* [syzbot] [raid?] kernel BUG in find_zone @ 2026-09-16 12:57 syzbot 2026-09-17 1:18 ` Zizhi Wo 0 siblings, 1 reply; 4+ messages in thread From: syzbot @ 2026-09-16 12:57 UTC (permalink / raw) To: linux-kernel, linux-raid, magiclinan, song, syzkaller-bugs, xiao, yukuai, yukuai Hello, syzbot found the following issue on: HEAD commit: 50d05c7c76c9 Merge tag 'landlock-7.3-rc3' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=100769f9580000 kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9 dashboard link: https://syzkaller.appspot.com/bug?extid=50f9bc7ab8eb224b7629 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 userspace arch: i386 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-50d05c7c.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/303a0ade8f9e/vmlinux-50d05c7c.xz kernel image: https://storage.googleapis.com/syzbot-assets/70b8ca71442b/bzImage-50d05c7c.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+50f9bc7ab8eb224b7629@syzkaller.appspotmail.com ------------[ cut here ]------------ kernel BUG at drivers/md/raid0.c:318! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 8386 Comm: syz.2.584 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000033863fff CR3: 0000000070ae4000 CR4: 0000000000352ef0 Call Trace: <TASK> raid0_map_submit_bio drivers/md/raid0.c:568 [inline] raid0_make_request+0x299/0x1660 drivers/md/raid0.c:626 md_handle_request+0x824/0x1230 drivers/md/md.c:417 md_submit_bio+0x1e9/0x350 drivers/md/md.c:458 __submit_bio block/blk-core.c:681 [inline] __submit_bio+0x20e/0x3d0 block/blk-core.c:670 __submit_bio_noacct block/blk-core.c:724 [inline] submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792 submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925 blk_crypto_submit_bio include/linux/blk-crypto.h:212 [inline] __bh_submit+0x7ce/0xaa0 fs/buffer.c:1132 bh_submit fs/buffer.c:1146 [inline] block_read_full_folio+0x496/0x8c0 fs/buffer.c:2373 filemap_read_folio+0xfc/0x3b0 mm/filemap.c:2520 do_read_cache_folio+0x2d7/0x6b0 mm/filemap.c:4156 read_mapping_folio include/linux/pagemap.h:1015 [inline] read_part_sector+0xd1/0x370 block/partitions/core.c:724 adfspart_check_ICS+0x91/0x7d0 block/partitions/acorn.c:357 check_partition block/partitions/core.c:143 [inline] blk_add_partitions block/partitions/core.c:591 [inline] bdev_disk_changed+0x7b1/0x1260 block/partitions/core.c:695 blkdev_get_whole+0x187/0x290 block/bdev.c:793 bdev_open+0x2c7/0xe40 block/bdev.c:1002 blkdev_open+0x34e/0x4f0 block/fops.c:674 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf700efec Code: Unable to access opcode bytes at 0xf700efc2. RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000300 RDX: 0000000000004002 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f5315ff4 CR3: 0000000070ae4000 CR4: 0000000000352ef0 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [raid?] kernel BUG in find_zone 2026-09-16 12:57 [syzbot] [raid?] kernel BUG in find_zone syzbot @ 2026-09-17 1:18 ` Zizhi Wo 2026-09-17 1:18 ` syzbot 0 siblings, 1 reply; 4+ messages in thread From: Zizhi Wo @ 2026-09-17 1:18 UTC (permalink / raw) To: syzbot, linux-kernel, linux-raid, magiclinan, song, syzkaller-bugs, xiao, yukuai, yukuai [-- Attachment #1: Type: text/plain, Size: 6733 bytes --] #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master Please test the attached patch. Thanks, Zizhi Wo 在 2026/9/16 20:57, syzbot 写道: > Hello, > > syzbot found the following issue on: > > HEAD commit: 50d05c7c76c9 Merge tag 'landlock-7.3-rc3' of git://git.ker.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=100769f9580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9 > dashboard link: https://syzkaller.appspot.com/bug?extid=50f9bc7ab8eb224b7629 > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > userspace arch: i386 > > Unfortunately, I don't have any reproducer for this issue yet. > > Downloadable assets: > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-50d05c7c.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/303a0ade8f9e/vmlinux-50d05c7c.xz > kernel image: https://storage.googleapis.com/syzbot-assets/70b8ca71442b/bzImage-50d05c7c.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+50f9bc7ab8eb224b7629@syzkaller.appspotmail.com > > ------------[ cut here ]------------ > kernel BUG at drivers/md/raid0.c:318! > Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI > CPU: 1 UID: 0 PID: 8386 Comm: syz.2.584 Tainted: G L syzkaller #0 PREEMPT(full) > Tainted: [L]=SOFTLOCKUP > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 > RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] > RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 > Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 > RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 > RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 > RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 > RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 > R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 > R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 > FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 > CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 > CR2: 0000000033863fff CR3: 0000000070ae4000 CR4: 0000000000352ef0 > Call Trace: > <TASK> > raid0_map_submit_bio drivers/md/raid0.c:568 [inline] > raid0_make_request+0x299/0x1660 drivers/md/raid0.c:626 > md_handle_request+0x824/0x1230 drivers/md/md.c:417 > md_submit_bio+0x1e9/0x350 drivers/md/md.c:458 > __submit_bio block/blk-core.c:681 [inline] > __submit_bio+0x20e/0x3d0 block/blk-core.c:670 > __submit_bio_noacct block/blk-core.c:724 [inline] > submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792 > submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925 > blk_crypto_submit_bio include/linux/blk-crypto.h:212 [inline] > __bh_submit+0x7ce/0xaa0 fs/buffer.c:1132 > bh_submit fs/buffer.c:1146 [inline] > block_read_full_folio+0x496/0x8c0 fs/buffer.c:2373 > filemap_read_folio+0xfc/0x3b0 mm/filemap.c:2520 > do_read_cache_folio+0x2d7/0x6b0 mm/filemap.c:4156 > read_mapping_folio include/linux/pagemap.h:1015 [inline] > read_part_sector+0xd1/0x370 block/partitions/core.c:724 > adfspart_check_ICS+0x91/0x7d0 block/partitions/acorn.c:357 > check_partition block/partitions/core.c:143 [inline] > blk_add_partitions block/partitions/core.c:591 [inline] > bdev_disk_changed+0x7b1/0x1260 block/partitions/core.c:695 > blkdev_get_whole+0x187/0x290 block/bdev.c:793 > bdev_open+0x2c7/0xe40 block/bdev.c:1002 > blkdev_open+0x34e/0x4f0 block/fops.c:674 > do_dentry_open+0x6ab/0x14d0 fs/open.c:996 > vfs_open+0x82/0x3f0 fs/open.c:1101 > do_open fs/namei.c:4837 [inline] > path_openat+0x19fa/0x2440 fs/namei.c:5000 > do_file_open+0x20e/0x430 fs/namei.c:5029 > do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 > do_sys_open fs/open.c:1423 [inline] > __do_compat_sys_openat fs/open.c:1485 [inline] > __se_compat_sys_openat fs/open.c:1483 [inline] > __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1483 > do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] > __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 > do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 > entry_SYSENTER_compat_after_hwframe+0x84/0x8e > RIP: 0023:0xf700efec > Code: Unable to access opcode bytes at 0xf700efc2. > RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 > RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000300 > RDX: 0000000000004002 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 > </TASK> > Modules linked in: > ---[ end trace 0000000000000000 ]--- > RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] > RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 > Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 > RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 > RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 > RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 > RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 > R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 > R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 > FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 > CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 > CR2: 00000000f5315ff4 CR3: 0000000070ae4000 CR4: 0000000000352ef0 > > > --- > This report is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this issue. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > If the report is already addressed, let syzbot know by replying with: > #syz fix: exact-commit-title > > If you want to overwrite report's subsystems, reply with: > #syz set subsystems: new-subsystem > (See the list of subsystem names on the web dashboard) > > If the report is a duplicate of another one, reply with: > #syz dup: exact-subject-of-another-report > > If you want to undo deduplication, reply with: > #syz undup > [-- Attachment #2: 0001-md-raid5-reject-a-per-device-size-smaller-than-one-c.patch --] [-- Type: text/plain, Size: 3471 bytes --] From d2e0508c9a66cad5b5cc3297de68a716e7bf7207 Mon Sep 17 00:00:00 2001 From: Zizhi Wo <wozizhi@huawei.com> Date: Wed, 16 Sep 2026 16:49:40 +0800 Subject: [PATCH] md/raid5: reject a per-device size smaller than one chunk Both raid5_run() and raid5_resize() align the per-device size down to a whole multiple of the chunk size: mddev->dev_sectors &= ~(chunk_sectors - 1); Neither checks the result, so a size smaller than one chunk silently becomes zero. In raid5_run() that is harmless: the array size is derived from the same zero, so the disk just ends up with no capacity. In raid5_resize() it leaves the array inconsistent -- mddev->dev_sectors becomes zero, while mddev->array_sectors and the gendisk capacity keep the previous. A later raid4/raid5 -> raid0 takeover copies the zero into every rdev->sectors (raid0_takeover_raid45()), so create_strip_zones() builds a strip zone table whose zone_end is zero. Any read then passes bio_check_eod() against the stale capacity and hits the BUG() in find_zone(): kernel BUG at drivers/md/raid0.c:318! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 45 UID: 0 PID: 1300 Comm: mdadm Not tainted 7.3.0-rc3+ #106 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:raid0_make_request+0x10cb/0x16a0 Call Trace: <TASK> md_handle_request+0x566/0xb40 __submit_bio+0x2b2/0x600 submit_bio_noacct_nocheck+0x509/0xb30 block_read_full_folio+0x364/0x6d0 filemap_read_folio+0xa2/0x200 do_read_cache_folio+0x1b6/0x330 read_part_sector+0xb6/0x2a0 read_lba+0x17d/0x280 efi_partition+0x2a6/0x2520 bdev_disk_changed+0x6e0/0xfa0 ...... bdev_open+0x214/0xc40 Reject a size smaller than one chunk in both functions, so that a running raid4/raid5 array always has mddev->dev_sectors >= one chunk. The check is done where the value takes effect, not where it is assigned. mddev->dev_sectors is written from several places, and none of them can tell whether the value is usable: the chunk size may still change later. raid5_run() and raid5_resize() are where every input is final, so one check in each covers them all. Fixes: eea136d69f9f ("md: fix buglet in RAID5 -> RAID0 conversion.") Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- drivers/md/raid5.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index b91545ce090d..e0f1a8e7bd3a 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -8201,10 +8201,16 @@ static int raid5_run(struct mddev *mddev) goto abort; } /* device size must be a multiple of chunk size */ mddev->dev_sectors &= ~((sector_t)mddev->chunk_sectors - 1); + if (!mddev->dev_sectors) { + pr_warn("md/raid:%s: device size is smaller than one chunk\n", + mdname(mddev)); + ret = -EINVAL; + goto abort; + } mddev->resync_max_sectors = mddev->dev_sectors; if (mddev->degraded > dirty_parity_disks && mddev->resync_offset != MaxSector) { if (test_bit(MD_HAS_PPL, &mddev->flags)) @@ -8534,10 +8540,12 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors) struct r5conf *conf = mddev->private; if (raid5_has_log(conf) || raid5_has_ppl(conf)) return -EINVAL; sectors &= ~((sector_t)conf->chunk_sectors - 1); + if (!sectors) + return -EINVAL; newsize = raid5_size(mddev, sectors, mddev->raid_disks); if (mddev->external_size && mddev->array_sectors > newsize) return -EINVAL; -- 2.52.0 ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [raid?] kernel BUG in find_zone 2026-09-17 1:18 ` Zizhi Wo @ 2026-09-17 1:18 ` syzbot 2026-09-17 1:24 ` Zizhi Wo 0 siblings, 1 reply; 4+ messages in thread From: syzbot @ 2026-09-17 1:18 UTC (permalink / raw) To: wozizhi Cc: linux-kernel, linux-raid, magiclinan, song, syzkaller-bugs, wozizhi, xiao, yukuai, yukuai > #syz test: This crash does not have a reproducer. I cannot test it. > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master > > Please test the attached patch. > > Thanks, > Zizhi Wo > > 在 2026/9/16 20:57, syzbot 写道: >> Hello, >> >> syzbot found the following issue on: >> >> HEAD commit: 50d05c7c76c9 Merge tag 'landlock-7.3-rc3' of git://git.ker.. >> git tree: upstream >> console output: https://syzkaller.appspot.com/x/log.txt?x=100769f9580000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9 >> dashboard link: https://syzkaller.appspot.com/bug?extid=50f9bc7ab8eb224b7629 >> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 >> userspace arch: i386 >> >> Unfortunately, I don't have any reproducer for this issue yet. >> >> Downloadable assets: >> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-50d05c7c.raw.xz >> vmlinux: https://storage.googleapis.com/syzbot-assets/303a0ade8f9e/vmlinux-50d05c7c.xz >> kernel image: https://storage.googleapis.com/syzbot-assets/70b8ca71442b/bzImage-50d05c7c.xz >> >> IMPORTANT: if you fix the issue, please add the following tag to the commit: >> Reported-by: syzbot+50f9bc7ab8eb224b7629@syzkaller.appspotmail.com >> >> ------------[ cut here ]------------ >> kernel BUG at drivers/md/raid0.c:318! >> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI >> CPU: 1 UID: 0 PID: 8386 Comm: syz.2.584 Tainted: G L syzkaller #0 PREEMPT(full) >> Tainted: [L]=SOFTLOCKUP >> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 >> RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] >> RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 >> Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 >> RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 >> RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 >> RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 >> RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 >> R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 >> R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 >> FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 >> CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 >> CR2: 0000000033863fff CR3: 0000000070ae4000 CR4: 0000000000352ef0 >> Call Trace: >> <TASK> >> raid0_map_submit_bio drivers/md/raid0.c:568 [inline] >> raid0_make_request+0x299/0x1660 drivers/md/raid0.c:626 >> md_handle_request+0x824/0x1230 drivers/md/md.c:417 >> md_submit_bio+0x1e9/0x350 drivers/md/md.c:458 >> __submit_bio block/blk-core.c:681 [inline] >> __submit_bio+0x20e/0x3d0 block/blk-core.c:670 >> __submit_bio_noacct block/blk-core.c:724 [inline] >> submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792 >> submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925 >> blk_crypto_submit_bio include/linux/blk-crypto.h:212 [inline] >> __bh_submit+0x7ce/0xaa0 fs/buffer.c:1132 >> bh_submit fs/buffer.c:1146 [inline] >> block_read_full_folio+0x496/0x8c0 fs/buffer.c:2373 >> filemap_read_folio+0xfc/0x3b0 mm/filemap.c:2520 >> do_read_cache_folio+0x2d7/0x6b0 mm/filemap.c:4156 >> read_mapping_folio include/linux/pagemap.h:1015 [inline] >> read_part_sector+0xd1/0x370 block/partitions/core.c:724 >> adfspart_check_ICS+0x91/0x7d0 block/partitions/acorn.c:357 >> check_partition block/partitions/core.c:143 [inline] >> blk_add_partitions block/partitions/core.c:591 [inline] >> bdev_disk_changed+0x7b1/0x1260 block/partitions/core.c:695 >> blkdev_get_whole+0x187/0x290 block/bdev.c:793 >> bdev_open+0x2c7/0xe40 block/bdev.c:1002 >> blkdev_open+0x34e/0x4f0 block/fops.c:674 >> do_dentry_open+0x6ab/0x14d0 fs/open.c:996 >> vfs_open+0x82/0x3f0 fs/open.c:1101 >> do_open fs/namei.c:4837 [inline] >> path_openat+0x19fa/0x2440 fs/namei.c:5000 >> do_file_open+0x20e/0x430 fs/namei.c:5029 >> do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 >> do_sys_open fs/open.c:1423 [inline] >> __do_compat_sys_openat fs/open.c:1485 [inline] >> __se_compat_sys_openat fs/open.c:1483 [inline] >> __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1483 >> do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] >> __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 >> do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 >> entry_SYSENTER_compat_after_hwframe+0x84/0x8e >> RIP: 0023:0xf700efec >> Code: Unable to access opcode bytes at 0xf700efc2. >> RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 >> RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000300 >> RDX: 0000000000004002 RSI: 0000000000000000 RDI: 0000000000000000 >> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 >> R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 >> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 >> </TASK> >> Modules linked in: >> ---[ end trace 0000000000000000 ]--- >> RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] >> RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 >> Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 >> RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 >> RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 >> RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 >> RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 >> R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 >> R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 >> FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 >> CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 >> CR2: 00000000f5315ff4 CR3: 0000000070ae4000 CR4: 0000000000352ef0 >> >> >> --- >> This report is generated by a bot. It may contain errors. >> See https://goo.gl/tpsmEJ for more information about syzbot. >> syzbot engineers can be reached at syzkaller@googlegroups.com. >> >> syzbot will keep track of this issue. See: >> https://goo.gl/tpsmEJ#status for how to communicate with syzbot. >> >> If the report is already addressed, let syzbot know by replying with: >> #syz fix: exact-commit-title >> >> If you want to overwrite report's subsystems, reply with: >> #syz set subsystems: new-subsystem >> (See the list of subsystem names on the web dashboard) >> >> If the report is a duplicate of another one, reply with: >> #syz dup: exact-subject-of-another-report >> >> If you want to undo deduplication, reply with: >> #syz undup >> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [raid?] kernel BUG in find_zone 2026-09-17 1:18 ` syzbot @ 2026-09-17 1:24 ` Zizhi Wo 0 siblings, 0 replies; 4+ messages in thread From: Zizhi Wo @ 2026-09-17 1:24 UTC (permalink / raw) To: syzbot, wozizhi Cc: linux-kernel, linux-raid, magiclinan, song, syzkaller-bugs, xiao, yukuai, yukuai 在 2026/9/17 9:18, syzbot 写道: >> #syz test: > > This crash does not have a reproducer. I cannot test it. Sorry for the noise -- I didn't realize this report has no reproducer. I've posted a patch that I believe fixes this issue to the list: https://lore.kernel.org/all/20260916095137.1157801-1-wozizhi@huaweicloud.com/ Since there's no syzbot reproducer, I constructed one locally and confirmed the patch resolves the crash. Thanks, Zizhi Wo > >> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master >> >> Please test the attached patch. >> >> Thanks, >> Zizhi Wo >> >> 在 2026/9/16 20:57, syzbot 写道: >>> Hello, >>> >>> syzbot found the following issue on: >>> >>> HEAD commit: 50d05c7c76c9 Merge tag 'landlock-7.3-rc3' of git://git.ker.. >>> git tree: upstream >>> console output: https://syzkaller.appspot.com/x/log.txt?x=100769f9580000 >>> kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9 >>> dashboard link: https://syzkaller.appspot.com/bug?extid=50f9bc7ab8eb224b7629 >>> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 >>> userspace arch: i386 >>> >>> Unfortunately, I don't have any reproducer for this issue yet. >>> >>> Downloadable assets: >>> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-50d05c7c.raw.xz >>> vmlinux: https://storage.googleapis.com/syzbot-assets/303a0ade8f9e/vmlinux-50d05c7c.xz >>> kernel image: https://storage.googleapis.com/syzbot-assets/70b8ca71442b/bzImage-50d05c7c.xz >>> >>> IMPORTANT: if you fix the issue, please add the following tag to the commit: >>> Reported-by: syzbot+50f9bc7ab8eb224b7629@syzkaller.appspotmail.com >>> >>> ------------[ cut here ]------------ >>> kernel BUG at drivers/md/raid0.c:318! >>> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI >>> CPU: 1 UID: 0 PID: 8386 Comm: syz.2.584 Tainted: G L syzkaller #0 PREEMPT(full) >>> Tainted: [L]=SOFTLOCKUP >>> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 >>> RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] >>> RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 >>> Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 >>> RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 >>> RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 >>> RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 >>> RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 >>> R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 >>> R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 >>> FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 >>> CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 >>> CR2: 0000000033863fff CR3: 0000000070ae4000 CR4: 0000000000352ef0 >>> Call Trace: >>> <TASK> >>> raid0_map_submit_bio drivers/md/raid0.c:568 [inline] >>> raid0_make_request+0x299/0x1660 drivers/md/raid0.c:626 >>> md_handle_request+0x824/0x1230 drivers/md/md.c:417 >>> md_submit_bio+0x1e9/0x350 drivers/md/md.c:458 >>> __submit_bio block/blk-core.c:681 [inline] >>> __submit_bio+0x20e/0x3d0 block/blk-core.c:670 >>> __submit_bio_noacct block/blk-core.c:724 [inline] >>> submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792 >>> submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925 >>> blk_crypto_submit_bio include/linux/blk-crypto.h:212 [inline] >>> __bh_submit+0x7ce/0xaa0 fs/buffer.c:1132 >>> bh_submit fs/buffer.c:1146 [inline] >>> block_read_full_folio+0x496/0x8c0 fs/buffer.c:2373 >>> filemap_read_folio+0xfc/0x3b0 mm/filemap.c:2520 >>> do_read_cache_folio+0x2d7/0x6b0 mm/filemap.c:4156 >>> read_mapping_folio include/linux/pagemap.h:1015 [inline] >>> read_part_sector+0xd1/0x370 block/partitions/core.c:724 >>> adfspart_check_ICS+0x91/0x7d0 block/partitions/acorn.c:357 >>> check_partition block/partitions/core.c:143 [inline] >>> blk_add_partitions block/partitions/core.c:591 [inline] >>> bdev_disk_changed+0x7b1/0x1260 block/partitions/core.c:695 >>> blkdev_get_whole+0x187/0x290 block/bdev.c:793 >>> bdev_open+0x2c7/0xe40 block/bdev.c:1002 >>> blkdev_open+0x34e/0x4f0 block/fops.c:674 >>> do_dentry_open+0x6ab/0x14d0 fs/open.c:996 >>> vfs_open+0x82/0x3f0 fs/open.c:1101 >>> do_open fs/namei.c:4837 [inline] >>> path_openat+0x19fa/0x2440 fs/namei.c:5000 >>> do_file_open+0x20e/0x430 fs/namei.c:5029 >>> do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 >>> do_sys_open fs/open.c:1423 [inline] >>> __do_compat_sys_openat fs/open.c:1485 [inline] >>> __se_compat_sys_openat fs/open.c:1483 [inline] >>> __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1483 >>> do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] >>> __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 >>> do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 >>> entry_SYSENTER_compat_after_hwframe+0x84/0x8e >>> RIP: 0023:0xf700efec >>> Code: Unable to access opcode bytes at 0xf700efc2. >>> RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 >>> RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000300 >>> RDX: 0000000000004002 RSI: 0000000000000000 RDI: 0000000000000000 >>> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 >>> R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 >>> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 >>> </TASK> >>> Modules linked in: >>> ---[ end trace 0000000000000000 ]--- >>> RIP: 0010:find_zone drivers/md/raid0.c:318 [inline] >>> RIP: 0010:find_zone.isra.0+0x129/0x150 drivers/md/raid0.c:305 >>> Code: f9 48 89 e8 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ef e8 a2 00 fe f9 e9 79 ff ff ff e8 c8 bf 8b f9 90 <0f> 0b 48 8b 3c 24 e8 8c 00 fe f9 e9 04 ff ff ff 48 89 df e8 7f 00 >>> RSP: 0018:ffffc9000557f090 EFLAGS: 00010293 >>> RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 >>> RDX: ffff888022b34b00 RSI: ffffffff887fa208 RDI: ffff888022b34b00 >>> RBP: ffff888042790b18 R08: 0000000000000004 R09: 0000000000000001 >>> R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 >>> R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 >>> FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f53fdb40 >>> CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 >>> CR2: 00000000f5315ff4 CR3: 0000000070ae4000 CR4: 0000000000352ef0 >>> >>> >>> --- >>> This report is generated by a bot. It may contain errors. >>> See https://goo.gl/tpsmEJ for more information about syzbot. >>> syzbot engineers can be reached at syzkaller@googlegroups.com. >>> >>> syzbot will keep track of this issue. See: >>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot. >>> >>> If the report is already addressed, let syzbot know by replying with: >>> #syz fix: exact-commit-title >>> >>> If you want to overwrite report's subsystems, reply with: >>> #syz set subsystems: new-subsystem >>> (See the list of subsystem names on the web dashboard) >>> >>> If the report is a duplicate of another one, reply with: >>> #syz dup: exact-subject-of-another-report >>> >>> If you want to undo deduplication, reply with: >>> #syz undup >>> > ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-17 1:24 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-09-16 12:57 [syzbot] [raid?] kernel BUG in find_zone syzbot 2026-09-17 1:18 ` Zizhi Wo 2026-09-17 1:18 ` syzbot 2026-09-17 1:24 ` Zizhi Wo
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®