[syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    fda5e3f28400 Merge tag 'trace-v6.13-rc7-2' of git://git.ke..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1117e024580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f5e182416a4b418f
dashboard link: https://syzkaller.appspot.com/bug?extid=4e21d5f67b886a692b55
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=177959df980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1288d1f8580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cd46ddd4b381/disk-fda5e3f2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f7cf021f77f5/vmlinux-fda5e3f2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12cb03ba7d7e/bzImage-fda5e3f2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4e21d5f67b886a692b55@syzkaller.appspotmail.com

list_del corruption. prev->next should be ffffc90003377b98, but was ffff88802a2585c8. (prev=ffff88802a2585c8)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:62!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 9290 Comm: syz-executor367 Not tainted 6.13.0-rc7-syzkaller-00191-gfda5e3f28400 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:__list_del_entry_valid_or_report+0x12c/0x1c0 lib/list_debug.c:62
Code: e8 19 db da fc 90 0f 0b 48 89 ca 48 c7 c7 00 a0 b1 8b e8 07 db da fc 90 0f 0b 48 89 c2 48 c7 c7 60 a0 b1 8b e8 f5 da da fc 90 <0f> 0b 48 89 d1 48 c7 c7 e0 a0 b1 8b 48 89 c2 e8 e0 da da fc 90 0f
RSP: 0018:ffffc90003377880 EFLAGS: 00010086
RAX: 000000000000006d RBX: ffffc90003377b80 RCX: ffffffff8178e449
RDX: 0000000000000000 RSI: ffffffff81798bd6 RDI: 0000000000000005
RBP: ffff88802a258588 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000001 R11: 0000000000000001 R12: 0000000000000286
R13: ffffc90003377b98 R14: ffffc90003377ba0 R15: ffffc90003377b70
FS:  0000555578a00380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f687b8542b0 CR3: 0000000073a90000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 __remove_wait_queue include/linux/wait.h:207 [inline]
 remove_wait_queue+0x30/0x180 kernel/sched/wait.c:55
 free_poll_entry fs/select.c:132 [inline]
 poll_freewait+0xd5/0x250 fs/select.c:141
 do_sys_poll+0x6f7/0xde0 fs/select.c:1010
 __do_sys_poll fs/select.c:1074 [inline]
 __se_sys_poll fs/select.c:1062 [inline]
 __x64_sys_poll+0x1a8/0x450 fs/select.c:1062
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f687b7d8809
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdb8bb93f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
RAX: ffffffffffffffda RBX: 00307276642f3072 RCX: 00007f687b7d8809
RDX: 0000000000000106 RSI: 0000000000000005 RDI: 0000000020000080
RBP: 0000000000000000 R08: 00007ffdb8bb8f60 R09: 00007ffdb8bb8f60
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdb8bb941c
R13: 00007ffdb8bb9430 R14: 00007ffdb8bb9470 R15: 0000000000000359
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x12c/0x1c0 lib/list_debug.c:62
Code: e8 19 db da fc 90 0f 0b 48 89 ca 48 c7 c7 00 a0 b1 8b e8 07 db da fc 90 0f 0b 48 89 c2 48 c7 c7 60 a0 b1 8b e8 f5 da da fc 90 <0f> 0b 48 89 d1 48 c7 c7 e0 a0 b1 8b 48 89 c2 e8 e0 da da fc 90 0f
RSP: 0018:ffffc90003377880 EFLAGS: 00010086
RAX: 000000000000006d RBX: ffffc90003377b80 RCX: ffffffff8178e449
RDX: 0000000000000000 RSI: ffffffff81798bd6 RDI: 0000000000000005
RBP: ffff88802a258588 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000001 R11: 0000000000000001 R12: 0000000000000286
R13: ffffc90003377b98 R14: ffffc90003377ba0 R15: ffffc90003377b70
FS:  0000555578a00380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f687b8542b0 CR3: 0000000073a90000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] Re: [syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)
Author: lizhi.xu@windriver.com

#syz test

diff --git a/fs/select.c b/fs/select.c
index 7da531b1cf6b..63dd2fb58447 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -977,6 +977,7 @@ static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
  	struct poll_list *walk = head;
 	unsigned int todo = nfds;
 	unsigned int len;
+	static DEFINE_MUTEX(syspoll_lock);
 
 	if (nfds > rlimit(RLIMIT_NOFILE))
 		return -EINVAL;
@@ -1005,9 +1006,11 @@ static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
 		}
 	}
 
+	mutex_lock(&syspoll_lock);
 	poll_initwait(&table);
 	fdcount = do_poll(head, &table, end_time);
 	poll_freewait(&table);
+	mutex_unlock(&syspoll_lock);
 
 	if (!user_write_access_begin(ufds, nfds * sizeof(*ufds)))
 		goto out_fds;

Re: [syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[syzbot]

syzbot has bisected this issue to:

commit 8ffdff6a8cfbdc174a3a390b6f825a277b5bb895
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Apr 14 08:58:10 2021 +0000

    staging: comedi: move out of staging directory

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13009f70580000
start commit:   05df91921da6 Merge tag 'v6.16-rc4-smb3-client-fixes' of gi..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=10809f70580000
console output: https://syzkaller.appspot.com/x/log.txt?x=17009f70580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=45bd916a213c79bb
dashboard link: https://syzkaller.appspot.com/bug?extid=4e21d5f67b886a692b55
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=161cdc8c580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14d1a582580000

Reported-by: syzbot+4e21d5f67b886a692b55@syzkaller.appspotmail.com
Fixes: 8ffdff6a8cfb ("staging: comedi: move out of staging directory")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[Hillf Danton]

> Date: Mon, 07 Jul 2025 02:30:02 -0700
> syzbot has bisected this issue to:
> 
> commit 8ffdff6a8cfbdc174a3a390b6f825a277b5bb895
> Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Date:   Wed Apr 14 08:58:10 2021 +0000
> 
>     staging: comedi: move out of staging directory
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13009f70580000
> start commit:   05df91921da6 Merge tag 'v6.16-rc4-smb3-client-fixes' of gi..
> git tree:       upstream
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=10809f70580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=17009f70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=45bd916a213c79bb
> dashboard link: https://syzkaller.appspot.com/bug?extid=4e21d5f67b886a692b55
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=161cdc8c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14d1a582580000

#syz test upstream master

--- x/drivers/comedi/comedi_fops.c
+++ y/drivers/comedi/comedi_fops.c
@@ -2454,7 +2454,7 @@ static __poll_t comedi_poll(struct file
 	struct comedi_device *dev = cfp->dev;
 	struct comedi_subdevice *s, *s_read;
 
-	down_read(&dev->attach_lock);
+	down_write(&dev->attach_lock);
 
 	if (!dev->attached) {
 		dev_dbg(dev->class_dev, "no driver attached\n");
@@ -2484,7 +2484,7 @@ static __poll_t comedi_poll(struct file
 	}
 
 done:
-	up_read(&dev->attach_lock);
+	up_write(&dev->attach_lock);
 	return mask;
 }
 
--

Re: [syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: corrupted list in remove_wait_queue

 slab kmalloc-8k start ffff8881457ec000 pointer offset 1480 size 8192
list_del corruption. prev->next should be ffffc90003d8fb98, but was ffff8881457ec5c8. (prev=ffff8881457ec5c8)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:62!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6485 Comm: syz.1.17 Not tainted 6.16.0-rc5-syzkaller-gd7b8f8e20813-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__list_del_entry_valid_or_report+0x17a/0x200 lib/list_debug.c:62
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 a0 26 f5 8b e8 07 ca bf fc 90 <0f> 0b 4c 89 e7 e8 dc e7 23 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc90003d8f880 EFLAGS: 00010086
RAX: 000000000000006d RBX: ffffc90003d8fb98 RCX: ffffffff819a6f69
RDX: 0000000000000000 RSI: ffffffff819aeb6e RDI: 0000000000000005
RBP: ffff8881457ec5c8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000001 R11: 0000000000000001 R12: ffff8881457ec5c8
R13: ffffc90003d8fb98 R14: ffffc90003d8fba0 R15: ffffc90003d8fb70
FS:  00007f2a989306c0(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc742be1a8 CR3: 0000000077286000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 __remove_wait_queue include/linux/wait.h:207 [inline]
 remove_wait_queue+0x30/0x180 kernel/sched/wait.c:55
 free_poll_entry fs/select.c:132 [inline]
 poll_freewait+0xd5/0x250 fs/select.c:141
 do_sys_poll+0x6a9/0xde0 fs/select.c:1010
 __do_sys_poll fs/select.c:1074 [inline]
 __se_sys_poll fs/select.c:1062 [inline]
 __x64_sys_poll+0x1a6/0x450 fs/select.c:1062
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2a97b85d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2a98930038 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
RAX: ffffffffffffffda RBX: 00007f2a97d75fa0 RCX: 00007f2a97b85d29
RDX: 0000000000000106 RSI: 0000000000000005 RDI: 0000000020000080
RBP: 00007f2a97c01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f2a97d75fa0 R15: 00007ffddfb83ed8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x17a/0x200 lib/list_debug.c:62
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 a0 26 f5 8b e8 07 ca bf fc 90 <0f> 0b 4c 89 e7 e8 dc e7 23 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc90003d8f880 EFLAGS: 00010086
RAX: 000000000000006d RBX: ffffc90003d8fb98 RCX: ffffffff819a6f69
RDX: 0000000000000000 RSI: ffffffff819aeb6e RDI: 0000000000000005
RBP: ffff8881457ec5c8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000001 R11: 0000000000000001 R12: ffff8881457ec5c8
R13: ffffc90003d8fb98 R14: ffffc90003d8fba0 R15: ffffc90003d8fb70
FS:  00007f2a989306c0(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc742be1a8 CR3: 0000000077286000 CR4: 00000000003526f0


Tested on:

commit:         d7b8f8e2 Linux 6.16-rc5
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13ec9f70580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a9b42a4fcb738e08
dashboard link: https://syzkaller.appspot.com/bug?extid=4e21d5f67b886a692b55
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=143c928c580000

Re: [syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 35b6fc51c666fc96355be5cd633ed0fe4ccf68b2
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Tue Jul 22 15:53:16 2025 +0000

    comedi: fix race between polling and detaching

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=10d49dfc580000
start commit:   038d61fd6422 Linux 6.16
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=515ec0b49771bcd1
dashboard link: https://syzkaller.appspot.com/bug?extid=4e21d5f67b886a692b55
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14fbbcf0580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11034aa2580000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: comedi: fix race between polling and detaching

For information about bisection process see: https://goo.gl/tpsmEJ#bisection