From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F33CF34A797 for ; Fri, 12 Jun 2026 19:43:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.92.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781293414; cv=none; b=ptm7heluE2oVPWnDZ3AplA8bUc3mo629KKcVcZIHEk2Tpef1K2fcCstuEBjINAA1uXeJYWaycB4mmCibRjB42ACTj13QoZKo5eUofICAODT7A4ElwytZ5HzwbDnYbuXW+NQdcTWUYQK2qcuBvAmgnJLSwTttgLNo0Kl4+FuF97Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781293414; c=relaxed/simple; bh=8vAkRRbLmxd4OQMtVQJ86YGGGFUdNjJ379S0zs19LWA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=jxKokkfzYD0gtpFtHlCIRvAbsMQNQv7fb5KPE1/QDKU1IQ6PltT0svlmKGZFAzFuubAFzmx+hg6hF1FTZnBENvfTKIyEKYt5SjMGmh2m2nhWiGNLHoAtm/w+dF+QLLz1uIsXfr64fGy2Rwny71fQ3qMbAcBLN1apXrAP5QVXsl8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=pass smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=GxZeYDJ1; arc=none smtp.client-ip=90.155.92.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="GxZeYDJ1" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=bZlwiXG6k1ZswfN4dgvc5m9I3M6m2//4fFSPQBswvow=; b=GxZeYDJ1jmtgcbGMZLseqg2h0K KiKvEXDy1zz+uKIR0hy1//P8wpieC5ZK8yLOIpNE0CRcrfkzmQxKMHRgdv0xLIWuMM3O6V6uaFeFi dA85PHkXRs0lMhxnjKUOx78qza9B1u5F9GfVkhHMgnIACTFCwF9j16y24cKRv0jGlPGRDULG5nJoQ XE3lAi7dUivyt8z370n/zli6pct57ir6JIzawTWgmDmYCOxCm8g5wSFyIXpWP9v9ogihzC6oXRyB3 46hr+0lQx/lAUy9HS7aS8Yi4ifTizsYkvzEx6w0GMGIb/dLnCcyOGK2z9U5kro35XVMQDSlCtgkBb E9M3ZL1g==; Received: from 77-249-17-252.cable.dynamic.v4.ziggo.nl ([77.249.17.252] helo=noisy.programming.kicks-ass.net) by desiato.infradead.org with esmtpsa (Exim 4.99.2 #2 (Red Hat Linux)) id 1wY7mr-00000006oYw-18Jd; Fri, 12 Jun 2026 19:43:29 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id 0219130036F; Fri, 12 Jun 2026 21:43:28 +0200 (CEST) Date: Fri, 12 Jun 2026 21:43:27 +0200 From: Peter Zijlstra To: syzbot Cc: linux-kernel@vger.kernel.org, luto@kernel.org, syzkaller-bugs@googlegroups.com, tglx@kernel.org Subject: Re: [syzbot] [kernel?] general protection fault in __schedule (3) Message-ID: <20260612194327.GD42921@noisy.programming.kicks-ass.net> References: <6a2c4b8f.be3f099c.2836ae.0000.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6a2c4b8f.be3f099c.2836ae.0000.GAE@google.com> On Fri, Jun 12, 2026 at 11:10:23AM -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: ec039126b7fa Add linux-next specific files for 20260611 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=137c78ae580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=5aaa5302b37e7e10 > dashboard link: https://syzkaller.appspot.com/bug?extid=484ec80b3ff2dbdea632 > compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 > > Unfortunately, I don't have any reproducer for this issue yet. > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/4f58c704a9e9/disk-ec039126.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/bf67100d5618/vmlinux-ec039126.xz > kernel image: https://storage.googleapis.com/syzbot-assets/bf93fe076f41/bzImage-ec039126.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+484ec80b3ff2dbdea632@syzkaller.appspotmail.com > > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI > KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] > CPU: 0 UID: 0 PID: 5884 Comm: syz.2.21 Not tainted syzkaller #0 PREEMPT_{RT,(full)} > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 > RIP: 0010:task_cpu include/linux/sched.h:2268 [inline] > RIP: 0010:is_task_rq_idle kernel/sched/core.c:6169 [inline] > RIP: 0010:cookie_equals kernel/sched/core.c:6174 [inline] > RIP: 0010:pick_next_task kernel/sched/core.c:6355 [inline] > RIP: 0010:__schedule+0x4030/0x5550 kernel/sched/core.c:7143 > Code: 24 80 00 00 00 e8 80 67 fc f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 > RSP: 0000:ffffc9000565fcc0 EFLAGS: 00010003 > RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 > RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 > RBP: ffffc9000565fea8 R08: ffffffff8f8d70f7 R09: 1ffffffff1f1ae1e > R10: dffffc0000000000 R11: fffffbfff1f1ae1f R12: ffff8880b863c658 > R13: ffff888125eb8000 R14: 1ffff110170c7922 R15: 0000000000000014 > FS: 000055557157d500(0000) GS:ffff888125eb8000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00005555904597d0 CR3: 000000005f3e8000 CR4: 00000000003526f0 > Call Trace: > > __schedule_loop kernel/sched/core.c:7307 [inline] > schedule+0x164/0x360 kernel/sched/core.c:7322 > __exit_to_user_mode_loop kernel/entry/common.c:55 [inline] > exit_to_user_mode_loop kernel/entry/common.c:101 [inline] > __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] > irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline] > irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline] > irqentry_exit+0x291/0x8c0 kernel/entry/common.c:165 > asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:679 > RIP: 0033:0x7f9b0e311494 > Code: 54 24 28 0f 82 5e 03 00 00 40 0f b6 fe c6 44 24 0e 01 45 31 ed 45 31 f6 89 7c 24 08 85 c0 0f 84 10 01 00 00 66 90 48 8b 3c 24 <49> 8b 54 24 40 4c 89 f0 4a 03 14 ef 80 3d 01 69 3a 00 00 49 89 d6 > RSP: 002b:00007fff0de8b200 EFLAGS: 00000293 > RAX: 0000000000000001 RBX: ffffffff81b962a3 RCX: ffffffff81b962a3 > RDX: 00000000000002a3 RSI: ffffffff81b962a3 RDI: 00007f9b0da95008 > RBP: 0000000000000000 R08: 00007f9b0e6a0000 R09: 00007f9b0e6a2000 > R10: 0000000081b962a7 R11: 0000000000000006 R12: 00007f9b0e6b6128 > R13: 000000000000a5e4 R14: ffffffff81b96705 R15: 00007f9b0f1e5720 > > Modules linked in: > ---[ end trace 0000000000000000 ]--- > RIP: 0010:task_cpu include/linux/sched.h:2268 [inline] > RIP: 0010:is_task_rq_idle kernel/sched/core.c:6169 [inline] > RIP: 0010:cookie_equals kernel/sched/core.c:6174 [inline] > RIP: 0010:pick_next_task kernel/sched/core.c:6355 [inline] > RIP: 0010:__schedule+0x4030/0x5550 kernel/sched/core.c:7143 > Code: 24 80 00 00 00 e8 80 67 fc f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 > RSP: 0000:ffffc9000565fcc0 EFLAGS: 00010003 > RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 > RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 > RBP: ffffc9000565fea8 R08: ffffffff8f8d70f7 R09: 1ffffffff1f1ae1e > R10: dffffc0000000000 R11: fffffbfff1f1ae1f R12: ffff8880b863c658 > R13: ffff888125eb8000 R14: 1ffff110170c7922 R15: 0000000000000014 > FS: 000055557157d500(0000) GS:ffff888125eb8000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00005555904597d0 CR3: 000000005f3e8000 CR4: 00000000003526f0 > ---------------- > Code disassembly (best guess): > 0: 24 80 and $0x80,%al > 2: 00 00 add %al,(%rax) > 4: 00 e8 add %ch,%al > 6: 80 67 fc f6 andb $0xf6,-0x4(%rdi) > a: 48 8b 84 24 80 00 00 mov 0x80(%rsp),%rax > 11: 00 > 12: 48 8b 18 mov (%rax),%rbx > 15: 4c 8d 7b 14 lea 0x14(%rbx),%r15 > 19: 4c 89 f8 mov %r15,%rax > 1c: 48 c1 e8 03 shr $0x3,%rax > 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx > 27: fc ff df > * 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction > 2e: 84 c0 test %al,%al > 30: 0f 85 87 04 00 00 jne 0x4bd > 36: 45 8b 3f mov (%r15),%r15d > 39: 49 83 ff 08 cmp $0x8,%r15 > 3d: 0f .byte 0xf > 3e: 83 .byte 0x83 > 3f: 98 cwtl > > > --- > This report is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this issue. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > If the report is already addressed, let syzbot know by replying with: > #syz fix: exact-commit-title Both these reports are SCHED_CORE=y and there was a known issue there, which should be fixed in today's edition (next-20260612) with commit: #syz fix: c095741713d1 sched/fair: Fix newidle vs core-sched