[v6.6] kernel BUG in sg_init_one
0 views
Skip to first unread message
syzbot
Jul 28, 2026, 7:30:26 AM (8 days ago) Jul 28
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c5596480c50e Linux 6.6.145
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1697e499580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=20669bb5133987a0ef96
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eb5cda0a8020/disk-c5596480.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ca05ff2fc502/vmlinux-c5596480.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6daf3255b985/bzImage-c5596480.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+20669b...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:187!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8660 Comm: syz.0.934 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:sg_set_buf include/linux/scatterlist.h:187 [inline]
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
Code: 80 c1 03 38 c1 7c cf e8 68 e9 b0 fd eb c8 44 89 f1 80 e1 07 80 c1 03 38 c1 7c d2 4c 89 f7 e8 51 e9 b0 fd eb c8 e8 4a 6b 58 fd <0f> 0b e8 43 6b 58 fd 0f 0b 90 f3 0f 1e fa 55 41 57 41 56 41 55 41
RSP: 0018:ffffc900060672e8 EFLAGS: 00010287
RAX: ffffffff842f0986 RBX: ffff888030e18400 RCX: 0000000000080000
RDX: ffffc9000b8b1000 RSI: 0000000000008070 RDI: 0000000000008071
RBP: 1ffff92000c0ce94 R08: ffffc900060674bf R09: 0000000000000000
R10: ffffc900060674a0 R11: fffff52000c0ce98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900060674a0 R15: ffffc900060674e0
FS: 00007f2d228b96c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f591641dd18 CR3: 000000002ac2c000 CR4: 00000000003506f0
Call Trace:
<TASK>
rxkad_secure_packet+0x2fb/0x12e0 net/rxrpc/rxkad.c:372
rxrpc_send_data+0x1021/0x29d0 net/rxrpc/sendmsg.c:405
rxrpc_do_sendmsg+0x10c6/0x12d0 net/rxrpc/sendmsg.c:726
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2d2199de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2d228b9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f2d21c25fa0 RCX: 00007f2d2199de99
RDX: 0000000000000000 RSI: 0000200000000b00 RDI: 0000000000000004
RBP: 00007f2d21a33eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2d21c26038 R14: 00007f2d21c25fa0 R15: 00007ffd63e02608
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:sg_set_buf include/linux/scatterlist.h:187 [inline]
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
Code: 80 c1 03 38 c1 7c cf e8 68 e9 b0 fd eb c8 44 89 f1 80 e1 07 80 c1 03 38 c1 7c d2 4c 89 f7 e8 51 e9 b0 fd eb c8 e8 4a 6b 58 fd <0f> 0b e8 43 6b 58 fd 0f 0b 90 f3 0f 1e fa 55 41 57 41 56 41 55 41
RSP: 0018:ffffc900060672e8 EFLAGS: 00010287
RAX: ffffffff842f0986 RBX: ffff888030e18400 RCX: 0000000000080000
RDX: ffffc9000b8b1000 RSI: 0000000000008070 RDI: 0000000000008071
RBP: 1ffff92000c0ce94 R08: ffffc900060674bf R09: 0000000000000000
R10: ffffc900060674a0 R11: fffff52000c0ce98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900060674a0 R15: ffffc900060674e0
FS: 00007f2d228b96c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffff66de34 CR3: 000000002ac2c000 CR4: 00000000003506f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: c5596480c50e Linux 6.6.145
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1697e499580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=20669bb5133987a0ef96
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eb5cda0a8020/disk-c5596480.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ca05ff2fc502/vmlinux-c5596480.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6daf3255b985/bzImage-c5596480.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+20669b...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:187!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8660 Comm: syz.0.934 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:sg_set_buf include/linux/scatterlist.h:187 [inline]
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
Code: 80 c1 03 38 c1 7c cf e8 68 e9 b0 fd eb c8 44 89 f1 80 e1 07 80 c1 03 38 c1 7c d2 4c 89 f7 e8 51 e9 b0 fd eb c8 e8 4a 6b 58 fd <0f> 0b e8 43 6b 58 fd 0f 0b 90 f3 0f 1e fa 55 41 57 41 56 41 55 41
RSP: 0018:ffffc900060672e8 EFLAGS: 00010287
RAX: ffffffff842f0986 RBX: ffff888030e18400 RCX: 0000000000080000
RDX: ffffc9000b8b1000 RSI: 0000000000008070 RDI: 0000000000008071
RBP: 1ffff92000c0ce94 R08: ffffc900060674bf R09: 0000000000000000
R10: ffffc900060674a0 R11: fffff52000c0ce98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900060674a0 R15: ffffc900060674e0
FS: 00007f2d228b96c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f591641dd18 CR3: 000000002ac2c000 CR4: 00000000003506f0
Call Trace:
<TASK>
rxkad_secure_packet+0x2fb/0x12e0 net/rxrpc/rxkad.c:372
rxrpc_send_data+0x1021/0x29d0 net/rxrpc/sendmsg.c:405
rxrpc_do_sendmsg+0x10c6/0x12d0 net/rxrpc/sendmsg.c:726
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2d2199de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2d228b9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f2d21c25fa0 RCX: 00007f2d2199de99
RDX: 0000000000000000 RSI: 0000200000000b00 RDI: 0000000000000004
RBP: 00007f2d21a33eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2d21c26038 R14: 00007f2d21c25fa0 R15: 00007ffd63e02608
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:sg_set_buf include/linux/scatterlist.h:187 [inline]
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
Code: 80 c1 03 38 c1 7c cf e8 68 e9 b0 fd eb c8 44 89 f1 80 e1 07 80 c1 03 38 c1 7c d2 4c 89 f7 e8 51 e9 b0 fd eb c8 e8 4a 6b 58 fd <0f> 0b e8 43 6b 58 fd 0f 0b 90 f3 0f 1e fa 55 41 57 41 56 41 55 41
RSP: 0018:ffffc900060672e8 EFLAGS: 00010287
RAX: ffffffff842f0986 RBX: ffff888030e18400 RCX: 0000000000080000
RDX: ffffc9000b8b1000 RSI: 0000000000008070 RDI: 0000000000008071
RBP: 1ffff92000c0ce94 R08: ffffc900060674bf R09: 0000000000000000
R10: ffffc900060674a0 R11: fffff52000c0ce98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900060674a0 R15: ffffc900060674e0
FS: 00007f2d228b96c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffff66de34 CR3: 000000002ac2c000 CR4: 00000000003506f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 1, 2026, 4:25:41 PM (4 days ago) Aug 1
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: a1153c0deb44 Linux 6.6.147
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12368649580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ab0db9580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9f646bfa1b52/disk-a1153c0d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a2aec2e8f0fd/vmlinux-a1153c0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7abe1f87405/bzImage-a1153c0d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+20669b...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:187!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5932 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RSP: 0018:ffffc900033172e8 EFLAGS: 00010293
RAX: ffffffff842f03e6 RBX: ffff88802419b480 RCX: ffff88802d603c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00004080033174e0
RBP: 1ffff92000662e94 R08: ffffc900033174bf R09: 0000000000000000
R10: ffffc900033174a0 R11: fffff52000662e98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900033174a0 R15: ffffc900033174e0
FS: 0000555561b62500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
RAX: ffffffffffffffda RBX: 00007fcdfca25fa0 RCX: 00007fcdfc79e019
RDX: 0000000000000000 RSI: 0000200000000b00 RDI: 0000000000000003
RBP: 00007fcdfc83500c R08: 0000000000000000 R09: 0000000000000000
RSP: 0018:ffffc900033172e8 EFLAGS: 00010293
RAX: ffffffff842f03e6 RBX: ffff88802419b480 RCX: ffff88802d603c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00004080033174e0
RBP: 1ffff92000662e94 R08: ffffc900033174bf R09: 0000000000000000
R10: ffffc900033174a0 R11: fffff52000662e98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900033174a0 R15: ffffc900033174e0
FS: 0000555561b62500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: a1153c0deb44 Linux 6.6.147
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12368649580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=20669bb5133987a0ef96
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1591ee32580000
dashboard link: https://syzkaller.appspot.com/bug?extid=20669bb5133987a0ef96
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ab0db9580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9f646bfa1b52/disk-a1153c0d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a2aec2e8f0fd/vmlinux-a1153c0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7abe1f87405/bzImage-a1153c0d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+20669b...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:187!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:sg_set_buf include/linux/scatterlist.h:187 [inline]
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
Code: 80 c1 03 38 c1 7c cf e8 28 e9 b0 fd eb c8 44 89 f1 80 e1 07 80 c1 03 38 c1 7c d2 4c 89 f7 e8 11 e9 b0 fd eb c8 e8 3a 6b 58 fd <0f> 0b e8 33 6b 58 fd 0f 0b 90 f3 0f 1e fa 55 41 57 41 56 41 55 41
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
RSP: 0018:ffffc900033172e8 EFLAGS: 00010293
RAX: ffffffff842f03e6 RBX: ffff88802419b480 RCX: ffff88802d603c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00004080033174e0
RBP: 1ffff92000662e94 R08: ffffc900033174bf R09: 0000000000000000
R10: ffffc900033174a0 R11: fffff52000662e98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900033174a0 R15: ffffc900033174e0
FS: 0000555561b62500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f93197db2d0 CR3: 00000000746a7000 CR4: 00000000003506f0
Call Trace:
<TASK>
rxkad_secure_packet+0x2fb/0x12e0 net/rxrpc/rxkad.c:372
rxrpc_send_data+0x1021/0x29d0 net/rxrpc/sendmsg.c:405
rxrpc_do_sendmsg+0x10c6/0x12d0 net/rxrpc/sendmsg.c:726
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fcdfc79e019
<TASK>
rxkad_secure_packet+0x2fb/0x12e0 net/rxrpc/rxkad.c:372
rxrpc_send_data+0x1021/0x29d0 net/rxrpc/sendmsg.c:405
rxrpc_do_sendmsg+0x10c6/0x12d0 net/rxrpc/sendmsg.c:726
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffca0410f18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fcdfca25fa0 RCX: 00007fcdfc79e019
RDX: 0000000000000000 RSI: 0000200000000b00 RDI: 0000000000000003
RBP: 00007fcdfc83500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcdfca25fac R14: 00007fcdfca25fa0 R15: 00007fcdfca25fa0
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:sg_set_buf include/linux/scatterlist.h:187 [inline]
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
Code: 80 c1 03 38 c1 7c cf e8 28 e9 b0 fd eb c8 44 89 f1 80 e1 07 80 c1 03 38 c1 7c d2 4c 89 f7 e8 11 e9 b0 fd eb c8 e8 3a 6b 58 fd <0f> 0b e8 33 6b 58 fd 0f 0b 90 f3 0f 1e fa 55 41 57 41 56 41 55 41
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:sg_set_buf include/linux/scatterlist.h:187 [inline]
RIP: 0010:sg_init_one+0x156/0x160 lib/scatterlist.c:143
RSP: 0018:ffffc900033172e8 EFLAGS: 00010293
RAX: ffffffff842f03e6 RBX: ffff88802419b480 RCX: ffff88802d603c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00004080033174e0
RBP: 1ffff92000662e94 R08: ffffc900033174bf R09: 0000000000000000
R10: ffffc900033174a0 R11: fffff52000662e98 R12: dffffc0000000000
R13: 0000000000000008 R14: ffffc900033174a0 R15: ffffc900033174e0
FS: 0000555561b62500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f93197db2d0 CR3: 00000000746a7000 CR4: 00000000003506f0
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
12:23 PM (5 hours ago) 12:23 PM
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15db3aa9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=b2c0fcf268006aa33591
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b2c0fc...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:163!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5025 Comm: syz.0.270 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : sg_set_buf include/linux/scatterlist.h:163 [inline]
pc : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
lr : sg_set_buf include/linux/scatterlist.h:163 [inline]
lr : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
sp : ffff8000215b7750
x29: ffff8000215b7750 x28: ffff0000d268dd00 x27: dfff800000000000
x26: ffff0000da79820e x25: ffff7000042b6f00 x24: 1ffff000042b6f14
x23: dfff800000000000 x22: 0001000000000010 x21: 0000000000000010
x20: ffff8000215b78a0 x19: 0000000000000000 x18: 0000000000000000
x17: ffff80000a5527fc x16: ffff800011b90080 x15: ffff80000a5527fc
x14: 0000000000000003 x13: 1ffff000042b6f15 x12: 0000000000080000
x11: 0000000000002ae6 x10: ffff8000223a9000 x9 : ffff80000a910304
x8 : 0000000000002ae7 x7 : 0000000000000000 x6 : ffff80000805a910
x5 : 00000000ffffffff x4 : 0000000000000008 x3 : 0000000000000010
x2 : 0000000000000000 x1 : 0001000000000010 x0 : 0000600000000000
Call trace:
sg_set_buf include/linux/scatterlist.h:163 [inline]
sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
software_key_eds_op+0x410/0x938 crypto/asymmetric_keys/public_key.c:277
asymmetric_key_eds_op+0x108/0x128 crypto/asymmetric_keys/asymmetric_type.c:596
keyctl_pkey_e_d_s+0x1c8/0x3a0 security/keys/keyctl_pkey.c:262
__do_sys_keyctl security/keys/keyctl.c:2009 [inline]
__se_sys_keyctl security/keys/keyctl.c:1886 [inline]
__arm64_sys_keyctl+0x66c/0x8e0 security/keys/keyctl.c:1886
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 977f91c6 17ffffec 976e8a31 (d4210000)
syzbot found the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15db3aa9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=b2c0fcf268006aa33591
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:163!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5025 Comm: syz.0.270 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : sg_set_buf include/linux/scatterlist.h:163 [inline]
pc : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
lr : sg_set_buf include/linux/scatterlist.h:163 [inline]
lr : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
sp : ffff8000215b7750
x29: ffff8000215b7750 x28: ffff0000d268dd00 x27: dfff800000000000
x26: ffff0000da79820e x25: ffff7000042b6f00 x24: 1ffff000042b6f14
x23: dfff800000000000 x22: 0001000000000010 x21: 0000000000000010
x20: ffff8000215b78a0 x19: 0000000000000000 x18: 0000000000000000
x17: ffff80000a5527fc x16: ffff800011b90080 x15: ffff80000a5527fc
x14: 0000000000000003 x13: 1ffff000042b6f15 x12: 0000000000080000
x11: 0000000000002ae6 x10: ffff8000223a9000 x9 : ffff80000a910304
x8 : 0000000000002ae7 x7 : 0000000000000000 x6 : ffff80000805a910
x5 : 00000000ffffffff x4 : 0000000000000008 x3 : 0000000000000010
x2 : 0000000000000000 x1 : 0001000000000010 x0 : 0000600000000000
Call trace:
sg_set_buf include/linux/scatterlist.h:163 [inline]
sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
software_key_eds_op+0x410/0x938 crypto/asymmetric_keys/public_key.c:277
asymmetric_key_eds_op+0x108/0x128 crypto/asymmetric_keys/asymmetric_type.c:596
keyctl_pkey_e_d_s+0x1c8/0x3a0 security/keys/keyctl_pkey.c:262
__do_sys_keyctl security/keys/keyctl.c:2009 [inline]
__se_sys_keyctl security/keys/keyctl.c:1886 [inline]
__arm64_sys_keyctl+0x66c/0x8e0 security/keys/keyctl.c:1886
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 977f91c6 17ffffec 976e8a31 (d4210000)
---[ end trace 0000000000000000 ]---
syzbot
12:49 PM (5 hours ago) 12:49 PM
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1695ecc6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11740132580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b2c0fc...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:163!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4535 Comm: syz.0.17 Not tainted syzkaller #0
x29: ffff8000211a7750 x28: ffff0000ca8ea500 x27: dfff800000000000
x26: ffff0000d6237a0e x25: ffff700004234f00 x24: 1ffff00004234f14
x11: ff0080000a910304 x10: 0000000000000000 x9 : ffff80000a910304
x8 : ffff0000c4ffd400 x7 : 0000000000000000 x6 : ffff80000805a910
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=b2c0fcf268006aa33591
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=175e3bb9580000
dashboard link: https://syzkaller.appspot.com/bug?extid=b2c0fcf268006aa33591
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11740132580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b2c0fc...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:163!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : sg_set_buf include/linux/scatterlist.h:163 [inline]
pc : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
lr : sg_set_buf include/linux/scatterlist.h:163 [inline]
lr : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
sp : ffff8000211a7750
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : sg_set_buf include/linux/scatterlist.h:163 [inline]
pc : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
lr : sg_set_buf include/linux/scatterlist.h:163 [inline]
lr : sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
x29: ffff8000211a7750 x28: ffff0000ca8ea500 x27: dfff800000000000
x26: ffff0000d6237a0e x25: ffff700004234f00 x24: 1ffff00004234f14
x23: dfff800000000000 x22: 0001000000000010 x21: 0000000000000010
x20: ffff8000211a78a0 x19: 0000000000000000 x18: 0000000000000000
x17: ffff80000a5527fc x16: ffff800011b90080 x15: ffff80000a5527fc
x14: 0000000000000003 x13: 1ffff00004234f15 x12: 0000000000000000
x11: ff0080000a910304 x10: 0000000000000000 x9 : ffff80000a910304
x8 : ffff0000c4ffd400 x7 : 0000000000000000 x6 : ffff80000805a910
x5 : 00000000ffffffff x4 : 0000000000000008 x3 : 0000000000000010
x2 : 0000000000000000 x1 : 0001000000000010 x0 : 0000600000000000
Call trace:
sg_set_buf include/linux/scatterlist.h:163 [inline]
sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
software_key_eds_op+0x410/0x938 crypto/asymmetric_keys/public_key.c:277
asymmetric_key_eds_op+0x108/0x128 crypto/asymmetric_keys/asymmetric_type.c:596
keyctl_pkey_e_d_s+0x1c8/0x3a0 security/keys/keyctl_pkey.c:262
__do_sys_keyctl security/keys/keyctl.c:2009 [inline]
__se_sys_keyctl security/keys/keyctl.c:1886 [inline]
__arm64_sys_keyctl+0x66c/0x8e0 security/keys/keyctl.c:1886
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 977f91c6 17ffffec 976e8a31 (d4210000)
---[ end trace 0000000000000000 ]---
---
x2 : 0000000000000000 x1 : 0001000000000010 x0 : 0000600000000000
Call trace:
sg_set_buf include/linux/scatterlist.h:163 [inline]
sg_init_one+0x1b4/0x1c8 lib/scatterlist.c:141
software_key_eds_op+0x410/0x938 crypto/asymmetric_keys/public_key.c:277
asymmetric_key_eds_op+0x108/0x128 crypto/asymmetric_keys/asymmetric_type.c:596
keyctl_pkey_e_d_s+0x1c8/0x3a0 security/keys/keyctl_pkey.c:262
__do_sys_keyctl security/keys/keyctl.c:2009 [inline]
__se_sys_keyctl security/keys/keyctl.c:1886 [inline]
__arm64_sys_keyctl+0x66c/0x8e0 security/keys/keyctl.c:1886
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 977f91c6 17ffffec 976e8a31 (d4210000)
---[ end trace 0000000000000000 ]---
---
Reply all
Reply to author
Forward
0 new messages