[syzbot] [lsm?] [io-uring?] kernel BUG in commit_creds (3)

[syzbot] [lsm?] [io-uring?] kernel BUG in commit_creds (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    5445d6419962 arm64: Don't read GMID_EL1 when MTE is disabled
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11f4d8c9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=fa63184795283ac3f842
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=124353f9580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10f73bf9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b70e3bd109/disk-5445d641.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5227e56ac93/vmlinux-5445d641.xz
kernel image: https://storage.googleapis.com/syzbot-assets/54905f78be59/Image-5445d641.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fa63184795283ac3f842@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at kernel/cred.c:376!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4923 Comm: iou-wrk-4922 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : commit_creds+0x888/0x8d4 kernel/cred.c:376
lr : commit_creds+0x888/0x8d4 kernel/cred.c:376
sp : ffff800098287850
x29: ffff800098287860 x28: ffff0000d05e08c8 x27: ffff0000d05e0000
x26: dfff800000000000 x25: dfff800000000000 x24: ffff700013050f18
x23: ffff0000c7e6bac8 x22: ffff0000d05e08d0 x21: ffff0000d2bb7000
x20: ffff0000d2bb7000 x19: ffff0000d2bb7300 x18: 1fffe00035b9ec28
x17: ffff8000818fd3bc x16: ffff8000816109b4 x15: ffff800080391038
x14: ffff8000815de4b4 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff600018fcd751 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000004 x3 : ffff800080391048
x2 : 0000000000000000 x1 : ffff0000d05e0000 x0 : 0000000000000000
Call trace:
 commit_creds+0x888/0x8d4 kernel/cred.c:376 (P)
 smk_write_relabel_self+0x398/0x418 security/smack/smackfs.c:2709
 loop_rw_iter+0x3c0/0x5c0 include/linux/uio.h:-1
 io_write+0xd50/0x1364 io_uring/rw.c:1170
 __io_issue_sqe+0x134/0x364 io_uring/io_uring.c:1386
 io_issue_sqe+0x94/0x8f0 io_uring/io_uring.c:1409
 io_wq_submit_work+0x4c4/0x690 io_uring/io_uring.c:1525
 io_worker_handle_work+0x640/0xeb8 io_uring/io-wq.c:659
 io_wq_worker+0x830/0xb44 io_uring/io-wq.c:752
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 91009280 9420ad5a 17fffe51 940b1fa2 (d4210000) 
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup