From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-il1-f208.google.com (mail-il1-f208.google.com [209.85.166.208]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08D571CAA85 for ; Sat, 22 Nov 2025 15:15:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.166.208 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763824526; cv=none; b=glVtmtqgkLDakOVFJ1cTsiBsSdgIGUg1nGqbF1YdsVstKt7z4ytbQbPL7ZSL5TSMadqKGxRzEhbjk7SQjpYSGeNSSo6U/AUCxPauw2RVBCYfdvXijom406bFUA9CI0t1abfOBuSGlGQf+8+LWkIr3lDzsm/51uXDPZOGj/6aP28= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763824526; c=relaxed/simple; bh=8sWN1ENPLUgeeVZQIOYtOoedNe0FHL7B1OhHeYgWRDE=; h=MIME-Version:Date:Message-ID:Subject:From:To:Content-Type; b=oLURmKrb6jrI5oNQezuluAsmeGsd9UWNwALWTMmH1HMFFilAhIhiN3CfeQsgKP3JOESTtur/j5QLziUUGwTp8Q6Gn+dZQ/rJX+DGwCF45Ghu+1hyLaAmExHHiqEZ16xsiu9DBM8GlaiNZmKk9qzpZaz7ulbp4wOm2mz7dSegGp8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.166.208 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-il1-f208.google.com with SMTP id e9e14a558f8ab-4337cb921c2so29543915ab.2 for ; Sat, 22 Nov 2025 07:15:24 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763824524; x=1764429324; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=AU/O7/Z0dqPQ9UvCKH8MGsukSiWCHv6ThrapqzKdzZ8=; b=vBqkUbUZwow/bff9y15nw7gelC8zrP1bjMAVWJYXxuQ6ktp486rqkmld9fX1SvdwKn 3yOYZCcVkBHqfe0435hezcpiSYuI8YoHlMmlfwti2eICPLgO98/coqVs3haNqDBr0QNJ y17XSJFtiZDTtxerd0JMuRFW0DQEZZ8GKM8Fnxza4UydFGLFdvWskGUub0N0lzG7vrUN ja9tmHnP+4oqeBdA+ipC0BsSKeXNIgiqeY1vPMDA9Yt0i+3ykmwt4SRnPfsr/xYYXZ4J 5fCzoH6jm29HByjLZMSHcnC5iI3aqWs0NUdEzCDw0NM7EFjvP8GJ39/FaOJWrrBPei99 R3ZA== X-Forwarded-Encrypted: i=1; AJvYcCWnwiDsqG7mA/K9McgpkkoTNNPoU3sCbPM7HaBPI190aKL9l1P748XMqtSUV8WfEt1PUN6fOZUF+N6sr7o=@vger.kernel.org X-Gm-Message-State: AOJu0Yxn9tuTRh8j7IQvI0D4D+vuGM52g6QGnZevJlm471jOM6HTZomP u2VASwgmp/fcrShEXCjUmEBJyruSs9OUHte9t3gKqSaL3aebNM83mpnPUAhe4atM8lpbSnTEXSL wFlbxj4JOxhfhbp+IJSuMoA+r7xW5F9P5HN4070DL2XcjpMMJQaxtr6ATV/g= X-Google-Smtp-Source: AGHT+IHIFviwdQvavYW7rTJuBE9YhBXOLa3bnChirEIvAqejFgHji3eqKhav+qAycjvy+ONKIyY2jCQjB4L2HLqxTyWip3ZJ8WHP Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a92:c24e:0:b0:434:70bd:8b36 with SMTP id e9e14a558f8ab-435b8e3d704mr53687375ab.7.1763824524199; Sat, 22 Nov 2025 07:15:24 -0800 (PST) Date: Sat, 22 Nov 2025 07:15:24 -0800 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6921d38c.050a0220.2ffa18.0009.GAE@google.com> Subject: [syzbot] [mm?] kernel BUG in qlist_free_all (3) From: syzbot To: akpm@linux-foundation.org, baolin.wang@linux.alibaba.com, hughd@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot found the following issue on: HEAD commit: e7c375b18160 Merge tag 'vfs-6.18-rc7.fixes' of gitolite.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=174ce692580000 kernel config: https://syzkaller.appspot.com/x/.config?x=1cd7f786c0f5182f dashboard link: https://syzkaller.appspot.com/bug?extid=c2d8be6880c81b4308a0 compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/1fcb660703f1/disk-e7c375b1.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/4bf314965321/vmlinux-e7c375b1.xz kernel image: https://storage.googleapis.com/syzbot-assets/456b373fea36/bzImage-e7c375b1.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+c2d8be6880c81b4308a0@syzkaller.appspotmail.com ------------[ cut here ]------------ kernel BUG at arch/x86/mm/physaddr.c:28! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5199 Comm: udevd Tainted: G I syzkaller #0 PREEMPT(full) Tainted: [I]=FIRMWARE_WORKAROUND Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__phys_addr+0xfa/0x180 arch/x86/mm/physaddr.c:28 Code: 48 d3 e8 48 89 c3 48 89 c6 e8 92 c0 4e 00 48 85 db 75 11 e8 18 c5 4e 00 48 89 e8 5b 5d 41 5c c3 cc cc cc cc e8 07 c5 4e 00 90 <0f> 0b e8 ff c4 4e 00 48 c7 c0 10 d0 1a 8e 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900030976c0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 77ffff890029ae0a RCX: ffffffff816d91f3 RDX: ffff88807e69dac0 RSI: ffffffff816d9279 RDI: 0000000000000006 RBP: 780077088029ae0a R08: 0000000000000006 R09: 77ffff890029ae0a R10: 780077088029ae0a R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: ffffc90003097718 R15: ffff88807e730001 FS: 00007f359dd9a880(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000005e000 CR3: 000000007e0a2000 CR4: 00000000003526f0 Call Trace: virt_to_folio include/linux/mm.h:1245 [inline] virt_to_slab mm/slab.h:191 [inline] qlink_to_cache mm/kasan/quarantine.c:131 [inline] qlist_free_all+0x65/0x120 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:352 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4978 [inline] slab_alloc_node mm/slub.c:5288 [inline] kmem_cache_alloc_lru_noprof+0x254/0x6e0 mm/slub.c:5307 shmem_alloc_inode+0x25/0x50 mm/shmem.c:5149 alloc_inode+0x64/0x240 fs/inode.c:346 new_inode+0x22/0x1c0 fs/inode.c:1145 __shmem_get_inode mm/shmem.c:3048 [inline] shmem_get_inode+0x19a/0xfb0 mm/shmem.c:3122 shmem_mknod+0x1a8/0x450 mm/shmem.c:3843 lookup_open.isra.0+0x11d3/0x1580 fs/namei.c:3796 open_last_lookups fs/namei.c:3895 [inline] path_openat+0x893/0x2cb0 fs/namei.c:4131 do_filp_open+0x20b/0x470 fs/namei.c:4161 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f359d6a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffeb2981680 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f359dd9a880 RCX: 00007f359d6a7407 RDX: 0000000000080141 RSI: 000055a5a8bca02e RDI: ffffffffffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000001a4 R11: 0000000000000202 R12: 00000000ffffffff R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__phys_addr+0xfa/0x180 arch/x86/mm/physaddr.c:28 Code: 48 d3 e8 48 89 c3 48 89 c6 e8 92 c0 4e 00 48 85 db 75 11 e8 18 c5 4e 00 48 89 e8 5b 5d 41 5c c3 cc cc cc cc e8 07 c5 4e 00 90 <0f> 0b e8 ff c4 4e 00 48 c7 c0 10 d0 1a 8e 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900030976c0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 77ffff890029ae0a RCX: ffffffff816d91f3 RDX: ffff88807e69dac0 RSI: ffffffff816d9279 RDI: 0000000000000006 RBP: 780077088029ae0a R08: 0000000000000006 R09: 77ffff890029ae0a R10: 780077088029ae0a R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: ffffc90003097718 R15: ffff88807e730001 FS: 00007f359dd9a880(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000005e000 CR3: 000000007e0a2000 CR4: 00000000003526f0 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup