[syzbot] [kernel?] KMSAN: uninit-value in __schedule (5)
18 views
Skip to first unread message
syzbot
Apr 10, 2024, 5:12:21 AM4/10/24
to b...@alien8.de, dave....@linux.intel.com, h...@zytor.com, linux-...@vger.kernel.org, mi...@redhat.com, syzkall...@googlegroups.com, tg...@linutronix.de, x...@kernel.org
Hello,
syzbot found the following issue on:
HEAD commit: e8b0ccb2a787 Merge tag '9p-for-6.9-rc3' of https://github...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14c4529d180000
kernel config: https://syzkaller.appspot.com/x/.config?x=5112b3f484393436
dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cf4b0d1e3b2d/disk-e8b0ccb2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/422cac6cc940/vmlinux-e8b0ccb2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9a4df48e199b/bzImage-e8b0ccb2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
Dead loop on virtual device ipvlan1, fix it urgently!
=====================================================
BUG: KMSAN: uninit-value in schedule_debug kernel/sched/core.c:5962 [inline]
BUG: KMSAN: uninit-value in __schedule+0x816/0x6bc0 kernel/sched/core.c:6629
schedule_debug kernel/sched/core.c:5962 [inline]
__schedule+0x816/0x6bc0 kernel/sched/core.c:6629
preempt_schedule_common kernel/sched/core.c:6925 [inline]
__cond_resched+0x49/0xc0 kernel/sched/core.c:8590
_cond_resched include/linux/sched.h:1988 [inline]
process_one_work kernel/workqueue.c:3287 [inline]
process_scheduled_works+0xc19/0x1bd0 kernel/workqueue.c:3335
worker_thread+0xea5/0x1560 kernel/workqueue.c:3416
kthread+0x3e2/0x540 kernel/kthread.c:388
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Local variable _addrs created at:
nf_ct_get_tuple+0x56/0x7d0 net/netfilter/nf_conntrack_core.c:277
resolve_normal_ct net/netfilter/nf_conntrack_core.c:1822 [inline]
nf_conntrack_in+0x5cd/0x30d0 net/netfilter/nf_conntrack_core.c:1996
CPU: 0 PID: 5088 Comm: kworker/0:4 Tainted: G W 6.9.0-rc2-syzkaller-00207-ge8b0ccb2a787 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: mld mld_ifc_work
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: e8b0ccb2a787 Merge tag '9p-for-6.9-rc3' of https://github...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14c4529d180000
kernel config: https://syzkaller.appspot.com/x/.config?x=5112b3f484393436
dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cf4b0d1e3b2d/disk-e8b0ccb2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/422cac6cc940/vmlinux-e8b0ccb2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9a4df48e199b/bzImage-e8b0ccb2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
Dead loop on virtual device ipvlan1, fix it urgently!
=====================================================
BUG: KMSAN: uninit-value in schedule_debug kernel/sched/core.c:5962 [inline]
BUG: KMSAN: uninit-value in __schedule+0x816/0x6bc0 kernel/sched/core.c:6629
schedule_debug kernel/sched/core.c:5962 [inline]
__schedule+0x816/0x6bc0 kernel/sched/core.c:6629
preempt_schedule_common kernel/sched/core.c:6925 [inline]
__cond_resched+0x49/0xc0 kernel/sched/core.c:8590
_cond_resched include/linux/sched.h:1988 [inline]
process_one_work kernel/workqueue.c:3287 [inline]
process_scheduled_works+0xc19/0x1bd0 kernel/workqueue.c:3335
worker_thread+0xea5/0x1560 kernel/workqueue.c:3416
kthread+0x3e2/0x540 kernel/kthread.c:388
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Local variable _addrs created at:
nf_ct_get_tuple+0x56/0x7d0 net/netfilter/nf_conntrack_core.c:277
resolve_normal_ct net/netfilter/nf_conntrack_core.c:1822 [inline]
nf_conntrack_in+0x5cd/0x30d0 net/netfilter/nf_conntrack_core.c:1996
CPU: 0 PID: 5088 Comm: kworker/0:4 Tainted: G W 6.9.0-rc2-syzkaller-00207-ge8b0ccb2a787 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: mld mld_ifc_work
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Feb 9, 2026, 1:35:35 PMFeb 9
to b...@alien8.de, dave....@linux.intel.com, da...@davemloft.net, dsa...@kernel.org, edum...@google.com, ho...@kernel.org, h...@zytor.com, ku...@kernel.org, linux-...@vger.kernel.org, mi...@redhat.com, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com, tg...@linutronix.de, x...@kernel.org
syzbot has found a reproducer for the following issue on:
HEAD commit: 05f7e89ab973 Linux 6.19
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17daf65a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df890e720d1bb80
dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1029533a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ea9f39c5175d/disk-05f7e89a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/734edeebfa32/vmlinux-05f7e89a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a2cb36d849f0/bzImage-05f7e89a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-use-after-free in membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
BUG: KASAN: slab-use-after-free in context_switch kernel/sched/core.c:5230 [inline]
BUG: KASAN: slab-use-after-free in __schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
Read of size 4 at addr ffff88801db4e2c0 by task kworker/u8:1/13
CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x156/0x4c9 mm/kasan/report.c:482
kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186 [inline]
kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
context_switch kernel/sched/core.c:5230 [inline]
__schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4194
process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Allocated by task 5942:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6090:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kmem_cache_free+0x143/0x720 mm/slub.c:6789
mmdrop include/linux/sched/mm.h:55 [inline]
mmdrop_sched include/linux/sched/mm.h:83 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
finish_task_switch.isra.0+0x76e/0xb70 kernel/sched/core.c:5143
context_switch kernel/sched/core.c:5263 [inline]
__schedule+0xfee/0x5fa0 kernel/sched/core.c:6867
preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7051
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
anon_pipe_write+0xdaa/0x1d40 fs/pipe.c:596
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x6ac/0x1070 fs/read_write.c:686
ksys_write+0x1f8/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88801db4e200
which belongs to the cache mm_struct of size 2968
The buggy address is located 192 bytes inside of
freed 2968-byte region [ffff88801db4e200, ffff88801db4ed98)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1db48
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888031ddb901
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff30b40 dead000000000100 dead000000000122
raw: 0000000000000000 00000000800a000a 00000000f5000000 ffff888031ddb901
head: 00fff00000000040 ffff88813ff30b40 dead000000000100 dead000000000122
head: 0000000000000000 00000000800a000a 00000000f5000000 ffff888031ddb901
head: 00fff00000000003 ffffea000076d201 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5202, tgid 5202 (udevd), ts 49764882375, free_ts 49738398245
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0xe3d/0x2e10 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab mm/slub.c:3248 [inline]
new_slab+0x2c4/0x440 mm/slub.c:3302
___slab_alloc+0xda3/0x1ca0 mm/slub.c:4656
__slab_alloc.isra.0+0x63/0x110 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
kmem_cache_alloc_noprof+0x4ec/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5349 tgid 5349 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
vm_area_dup+0x27/0x8e0 mm/vma_init.c:123
__split_vma+0x18c/0xe30 mm/vma.c:513
vms_gather_munmap_vmas+0x3aa/0x1320 mm/vma.c:1423
__mmap_setup mm/vma.c:2405 [inline]
__mmap_region+0x46e/0x2820 mm/vma.c:2734
mmap_region+0x180/0x3e0 mm/vma.c:2830
do_mmap+0xc63/0x12f0 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x328/0x5b0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88801db4e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801db4e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801db4e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801db4e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801db4e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 05f7e89ab973 Linux 6.19
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17daf65a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df890e720d1bb80
dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1029533a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ea9f39c5175d/disk-05f7e89a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/734edeebfa32/vmlinux-05f7e89a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a2cb36d849f0/bzImage-05f7e89a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-use-after-free in membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
BUG: KASAN: slab-use-after-free in context_switch kernel/sched/core.c:5230 [inline]
BUG: KASAN: slab-use-after-free in __schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
Read of size 4 at addr ffff88801db4e2c0 by task kworker/u8:1/13
CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x156/0x4c9 mm/kasan/report.c:482
kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186 [inline]
kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
context_switch kernel/sched/core.c:5230 [inline]
__schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4194
process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Allocated by task 5942:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6090:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kmem_cache_free+0x143/0x720 mm/slub.c:6789
mmdrop include/linux/sched/mm.h:55 [inline]
mmdrop_sched include/linux/sched/mm.h:83 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
finish_task_switch.isra.0+0x76e/0xb70 kernel/sched/core.c:5143
context_switch kernel/sched/core.c:5263 [inline]
__schedule+0xfee/0x5fa0 kernel/sched/core.c:6867
preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7051
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194
anon_pipe_write+0xdaa/0x1d40 fs/pipe.c:596
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x6ac/0x1070 fs/read_write.c:686
ksys_write+0x1f8/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88801db4e200
which belongs to the cache mm_struct of size 2968
The buggy address is located 192 bytes inside of
freed 2968-byte region [ffff88801db4e200, ffff88801db4ed98)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1db48
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888031ddb901
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff30b40 dead000000000100 dead000000000122
raw: 0000000000000000 00000000800a000a 00000000f5000000 ffff888031ddb901
head: 00fff00000000040 ffff88813ff30b40 dead000000000100 dead000000000122
head: 0000000000000000 00000000800a000a 00000000f5000000 ffff888031ddb901
head: 00fff00000000003 ffffea000076d201 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5202, tgid 5202 (udevd), ts 49764882375, free_ts 49738398245
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0xe3d/0x2e10 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab mm/slub.c:3248 [inline]
new_slab+0x2c4/0x440 mm/slub.c:3302
___slab_alloc+0xda3/0x1ca0 mm/slub.c:4656
__slab_alloc.isra.0+0x63/0x110 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
kmem_cache_alloc_noprof+0x4ec/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5349 tgid 5349 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
vm_area_dup+0x27/0x8e0 mm/vma_init.c:123
__split_vma+0x18c/0xe30 mm/vma.c:513
vms_gather_munmap_vmas+0x3aa/0x1320 mm/vma.c:1423
__mmap_setup mm/vma.c:2405 [inline]
__mmap_region+0x46e/0x2820 mm/vma.c:2734
mmap_region+0x180/0x3e0 mm/vma.c:2830
do_mmap+0xc63/0x12f0 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x328/0x5b0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88801db4e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801db4e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801db4e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801db4e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801db4e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Feb 9, 2026, 4:19:26 PMFeb 9
to b...@alien8.de, dave....@linux.intel.com, da...@davemloft.net, dsa...@kernel.org, edum...@google.com, ho...@kernel.org, h...@zytor.com, ku...@kernel.org, linux-...@vger.kernel.org, mi...@redhat.com, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com, tg...@kernel.org, tg...@linutronix.de, x...@kernel.org
syzbot has found a reproducer for the following issue on:
HEAD commit: 05f7e89ab973 Linux 6.19
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15651b22580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df890e720d1bb80
dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111b465a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171d533a580000
Downloadable assets:
CPU: 1 UID: 0 PID: 3479 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: 0x0 (gid-cache-wq)
spin_unlock_bh include/linux/spinlock.h:396 [inline]
netif_addr_unlock_bh include/linux/netdevice.h:4874 [inline]
dev_uc_add+0xd4/0x110 net/core/dev_addr_lists.c:694
vlan_dev_set_mac_address+0x2d4/0x440 net/8021q/vlan_dev.c:324
netif_set_mac_address+0x304/0x4a0 net/core/dev.c:9985
do_setlink.isra.0+0x75f/0x3e50 net/core/rtnetlink.c:3110
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x11bd/0x2380 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x4aa/0x520 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2209
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e378
head: 00fff00000000003 ffffea0001f8de01 00000000ffffffff 00000000ffffffff
__put_partials+0x127/0x160 mm/slub.c:3886
kmalloc_noprof include/linux/slab.h:957 [inline]
tomoyo_print_header security/tomoyo/audit.c:156 [inline]
tomoyo_init_log+0x1a0/0x20c0 security/tomoyo/audit.c:255
tomoyo_supervisor+0x506/0x1340 security/tomoyo/common.c:2198
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x270/0x3b0 security/tomoyo/file.c:573
tomoyo_path_perm+0x364/0x460 security/tomoyo/file.c:838
security_inode_getattr+0x116/0x280 security/security.c:1869
vfs_getattr fs/stat.c:259 [inline]
vfs_statx_path fs/stat.c:299 [inline]
vfs_statx+0x11f/0x3f0 fs/stat.c:356
vfs_fstatat+0x7b/0xf0 fs/stat.c:375
__do_sys_newfstatat+0x9d/0x120 fs/stat.c:542
ffff88807e37a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807e37a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807e37a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807e37a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
HEAD commit: 05f7e89ab973 Linux 6.19
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15651b22580000
kernel config: https://syzkaller.appspot.com/x/.config?x=df890e720d1bb80
dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111b465a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171d533a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ea9f39c5175d/disk-05f7e89a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/734edeebfa32/vmlinux-05f7e89a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a2cb36d849f0/bzImage-05f7e89a.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/734edeebfa32/vmlinux-05f7e89a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a2cb36d849f0/bzImage-05f7e89a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-use-after-free in membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
BUG: KASAN: slab-use-after-free in context_switch kernel/sched/core.c:5230 [inline]
BUG: KASAN: slab-use-after-free in __schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
Read of size 4 at addr ffff88807e37a580 by task kworker/u8:7/3479
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: slab-use-after-free in membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
BUG: KASAN: slab-use-after-free in context_switch kernel/sched/core.c:5230 [inline]
BUG: KASAN: slab-use-after-free in __schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
CPU: 1 UID: 0 PID: 3479 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: 0x0 (gid-cache-wq)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x156/0x4c9 mm/kasan/report.c:482
kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186 [inline]
kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
context_switch kernel/sched/core.c:5230 [inline]
__schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
worker_thread+0x526/0xe40 kernel/workqueue.c:3436
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x156/0x4c9 mm/kasan/report.c:482
kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186 [inline]
kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
context_switch kernel/sched/core.c:5230 [inline]
__schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Allocated by task 5947:
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5952:
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kmem_cache_free+0x143/0x720 mm/slub.c:6789
mmdrop include/linux/sched/mm.h:55 [inline]
mmdrop_sched include/linux/sched/mm.h:83 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
finish_task_switch.isra.0+0x76e/0xb70 kernel/sched/core.c:5143
context_switch kernel/sched/core.c:5263 [inline]
__schedule+0xfee/0x5fa0 kernel/sched/core.c:6867
preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7051
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__local_bh_enable_ip+0xff/0x120 kernel/softirq.c:457
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kmem_cache_free+0x143/0x720 mm/slub.c:6789
mmdrop include/linux/sched/mm.h:55 [inline]
mmdrop_sched include/linux/sched/mm.h:83 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
finish_task_switch.isra.0+0x76e/0xb70 kernel/sched/core.c:5143
context_switch kernel/sched/core.c:5263 [inline]
__schedule+0xfee/0x5fa0 kernel/sched/core.c:6867
preempt_schedule_common+0x42/0xc0 kernel/sched/core.c:7051
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
spin_unlock_bh include/linux/spinlock.h:396 [inline]
netif_addr_unlock_bh include/linux/netdevice.h:4874 [inline]
dev_uc_add+0xd4/0x110 net/core/dev_addr_lists.c:694
vlan_dev_set_mac_address+0x2d4/0x440 net/8021q/vlan_dev.c:324
netif_set_mac_address+0x304/0x4a0 net/core/dev.c:9985
do_setlink.isra.0+0x75f/0x3e50 net/core/rtnetlink.c:3110
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x11bd/0x2380 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x4aa/0x520 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88807e37a4c0
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
which belongs to the cache mm_struct of size 2968
The buggy address is located 192 bytes inside of
freed 2968-byte region [ffff88807e37a4c0, ffff88807e37b058)
The buggy address is located 192 bytes inside of
The buggy address belongs to the physical page:
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888033218c01
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff30b40 dead000000000100 dead000000000122
raw: 0000000000000000 00000000800a000a 00000000f5000000 ffff888033218c01
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff30b40 dead000000000100 dead000000000122
head: 00fff00000000040 ffff88813ff30b40 dead000000000100 dead000000000122
head: 0000000000000000 00000000800a000a 00000000f5000000 ffff888033218c01
head: 00fff00000000003 ffffea0001f8de01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5573, tgid 5573 (dhcpcd-run-hook), ts 54892168157, free_ts 54822253634
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0xe3d/0x2e10 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab mm/slub.c:3248 [inline]
new_slab+0x2c4/0x440 mm/slub.c:3302
___slab_alloc+0xda3/0x1ca0 mm/slub.c:4656
__slab_alloc.isra.0+0x63/0x110 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
kmem_cache_alloc_noprof+0x4ec/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5571 tgid 5571 stack trace:
post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0xe3d/0x2e10 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab mm/slub.c:3248 [inline]
new_slab+0x2c4/0x440 mm/slub.c:3302
___slab_alloc+0xda3/0x1ca0 mm/slub.c:4656
__slab_alloc.isra.0+0x63/0x110 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
kmem_cache_alloc_noprof+0x4ec/0x780 mm/slub.c:5270
dup_mm kernel/fork.c:1519 [inline]
copy_mm kernel/fork.c:1581 [inline]
copy_process+0x73df/0x7890 kernel/fork.c:2221
kernel_clone+0xfc/0x930 kernel/fork.c:2651
__do_sys_clone+0xd9/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973
discard_slab mm/slub.c:3346 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973
__put_partials+0x127/0x160 mm/slub.c:3886
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x2e1/0x810 mm/slub.c:5775
qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmalloc_noprof include/linux/slab.h:957 [inline]
tomoyo_print_header security/tomoyo/audit.c:156 [inline]
tomoyo_init_log+0x1a0/0x20c0 security/tomoyo/audit.c:255
tomoyo_supervisor+0x506/0x1340 security/tomoyo/common.c:2198
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x270/0x3b0 security/tomoyo/file.c:573
tomoyo_path_perm+0x364/0x460 security/tomoyo/file.c:838
security_inode_getattr+0x116/0x280 security/security.c:1869
vfs_getattr fs/stat.c:259 [inline]
vfs_statx_path fs/stat.c:299 [inline]
vfs_statx+0x11f/0x3f0 fs/stat.c:356
vfs_fstatat+0x7b/0xf0 fs/stat.c:375
__do_sys_newfstatat+0x9d/0x120 fs/stat.c:542
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88807e37a480: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88807e37a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807e37a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807e37a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807e37a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Thomas Gleixner
Feb 10, 2026, 2:05:13 PMFeb 10
to syzbot, b...@alien8.de, dave....@linux.intel.com, da...@davemloft.net, dsa...@kernel.org, edum...@google.com, ho...@kernel.org, h...@zytor.com, ku...@kernel.org, linux-...@vger.kernel.org, mi...@redhat.com, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com, x...@kernel.org
On Mon, Feb 09 2026 at 10:35, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 05f7e89ab973 Linux 6.19
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17daf65a580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=df890e720d1bb80
> dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1029533a580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ea9f39c5175d/disk-05f7e89a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/734edeebfa32/vmlinux-05f7e89a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/a2cb36d849f0/bzImage-05f7e89a.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
> BUG: KASAN: slab-use-after-free in membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
> BUG: KASAN: slab-use-after-free in context_switch kernel/sched/core.c:5230 [inline]
> BUG: KASAN: slab-use-after-free in __schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
> Read of size 4 at addr ffff88801db4e2c0 by task kworker/u8:1/13
That's most likely the same issue as with the futex report. Caused by a
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 05f7e89ab973 Linux 6.19
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17daf65a580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=df890e720d1bb80
> dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1029533a580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ea9f39c5175d/disk-05f7e89a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/734edeebfa32/vmlinux-05f7e89a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/a2cb36d849f0/bzImage-05f7e89a.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+28bdcf...@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
> BUG: KASAN: slab-use-after-free in membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
> BUG: KASAN: slab-use-after-free in context_switch kernel/sched/core.c:5230 [inline]
> BUG: KASAN: slab-use-after-free in __schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
> Read of size 4 at addr ffff88801db4e2c0 by task kworker/u8:1/13
double mmdrop() in do_procmap_query(). The reproducer fiddles with
that...
See https://lore.kernel.org/all/20260129215340....@kernel.org/T/#m5250c5bf0612d19c7991b6454f309e41776982be
Thanks,
tglx
Reply all
Reply to author
Forward
0 new messages