* [syzbot] kernel BUG in create_default_group...
@ 2026-10-19 18:08 syzbot
2026-10-21 5:30 ` Edward Adam Davis
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: syzbot @ 2026-10-19 18:08 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 58161ead29e5 Merge tag 'drm-fixes-2026-10-17' of https://g..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=103272e1580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4ccb65e03706547e
dashboard link: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=173b8121580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4fae162886e497f72228@syzkaller.appspotmail.com
Warning: Permanently added '[localhost]:19552' (ED25519) to the list of known hosts.
[*] Starting reproducer for kernel BUG in create_default_group...
[+] mkdir /sys/kernel/config successful or directory already exists.
[+] configfs mounted or already mounted.
[+] mkdir /sys/kernel/debug successful or directory already exists.
[+] debugfs mounted or already mounted.
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/ignore-gfp-wait
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/cache-filter
[+] Successfully wrote '-1
' to /sys/kernel/debug/failslab/times
[+] Pre-clean of /sys/kernel/config/nvmet/ports/1 successful.
[+] Online CPU count: 1
[+] Started 6 background racing helper threads.
[*] Iterating fault injection points (fail-nth 1..80 with concurrent race)...
[*] Testing fail-nth = 1 (1 attempts)...
[*] Testing fail-nth = 2 (1 attempts)...
[*] Testing fail-nth = 3 (1 attempts)...
[*] Testing fail-nth = 4 (1 attempts)...
[*] Testing fail-nth = 5 (1 attempts)...
[*] Testing fail-nth = 6 (1 attempts)...
[*] Testing fail-nth = 7 (1 attempts)...
[*] Testing fail-nth = 8 (1 attempts)...
[*] Testing fail-nth = 9 (1 attempts)...
[*] Testing fail-nth = 10 (1 attempts)...
[*] Testing fail-nth = 11 (1 attempts)...
[*] Testing fail-nth = 12 (1 attempts)...
[*] Testing fail-nth = 13 (1 attempts)...
[*] Testing fail-nth = 14 (1 attempts)...
[*] Testing fail-nth = 15 (1 attempts)...
[*] Testing fail-nth = 16 (1 attempts)...
[*] Testing fail-nth = 17 (1 attempts)...
[*] Testing fail-nth = 18 (1 attempts)...
[*] Testing fail-nth = 19 (1 attempts)...
[*] Testing fail-nth = 20 (1 attempts)...
[*] Testing fail-nth = 21 (1 attempts)...
[*] Testing fail-nth = 22 (1 attempts)...
[*] Testing fail-nth = 23 (1 attempts)...
[*] Testing fail-nth = 24 (1 attempts)...
[*] Testing fail-nth = 25 (1 attempts)...
[*] Testing fail-nth = 26 (1 attempts)...
[*] Testing fail-nth = 27 (1 attempts)...
[*] Testing fail-nth = 28 (1 attempts)...
[*] Testing fail-nth = 29 (1 attempts)...
[*] Testing fail-nth = 30 (1 attempts)...
[*] Testing fail-nth = 31 (1 attempts)...
[*] Testing fail-nth = 32 (1 attempts)...
[*] Testing fail-nth = 33 (1 attempts)...
[*] Testing fail-nth = 34 (1 attempts)...
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] kernel BUG in create_default_group...
2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot
@ 2026-10-21 5:30 ` Edward Adam Davis
2026-10-21 5:50 ` syzbot
2026-10-21 6:25 ` [PATCH] configfs: Delay the fop setting to prevent noise generated by open Edward Adam Davis
2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis
2 siblings, 1 reply; 6+ messages in thread
From: Edward Adam Davis @ 2026-10-21 5:30 UTC (permalink / raw)
To: syzbot+4fae162886e497f72228; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 58161ead29e5
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index eda80c2a2d38..45a955b8ab36 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -313,7 +313,6 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry,
goto out_remove;
inode->i_op = &configfs_dir_inode_operations;
- inode->i_fop = &configfs_dir_operations;
/* directory inodes start off with i_nlink == 2 (for "." entry) */
inc_nlink(inode);
d_make_persistent(dentry, inode);
@@ -930,6 +929,10 @@ static int configfs_attach_group(struct config_item *item,
inode_unlock(d_inode(dentry));
if (ret)
d_delete(dentry);
+ else {
+ struct inode *inode = d_inode(dentry);
+ inode->i_fop = &configfs_dir_operations;
+ }
}
return ret;
@@ -1430,8 +1433,13 @@ static struct dentry *configfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
if (group)
ret = configfs_attach_group(item, dentry, frag);
- else
+ else {
ret = configfs_attach_item(item, dentry, frag);
+ if (!ret) {
+ struct inode *inode = d_inode(dentry);
+ inode->i_fop = &configfs_dir_operations;
+ }
+ }
spin_lock(&configfs_dirent_lock);
sd->s_type &= ~CONFIGFS_USET_IN_MKDIR;
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] kernel BUG in create_default_group...
2026-10-21 5:30 ` Edward Adam Davis
@ 2026-10-21 5:50 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-10-21 5:50 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in create_default_group...
Warning: Permanently added '[localhost]:36728' (ED25519) to the list of known hosts.
[*] Starting reproducer for kernel BUG in create_default_group...
[+] mkdir /sys/kernel/config successful or directory already exists.
[+] configfs mounted or already mounted.
[+] mkdir /sys/kernel/debug successful or directory already exists.
[+] debugfs mounted or already mounted.
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/ignore-gfp-wait
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/cache-filter
[+] Successfully wrote '-1
' to /sys/kernel/debug/failslab/times
[+] Pre-clean of /sys/kernel/config/nvmet/ports/1 successful.
[+] Online CPU count: 1
[+] Started 6 background racing helper threads.
[*] Iterating fault injection points (fail-nth 1..80 with concurrent race)...
[*] Testing fail-nth = 1 (1 attempts)...
[*] Testing fail-nth = 2 (1 attempts)...
[*] Testing fail-nth = 3 (1 attempts)...
[*] Testing fail-nth = 4 (1 attempts)...
[*] Testing fail-nth = 5 (1 attempts)...
[*] Testing fail-nth = 6 (1 attempts)...
[*] Testing fail-nth = 7 (1 attempts)...
[*] Testing fail-nth = 8 (1 attempts)...
[*] Testing fail-nth = 9 (1 attempts)...
[*] Testing fail-nth = 10 (1 attempts)...
[*] Testing fail-nth = 11 (1 attempts)...
[*] Testing fail-nth = 12 (1 attempts)...
[*] Testing fail-nth = 13 (1 attempts)...
[*] Testing fail-nth = 14 (1 attempts)...
[*] Testing fail-nth = 15 (1 attempts)...
[*] Testing fail-nth = 16 (1 attempts)...
[*] Testing fail-nth = 17 (1 attempts)...
[*] Testing fail-nth = 18 (1 attempts)...
[*] Testing fail-nth = 19 (1 attempts)...
[*] Testing fail-nth = 20 (1 attempts)...
[*] Testing fail-nth = 21 (1 attempts)...
[*] Testing fail-nth = 22 (1 attempts)...
[*] Testing fail-nth = 23 (1 attempts)...
[*] Testing fail-nth = 24 (1 attempts)...
[*] Testing fail-nth = 25 (1 attempts)...
[*] Testing fail-nth = 26 (1 attempts)...
[*] Testing fail-nth = 27 (1 attempts)...
[*] Testing fail-nth = 28 (1 attempts)...
[*] Testing fail-nth = 29 (1 attempts)...
[*] Testing fail-nth = 30 (1 attempts)...
[*] Testing fail-nth = 31 (1 attempts)...
[*] Testing fail-nth = 32 (1 attempts)...
[*] Testing fail-nth = 33 (1 attempts)...
[*] Testing fail-nth = 34 (1 attempts)...
[*] Testing fail-nth = 35 (1 attempts)...
[*] Testing fail-nth = 36 (1 attempts)...
[*] Testing fail-nth = 37 (1 attempts)...
[*] Testing fail-nth = 38 (12 attempts)...
[*] Testing fail-nth = 39 (12 attempts)...
[*] Testing fail-nth = 40 (12 attempts)...
[*] Testing fail-nth = 41 (12 attempts)...
[*] Testing fail-nth = 42 (12 attempts)...
[*] Testing fail-nth = 43 (12 attempts)...
[*] Testing fail-nth = 44 (12 attempts)...
[*] Testing fail-nth = 45 (12 attempts)...
[*] Testing fail-nth = 46 (12 attempts)...
[*] Testing fail-nth = 47 (12 attempts)...
[*] Testing fail-nth = 48 (12 attempts)...
[*] Testing fail-nth = 49 (12 attempts)...
[*] Testing fail-nth = 50 (12 attempts)...
[*] Testing fail-nth = 51 (1 attempts)...
[*] Testing fail-nth = 52 (1 attempts)...
[*] Testing fail-nth = 53 (1 attempts)...
[*] Testing fail-nth = 54 (1 attempts)...
[*] Testing fail-nth = 55 (1 attempts)...
[*] Testing fail-nth = 56 (1 attempts)...
[*] Testing fail-nth = 57 (1 attempts)...
[*] Testing fail-nth = 58 (1 attempts)...
[*] Testing fail-nth = 59 (1 attempts)...
[*] Testing fail-nth = 60 (1 attempts)...
[*] Testing fail-nth = 61 (1 attempts)...
[*] Testing fail-nth = 62 (1 attempts)...
[*] Testing fail-nth = 63 (1 attempts)...
[*] Testing fail-nth = 64 (1 attempts)...
[*] Testing fail-nth = 65 (1 attempts)...
[*] Testing fail-nth = 66 (1 attempts)...
[*] Testing fail-nth = 67 (1 attempts)...
[*] Testing fail-nth = 68 (1 attempts)...
Tested on:
commit: 58161ead Merge tag 'drm-fixes-2026-10-17' of https://g..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17262831580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4ccb65e03706547e
dashboard link: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=14c2bb05580000
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] configfs: Delay the fop setting to prevent noise generated by open
2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot
2026-10-21 5:30 ` Edward Adam Davis
@ 2026-10-21 6:25 ` Edward Adam Davis
2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis
2 siblings, 0 replies; 6+ messages in thread
From: Edward Adam Davis @ 2026-10-21 6:25 UTC (permalink / raw)
To: syzbot+4fae162886e497f72228
Cc: linux-kernel, syzkaller-bugs, leitao, a.hindborg
mkdir() triggers:
configfs_mkdir() ->
configfs_attach_group() ->
populate_groups() ->
create_default_group("ana_groups") ->
configfs_attach_group() ->
populate_groups() ->
create_default_group("1")
The creation of an inode for the subdentry 1 under ana_groups failed
due to fault injection. [1]
Because helper threads are racing open() on ana_groups, ana_groups has
dentry refcount > 1. d_delete() skips dentry_unlink_inode(), leaving
d_inode non-NULL. create_default_group() hits BUG_ON(d_inode(child)) at
fs/configfs/dir.c:734! [2]
[1]
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times -1
Call Trace:
should_failslab+0xa8/0x100
kmem_cache_alloc_noprof+0xa1/0x600
security_inode_alloc+0x39/0x310
inode_init_always_gfp+0x97e/0xd30
alloc_inode+0x82/0x1b0
new_inode+0x1f/0x170
configfs_new_inode+0x27/0x410
configfs_create+0xb5/0x270
configfs_attach_item+0x25f/0xd60
configfs_attach_group+0x2a/0x370
create_default_group+0x87/0x180
configfs_attach_group+0x169/0x370
configfs_mkdir+0x6f0/0x9e0
vfs_mkdir+0x40c/0x620
[2]
kernel BUG at fs/configfs/dir.c:734!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:create_default_group+0x17c/0x180
Call Trace:
configfs_attach_group+0x169/0x370
configfs_mkdir+0x6f0/0x9e0
vfs_mkdir+0x40c/0x620
The root cause is a race condition between open and mkdir; delaying the
assignment of the fop ensures that directories are not opened before they
are ready.
Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem")
Reported-by: syzbot+4fae162886e497f72228@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
fs/configfs/dir.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index eda80c2a2d38..45a955b8ab36 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -313,7 +313,6 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry,
goto out_remove;
inode->i_op = &configfs_dir_inode_operations;
- inode->i_fop = &configfs_dir_operations;
/* directory inodes start off with i_nlink == 2 (for "." entry) */
inc_nlink(inode);
d_make_persistent(dentry, inode);
@@ -930,6 +929,10 @@ static int configfs_attach_group(struct config_item *item,
inode_unlock(d_inode(dentry));
if (ret)
d_delete(dentry);
+ else {
+ struct inode *inode = d_inode(dentry);
+ inode->i_fop = &configfs_dir_operations;
+ }
}
return ret;
@@ -1430,8 +1433,13 @@ static struct dentry *configfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
if (group)
ret = configfs_attach_group(item, dentry, frag);
- else
+ else {
ret = configfs_attach_item(item, dentry, frag);
+ if (!ret) {
+ struct inode *inode = d_inode(dentry);
+ inode->i_fop = &configfs_dir_operations;
+ }
+ }
spin_lock(&configfs_dirent_lock);
sd->s_type &= ~CONFIGFS_USET_IN_MKDIR;
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] kernel BUG in create_default_group...
2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot
2026-10-21 5:30 ` Edward Adam Davis
2026-10-21 6:25 ` [PATCH] configfs: Delay the fop setting to prevent noise generated by open Edward Adam Davis
@ 2026-10-21 9:40 ` Edward Adam Davis
2026-10-21 9:58 ` syzbot
2 siblings, 1 reply; 6+ messages in thread
From: Edward Adam Davis @ 2026-10-21 9:40 UTC (permalink / raw)
To: syzbot+4fae162886e497f72228; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 58161ead29e5
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index eda80c2a2d38..edc5a7419ad9 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1605,6 +1605,9 @@ static int configfs_dir_open(struct inode *inode, struct file *file)
struct configfs_dirent * parent_sd = dentry->d_fsdata;
int err;
+ if (!configfs_dirent_is_ready(parent_sd))
+ return -EAGAIN;
+
inode_lock(d_inode(dentry));
/*
* Fake invisibility if dir belongs to a group/default groups hierarchy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] kernel BUG in create_default_group...
2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis
@ 2026-10-21 9:58 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-10-21 9:58 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in create_default_group...
Warning: Permanently added '[localhost]:52391' (ED25519) to the list of known hosts.
[*] Starting reproducer for kernel BUG in create_default_group...
[+] mkdir /sys/kernel/config successful or directory already exists.
[+] configfs mounted or already mounted.
[+] mkdir /sys/kernel/debug successful or directory already exists.
[+] debugfs mounted or already mounted.
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/ignore-gfp-wait
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/cache-filter
[+] Successfully wrote '-1
' to /sys/kernel/debug/failslab/times
[+] Pre-clean of /sys/kernel/config/nvmet/ports/1 successful.
[+] Online CPU count: 1
[+] Started 6 background racing helper threads.
[*] Iterating fault injection points (fail-nth 1..80 with concurrent race)...
[*] Testing fail-nth = 1 (1 attempts)...
[*] Testing fail-nth = 2 (1 attempts)...
[*] Testing fail-nth = 3 (1 attempts)...
[*] Testing fail-nth = 4 (1 attempts)...
[*] Testing fail-nth = 5 (1 attempts)...
[*] Testing fail-nth = 6 (1 attempts)...
[*] Testing fail-nth = 7 (1 attempts)...
[*] Testing fail-nth = 8 (1 attempts)...
[*] Testing fail-nth = 9 (1 attempts)...
[*] Testing fail-nth = 10 (1 attempts)...
[*] Testing fail-nth = 11 (1 attempts)...
[*] Testing fail-nth = 12 (1 attempts)...
[*] Testing fail-nth = 13 (1 attempts)...
[*] Testing fail-nth = 14 (1 attempts)...
[*] Testing fail-nth = 15 (1 attempts)...
[*] Testing fail-nth = 16 (1 attempts)...
[*] Testing fail-nth = 17 (1 attempts)...
[*] Testing fail-nth = 18 (1 attempts)...
[*] Testing fail-nth = 19 (1 attempts)...
[*] Testing fail-nth = 20 (1 attempts)...
[*] Testing fail-nth = 21 (1 attempts)...
[*] Testing fail-nth = 22 (1 attempts)...
[*] Testing fail-nth = 23 (1 attempts)...
[*] Testing fail-nth = 24 (1 attempts)...
[*] Testing fail-nth = 25 (1 attempts)...
[*] Testing fail-nth = 26 (1 attempts)...
[*] Testing fail-nth = 27 (1 attempts)...
[*] Testing fail-nth = 28 (1 attempts)...
[*] Testing fail-nth = 29 (1 attempts)...
[*] Testing fail-nth = 30 (1 attempts)...
[*] Testing fail-nth = 31 (1 attempts)...
[*] Testing fail-nth = 32 (1 attempts)...
[*] Testing fail-nth = 33 (1 attempts)...
[*] Testing fail-nth = 34 (1 attempts)...
[*] Testing fail-nth = 35 (1 attempts)...
Tested on:
commit: 58161ead Merge tag 'drm-fixes-2026-10-17' of https://g..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11b5ebcd580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4ccb65e03706547e
dashboard link: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=12c84e7f980000
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-21 9:58 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot
2026-10-21 5:30 ` Edward Adam Davis
2026-10-21 5:50 ` syzbot
2026-10-21 6:25 ` [PATCH] configfs: Delay the fop setting to prevent noise generated by open Edward Adam Davis
2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis
2026-10-21 9:58 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®