] IPI shorthand broadcast: enabled
[ 12.628894][ T1] sched_clock: Marking stable (12590011719, 31029087)->(12629106451, -8065645)
[ 12.638998][ T1] registered taskstats version 1
[ 12.648379][ T1] Loading compiled-in X.509 certificates
[ 12.699133][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: d488cbc2e071d1aa06eea7feaf70de2187f78c53'
[ 12.744621][ T1] zswap: loaded using pool 842
[ 12.749914][ T1] Demotion targets for Node 0: null
[ 12.755145][ T1] Demotion targets for Node 1: null
[ 12.760384][ T1] kmemleak: Kernel memory leak detector initialized (mem pool available: 15732)
[ 12.769760][ T1] Key type .fscrypt registered
[ 12.774552][ T1] Key type fscrypt-provisioning registered
[ 12.781620][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 12.790548][ T1] Btrfs loaded, assert=on, zoned=yes, fsverity=yes
[ 12.797582][ T1] Key type big_key registered
[ 12.802295][ T1] Key type encrypted registered
[ 12.807171][ T1] AppArmor: AppArmor sha256 policy hashing enabled
[ 12.813703][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 12.820129][ T1] Loading compiled-in module X.509 certificates
[ 12.870006][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: d488cbc2e071d1aa06eea7feaf70de2187f78c53'
[ 12.880814][ T1] ima: Allocated hash algorithm: sha256
[ 12.886586][ T1] ima: No architecture policies found
[ 12.892082][ T1] evm: Initialising EVM extended attributes:
[ 12.898045][ T1] evm: security.selinux (disabled)
[ 12.903188][ T1] evm: security.SMACK64 (disabled)
[ 12.908308][ T1] evm: security.SMACK64EXEC (disabled)
[ 12.913772][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 12.919669][ T1] evm: security.SMACK64MMAP (disabled)
[ 12.925137][ T1] evm: security.apparmor
[ 12.929367][ T1] evm: security.ima
[ 12.933210][ T1] evm: security.capability
[ 12.937621][ T1] evm: HMAC attrs: 0x1
[ 12.942363][ T1] PM: Magic number: 1:891:1009
[ 12.947794][ T1] netconsole: network logging started
[ 12.953395][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 12.961366][ T1] rdma_rxe: loaded
[ 12.965484][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 12.975828][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 12.983699][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 12.992052][ T3096] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[ 13.001170][ T1] clk: Disabling unused clocks
[ 13.001625][ T3096] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[ 13.006350][ T1] ALSA device list:
[ 13.018837][ T1] #0: Dummy 1
[ 13.022303][ T1] #1: Loopback 1
[ 13.026009][ T1] #2: Virtual MIDI Card 1
[ 13.031911][ T1] check access for rdinit=/init failed: -2, ignoring
[ 13.038581][ T1] md: Waiting for all devices to be available before autodetect
[ 13.046224][ T1] md: If you don't use raid, use raid=noautodetect
[ 13.052720][ T1] md: Autodetecting RAID arrays.
[ 13.057648][ T1] md: autorun ...
[ 13.061368][ T1] md: ... autorun DONE.
[ 13.182345][ T1] EXT4-fs (sda1): orphan cleanup on readonly fs
[ 13.191140][ T1] EXT4-fs (sda1): mounted filesystem 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 ro with ordered data mode. Quota mode: none.
[ 13.203709][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 13.212657][ T1] devtmpfs: mounted
[ 13.222294][ T1] Freeing unused kernel image (initmem) memory: 16140K
[ 13.230584][ T1] Write protecting the kernel read-only data: 94208k
[ 13.240931][ T1] Freeing unused kernel image (text/rodata gap) memory: 1156K
[ 13.249727][ T1] Freeing unused kernel image (rodata/data gap) memory: 964K
[ 13.408312][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 13.416107][ T1] x86/mm: Checking user space page tables
[ 13.559233][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 13.566791][ T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[ 13.579439][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 13.588985][ T1] Run /sbin/init as init process
[ 13.928520][ T1] kmemleak: Cannot insert 0xffff8881098de400 into the object search tree (overlaps existing)
[ 13.928535][ T1] CPU: 1 UID: 0 PID: 1 Comm: init Not tainted syzkaller #0 PREEMPT(full)
[ 13.928553][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 13.928561][ T1] Call Trace:
[ 13.928565][ T1] <TASK>
[ 13.928569][ T1] dump_stack_lvl+0xab/0xe0
[ 13.928613][ T1] __link_object+0x194/0x210
[ 13.928634][ T1] __create_object+0x48/0x80
[ 13.928658][ T1] __kmalloc_cache_noprof+0x3a6/0x5b0
[ 13.928688][ T1] ? ima_add_digest_entry+0x32/0x1c0
[ 13.928719][ T1] ? ima_add_digest_entry+0x32/0x1c0
[ 13.928740][ T1] ima_add_digest_entry+0x32/0x1c0
[ 13.928763][ T1] ima_add_template_entry+0x28a/0x340
[ 13.928788][ T1] ima_store_template+0x7f/0xd0
[ 13.928814][ T1] ima_store_measurement+0x134/0x290
[ 13.928841][ T1] process_measurement+0x11a2/0x12d0
[ 13.928868][ T1] ima_file_check+0x66/0x90
[ 13.928890][ T1] security_file_post_open+0x8e/0x210
[ 13.928907][ T1] path_openat+0x9c0/0x1eb0
[ 13.928923][ T1] ? nd_jump_root+0x60/0x1b0
[ 13.928948][ T1] do_filp_open+0x102/0x1f0
[ 13.928966][ T1] do_sys_openat2+0xc1/0x140
[ 13.928988][ T1] __x64_sys_openat+0xb2/0x100
[ 13.929010][ T1] do_syscall_64+0xa4/0xfa0
[ 13.929032][ T1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 13.929048][ T1] RIP: 0033:0x7f697b4470ba
[ 13.929059][ T1] Code: 41 89 f2 48 89 54 24 e0 41 83 e2 40 75 2a 89 f0 f7 d0 a9 00 00 41 00 74 1f 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 2e c3 0f 1f 44 00 00 48 8d 44 24 08 c7 44 24
[ 13.929074][ T1] RSP: 002b:00007ffef00e24a8 EFLAGS: 00000206 ORIG_RAX: 0000000000000101
[ 13.929087][ T1] RAX: ffffffffffffffda RBX: 00007ffef00e2520 RCX: 00007f697b4470ba
[ 13.929099][ T1] RDX: 0000000000080000 RSI: 00007ffef00e2520 RDI: 00000000ffffff9c
[ 13.929108][ T1] RBP: 00007ffef00e2510 R08: 00007ffef00e2717 R09: 0000000000000000
[ 13.929117][ T1] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000001b
[ 13.929126][ T1] R13: 00007f697b41b050 R14: 00007ffef00e2730 R15: 0000000000000000
[ 13.929137][ T1] </TASK>
[ 13.929148][ T1] kmemleak: Kernel memory leak detector disabled
[ 13.929153][ T1] kmemleak: Object 0xffff8881098de400 (size 64):
[ 13.929161][ T1] kmemleak: comm "init", pid 1, jiffies 4294938627
[ 13.929169][ T1] kmemleak: min_count = 1
[ 13.929173][ T1] kmemleak: count = 0
[ 13.929177][ T1] kmemleak: flags = 0x1
[ 13.929181][ T1] kmemleak: checksum = 0
[ 13.929186][ T1] kmemleak: backtrace:
[ 13.929189][ T1] __kmalloc_noprof+0x3e3/0x6b0
[ 13.929203][ T1] ima_write_template_field_data+0x56/0x150
[ 13.929221][ T1] ima_eventdigest_init_common+0x10a/0x270
[ 13.929238][ T1] ima_alloc_init_template+0x16d/0x250
[ 13.929264][ T1] ima_store_measurement+0x100/0x290
[ 13.929289][ T1] process_measurement+0x11a2/0x12d0
[ 13.929310][ T1] ima_file_check+0x66/0x90
[ 13.929330][ T1] security_file_post_open+0x8e/0x210
[ 13.929345][ T1] path_openat+0x9c0/0x1eb0
[ 13.929358][ T1] do_filp_open+0x102/0x1f0
[ 13.929372][ T1] do_sys_openat2+0xc1/0x140
[ 13.929391][ T1] __x64_sys_openat+0xb2/0x100
[ 13.929412][ T1] do_syscall_64+0xa4/0xfa0
[ 13.929432][ T1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 14.289664][ T5148] mount (5148) used greatest stack depth: 12432 bytes left
[ 14.338066][ T5149] Oops: general protection fault, probably for non-canonical address 0x8c9f1f3bd28c4867: 0000 [#1] SMP PTI
[ 14.349450][ T5149] CPU: 1 UID: 0 PID: 5149 Comm: init Not tainted syzkaller #0 PREEMPT(full)
[ 14.358203][ T5149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 14.368256][ T5149] RIP: 0010:__kmalloc_cache_noprof+0x422/0x5b0
[ 14.374496][ T5149] Code: c1 e9 3a 48 0f a3 48 08 0f 83 4f 01 00 00 48 85 ff 0f 84 5c fe ff ff 41 ba ff ff ff ff 41 8b 44 24 30 49 8b 34 24 48 8d 4a 08 <48> 8b 1c 07 48 89 f8 65 48 0f c7 0e 0f 85 f7 fd ff ff 41 8b 44 24
[ 14.394091][ T5149] RSP: 0018:ffffc90002257cd0 EFLAGS: 00010246
[ 14.400158][ T5149] RAX: 0000000000000020 RBX: ffffea0004263780 RCX: 000000000001ac01
[ 14.408215][ T5149] RDX: 000000000001abf9 RSI: ffffffff8946da20 RDI: 8c9f1f3bd28c4847
[ 14.416264][ T5149] RBP: ffffc90002257d30 R08: 0000000000000040 R09: 0000000000000000
[ 14.424232][ T5149] R10: 00000000ffffffff R11: 00322e6f732e3436 R12: ffff888100041700
[ 14.432333][ T5149] R13: 0000000000000c00 R14: 0000000000000040 R15: 0000000000000cc0
[ 14.440345][ T5149] FS: 00007f697b0b0c80(0000) GS:ffff8881b26c2000(0000) knlGS:0000000000000000
[ 14.449272][ T5149] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 14.455856][ T5149] CR2: 00007f697b11aa10 CR3: 0000000109c5e000 CR4: 00000000003526f0
[ 14.463913][ T5149] Call Trace:
[ 14.467185][ T5149] <TASK>
[ 14.470105][ T5149] ? load_elf_binary+0x2fc/0x27a0
[ 14.475121][ T5149] ? load_elf_binary+0x2fc/0x27a0
[ 14.480147][ T5149] load_elf_binary+0x2fc/0x27a0
[ 14.484985][ T5149] ? load_misc_binary+0x3b5/0x600
[ 14.489996][ T5149] bprm_execve+0x3f7/0x830
[ 14.494403][ T5149] do_execveat_common.isra.0+0x262/0x2e0
[ 14.500026][ T5149] __x64_sys_execve+0x3d/0x50
[ 14.504778][ T5149] do_syscall_64+0xa4/0xfa0
[ 14.509377][ T5149] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 14.515266][ T5149] RIP: 0033:0x7f697b24b107
[ 14.519691][ T5149] Code: 0f 00 64 c7 00 07 00 00 00 b8 ff ff ff ff c9 c3 0f 1f 00 48 8b 05 a9 ee 0f 00 48 8b 10 e9 01 00 00 00 90 b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 ec 0f 00 f7 d8 64 89 01 48
[ 14.539376][ T5149] RSP: 002b:00007ffef00e3208 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
[ 14.547775][ T5149] RAX: ffffffffffffffda RBX: 00007ffef00e3310 RCX: 00007f697b24b107
[ 14.555732][ T5149] RDX: 0000562c23324480 RSI: 00007ffef00e3280 RDI: 00007ffef00e3310
[ 14.563778][ T5149] RBP: 00007ffef00e3270 R08: 0000000000000000 R09: 0000000000000001
[ 14.571747][ T5149] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffef00e3280
[ 14.579709][ T5149] R13: 0000562c23324480 R14: 0000000000000001 R15: 0000000000000001
[ 14.587668][ T5149] </TASK>
[ 14.590674][ T5149] Modules linked in:
[ 14.594597][ T5149] ---[ end trace 0000000000000000 ]---
[ 14.600083][ T5149] RIP: 0010:__kmalloc_cache_noprof+0x422/0x5b0
[ 14.606318][ T5149] Code: c1 e9 3a 48 0f a3 48 08 0f 83 4f 01 00 00 48 85 ff 0f 84 5c fe ff ff 41 ba ff ff ff ff 41 8b 44 24 30 49 8b 34 24 48 8d 4a 08 <48> 8b 1c 07 48 89 f8 65 48 0f c7 0e 0f 85 f7 fd ff ff 41 8b 44 24
[ 14.625968][ T5149] RSP: 0018:ffffc90002257cd0 EFLAGS: 00010246
[ 14.632056][ T5149] RAX: 0000000000000020 RBX: ffffea0004263780 RCX: 000000000001ac01
[ 14.640024][ T5149] RDX: 000000000001abf9 RSI: ffffffff8946da20 RDI: 8c9f1f3bd28c4847
[ 14.648028][ T5149] RBP: ffffc90002257d30 R08: 0000000000000040 R09: 0000000000000000
[ 14.656008][ T5149] R10: 00000000ffffffff R11: 00322e6f732e3436 R12: ffff888100041700
[ 14.663982][ T5149] R13: 0000000000000c00 R14: 0000000000000040 R15: 0000000000000cc0
[ 14.672296][ T5149] FS: 00007f697b0b0c80(0000) GS:ffff8881b25c2000(0000) knlGS:0000000000000000
[ 14.681247][ T5149] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 14.687849][ T5149] CR2: 00007f022521ae9c CR3: 0000000109c5e000 CR4: 00000000003526f0
[ 14.695952][ T5149] Kernel panic - not syncing: Fatal exception
[ 14.702417][ T5149] Kernel Offset: disabled
[ 14.706729][ T5149] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2273466794=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4def
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/cc4VJZ8z.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=16b8c212580000


Tested on:

commit: 9b9e4370 Merge tag 'slab-for-6.18-rc6' of git://git.ke..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=132cb532580000

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

roller area network core
[ 9.749562][ T1] NET: Registered PF_CAN protocol family
[ 9.750438][ T1] can: raw protocol
[ 9.750982][ T1] can: broadcast manager protocol
[ 9.751738][ T1] can: netlink gateway - max_hops=1
[ 9.752496][ T1] can: SAE J1939
[ 9.753010][ T1] can: isotp protocol (max_pdu_size 8300)
[ 9.754130][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 9.754932][ T1] Bluetooth: RFCOMM socket layer initialized
[ 9.755826][ T1] Bluetooth: RFCOMM ver 1.11
[ 9.756640][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 9.757547][ T1] Bluetooth: BNEP filters: protocol multicast
[ 9.758499][ T1] Bluetooth: BNEP socket layer initialized
[ 9.759429][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 9.760557][ T1] Bluetooth: HIDP socket layer initialized
[ 9.762424][ T1] NET: Registered PF_RXRPC protocol family
[ 9.763241][ T1] Key type rxrpc registered
[ 9.764425][ T1] Key type rxrpc_s registered
[ 9.765548][ T1] NET: Registered PF_KCM protocol family
[ 9.766688][ T1] lec:lane_module_init: lec.c: initialized
[ 9.767737][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 9.768664][ T1] l2tp_core: L2TP core driver, V2.0
[ 9.769494][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 9.770289][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 9.771155][ T1] l2tp_netlink: L2TP netlink interface
[ 9.771938][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 9.772847][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 9.774041][ T1] NET: Registered PF_PHONET protocol family
[ 9.774894][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 9.775717][ T1] sctp: Hash tables configured (bind 256/256)
[ 9.777068][ T1] NET: Registered PF_RDS protocol family
[ 9.778075][ T1] Registered RDS/infiniband transport
[ 9.778994][ T1] Registered RDS/tcp transport
[ 9.779692][ T1] tipc: Activated (version 2.0.0)
[ 9.780699][ T1] NET: Registered PF_TIPC protocol family
[ 9.782344][ T1] tipc: Started in single node mode
[ 9.784387][ T1] smc: adding smcd device lo without pnetid
[ 9.785913][ T1] NET: Registered PF_SMC protocol family
[ 9.787625][ T1] 9pnet: Installing 9P2000 support
[ 9.789167][ T1] NET: Registered PF_CAIF protocol family
[ 9.791371][ T1] NET: Registered PF_IEEE802154 protocol family
[ 9.792806][ T1] Key type dns_resolver registered
[ 9.794259][ T1] Key type ceph registered
[ 9.795165][ T1] libceph: loaded (mon/osd proto 15/24)
[ 9.796573][ T1] batman_adv: B.A.T.M.A.N. advanced 2025.4 (compatibility version 15) loaded
[ 9.798385][ T1] openvswitch: Open vSwitch switching datapath
[ 9.799992][ T1] NET: Registered PF_VSOCK protocol family
[ 9.800986][ T1] mpls_gso: MPLS GSO support
[ 9.819559][ T1] IPI shorthand broadcast: enabled
[ 10.013424][ T1] sched_clock: Marking stable (9984532893, 23793120)->(10012625265, -4299252)
[ 10.021125][ T1] registered taskstats version 1
[ 10.025750][ T1] Loading compiled-in X.509 certificates
[ 10.058263][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: ea23c8da7267aa5b617cb0954f38b31bf7cab05f'
[ 10.088097][ T1] zswap: loaded using pool 842
[ 10.089329][ T1] Demotion targets for Node 0: null
[ 10.090444][ T1] Demotion targets for Node 1: null
[ 10.091182][ T1] kmemleak: Kernel memory leak detector initialized (mem pool available: 15732)
[ 10.093020][ T1] Key type .fscrypt registered
[ 10.093752][ T1] Key type fscrypt-provisioning registered
[ 10.095763][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 10.099093][ T1] Btrfs loaded, assert=on, zoned=yes, fsverity=yes
[ 10.100242][ T1] Key type big_key registered
[ 10.101201][ T1] Key type encrypted registered
[ 10.101898][ T1] AppArmor: AppArmor sha256 policy hashing enabled
[ 10.102910][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 10.103860][ T1] Loading compiled-in module X.509 certificates
[ 10.135501][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: ea23c8da7267aa5b617cb0954f38b31bf7cab05f'
[ 10.137680][ T1] ima: Allocated hash algorithm: sha256
[ 10.138660][ T1] ima: No architecture policies found
[ 10.139629][ T1] evm: Initialising EVM extended attributes:
[ 10.140520][ T1] evm: security.selinux (disabled)
[ 10.141260][ T1] evm: security.SMACK64 (disabled)
[ 10.142032][ T1] evm: security.SMACK64EXEC (disabled)
[ 10.142977][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 10.143870][ T1] evm: security.SMACK64MMAP (disabled)
[ 10.144647][ T1] evm: security.apparmor
[ 10.145278][ T1] evm: security.ima
[ 10.145794][ T1] evm: security.capability
[ 10.146417][ T1] evm: HMAC attrs: 0x1
[ 10.147566][ T1] PM: Magic number: 1:78:913
[ 10.148733][ T1] tty ptyz9: hash matches
[ 10.149389][ T1] tty ptywc: hash matches
[ 10.150164][ T1] netconsole: network logging started
[ 10.151137][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 10.153632][ T1] rdma_rxe: loaded
[ 10.154685][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 10.157212][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 10.159121][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 10.160513][ T3094] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[ 10.161920][ T3094] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[ 10.163450][ T1] clk: Disabling unused clocks
[ 10.164221][ T1] ALSA device list:
[ 10.164750][ T1] #0: Dummy 1
[ 10.165239][ T1] #1: Loopback 1
[ 10.165745][ T1] #2: Virtual MIDI Card 1
[ 10.167530][ T1] check access for rdinit=/init failed: -2, ignoring
[ 10.168530][ T1] md: Waiting for all devices to be available before autodetect
[ 10.169637][ T1] md: If you don't use raid, use raid=noautodetect
[ 10.170520][ T1] md: Autodetecting RAID arrays.
[ 10.171192][ T1] md: autorun ...
[ 10.171746][ T1] md: ... autorun DONE.
[ 10.355755][ T1] EXT4-fs (sda1): orphan cleanup on readonly fs
[ 10.357816][ T1] EXT4-fs (sda1): mounted filesystem 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 ro with ordered data mode. Quota mode: none.
[ 10.359703][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 10.362032][ T1] devtmpfs: mounted
[ 10.368420][ T1] Freeing unused kernel image (initmem) memory: 16140K
[ 10.370400][ T1] Write protecting the kernel read-only data: 94208k
[ 10.374836][ T1] Freeing unused kernel image (text/rodata gap) memory: 1156K
[ 10.377014][ T1] Freeing unused kernel image (rodata/data gap) memory: 964K
[ 10.479434][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 10.481095][ T1] x86/mm: Checking user space page tables
[ 10.573323][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 10.574604][ T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[ 10.578671][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 10.580258][ T1] Run /sbin/init as init process
[ 10.915515][ T5147] mount (5147) used greatest stack depth: 12376 bytes left
[ 10.959767][ T5148] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 r/w.
[ 10.962072][ T5148] mount (5148) used greatest stack depth: 11720 bytes left
mount: mounting devtmpfs on /dev failed: Device or resource busy
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 11.009468][ T5152] mount (5152) used greatest stack depth: 10488 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 11.409279][ T5182] udevd[5182]: starting version 3.2.14
[ 11.616899][ T5183] udevd[5183]: starting eudev-3.2.14
[ 11.618261][ T5182] udevd (5182) used greatest stack depth: 9464 bytes left
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-10.2.0 starting
dev: loaded udev
no interfaces have a carrier
[ 16.257231][ T5478] 8021q: adding VLAN 0 to HW filter on device bond0
[ 16.264394][ T5549] Oops: general protection fault, probably for non-canonical address 0x6564752f62696c4f: 0000 [#1] SMP PTI
[ 16.265069][ T5478] eql: remember to turn off Van-Jacobson compression on your slave devices
[ 16.275854][ T5549] CPU: 1 UID: 0 PID: 5549 Comm: rcS Not tainted syzkaller #0 PREEMPT(full)
[ 16.275872][ T5549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 16.275881][ T5549] RIP: 0010:tomoyo_get_name+0xa9/0x270
[ 16.308751][ T5549] Code: 0f 85 6a 01 00 00 e8 b6 b1 ec fe 89 d8 48 c1 e3 04 48 8b 9b c0 1a 85 89 48 89 04 24 49 39 dd 0f 84 b2 00 00 00 e8 97 b1 ec fe <44> 8b 7b 20 89 ee 44 89 ff e8 39 a9 ec fe 41 39 ef 0f 85 85 00 00
[ 16.328351][ T5549] RSP: 0018:ffffc90002807c28 EFLAGS: 00010293
[ 16.334412][ T5549] RAX: 0000000000000000 RBX: 6564752f62696c2f RCX: ffffffff8274e487
[ 16.342387][ T5549] RDX: ffff888102fdb480 RSI: ffffffff8274e479 RDI: 0000000000000004
[ 16.350405][ T5549] RBP: 000000000367e4aa R08: 0000000000000004 R09: 0000000061736c61
[ 16.358373][ T5549] R10: 000000000367e4aa R11: 0000000000000000 R12: ffff88810984c000
[ 16.366511][ T5549] R13: ffffffff898520c0 R14: 0000000000000038 R15: 0000000061736c61
[ 16.374647][ T5549] FS: 00007fdabe210c80(0000) GS:ffff8881b26c2000(0000) knlGS:0000000000000000
[ 16.383729][ T5549] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 16.390297][ T5549] CR2: 00007fec51a9a7b8 CR3: 000000010966c000 CR4: 00000000003526f0
[ 16.398302][ T5549] Call Trace:
[ 16.401564][ T5549] <TASK>
[ 16.404607][ T5549] ? tomoyo_assign_namespace+0x84/0x1d0
[ 16.410156][ T5549] tomoyo_assign_domain+0x249/0x490
[ 16.415496][ T5549] tomoyo_find_next_domain+0x4d1/0xdb0
[ 16.420969][ T5549] tomoyo_bprm_check_security+0x72/0xc0
[ 16.426508][ T5549] security_bprm_check+0x1b9/0x1e0
[ 16.431605][ T5549] bprm_execve+0x381/0x830
[ 16.436100][ T5549] do_execveat_common.isra.0+0x262/0x2e0
[ 16.441713][ T5549] __x64_sys_execve+0x3d/0x50
[ 16.446381][ T5549] do_syscall_64+0xa4/0xfa0
[ 16.450879][ T5549] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 16.456743][ T5549] RIP: 0033:0x7fdabe3ab107
[ 16.461148][ T5549] Code: 0f 00 64 c7 00 07 00 00 00 b8 ff ff ff ff c9 c3 0f 1f 00 48 8b 05 a9 ee 0f 00 48 8b 10 e9 01 00 00 00 90 b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 ec 0f 00 f7 d8 64 89 01 48
[ 16.480773][ T5549] RSP: 002b:00007fffd1b40b78 EFLAGS: 00000206 ORIG_RAX: 000000000000003b
[ 16.489522][ T5549] RAX: ffffffffffffffda RBX: 000055ca63b60d30 RCX: 00007fdabe3ab107
[ 16.497466][ T5549] RDX: 000055ca63b57bb8 RSI: 000055ca63b60d30 RDI: 000055ca63b60ce8
[ 16.505417][ T5549] RBP: 000055ca63b60ce8 R08: 0000000000000000 R09: 0000000000000000
[ 16.513806][ T5549] R10: 0000000000000008 R11: 0000000000000206 R12: 000055ca63b57bb8
[ 16.521843][ T5549] R13: 00007fdabe570e8b R14: 000055ca63b57bb8 R15: 0000000000000000
[ 16.529794][ T5549] </TASK>
[ 16.532798][ T5549] Modules linked in:
[ 16.536769][ T5549] ---[ end trace 0000000000000000 ]---
[ 16.542535][ T5549] RIP: 0010:tomoyo_get_name+0xa9/0x270
[ 16.548074][ T5549] Code: 0f 85 6a 01 00 00 e8 b6 b1 ec fe 89 d8 48 c1 e3 04 48 8b 9b c0 1a 85 89 48 89 04 24 49 39 dd 0f 84 b2 00 00 00 e8 97 b1 ec fe <44> 8b 7b 20 89 ee 44 89 ff e8 39 a9 ec fe 41 39 ef 0f 85 85 00 00
[ 16.567885][ T5549] RSP: 0018:ffffc90002807c28 EFLAGS: 00010293
[ 16.574145][ T5549] RAX: 0000000000000000 RBX: 6564752f62696c2f RCX: ffffffff8274e487
[ 16.582126][ T5549] RDX: ffff888102fdb480 RSI: ffffffff8274e479 RDI: 0000000000000004
[ 16.590202][ T5549] RBP: 000000000367e4aa R08: 0000000000000004 R09: 0000000061736c61
[ 16.598259][ T5549] R10: 000000000367e4aa R11: 0000000000000000 R12: ffff88810984c000
[ 16.606251][ T5549] R13: ffffffff898520c0 R14: 0000000000000038 R15: 0000000061736c61
[ 16.614332][ T5549] FS: 00007fdabe210c80(0000) GS:ffff8881b26c2000(0000) knlGS:0000000000000000
[ 16.623328][ T5549] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 16.629908][ T5549] CR2: 00007fec51a9a7b8 CR3: 000000010966c000 CR4: 00000000003526f0
[ 16.637983][ T5549] Kernel panic - not syncing: Fatal exception
[ 16.644472][ T5549] Kernel Offset: disabled
[ 16.648952][ T5549] Rebooting in 86400 seconds..

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3937347293=/tmp/go-build -gno-record-gcc-switches'

/usr/bin/ld: /tmp/cctPnRU9.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=16bad7cd980000


Tested on:

commit: 6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...

git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11f2b60a580000

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+ad45f8...@syzkaller.appspotmail.com
Tested-by: syzbot+ad45f8...@syzkaller.appspotmail.com

Tested on:

commit: 6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=14cab532580000

kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11c3eb42580000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


Warning: Permanently added '10.128.1.132' (ED25519) to the list of known hosts.
2025/11/14 04:25:22 parsed 1 programs
[ 38.568834][ T5812] cgroup: Unknown subsys name 'net'
[ 38.681579][ T5812] cgroup: Unknown subsys name 'cpuset'
[ 38.687948][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 47.206806][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 48.634442][ T5821] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linu...@kvack.org if you depend on this functionality.
[ 49.057992][ T31] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 49.068464][ T31] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 49.080224][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 49.088091][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 49.177421][ T5870] chnl_net:caif_netlink_parms(): no params data found
[ 49.197720][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[ 49.205546][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state
[ 49.212806][ T5870] bridge_slave_0: entered allmulticast mode
[ 49.219093][ T5870] bridge_slave_0: entered promiscuous mode
[ 49.226954][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[ 49.234019][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state
[ 49.241114][ T5870] bridge_slave_1: entered allmulticast mode
[ 49.247273][ T5870] bridge_slave_1: entered promiscuous mode
[ 49.257812][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 49.267520][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 49.283802][ T5870] team0: Port device team_slave_0 added
[ 49.289970][ T5870] team0: Port device team_slave_1 added
[ 49.299659][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 49.306737][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 49.332781][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 49.344098][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 49.351244][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 49.377242][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 49.395484][ T5870] hsr_slave_0: entered promiscuous mode
[ 49.401255][ T5870] hsr_slave_1: entered promiscuous mode
[ 49.429633][ T5870] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 49.437511][ T5870] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 49.445536][ T5870] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 49.453283][ T5870] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 49.466311][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[ 49.473549][ T5870] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 49.480828][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[ 49.487888][ T5870] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 49.506659][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0
[ 49.515852][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
[ 49.523955][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 49.533442][ T5870] 8021q: adding VLAN 0 to HW filter on device team0
[ 49.541649][ T31] bridge0: port 1(bridge_slave_0) entered blocking state
[ 49.548678][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 49.557491][ T4775] bridge0: port 2(bridge_slave_1) entered blocking state
[ 49.564551][ T4775] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 49.609789][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 49.624774][ T5870] veth0_vlan: entered promiscuous mode
[ 49.632240][ T5870] veth1_vlan: entered promiscuous mode
[ 49.642980][ T5870] veth0_macvtap: entered promiscuous mode
[ 49.649568][ T5870] veth1_macvtap: entered promiscuous mode
[ 49.658587][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 49.667884][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 49.677213][ T4775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.685998][ T4775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.696282][ T4775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.705044][ T4775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.739615][ T5893] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 49.746762][ T5893] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 49.754212][ T5893] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 49.761539][ T5893] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 49.768803][ T5893] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 49.777506][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 49.811620][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 49.872308][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 49.932883][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/14 04:25:36 executed programs: 0
[ 52.871628][ T12] bridge_slave_1: left allmulticast mode
[ 52.877509][ T12] bridge_slave_1: left promiscuous mode
[ 52.883233][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.890693][ T12] bridge_slave_0: left allmulticast mode
[ 52.896320][ T12] bridge_slave_0: left promiscuous mode
[ 52.902081][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.942851][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 52.951925][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 52.960999][ T12] bond0 (unregistering): Released all slaves
[ 53.054718][ T12] hsr_slave_0: left promiscuous mode
[ 53.060223][ T12] hsr_slave_1: left promiscuous mode
[ 53.065682][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 53.073538][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 53.081030][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 53.088412][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 53.097247][ T12] veth1_macvtap: left promiscuous mode
[ 53.102787][ T12] veth0_macvtap: left promiscuous mode
[ 53.108333][ T12] veth1_vlan: left promiscuous mode
[ 53.113692][ T12] veth0_vlan: left promiscuous mode
[ 53.146117][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 53.154944][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 55.775892][ T5893] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 55.783123][ T5893] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 55.790299][ T5893] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 55.797638][ T5893] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 55.805009][ T5893] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 55.842807][ T5987] chnl_net:caif_netlink_parms(): no params data found
[ 55.861642][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.868694][ T5987] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.876286][ T5987] bridge_slave_0: entered allmulticast mode
[ 55.882536][ T5987] bridge_slave_0: entered promiscuous mode
[ 55.888863][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.896054][ T5987] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.903160][ T5987] bridge_slave_1: entered allmulticast mode
[ 55.909310][ T5987] bridge_slave_1: entered promiscuous mode
[ 55.921259][ T5987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 55.931363][ T5987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 55.946114][ T5987] team0: Port device team_slave_0 added
[ 55.952406][ T5987] team0: Port device team_slave_1 added
[ 55.962372][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 55.969330][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.995474][ T5987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 56.006426][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 56.013527][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 56.039738][ T5987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 56.056635][ T5987] hsr_slave_0: entered promiscuous mode
[ 56.062419][ T5987] hsr_slave_1: entered promiscuous mode
[ 56.253249][ T5987] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 56.261855][ T5987] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 56.269702][ T5987] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 56.278553][ T5987] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 56.294272][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.301460][ T5987] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 56.308739][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.315923][ T5987] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 56.338321][ T5987] 8021q: adding VLAN 0 to HW filter on device bond0
[ 56.348077][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
[ 56.356081][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 56.366155][ T5987] 8021q: adding VLAN 0 to HW filter on device team0
[ 56.374820][ T49] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.381909][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 56.400099][ T49] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.407204][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 56.458214][ T5987] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 56.477365][ T5987] veth0_vlan: entered promiscuous mode
[ 56.485374][ T5987] veth1_vlan: entered promiscuous mode
[ 56.498620][ T5987] veth0_macvtap: entered promiscuous mode
[ 56.506001][ T5987] veth1_macvtap: entered promiscuous mode
[ 56.516830][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 56.526501][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 56.536259][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.554454][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.571101][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.579028][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.589211][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 56.602245][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.602375][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.610080][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2609802501=/tmp/go-build -gno-record-gcc-switches'

/usr/bin/ld: /tmp/ccG1R0tu.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null

Tested on:

commit: 6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16ceb60a580000

[Mehdi Ben Hadj Khelifa]

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/super.c b/fs/super.c

index 5bab94fb7e03..a99e5281b057 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
if (!error)
error = fill_super(s, fc);
if (error) {
+ /*
+ * return back sb_info ownership to fc to be freed by put_fs_context()
+ */
+ fc->s_fs_info = s->s_fs_info;
+ s->s_fs_info = NULL;
deactivate_locked_super(s);
return error;
}
--
2.51.2

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/super.c b/fs/super.c

index 5bab94fb7e03..b1a78189b2c5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1690,6 +1690,7 @@ int get_tree_bdev_flags(struct fs_context *fc,

if (!error)
error = fill_super(s, fc);
if (error) {

+ fc->s_fs_info = s->s_fs_info;

[Christian Brauner]

No, either free it in hfs_fill_super() when it fails or add a wrapper
around kill_block_super() for hfs and free it after ->kill_sb() has run.

[Mehdi Ben Hadj Khelifa]

#syz test

diff --git a/fs/super.c b/fs/super.c

index 5bab94fb7e03..8fadf97fcc42 100644

--- a/fs/super.c
+++ b/fs/super.c
@@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
if (!error)
error = fill_super(s, fc);
if (error) {
+ /*

+ * return s_fs_info ownership to fc to be cleaned up by put_fs_context()

[Mehdi Ben Hadj Khelifa]

Ah. I just saw your reply after my I just sent out a new similar test.

I will be working on it with your suggestion.

Best Regards,
Mehdi Ben Hadj Khelifa

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)

Warning: Permanently added '10.128.1.80' (ED25519) to the list of known hosts.
2025/11/14 15:28:16 parsed 1 programs
[ 40.296558][ T5813] cgroup: Unknown subsys name 'net'
[ 40.388732][ T5813] cgroup: Unknown subsys name 'cpuset'
[ 40.395379][ T5813] cgroup: Unknown subsys name 'rlimit'

Setting up swapspace version 1, size = 127995904 bytes

[ 48.529645][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 49.725319][ T5826] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linu...@kvack.org if you depend on this functionality.
[ 50.124830][ T5874] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 50.132081][ T5874] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 50.139390][ T5874] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 50.146668][ T5874] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 50.153951][ T5874] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 50.211546][ T5881] chnl_net:caif_netlink_parms(): no params data found
[ 50.232138][ T5881] bridge0: port 1(bridge_slave_0) entered blocking state
[ 50.239234][ T5881] bridge0: port 1(bridge_slave_0) entered disabled state
[ 50.246331][ T5881] bridge_slave_0: entered allmulticast mode
[ 50.252736][ T5881] bridge_slave_0: entered promiscuous mode
[ 50.259377][ T5881] bridge0: port 2(bridge_slave_1) entered blocking state
[ 50.266469][ T5881] bridge0: port 2(bridge_slave_1) entered disabled state
[ 50.273698][ T5881] bridge_slave_1: entered allmulticast mode
[ 50.279872][ T5881] bridge_slave_1: entered promiscuous mode
[ 50.291361][ T5881] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 50.301121][ T5881] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 50.314859][ T5881] team0: Port device team_slave_0 added
[ 50.321138][ T5881] team0: Port device team_slave_1 added
[ 50.337350][ T5881] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 50.344455][ T5881] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 50.370408][ T5881] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 50.381546][ T5881] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 50.388602][ T5881] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 50.414701][ T5881] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 50.432432][ T5881] hsr_slave_0: entered promiscuous mode
[ 50.438187][ T5881] hsr_slave_1: entered promiscuous mode
[ 50.464974][ T5881] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 50.472557][ T5881] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 50.480523][ T5881] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 50.488191][ T5881] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 50.501383][ T5881] bridge0: port 2(bridge_slave_1) entered blocking state
[ 50.508462][ T5881] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 50.515715][ T5881] bridge0: port 1(bridge_slave_0) entered blocking state
[ 50.522863][ T5881] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 50.540612][ T5881] 8021q: adding VLAN 0 to HW filter on device bond0
[ 50.549623][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
[ 50.557084][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 50.566000][ T5881] 8021q: adding VLAN 0 to HW filter on device team0
[ 50.574224][ T74] bridge0: port 1(bridge_slave_0) entered blocking state
[ 50.581282][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 50.589909][ T31] bridge0: port 2(bridge_slave_1) entered blocking state
[ 50.596984][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 50.635045][ T5881] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 50.648984][ T5881] veth0_vlan: entered promiscuous mode
[ 50.655799][ T5881] veth1_vlan: entered promiscuous mode
[ 50.666178][ T5881] veth0_macvtap: entered promiscuous mode
[ 50.672895][ T5881] veth1_macvtap: entered promiscuous mode
[ 50.681496][ T5881] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 50.690818][ T5881] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 50.699598][ T74] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 50.708503][ T74] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 50.717969][ T74] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 50.727859][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 50.770674][ T31] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 50.781957][ T989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 50.790035][ T989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 50.800571][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 50.808621][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 50.816550][ T31] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 50.869426][ T31] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 50.899153][ T31] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/14 15:28:29 executed programs: 0
[ 53.832316][ T31] bridge_slave_1: left allmulticast mode
[ 53.838115][ T31] bridge_slave_1: left promiscuous mode
[ 53.843745][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.851578][ T31] bridge_slave_0: left allmulticast mode
[ 53.857222][ T31] bridge_slave_0: left promiscuous mode
[ 53.862866][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.918713][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 53.927986][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 53.936965][ T31] bond0 (unregistering): Released all slaves
[ 53.989491][ T31] hsr_slave_0: left promiscuous mode
[ 53.995049][ T31] hsr_slave_1: left promiscuous mode
[ 54.000970][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 54.008418][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 54.015806][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 54.023374][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 54.031704][ T31] veth1_macvtap: left promiscuous mode
[ 54.037164][ T31] veth0_macvtap: left promiscuous mode
[ 54.042886][ T31] veth1_vlan: left promiscuous mode
[ 54.048139][ T31] veth0_vlan: left promiscuous mode
[ 54.071579][ T31] team0 (unregistering): Port device team_slave_1 removed
[ 54.079731][ T31] team0 (unregistering): Port device team_slave_0 removed
[ 56.471062][ T5135] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 56.478199][ T5135] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 56.485237][ T5135] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 56.492501][ T5135] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 56.499741][ T5135] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 56.533269][ T5987] chnl_net:caif_netlink_parms(): no params data found
[ 56.551048][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.558200][ T5987] bridge0: port 1(bridge_slave_0) entered disabled state
[ 56.565306][ T5987] bridge_slave_0: entered allmulticast mode
[ 56.571616][ T5987] bridge_slave_0: entered promiscuous mode
[ 56.578339][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.585394][ T5987] bridge0: port 2(bridge_slave_1) entered disabled state
[ 56.592725][ T5987] bridge_slave_1: entered allmulticast mode
[ 56.599055][ T5987] bridge_slave_1: entered promiscuous mode
[ 56.609383][ T5987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 56.619214][ T5987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 56.633179][ T5987] team0: Port device team_slave_0 added
[ 56.639450][ T5987] team0: Port device team_slave_1 added
[ 56.649461][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 56.656391][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 56.682534][ T5987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 56.693636][ T5987] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 56.700652][ T5987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 56.726541][ T5987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 56.742791][ T5987] hsr_slave_0: entered promiscuous mode
[ 56.748575][ T5987] hsr_slave_1: entered promiscuous mode
[ 56.899621][ T5987] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 56.907406][ T5987] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 56.916005][ T5987] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 56.923914][ T5987] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 56.936978][ T5987] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.944085][ T5987] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 56.951366][ T5987] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.958429][ T5987] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 56.978679][ T5987] 8021q: adding VLAN 0 to HW filter on device bond0
[ 56.988116][ T31] bridge0: port 1(bridge_slave_0) entered disabled state
[ 56.995621][ T31] bridge0: port 2(bridge_slave_1) entered disabled state
[ 57.009787][ T5987] 8021q: adding VLAN 0 to HW filter on device team0
[ 57.019929][ T31] bridge0: port 1(bridge_slave_0) entered blocking state
[ 57.026986][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 57.035013][ T31] bridge0: port 2(bridge_slave_1) entered blocking state
[ 57.042090][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 57.091660][ T5987] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 57.108045][ T5987] veth0_vlan: entered promiscuous mode
[ 57.115202][ T5987] veth1_vlan: entered promiscuous mode
[ 57.128314][ T5987] veth0_macvtap: entered promiscuous mode
[ 57.135072][ T5987] veth1_macvtap: entered promiscuous mode
[ 57.144855][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 57.153327][ T5987] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 57.163642][ T74] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.175835][ T74] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.187129][ T74] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.200636][ T74] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.217417][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 57.227482][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 57.228996][ T74] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)

[ 57.243335][ T74] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3285272391=/tmp/go-build -gno-record-gcc-switches'

GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''

GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'

GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4d

nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"

/usr/bin/ld: /tmp/ccvacM34.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit: 6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=140237cd980000

[Mehdi Ben Hadj Khelifa]

Failure in setup_bdev_super() triggers an error path where
fc->s_fs_info ownership has already been transferred to the superblock via
sget_fc() call in get_tree_bdev_flags() and calling put_fs_context() in
do_new_mount() to free the s_fs_info for the specific filesystem gets
passed in a NULL pointer.

Pass back the ownership of the s_fs_info pointer to the filesystem context
once the error path has been triggered to be cleaned up gracefully in
put_fs_context().

Fixes: cb50b348c71f ("convenience helpers: vfs_get_super() and sget_fc()")
Reported-by: syzbot+ad45f8...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
Signed-off-by: Mehdi Ben Hadj Khelifa <mehdi.benh...@gmail.com>
---
Note:This patch might need some more testing as I only did run selftests
with no regression, check dmesg output for no regression, run reproducer
with no bug.

fs/super.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/fs/super.c b/fs/super.c
index 5bab94fb7e03..8fadf97fcc42 100644

--- a/fs/super.c
+++ b/fs/super.c
@@ -1690,6 +1690,11 @@ int get_tree_bdev_flags(struct fs_context *fc,
if (!error)
error = fill_super(s, fc);
if (error) {
+ /*

+ * return s_fs_info ownership to fc to be cleaned up by put_fs_context()

[Mehdi Ben Hadj Khelifa]

On 11/14/25 12:55 PM, Christian Brauner wrote:

Sorry for the noise,Resending with proper CCs:

I forgot to mention. I was giving back the ownership to the filesystem
context because upon setup_bdev_super fails put_fs_context still gets
called even if I would free s_fs_info in the kill_sb,so hfs_free_fc
would get a NULL pointer to kfree as a result..I don't think that would
be desirable.

I would be sending my patch out for more discussion.