[v6.1] general protection fault in loopback_jiffies_timer_pos_update
0 views
Skip to first unread message
syzbot
May 18, 2026, 10:08:21 AM (3 days ago) May 18
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c27210688955 Linux 6.1.173
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1674c6d2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=ab669cc0b6618d92cadc
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/92fbc0595a58/disk-c2721068.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0f281a0d62f7/vmlinux-c2721068.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b17a33c5f1fe/bzImage-c2721068.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ab669c...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
CPU: 0 PID: 5504 Comm: kworker/u4:14 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: netns cleanup_net
RIP: 0010:loopback_jiffies_timer_pos_update+0x138/0x1250 sound/drivers/aloop.c:619
Code: 9e 7d f9 44 89 f8 83 e0 02 44 89 7c 24 3c 75 0a e8 4d 9b 7d f9 45 31 ff eb 27 e8 43 9b 7d f9 49 8d 5d 48 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 6a a7 ce f9 4d 89 f7 4c 2b 3b 4c 89
RSP: 0018:ffffc90000007a88 EFLAGS: 00010006
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff88802eba5940
RDX: 0000000000000100 RSI: 0000000000000002 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffce1a R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000088000 CR3: 00000000571e0000 CR4: 00000000003506f0
Call Trace:
<IRQ>
loopback_jiffies_timer_function+0x5e/0x240 sound/drivers/aloop.c:662
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x53e/0x800 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_schedule_irq+0xb6/0x160 kernel/sched/core.c:6874
Code: 00 00 43 c6 44 37 04 f8 74 0b 0f 0b 48 f7 03 08 00 00 00 74 7f bf 01 00 00 00 e8 65 65 22 f7 e8 70 59 52 f7 fb bf 01 00 00 00 <e8> 75 b9 ff ff 43 c6 44 37 08 00 48 c7 44 24 40 00 00 00 00 9c 8f
RSP: 0018:ffffc90003d6f5c0 EFLAGS: 00000282
RAX: c5e073e22f54ae00 RBX: 0000000000000000 RCX: c5e073e22f54ae00
RDX: dffffc0000000000 RSI: ffffffff8a8c19a0 RDI: 0000000000000001
RBP: ffffc90003d6f660 R08: ffffffff90afa24f R09: 1ffffffff215f449
R10: dffffc0000000000 R11: fffffbfff215f44a R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920007adeb8
irqentry_exit+0x63/0x70 kernel/entry/common.c:439
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:696
RIP: 0010:lockdep_unregister_key+0x4e8/0x550 kernel/locking/lockdep.c:6370
Code: a1 aa 90 48 c7 c6 70 f7 64 81 e8 73 a8 07 00 e8 de bb 07 00 e9 5c fc ff ff e8 d4 fe c8 08 41 f7 c4 00 02 00 00 74 d1 fb 84 db <75> d0 eb e1 0f 0b eb 88 0f 0b e9 f8 fe ff ff 0f 0b e9 45 ff ff ff
RSP: 0018:ffffc90003d6f720 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: c5e073e22f54ae00
RDX: 0000000000000001 RSI: ffffffff8a8c2680 RDI: ffffffff8adf1ba0
RBP: ffffc90003d6f800 R08: ffffffff90acbdd7 R09: 1ffffffff21597ba
R10: dffffc0000000000 R11: fffffbfff21597bb R12: 0000000000000207
R13: ffff88802a7e3a99 R14: ffffffff90aca1a8 R15: 1ffff920007adee8
__qdisc_destroy+0x128/0x430 net/sched/sch_generic.c:1081
netdev_for_each_tx_queue include/linux/netdevice.h:2465 [inline]
dev_shutdown+0x92/0x440 net/sched/sch_generic.c:1465
unregister_netdevice_many_notify+0xa76/0x19c0 net/core/dev.c:11014
unregister_netdevice_many net/core/dev.c:11077 [inline]
default_device_exit_batch+0x9ea/0xa80 net/core/dev.c:11549
ops_exit_list net/core/net_namespace.c:177 [inline]
cleanup_net+0x791/0xba0 net/core/net_namespace.c:640
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:loopback_jiffies_timer_pos_update+0x138/0x1250 sound/drivers/aloop.c:619
Code: 9e 7d f9 44 89 f8 83 e0 02 44 89 7c 24 3c 75 0a e8 4d 9b 7d f9 45 31 ff eb 27 e8 43 9b 7d f9 49 8d 5d 48 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 6a a7 ce f9 4d 89 f7 4c 2b 3b 4c 89
RSP: 0018:ffffc90000007a88 EFLAGS: 00010006
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff88802eba5940
RDX: 0000000000000100 RSI: 0000000000000002 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffce1a R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000088000 CR3: 00000000571e0000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: 9e sahf
1: 7d f9 jge 0xfffffffc
3: 44 89 f8 mov %r15d,%eax
6: 83 e0 02 and $0x2,%eax
9: 44 89 7c 24 3c mov %r15d,0x3c(%rsp)
e: 75 0a jne 0x1a
10: e8 4d 9b 7d f9 call 0xf97d9b62
15: 45 31 ff xor %r15d,%r15d
18: eb 27 jmp 0x41
1a: e8 43 9b 7d f9 call 0xf97d9b62
1f: 49 8d 5d 48 lea 0x48(%r13),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 6a a7 ce f9 call 0xf9cea7a2
38: 4d 89 f7 mov %r14,%r15
3b: 4c 2b 3b sub (%rbx),%r15
3e: 4c rex.WR
3f: 89 .byte 0x89
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: c27210688955 Linux 6.1.173
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1674c6d2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=ab669cc0b6618d92cadc
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/92fbc0595a58/disk-c2721068.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0f281a0d62f7/vmlinux-c2721068.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b17a33c5f1fe/bzImage-c2721068.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ab669c...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
CPU: 0 PID: 5504 Comm: kworker/u4:14 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: netns cleanup_net
RIP: 0010:loopback_jiffies_timer_pos_update+0x138/0x1250 sound/drivers/aloop.c:619
Code: 9e 7d f9 44 89 f8 83 e0 02 44 89 7c 24 3c 75 0a e8 4d 9b 7d f9 45 31 ff eb 27 e8 43 9b 7d f9 49 8d 5d 48 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 6a a7 ce f9 4d 89 f7 4c 2b 3b 4c 89
RSP: 0018:ffffc90000007a88 EFLAGS: 00010006
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff88802eba5940
RDX: 0000000000000100 RSI: 0000000000000002 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffce1a R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000088000 CR3: 00000000571e0000 CR4: 00000000003506f0
Call Trace:
<IRQ>
loopback_jiffies_timer_function+0x5e/0x240 sound/drivers/aloop.c:662
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x53e/0x800 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_schedule_irq+0xb6/0x160 kernel/sched/core.c:6874
Code: 00 00 43 c6 44 37 04 f8 74 0b 0f 0b 48 f7 03 08 00 00 00 74 7f bf 01 00 00 00 e8 65 65 22 f7 e8 70 59 52 f7 fb bf 01 00 00 00 <e8> 75 b9 ff ff 43 c6 44 37 08 00 48 c7 44 24 40 00 00 00 00 9c 8f
RSP: 0018:ffffc90003d6f5c0 EFLAGS: 00000282
RAX: c5e073e22f54ae00 RBX: 0000000000000000 RCX: c5e073e22f54ae00
RDX: dffffc0000000000 RSI: ffffffff8a8c19a0 RDI: 0000000000000001
RBP: ffffc90003d6f660 R08: ffffffff90afa24f R09: 1ffffffff215f449
R10: dffffc0000000000 R11: fffffbfff215f44a R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920007adeb8
irqentry_exit+0x63/0x70 kernel/entry/common.c:439
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:696
RIP: 0010:lockdep_unregister_key+0x4e8/0x550 kernel/locking/lockdep.c:6370
Code: a1 aa 90 48 c7 c6 70 f7 64 81 e8 73 a8 07 00 e8 de bb 07 00 e9 5c fc ff ff e8 d4 fe c8 08 41 f7 c4 00 02 00 00 74 d1 fb 84 db <75> d0 eb e1 0f 0b eb 88 0f 0b e9 f8 fe ff ff 0f 0b e9 45 ff ff ff
RSP: 0018:ffffc90003d6f720 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: c5e073e22f54ae00
RDX: 0000000000000001 RSI: ffffffff8a8c2680 RDI: ffffffff8adf1ba0
RBP: ffffc90003d6f800 R08: ffffffff90acbdd7 R09: 1ffffffff21597ba
R10: dffffc0000000000 R11: fffffbfff21597bb R12: 0000000000000207
R13: ffff88802a7e3a99 R14: ffffffff90aca1a8 R15: 1ffff920007adee8
__qdisc_destroy+0x128/0x430 net/sched/sch_generic.c:1081
netdev_for_each_tx_queue include/linux/netdevice.h:2465 [inline]
dev_shutdown+0x92/0x440 net/sched/sch_generic.c:1465
unregister_netdevice_many_notify+0xa76/0x19c0 net/core/dev.c:11014
unregister_netdevice_many net/core/dev.c:11077 [inline]
default_device_exit_batch+0x9ea/0xa80 net/core/dev.c:11549
ops_exit_list net/core/net_namespace.c:177 [inline]
cleanup_net+0x791/0xba0 net/core/net_namespace.c:640
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:loopback_jiffies_timer_pos_update+0x138/0x1250 sound/drivers/aloop.c:619
Code: 9e 7d f9 44 89 f8 83 e0 02 44 89 7c 24 3c 75 0a e8 4d 9b 7d f9 45 31 ff eb 27 e8 43 9b 7d f9 49 8d 5d 48 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 6a a7 ce f9 4d 89 f7 4c 2b 3b 4c 89
RSP: 0018:ffffc90000007a88 EFLAGS: 00010006
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff88802eba5940
RDX: 0000000000000100 RSI: 0000000000000002 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffce1a R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000088000 CR3: 00000000571e0000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: 9e sahf
1: 7d f9 jge 0xfffffffc
3: 44 89 f8 mov %r15d,%eax
6: 83 e0 02 and $0x2,%eax
9: 44 89 7c 24 3c mov %r15d,0x3c(%rsp)
e: 75 0a jne 0x1a
10: e8 4d 9b 7d f9 call 0xf97d9b62
15: 45 31 ff xor %r15d,%r15d
18: eb 27 jmp 0x41
1a: e8 43 9b 7d f9 call 0xf97d9b62
1f: 49 8d 5d 48 lea 0x48(%r13),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 6a a7 ce f9 call 0xf9cea7a2
38: 4d 89 f7 mov %r14,%r15
3b: 4c 2b 3b sub (%rbx),%r15
3e: 4c rex.WR
3f: 89 .byte 0x89
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages