[v6.1] general protection fault in a2150_interrupt
0 views
Skip to first unread message
syzbot
May 22, 2026, 9:15:26 AM (2 days ago) May 22
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c27210688955 Linux 6.1.173
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12071c2e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=37f51e30c0b907a7bcc7
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/92fbc0595a58/disk-c2721068.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0f281a0d62f7/vmlinux-c2721068.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b17a33c5f1fe/bzImage-c2721068.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+37f51e...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 26 Comm: kauditd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:a2150_interrupt+0xbe/0x820 drivers/comedi/drivers/ni_at_a2150.c:135
Code: 04 00 fa 4d 8b 2e 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 91 04 00 fa 4d 8b 75 00 49 83 c6 08 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 74 04 00 fa 49 8b 06 48 89 44 24 58
RSP: 0018:ffffc900000079e0 EFLAGS: 00010002
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888017763b80
RDX: 0000000000010100 RSI: ffff88802e33f800 RDI: 0000000000000007
RBP: ffffc90000007b10 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 1ffff92000000f50
R13: ffff8880289a2380 R14: 0000000000000008 R15: 1ffff11004cd9420
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff21ff8 CR3: 00000000250f3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__handle_irq_event_percpu+0x293/0xa50 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x87/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x243/0xb20 kernel/irq/chip.c:819
generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
handle_irq arch/x86/kernel/irq.c:233 [inline]
__common_interrupt+0xd7/0x1e0 arch/x86/kernel/irq.c:252
common_interrupt+0x59/0xd0 arch/x86/kernel/irq.c:242
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:682
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:319 [inline]
RIP: 0010:handle_softirqs+0x1c8/0x930 kernel/softirq.c:584
Code: 89 7c 24 44 0f b7 db 48 c7 c7 80 0f 8b 8a e8 2f 90 de 08 65 66 c7 05 15 25 b4 7e 00 00 e8 50 74 39 00 fb 49 c7 c6 c0 a0 80 8c <89> 5c 24 4c b8 ff ff ff ff 0f bc 44 24 4c 41 89 c5 41 ff c5 0f 84
RSP: 0018:ffffc90000007e00 EFLAGS: 00000286
RAX: 2f5eeb80224cba00 RBX: 0000000000000202 RCX: 2f5eeb80224cba00
RDX: dffffc0000000000 RSI: ffffffff8a8c19a0 RDI: ffffffff8adf1ba0
RBP: ffffc90000007f30 R08: ffffffff90afa247 R09: 1ffffffff215f448
R10: dffffc0000000000 R11: fffffbfff215f449 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffffff8c80a0c0 R15: 000000000000000a
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_emit_next_record+0x970/0xba0 kernel/printk/printk.c:2786
Code: 0f 85 a7 00 00 00 e8 0f ac 1a 00 0f b6 5c 24 0f 4d 85 e4 75 07 e8 00 ac 1a 00 eb 06 e8 f9 ab 1a 00 fb 66 43 c7 44 3d 24 f8 f8 <43> c6 44 3d 26 f8 49 81 c6 00 06 06 06 4f 89 74 3d 14 66 43 c7 44
RSP: 0018:ffffc90000a2f860 EFLAGS: 00000293
RAX: ffffffff8167dab7 RBX: 0000000000000001 RCX: ffff888017763b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000a2fa80 R08: ffffffff90afa247 R09: 1ffffffff215f448
R10: dffffc0000000000 R11: fffffbfff215f449 R12: 0000000000000200
R13: 1ffff92000145f18 R14: f8f8f8f8f2f2f2f8 R15: dffffc0000000000
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x223/0x630 kernel/printk/printk.c:2906
vprintk_emit+0x4b3/0x6a0 kernel/printk/printk.c:2303
_printk+0xda/0x130 kernel/printk/printk.c:2328
kauditd_printk_skb kernel/audit.c:547 [inline]
kauditd_hold_skb+0x1c2/0x210 kernel/audit.c:582
kauditd_send_queue+0x290/0x2e0 kernel/audit.c:767
kauditd_thread+0x70c/0x990 kernel/audit.c:891
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:a2150_interrupt+0xbe/0x820 drivers/comedi/drivers/ni_at_a2150.c:135
Code: 04 00 fa 4d 8b 2e 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 91 04 00 fa 4d 8b 75 00 49 83 c6 08 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 74 04 00 fa 49 8b 06 48 89 44 24 58
RSP: 0018:ffffc900000079e0 EFLAGS: 00010002
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888017763b80
RDX: 0000000000010100 RSI: ffff88802e33f800 RDI: 0000000000000007
RBP: ffffc90000007b10 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 1ffff92000000f50
R13: ffff8880289a2380 R14: 0000000000000008 R15: 1ffff11004cd9420
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff21ff8 CR3: 00000000250f3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 04 00 add $0x0,%al
2: fa cli
3: 4d 8b 2e mov (%r14),%r13
6: 4c 89 e8 mov %r13,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
11: 74 08 je 0x1b
13: 4c 89 ef mov %r13,%rdi
16: e8 91 04 00 fa call 0xfa0004ac
1b: 4d 8b 75 00 mov 0x0(%r13),%r14
1f: 49 83 c6 08 add $0x8,%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 74 04 00 fa call 0xfa0004ac
38: 49 8b 06 mov (%r14),%rax
3b: 48 89 44 24 58 mov %rax,0x58(%rsp)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: c27210688955 Linux 6.1.173
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12071c2e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=37f51e30c0b907a7bcc7
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/92fbc0595a58/disk-c2721068.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0f281a0d62f7/vmlinux-c2721068.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b17a33c5f1fe/bzImage-c2721068.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+37f51e...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 26 Comm: kauditd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:a2150_interrupt+0xbe/0x820 drivers/comedi/drivers/ni_at_a2150.c:135
Code: 04 00 fa 4d 8b 2e 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 91 04 00 fa 4d 8b 75 00 49 83 c6 08 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 74 04 00 fa 49 8b 06 48 89 44 24 58
RSP: 0018:ffffc900000079e0 EFLAGS: 00010002
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888017763b80
RDX: 0000000000010100 RSI: ffff88802e33f800 RDI: 0000000000000007
RBP: ffffc90000007b10 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 1ffff92000000f50
R13: ffff8880289a2380 R14: 0000000000000008 R15: 1ffff11004cd9420
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff21ff8 CR3: 00000000250f3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__handle_irq_event_percpu+0x293/0xa50 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x87/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x243/0xb20 kernel/irq/chip.c:819
generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
handle_irq arch/x86/kernel/irq.c:233 [inline]
__common_interrupt+0xd7/0x1e0 arch/x86/kernel/irq.c:252
common_interrupt+0x59/0xd0 arch/x86/kernel/irq.c:242
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:682
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:319 [inline]
RIP: 0010:handle_softirqs+0x1c8/0x930 kernel/softirq.c:584
Code: 89 7c 24 44 0f b7 db 48 c7 c7 80 0f 8b 8a e8 2f 90 de 08 65 66 c7 05 15 25 b4 7e 00 00 e8 50 74 39 00 fb 49 c7 c6 c0 a0 80 8c <89> 5c 24 4c b8 ff ff ff ff 0f bc 44 24 4c 41 89 c5 41 ff c5 0f 84
RSP: 0018:ffffc90000007e00 EFLAGS: 00000286
RAX: 2f5eeb80224cba00 RBX: 0000000000000202 RCX: 2f5eeb80224cba00
RDX: dffffc0000000000 RSI: ffffffff8a8c19a0 RDI: ffffffff8adf1ba0
RBP: ffffc90000007f30 R08: ffffffff90afa247 R09: 1ffffffff215f448
R10: dffffc0000000000 R11: fffffbfff215f449 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffffff8c80a0c0 R15: 000000000000000a
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_emit_next_record+0x970/0xba0 kernel/printk/printk.c:2786
Code: 0f 85 a7 00 00 00 e8 0f ac 1a 00 0f b6 5c 24 0f 4d 85 e4 75 07 e8 00 ac 1a 00 eb 06 e8 f9 ab 1a 00 fb 66 43 c7 44 3d 24 f8 f8 <43> c6 44 3d 26 f8 49 81 c6 00 06 06 06 4f 89 74 3d 14 66 43 c7 44
RSP: 0018:ffffc90000a2f860 EFLAGS: 00000293
RAX: ffffffff8167dab7 RBX: 0000000000000001 RCX: ffff888017763b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000a2fa80 R08: ffffffff90afa247 R09: 1ffffffff215f448
R10: dffffc0000000000 R11: fffffbfff215f449 R12: 0000000000000200
R13: 1ffff92000145f18 R14: f8f8f8f8f2f2f2f8 R15: dffffc0000000000
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x223/0x630 kernel/printk/printk.c:2906
vprintk_emit+0x4b3/0x6a0 kernel/printk/printk.c:2303
_printk+0xda/0x130 kernel/printk/printk.c:2328
kauditd_printk_skb kernel/audit.c:547 [inline]
kauditd_hold_skb+0x1c2/0x210 kernel/audit.c:582
kauditd_send_queue+0x290/0x2e0 kernel/audit.c:767
kauditd_thread+0x70c/0x990 kernel/audit.c:891
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:a2150_interrupt+0xbe/0x820 drivers/comedi/drivers/ni_at_a2150.c:135
Code: 04 00 fa 4d 8b 2e 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 91 04 00 fa 4d 8b 75 00 49 83 c6 08 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 74 04 00 fa 49 8b 06 48 89 44 24 58
RSP: 0018:ffffc900000079e0 EFLAGS: 00010002
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888017763b80
RDX: 0000000000010100 RSI: ffff88802e33f800 RDI: 0000000000000007
RBP: ffffc90000007b10 R08: ffffffff8e1ffbef R09: 1ffffffff1c3ff7d
R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: 1ffff92000000f50
R13: ffff8880289a2380 R14: 0000000000000008 R15: 1ffff11004cd9420
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff21ff8 CR3: 00000000250f3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 04 00 add $0x0,%al
2: fa cli
3: 4d 8b 2e mov (%r14),%r13
6: 4c 89 e8 mov %r13,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
11: 74 08 je 0x1b
13: 4c 89 ef mov %r13,%rdi
16: e8 91 04 00 fa call 0xfa0004ac
1b: 4d 8b 75 00 mov 0x0(%r13),%r14
1f: 49 83 c6 08 add $0x8,%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 74 04 00 fa call 0xfa0004ac
38: 49 8b 06 mov (%r14),%rax
3b: 48 89 44 24 58 mov %rax,0x58(%rsp)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages