* [syzbot] kernel BUG in create_default_group...
@ 2026-10-19 18:08 syzbot
2026-10-21 5:30 ` Edward Adam Davis
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: syzbot @ 2026-10-19 18:08 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 58161ead29e5 Merge tag 'drm-fixes-2026-10-17' of https://g..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=103272e1580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4ccb65e03706547e
dashboard link: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=173b8121580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4fae162886e497f72228@syzkaller.appspotmail.com
Warning: Permanently added '[localhost]:19552' (ED25519) to the list of known hosts.
[*] Starting reproducer for kernel BUG in create_default_group...
[+] mkdir /sys/kernel/config successful or directory already exists.
[+] configfs mounted or already mounted.
[+] mkdir /sys/kernel/debug successful or directory already exists.
[+] debugfs mounted or already mounted.
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/ignore-gfp-wait
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/cache-filter
[+] Successfully wrote '-1
' to /sys/kernel/debug/failslab/times
[+] Pre-clean of /sys/kernel/config/nvmet/ports/1 successful.
[+] Online CPU count: 1
[+] Started 6 background racing helper threads.
[*] Iterating fault injection points (fail-nth 1..80 with concurrent race)...
[*] Testing fail-nth = 1 (1 attempts)...
[*] Testing fail-nth = 2 (1 attempts)...
[*] Testing fail-nth = 3 (1 attempts)...
[*] Testing fail-nth = 4 (1 attempts)...
[*] Testing fail-nth = 5 (1 attempts)...
[*] Testing fail-nth = 6 (1 attempts)...
[*] Testing fail-nth = 7 (1 attempts)...
[*] Testing fail-nth = 8 (1 attempts)...
[*] Testing fail-nth = 9 (1 attempts)...
[*] Testing fail-nth = 10 (1 attempts)...
[*] Testing fail-nth = 11 (1 attempts)...
[*] Testing fail-nth = 12 (1 attempts)...
[*] Testing fail-nth = 13 (1 attempts)...
[*] Testing fail-nth = 14 (1 attempts)...
[*] Testing fail-nth = 15 (1 attempts)...
[*] Testing fail-nth = 16 (1 attempts)...
[*] Testing fail-nth = 17 (1 attempts)...
[*] Testing fail-nth = 18 (1 attempts)...
[*] Testing fail-nth = 19 (1 attempts)...
[*] Testing fail-nth = 20 (1 attempts)...
[*] Testing fail-nth = 21 (1 attempts)...
[*] Testing fail-nth = 22 (1 attempts)...
[*] Testing fail-nth = 23 (1 attempts)...
[*] Testing fail-nth = 24 (1 attempts)...
[*] Testing fail-nth = 25 (1 attempts)...
[*] Testing fail-nth = 26 (1 attempts)...
[*] Testing fail-nth = 27 (1 attempts)...
[*] Testing fail-nth = 28 (1 attempts)...
[*] Testing fail-nth = 29 (1 attempts)...
[*] Testing fail-nth = 30 (1 attempts)...
[*] Testing fail-nth = 31 (1 attempts)...
[*] Testing fail-nth = 32 (1 attempts)...
[*] Testing fail-nth = 33 (1 attempts)...
[*] Testing fail-nth = 34 (1 attempts)...
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [syzbot] kernel BUG in create_default_group... 2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot @ 2026-10-21 5:30 ` Edward Adam Davis 2026-10-21 5:50 ` syzbot 2026-10-21 6:25 ` [PATCH] configfs: Delay the fop setting to prevent noise generated by open Edward Adam Davis 2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis 2 siblings, 1 reply; 6+ messages in thread From: Edward Adam Davis @ 2026-10-21 5:30 UTC (permalink / raw) To: syzbot+4fae162886e497f72228; +Cc: linux-kernel, syzkaller-bugs From: Edward Aadm Davis <eadavis@sina.com> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 58161ead29e5 diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index eda80c2a2d38..45a955b8ab36 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -313,7 +313,6 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry, goto out_remove; inode->i_op = &configfs_dir_inode_operations; - inode->i_fop = &configfs_dir_operations; /* directory inodes start off with i_nlink == 2 (for "." entry) */ inc_nlink(inode); d_make_persistent(dentry, inode); @@ -930,6 +929,10 @@ static int configfs_attach_group(struct config_item *item, inode_unlock(d_inode(dentry)); if (ret) d_delete(dentry); + else { + struct inode *inode = d_inode(dentry); + inode->i_fop = &configfs_dir_operations; + } } return ret; @@ -1430,8 +1433,13 @@ static struct dentry *configfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, if (group) ret = configfs_attach_group(item, dentry, frag); - else + else { ret = configfs_attach_item(item, dentry, frag); + if (!ret) { + struct inode *inode = d_inode(dentry); + inode->i_fop = &configfs_dir_operations; + } + } spin_lock(&configfs_dirent_lock); sd->s_type &= ~CONFIGFS_USET_IN_MKDIR; ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] kernel BUG in create_default_group... 2026-10-21 5:30 ` Edward Adam Davis @ 2026-10-21 5:50 ` syzbot 0 siblings, 0 replies; 6+ messages in thread From: syzbot @ 2026-10-21 5:50 UTC (permalink / raw) To: eadavis, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: kernel BUG in create_default_group... Warning: Permanently added '[localhost]:36728' (ED25519) to the list of known hosts. [*] Starting reproducer for kernel BUG in create_default_group... [+] mkdir /sys/kernel/config successful or directory already exists. [+] configfs mounted or already mounted. [+] mkdir /sys/kernel/debug successful or directory already exists. [+] debugfs mounted or already mounted. [+] Successfully wrote 'N ' to /sys/kernel/debug/failslab/ignore-gfp-wait [+] Successfully wrote 'N ' to /sys/kernel/debug/failslab/cache-filter [+] Successfully wrote '-1 ' to /sys/kernel/debug/failslab/times [+] Pre-clean of /sys/kernel/config/nvmet/ports/1 successful. [+] Online CPU count: 1 [+] Started 6 background racing helper threads. [*] Iterating fault injection points (fail-nth 1..80 with concurrent race)... [*] Testing fail-nth = 1 (1 attempts)... [*] Testing fail-nth = 2 (1 attempts)... [*] Testing fail-nth = 3 (1 attempts)... [*] Testing fail-nth = 4 (1 attempts)... [*] Testing fail-nth = 5 (1 attempts)... [*] Testing fail-nth = 6 (1 attempts)... [*] Testing fail-nth = 7 (1 attempts)... [*] Testing fail-nth = 8 (1 attempts)... [*] Testing fail-nth = 9 (1 attempts)... [*] Testing fail-nth = 10 (1 attempts)... [*] Testing fail-nth = 11 (1 attempts)... [*] Testing fail-nth = 12 (1 attempts)... [*] Testing fail-nth = 13 (1 attempts)... [*] Testing fail-nth = 14 (1 attempts)... [*] Testing fail-nth = 15 (1 attempts)... [*] Testing fail-nth = 16 (1 attempts)... [*] Testing fail-nth = 17 (1 attempts)... [*] Testing fail-nth = 18 (1 attempts)... [*] Testing fail-nth = 19 (1 attempts)... [*] Testing fail-nth = 20 (1 attempts)... [*] Testing fail-nth = 21 (1 attempts)... [*] Testing fail-nth = 22 (1 attempts)... [*] Testing fail-nth = 23 (1 attempts)... [*] Testing fail-nth = 24 (1 attempts)... [*] Testing fail-nth = 25 (1 attempts)... [*] Testing fail-nth = 26 (1 attempts)... [*] Testing fail-nth = 27 (1 attempts)... [*] Testing fail-nth = 28 (1 attempts)... [*] Testing fail-nth = 29 (1 attempts)... [*] Testing fail-nth = 30 (1 attempts)... [*] Testing fail-nth = 31 (1 attempts)... [*] Testing fail-nth = 32 (1 attempts)... [*] Testing fail-nth = 33 (1 attempts)... [*] Testing fail-nth = 34 (1 attempts)... [*] Testing fail-nth = 35 (1 attempts)... [*] Testing fail-nth = 36 (1 attempts)... [*] Testing fail-nth = 37 (1 attempts)... [*] Testing fail-nth = 38 (12 attempts)... [*] Testing fail-nth = 39 (12 attempts)... [*] Testing fail-nth = 40 (12 attempts)... [*] Testing fail-nth = 41 (12 attempts)... [*] Testing fail-nth = 42 (12 attempts)... [*] Testing fail-nth = 43 (12 attempts)... [*] Testing fail-nth = 44 (12 attempts)... [*] Testing fail-nth = 45 (12 attempts)... [*] Testing fail-nth = 46 (12 attempts)... [*] Testing fail-nth = 47 (12 attempts)... [*] Testing fail-nth = 48 (12 attempts)... [*] Testing fail-nth = 49 (12 attempts)... [*] Testing fail-nth = 50 (12 attempts)... [*] Testing fail-nth = 51 (1 attempts)... [*] Testing fail-nth = 52 (1 attempts)... [*] Testing fail-nth = 53 (1 attempts)... [*] Testing fail-nth = 54 (1 attempts)... [*] Testing fail-nth = 55 (1 attempts)... [*] Testing fail-nth = 56 (1 attempts)... [*] Testing fail-nth = 57 (1 attempts)... [*] Testing fail-nth = 58 (1 attempts)... [*] Testing fail-nth = 59 (1 attempts)... [*] Testing fail-nth = 60 (1 attempts)... [*] Testing fail-nth = 61 (1 attempts)... [*] Testing fail-nth = 62 (1 attempts)... [*] Testing fail-nth = 63 (1 attempts)... [*] Testing fail-nth = 64 (1 attempts)... [*] Testing fail-nth = 65 (1 attempts)... [*] Testing fail-nth = 66 (1 attempts)... [*] Testing fail-nth = 67 (1 attempts)... [*] Testing fail-nth = 68 (1 attempts)... Tested on: commit: 58161ead Merge tag 'drm-fixes-2026-10-17' of https://g.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=17262831580000 kernel config: https://syzkaller.appspot.com/x/.config?x=4ccb65e03706547e dashboard link: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228 compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=14c2bb05580000 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] configfs: Delay the fop setting to prevent noise generated by open 2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot 2026-10-21 5:30 ` Edward Adam Davis @ 2026-10-21 6:25 ` Edward Adam Davis 2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis 2 siblings, 0 replies; 6+ messages in thread From: Edward Adam Davis @ 2026-10-21 6:25 UTC (permalink / raw) To: syzbot+4fae162886e497f72228 Cc: linux-kernel, syzkaller-bugs, leitao, a.hindborg mkdir() triggers: configfs_mkdir() -> configfs_attach_group() -> populate_groups() -> create_default_group("ana_groups") -> configfs_attach_group() -> populate_groups() -> create_default_group("1") The creation of an inode for the subdentry 1 under ana_groups failed due to fault injection. [1] Because helper threads are racing open() on ana_groups, ana_groups has dentry refcount > 1. d_delete() skips dentry_unlink_inode(), leaving d_inode non-NULL. create_default_group() hits BUG_ON(d_inode(child)) at fs/configfs/dir.c:734! [2] [1] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times -1 Call Trace: should_failslab+0xa8/0x100 kmem_cache_alloc_noprof+0xa1/0x600 security_inode_alloc+0x39/0x310 inode_init_always_gfp+0x97e/0xd30 alloc_inode+0x82/0x1b0 new_inode+0x1f/0x170 configfs_new_inode+0x27/0x410 configfs_create+0xb5/0x270 configfs_attach_item+0x25f/0xd60 configfs_attach_group+0x2a/0x370 create_default_group+0x87/0x180 configfs_attach_group+0x169/0x370 configfs_mkdir+0x6f0/0x9e0 vfs_mkdir+0x40c/0x620 [2] kernel BUG at fs/configfs/dir.c:734! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:create_default_group+0x17c/0x180 Call Trace: configfs_attach_group+0x169/0x370 configfs_mkdir+0x6f0/0x9e0 vfs_mkdir+0x40c/0x620 The root cause is a race condition between open and mkdir; delaying the assignment of the fop ensures that directories are not opened before they are ready. Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Reported-by: syzbot+4fae162886e497f72228@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228 Signed-off-by: Edward Adam Davis <eadavis@sina.com> --- fs/configfs/dir.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index eda80c2a2d38..45a955b8ab36 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -313,7 +313,6 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry, goto out_remove; inode->i_op = &configfs_dir_inode_operations; - inode->i_fop = &configfs_dir_operations; /* directory inodes start off with i_nlink == 2 (for "." entry) */ inc_nlink(inode); d_make_persistent(dentry, inode); @@ -930,6 +929,10 @@ static int configfs_attach_group(struct config_item *item, inode_unlock(d_inode(dentry)); if (ret) d_delete(dentry); + else { + struct inode *inode = d_inode(dentry); + inode->i_fop = &configfs_dir_operations; + } } return ret; @@ -1430,8 +1433,13 @@ static struct dentry *configfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, if (group) ret = configfs_attach_group(item, dentry, frag); - else + else { ret = configfs_attach_item(item, dentry, frag); + if (!ret) { + struct inode *inode = d_inode(dentry); + inode->i_fop = &configfs_dir_operations; + } + } spin_lock(&configfs_dirent_lock); sd->s_type &= ~CONFIGFS_USET_IN_MKDIR; -- 2.43.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] kernel BUG in create_default_group... 2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot 2026-10-21 5:30 ` Edward Adam Davis 2026-10-21 6:25 ` [PATCH] configfs: Delay the fop setting to prevent noise generated by open Edward Adam Davis @ 2026-10-21 9:40 ` Edward Adam Davis 2026-10-21 9:58 ` syzbot 2 siblings, 1 reply; 6+ messages in thread From: Edward Adam Davis @ 2026-10-21 9:40 UTC (permalink / raw) To: syzbot+4fae162886e497f72228; +Cc: linux-kernel, syzkaller-bugs From: Edward Aadm Davis <eadavis@sina.com> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 58161ead29e5 diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index eda80c2a2d38..edc5a7419ad9 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -1605,6 +1605,9 @@ static int configfs_dir_open(struct inode *inode, struct file *file) struct configfs_dirent * parent_sd = dentry->d_fsdata; int err; + if (!configfs_dirent_is_ready(parent_sd)) + return -EAGAIN; + inode_lock(d_inode(dentry)); /* * Fake invisibility if dir belongs to a group/default groups hierarchy ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] kernel BUG in create_default_group... 2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis @ 2026-10-21 9:58 ` syzbot 0 siblings, 0 replies; 6+ messages in thread From: syzbot @ 2026-10-21 9:58 UTC (permalink / raw) To: eadavis, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: kernel BUG in create_default_group... Warning: Permanently added '[localhost]:52391' (ED25519) to the list of known hosts. [*] Starting reproducer for kernel BUG in create_default_group... [+] mkdir /sys/kernel/config successful or directory already exists. [+] configfs mounted or already mounted. [+] mkdir /sys/kernel/debug successful or directory already exists. [+] debugfs mounted or already mounted. [+] Successfully wrote 'N ' to /sys/kernel/debug/failslab/ignore-gfp-wait [+] Successfully wrote 'N ' to /sys/kernel/debug/failslab/cache-filter [+] Successfully wrote '-1 ' to /sys/kernel/debug/failslab/times [+] Pre-clean of /sys/kernel/config/nvmet/ports/1 successful. [+] Online CPU count: 1 [+] Started 6 background racing helper threads. [*] Iterating fault injection points (fail-nth 1..80 with concurrent race)... [*] Testing fail-nth = 1 (1 attempts)... [*] Testing fail-nth = 2 (1 attempts)... [*] Testing fail-nth = 3 (1 attempts)... [*] Testing fail-nth = 4 (1 attempts)... [*] Testing fail-nth = 5 (1 attempts)... [*] Testing fail-nth = 6 (1 attempts)... [*] Testing fail-nth = 7 (1 attempts)... [*] Testing fail-nth = 8 (1 attempts)... [*] Testing fail-nth = 9 (1 attempts)... [*] Testing fail-nth = 10 (1 attempts)... [*] Testing fail-nth = 11 (1 attempts)... [*] Testing fail-nth = 12 (1 attempts)... [*] Testing fail-nth = 13 (1 attempts)... [*] Testing fail-nth = 14 (1 attempts)... [*] Testing fail-nth = 15 (1 attempts)... [*] Testing fail-nth = 16 (1 attempts)... [*] Testing fail-nth = 17 (1 attempts)... [*] Testing fail-nth = 18 (1 attempts)... [*] Testing fail-nth = 19 (1 attempts)... [*] Testing fail-nth = 20 (1 attempts)... [*] Testing fail-nth = 21 (1 attempts)... [*] Testing fail-nth = 22 (1 attempts)... [*] Testing fail-nth = 23 (1 attempts)... [*] Testing fail-nth = 24 (1 attempts)... [*] Testing fail-nth = 25 (1 attempts)... [*] Testing fail-nth = 26 (1 attempts)... [*] Testing fail-nth = 27 (1 attempts)... [*] Testing fail-nth = 28 (1 attempts)... [*] Testing fail-nth = 29 (1 attempts)... [*] Testing fail-nth = 30 (1 attempts)... [*] Testing fail-nth = 31 (1 attempts)... [*] Testing fail-nth = 32 (1 attempts)... [*] Testing fail-nth = 33 (1 attempts)... [*] Testing fail-nth = 34 (1 attempts)... [*] Testing fail-nth = 35 (1 attempts)... Tested on: commit: 58161ead Merge tag 'drm-fixes-2026-10-17' of https://g.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=11b5ebcd580000 kernel config: https://syzkaller.appspot.com/x/.config?x=4ccb65e03706547e dashboard link: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228 compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=12c84e7f980000 ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-21 9:58 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-10-19 18:08 [syzbot] kernel BUG in create_default_group syzbot 2026-10-21 5:30 ` Edward Adam Davis 2026-10-21 5:50 ` syzbot 2026-10-21 6:25 ` [PATCH] configfs: Delay the fop setting to prevent noise generated by open Edward Adam Davis 2026-10-21 9:40 ` [syzbot] kernel BUG in create_default_group Edward Adam Davis 2026-10-21 9:58 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®