[v5.15] WARNING in comedi_unlocked_ioctl
3 views
Skip to first unread message
syzbot
Jul 10, 2025, 7:52:33 AMJul 10
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3dea0e7f549e Linux 5.15.186
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16736a8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=fe91feccd8127a59
dashboard link: https://syzkaller.appspot.com/bug?extid=4d61e9f9af9f72f89a87
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8db6cfea7ea/disk-3dea0e7f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/eeb133c8268e/vmlinux-3dea0e7f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9478525201a1/Image-3dea0e7f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4d61e9...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 14538 at mm/page_alloc.c:5449 __alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
Modules linked in:
CPU: 0 PID: 14538 Comm: syz.3.2407 Not tainted 5.15.186-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
lr : __alloc_pages+0xac/0x470 mm/page_alloc.c:5442
sp : ffff800021507700
x29: ffff8000215077d0 x28: 1ffff000035c6cc8 x27: ffff800021507720
x26: ffff80001ae36640 x25: dfff800000000000 x24: ffff7000042a0ee4
x23: ffff80001ae36644 x22: 0000000000000000 x21: 0000000000040dc0
x20: 0000000000000000 x19: 0000000000000019 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008822af4 x15: 0000000000000005
x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000000005
x11: 1ffff000042a0ee8 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff800021507768 x7 : 0000000000000000 x6 : ffff800021507c40
x5 : ffff800021507c40 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff800021507740
Call trace:
__alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
alloc_pages+0x34c/0x5c0 mm/mempolicy.c:-1
kmalloc_order+0x40/0x160 mm/slab_common.c:986
kmalloc_order_trace+0x30/0x244 mm/slab_common.c:1002
kmalloc_large include/linux/slab.h:533 [inline]
__kmalloc+0x318/0x44c mm/slub.c:4396
kmalloc_array include/linux/slab.h:644 [inline]
kcalloc include/linux/slab.h:673 [inline]
comedi_unlocked_ioctl+0x914/0xdcc drivers/comedi/comedi_fops.c:2237
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 518
hardirqs last enabled at (517): [<ffff80000884efa0>] kasan_quarantine_put+0xc4/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (518): [<ffff8000111cabbc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (260): [<ffff800008031f40>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31
softirqs last disabled at (258): [<ffff800008031f0c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
---[ end trace 432199f2d1802a63 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 3dea0e7f549e Linux 5.15.186
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16736a8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=fe91feccd8127a59
dashboard link: https://syzkaller.appspot.com/bug?extid=4d61e9f9af9f72f89a87
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8db6cfea7ea/disk-3dea0e7f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/eeb133c8268e/vmlinux-3dea0e7f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9478525201a1/Image-3dea0e7f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4d61e9...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 14538 at mm/page_alloc.c:5449 __alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
Modules linked in:
CPU: 0 PID: 14538 Comm: syz.3.2407 Not tainted 5.15.186-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
lr : __alloc_pages+0xac/0x470 mm/page_alloc.c:5442
sp : ffff800021507700
x29: ffff8000215077d0 x28: 1ffff000035c6cc8 x27: ffff800021507720
x26: ffff80001ae36640 x25: dfff800000000000 x24: ffff7000042a0ee4
x23: ffff80001ae36644 x22: 0000000000000000 x21: 0000000000040dc0
x20: 0000000000000000 x19: 0000000000000019 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008822af4 x15: 0000000000000005
x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000000005
x11: 1ffff000042a0ee8 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff800021507768 x7 : 0000000000000000 x6 : ffff800021507c40
x5 : ffff800021507c40 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff800021507740
Call trace:
__alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
alloc_pages+0x34c/0x5c0 mm/mempolicy.c:-1
kmalloc_order+0x40/0x160 mm/slab_common.c:986
kmalloc_order_trace+0x30/0x244 mm/slab_common.c:1002
kmalloc_large include/linux/slab.h:533 [inline]
__kmalloc+0x318/0x44c mm/slub.c:4396
kmalloc_array include/linux/slab.h:644 [inline]
kcalloc include/linux/slab.h:673 [inline]
comedi_unlocked_ioctl+0x914/0xdcc drivers/comedi/comedi_fops.c:2237
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 518
hardirqs last enabled at (517): [<ffff80000884efa0>] kasan_quarantine_put+0xc4/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (518): [<ffff8000111cabbc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (260): [<ffff800008031f40>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31
softirqs last disabled at (258): [<ffff800008031f0c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
---[ end trace 432199f2d1802a63 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 10, 2025, 9:47:27 AMJul 10
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3dea0e7f549e Linux 5.15.186
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11e340f0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13ca9bd4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8db6cfea7ea/disk-3dea0e7f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/eeb133c8268e/vmlinux-3dea0e7f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9478525201a1/Image-3dea0e7f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4d61e9...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5213 at mm/page_alloc.c:5449 __alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
Modules linked in:
CPU: 1 PID: 5213 Comm: syz.1.476 Not tainted 5.15.186-syzkaller #0
x29: ffff800022dd77d0 x28: 1ffff000035c6cc8 x27: ffff800022dd7720
x26: ffff80001ae36640 x25: dfff800000000000 x24: ffff7000045baee4
x8 : ffff800022dd7768 x7 : 0000000000000000 x6 : ffff800022dd7c40
x5 : ffff800022dd7c40 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff800022dd7740
hardirqs last enabled at (1607): [<ffff80000884efa0>] kasan_quarantine_put+0xc4/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (1608): [<ffff8000111cabbc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (1596): [<ffff80000819e9e8>] softirq_handle_end kernel/softirq.c:419 [inline]
softirqs last enabled at (1596): [<ffff80000819e9e8>] handle_softirqs+0xa4c/0xbf0 kernel/softirq.c:604
softirqs last disabled at (1569): [<ffff80000819efec>] __do_softirq kernel/softirq.c:610 [inline]
softirqs last disabled at (1569): [<ffff80000819efec>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (1569): [<ffff80000819efec>] invoke_softirq kernel/softirq.c:457 [inline]
softirqs last disabled at (1569): [<ffff80000819efec>] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659
---[ end trace 99a4d1b656165b33 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 3dea0e7f549e Linux 5.15.186
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=fe91feccd8127a59
dashboard link: https://syzkaller.appspot.com/bug?extid=4d61e9f9af9f72f89a87
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=118ada8c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=4d61e9f9af9f72f89a87
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13ca9bd4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8db6cfea7ea/disk-3dea0e7f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/eeb133c8268e/vmlinux-3dea0e7f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9478525201a1/Image-3dea0e7f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4d61e9...@syzkaller.appspotmail.com
------------[ cut here ]------------
Modules linked in:
CPU: 1 PID: 5213 Comm: syz.1.476 Not tainted 5.15.186-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
lr : __alloc_pages+0xac/0x470 mm/page_alloc.c:5442
sp : ffff800022dd7700
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
lr : __alloc_pages+0xac/0x470 mm/page_alloc.c:5442
x29: ffff800022dd77d0 x28: 1ffff000035c6cc8 x27: ffff800022dd7720
x26: ffff80001ae36640 x25: dfff800000000000 x24: ffff7000045baee4
x23: ffff80001ae36644 x22: 0000000000000000 x21: 0000000000040dc0
x20: 0000000000000000 x19: 0000000000000019 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008822af4 x15: 0000000000000005
x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000000005
x11: 1ffff000045baee8 x10: 0000000000000000 x9 : 0000000000000000
x20: 0000000000000000 x19: 0000000000000019 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008822af4 x15: 0000000000000005
x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000000005
x8 : ffff800022dd7768 x7 : 0000000000000000 x6 : ffff800022dd7c40
x5 : ffff800022dd7c40 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff800022dd7740
Call trace:
__alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
alloc_pages+0x34c/0x5c0 mm/mempolicy.c:-1
kmalloc_order+0x40/0x160 mm/slab_common.c:986
kmalloc_order_trace+0x30/0x244 mm/slab_common.c:1002
kmalloc_large include/linux/slab.h:533 [inline]
__kmalloc+0x318/0x44c mm/slub.c:4396
kmalloc_array include/linux/slab.h:644 [inline]
kcalloc include/linux/slab.h:673 [inline]
comedi_unlocked_ioctl+0x914/0xdcc drivers/comedi/comedi_fops.c:2237
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 1608
__alloc_pages+0x2b4/0x470 mm/page_alloc.c:5449
alloc_pages+0x34c/0x5c0 mm/mempolicy.c:-1
kmalloc_order+0x40/0x160 mm/slab_common.c:986
kmalloc_order_trace+0x30/0x244 mm/slab_common.c:1002
kmalloc_large include/linux/slab.h:533 [inline]
__kmalloc+0x318/0x44c mm/slub.c:4396
kmalloc_array include/linux/slab.h:644 [inline]
kcalloc include/linux/slab.h:673 [inline]
comedi_unlocked_ioctl+0x914/0xdcc drivers/comedi/comedi_fops.c:2237
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
hardirqs last enabled at (1607): [<ffff80000884efa0>] kasan_quarantine_put+0xc4/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (1608): [<ffff8000111cabbc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (1596): [<ffff80000819e9e8>] softirq_handle_end kernel/softirq.c:419 [inline]
softirqs last enabled at (1596): [<ffff80000819e9e8>] handle_softirqs+0xa4c/0xbf0 kernel/softirq.c:604
softirqs last disabled at (1569): [<ffff80000819efec>] __do_softirq kernel/softirq.c:610 [inline]
softirqs last disabled at (1569): [<ffff80000819efec>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (1569): [<ffff80000819efec>] invoke_softirq kernel/softirq.c:457 [inline]
softirqs last disabled at (1569): [<ffff80000819efec>] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659
---[ end trace 99a4d1b656165b33 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Jul 11, 2025, 12:26:26 AMJul 11
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 59a2de10b81a Linux 6.6.97
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1440468c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ac0b29aca872266f
dashboard link: https://syzkaller.appspot.com/bug?extid=032ab98511c4a6864a8f
disk image: https://storage.googleapis.com/syzbot-assets/32864b54a55c/disk-59a2de10.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b0bbe4ada642/vmlinux-59a2de10.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9e3fe91e14c2/bzImage-59a2de10.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+032ab9...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5897 at mm/page_alloc.c:4433 __alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Modules linked in:
CPU: 0 PID: 5897 Comm: syz.2.7 Not tainted 6.6.97-syzkaller #0
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 c0 cb 62 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff
RSP: 0018:ffffc90004c7f9c0 EFLAGS: 00010246
RAX: ffffc90004c7fa00 RBX: 1ffff9200098ff3c RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90004c7fa28
RBP: ffffc90004c7fac0 R08: ffffc90004c7fa27 R09: 0000000000000000
R10: ffffc90004c7fa00 R11: fffff5200098ff45 R12: 000000000000001a
R13: 0000000000000000 R14: 0000000000040dc0 R15: dffffc0000000000
FS: 00007f7618dbd6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558882e808 CR3: 000000007eb86000 CR4: 00000000003506f0
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1148
__do_kmalloc_node mm/slab_common.c:995 [inline]
__kmalloc+0x111/0x240 mm/slab_common.c:1020
kmalloc_array include/linux/slab.h:637 [inline]
kcalloc include/linux/slab.h:668 [inline]
comedi_unlocked_ioctl+0x9f0/0xf00 drivers/comedi/comedi_fops.c:2242
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7617f8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7618dbd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f76181b5fa0 RCX: 00007f7617f8e929
RDX: 00002000001859c0 RSI: 000000008010640b RDI: 0000000000000003
RBP: 00007f7618010b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f76181b5fa0 R15: 00007ffdd4f87408
</TASK>
syzbot found the following issue on:
HEAD commit: 59a2de10b81a Linux 6.6.97
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1440468c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ac0b29aca872266f
dashboard link: https://syzkaller.appspot.com/bug?extid=032ab98511c4a6864a8f
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32864b54a55c/disk-59a2de10.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b0bbe4ada642/vmlinux-59a2de10.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9e3fe91e14c2/bzImage-59a2de10.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5897 at mm/page_alloc.c:4433 __alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Modules linked in:
CPU: 0 PID: 5897 Comm: syz.2.7 Not tainted 6.6.97-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 c0 cb 62 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff
RSP: 0018:ffffc90004c7f9c0 EFLAGS: 00010246
RAX: ffffc90004c7fa00 RBX: 1ffff9200098ff3c RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90004c7fa28
RBP: ffffc90004c7fac0 R08: ffffc90004c7fa27 R09: 0000000000000000
R10: ffffc90004c7fa00 R11: fffff5200098ff45 R12: 000000000000001a
R13: 0000000000000000 R14: 0000000000040dc0 R15: dffffc0000000000
FS: 00007f7618dbd6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558882e808 CR3: 000000007eb86000 CR4: 00000000003506f0
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1148
__do_kmalloc_node mm/slab_common.c:995 [inline]
__kmalloc+0x111/0x240 mm/slab_common.c:1020
kmalloc_array include/linux/slab.h:637 [inline]
kcalloc include/linux/slab.h:668 [inline]
comedi_unlocked_ioctl+0x9f0/0xf00 drivers/comedi/comedi_fops.c:2242
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7617f8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7618dbd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f76181b5fa0 RCX: 00007f7617f8e929
RDX: 00002000001859c0 RSI: 000000008010640b RDI: 0000000000000003
RBP: 00007f7618010b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f76181b5fa0 R15: 00007ffdd4f87408
</TASK>
syzbot
Jul 11, 2025, 12:55:34 AMJul 11
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: dfc486ec9cce Linux 6.1.144
syzbot found the following issue on:
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15ab20f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=af043eb58258a24b
dashboard link: https://syzkaller.appspot.com/bug?extid=b2bde13f12963932c08d
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/33f04d64fdc1/disk-dfc486ec.raw.xz
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
vmlinux: https://storage.googleapis.com/syzbot-assets/ae15f823ab9f/vmlinux-dfc486ec.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c42843bce2bf/bzImage-dfc486ec.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4955 at mm/page_alloc.c:5590 __alloc_pages+0x2f4/0x4e0 mm/page_alloc.c:5590
Modules linked in:
CPU: 0 PID: 4955 Comm: syz.3.185 Not tainted 6.1.144-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__alloc_pages+0x2f4/0x4e0 mm/page_alloc.c:5590
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 e8 cc 43 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 04 75 3e 44 89 f1 81 e1 7f ff
RSP: 0018:ffffc9000d4679c0 EFLAGS: 00010246
RAX: ffffc9000d467a00 RBX: 1ffff92001a8cf3c RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc9000d467a28
RBP: ffffc9000d467ac0 R08: dffffc0000000000 R09: ffffc9000d467a00
R10: fffff52001a8cf45 R11: 1ffff92001a8cf40 R12: 000000000000001a
R13: 0000000000000000 R14: 0000000000040dc0 R15: dffffc0000000000
FS: 00007f0a16e1a6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000001859c0 CR3: 0000000055183000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1077
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__do_kmalloc_node mm/slab_common.c:924 [inline]
__kmalloc+0x110/0x240 mm/slab_common.c:949
kmalloc_array include/linux/slab.h:615 [inline]
kcalloc include/linux/slab.h:646 [inline]
comedi_unlocked_ioctl+0x98b/0xe90 drivers/comedi/comedi_fops.c:2237
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0a15f8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0a16e1a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0a161b5fa0 RCX: 00007f0a15f8e929
RDX: 00002000001859c0 RSI: 000000008010640b RDI: 0000000000000003
RBP: 00007f0a16010b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f0a161b5fa0 R15: 00007fffa63e7568
syzbot
Jul 11, 2025, 6:12:37 AMJul 11
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1261a0f0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1629ba8c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/33f04d64fdc1/disk-dfc486ec.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ae15f823ab9f/vmlinux-dfc486ec.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c42843bce2bf/bzImage-dfc486ec.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b2bde1...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4427 at mm/page_alloc.c:5590 __alloc_pages+0x2f4/0x4e0 mm/page_alloc.c:5590
Modules linked in:
CPU: 1 PID: 4427 Comm: syz.0.16 Not tainted 6.1.144-syzkaller #0
RAX: ffffc90003457a00 RBX: 1ffff9200068af3c RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003457a28
RBP: ffffc90003457ac0 R08: dffffc0000000000 R09: ffffc90003457a00
R10: fffff5200068af45 R11: 1ffff9200068af40 R12: 000000000000001a
RAX: ffffffffffffffda RBX: 00007f3fdcbb5fa0 RCX: 00007f3fdc98e929
</TASK>
HEAD commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=af043eb58258a24b
dashboard link: https://syzkaller.appspot.com/bug?extid=b2bde13f12963932c08d
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12cc668c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=b2bde13f12963932c08d
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1629ba8c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/33f04d64fdc1/disk-dfc486ec.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ae15f823ab9f/vmlinux-dfc486ec.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c42843bce2bf/bzImage-dfc486ec.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b2bde1...@syzkaller.appspotmail.com
------------[ cut here ]------------
Modules linked in:
CPU: 1 PID: 4427 Comm: syz.0.16 Not tainted 6.1.144-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__alloc_pages+0x2f4/0x4e0 mm/page_alloc.c:5590
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 e8 cc 43 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 04 75 3e 44 89 f1 81 e1 7f ff
RSP: 0018:ffffc900034579c0 EFLAGS: 00010246
RIP: 0010:__alloc_pages+0x2f4/0x4e0 mm/page_alloc.c:5590
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 e8 cc 43 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 04 75 3e 44 89 f1 81 e1 7f ff
RAX: ffffc90003457a00 RBX: 1ffff9200068af3c RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003457a28
RBP: ffffc90003457ac0 R08: dffffc0000000000 R09: ffffc90003457a00
R10: fffff5200068af45 R11: 1ffff9200068af40 R12: 000000000000001a
R13: 0000000000000000 R14: 0000000000040dc0 R15: dffffc0000000000
FS: 000055555a83b500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000001859c0 CR3: 00000000308c8000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1077
__do_kmalloc_node mm/slab_common.c:924 [inline]
__kmalloc+0x110/0x240 mm/slab_common.c:949
kmalloc_array include/linux/slab.h:615 [inline]
kcalloc include/linux/slab.h:646 [inline]
comedi_unlocked_ioctl+0x98b/0xe90 drivers/comedi/comedi_fops.c:2237
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3fdc98e929
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1077
__do_kmalloc_node mm/slab_common.c:924 [inline]
__kmalloc+0x110/0x240 mm/slab_common.c:949
kmalloc_array include/linux/slab.h:615 [inline]
kcalloc include/linux/slab.h:646 [inline]
comedi_unlocked_ioctl+0x98b/0xe90 drivers/comedi/comedi_fops.c:2237
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdac00b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f3fdcbb5fa0 RCX: 00007f3fdc98e929
RDX: 00002000001859c0 RSI: 000000008010640b RDI: 0000000000000003
RBP: 00007f3fdca10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3fdcbb5fa0 R14: 00007f3fdcbb5fa0 R15: 0000000000000003
</TASK>
syzbot
Jul 11, 2025, 7:07:30 AMJul 11
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 59a2de10b81a Linux 6.6.97
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11a3468c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a3468c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32864b54a55c/disk-59a2de10.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b0bbe4ada642/vmlinux-59a2de10.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9e3fe91e14c2/bzImage-59a2de10.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+032ab9...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5943 at mm/page_alloc.c:4433 __alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Modules linked in:
CPU: 1 PID: 5943 Comm: syz.0.16 Not tainted 6.6.97-syzkaller #0
RAX: ffffc90003387a00 RBX: 1ffff92000670f3c RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003387a28
RBP: ffffc90003387ac0 R08: ffffc90003387a27 R09: 0000000000000000
R10: ffffc90003387a00 R11: fffff52000670f45 R12: 000000000000001a
RAX: ffffffffffffffda RBX: 00007fcc69fb5fa0 RCX: 00007fcc69d8e929
HEAD commit: 59a2de10b81a Linux 6.6.97
git tree: linux-6.6.y
kernel config: https://syzkaller.appspot.com/x/.config?x=ac0b29aca872266f
dashboard link: https://syzkaller.appspot.com/bug?extid=032ab98511c4a6864a8f
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15a3468c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=032ab98511c4a6864a8f
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a3468c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32864b54a55c/disk-59a2de10.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b0bbe4ada642/vmlinux-59a2de10.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9e3fe91e14c2/bzImage-59a2de10.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+032ab9...@syzkaller.appspotmail.com
------------[ cut here ]------------
Modules linked in:
CPU: 1 PID: 5943 Comm: syz.0.16 Not tainted 6.6.97-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 c0 cb 62 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff
RSP: 0018:ffffc900033879c0 EFLAGS: 00010246
RIP: 0010:__alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 c0 cb 62 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff
RAX: ffffc90003387a00 RBX: 1ffff92000670f3c RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003387a28
RBP: ffffc90003387ac0 R08: ffffc90003387a27 R09: 0000000000000000
R10: ffffc90003387a00 R11: fffff52000670f45 R12: 000000000000001a
R13: 0000000000000000 R14: 0000000000040dc0 R15: dffffc0000000000
FS: 0000555569a8c500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000001859c0 CR3: 0000000076de6000 CR4: 00000000003506e0
Call Trace:
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1148
__do_kmalloc_node mm/slab_common.c:995 [inline]
__kmalloc+0x111/0x240 mm/slab_common.c:1020
kmalloc_array include/linux/slab.h:637 [inline]
kcalloc include/linux/slab.h:668 [inline]
comedi_unlocked_ioctl+0x9f0/0xf00 drivers/comedi/comedi_fops.c:2242
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fcc69d8e929
<TASK>
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1148
__do_kmalloc_node mm/slab_common.c:995 [inline]
__kmalloc+0x111/0x240 mm/slab_common.c:1020
kmalloc_array include/linux/slab.h:637 [inline]
kcalloc include/linux/slab.h:668 [inline]
comedi_unlocked_ioctl+0x9f0/0xf00 drivers/comedi/comedi_fops.c:2242
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc0d25d278 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fcc69fb5fa0 RCX: 00007fcc69d8e929
RDX: 00002000001859c0 RSI: 000000008010640b RDI: 0000000000000003
RBP: 00007fcc69e10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcc69fb5fa0 R14: 00007fcc69fb5fa0 R15: 0000000000000003
syzbot
Aug 23, 2025, 2:56:07 AMAug 23
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3
Author: Ian Abbott <abb...@mev.co.uk>
Date: Fri Jul 4 12:04:05 2025 +0000
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16ef0ef0580000
start commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
#syz fix: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3
Author: Ian Abbott <abb...@mev.co.uk>
Date: Fri Jul 4 12:04:05 2025 +0000
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16ef0ef0580000
start commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=af043eb58258a24b
dashboard link: https://syzkaller.appspot.com/bug?extid=b2bde13f12963932c08d
dashboard link: https://syzkaller.appspot.com/bug?extid=b2bde13f12963932c08d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12cc668c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1629ba8c580000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1629ba8c580000
#syz fix: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Aug 27, 2025, 10:17:06 AMAug 27
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit c9d3d9667443caafa804cd07940aeaef8e53aa90
Author: Ian Abbott <abb...@mev.co.uk>
Date: Fri Jul 4 12:04:05 2025 +0000
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13213c42580000
Date: Fri Jul 4 12:04:05 2025 +0000
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
start commit: 59a2de10b81a Linux 6.6.97
git tree: linux-6.6.y
kernel config: https://syzkaller.appspot.com/x/.config?x=ac0b29aca872266f
dashboard link: https://syzkaller.appspot.com/bug?extid=032ab98511c4a6864a8f
dashboard link: https://syzkaller.appspot.com/bug?extid=032ab98511c4a6864a8f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15a3468c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a3468c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a3468c580000
syzbot
Nov 5, 2025, 8:03:17 PM (19 hours ago) Nov 5
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages