Re: [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty

mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed

* Re: [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty_count
       [not found] <CAD8CXU=ceJ1wD00HKsdhRE5yzOxGiOQiUBso9UAX0K96G6E8ew@mail.gmail.com>
@ 2026-11-01  7:39 ` syzbot
  0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-11-01  7:39 UTC (permalink / raw)
  To: linux-kernel, syzkaller-bugs, varun.singh10011

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in gserial_free_port

INFO
INFO: task syz.2.1663:10888 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.1663      state:D stack:28704 pid:10888 tgid:10885 ppid:6198   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 gserial_free_port+0x1fd/0x2e0 drivers/usb/gadget/function/u_serial.c:1306
 gserial_free_line+0x107/0x1e0 drivers/usb/gadget/function/u_serial.c:1326
 acm_free_instance+0x3b/0x60 drivers/usb/gadget/function/f_acm.c:875
 usb_put_function_instance+0x97/0xc0 drivers/usb/gadget/functions.c:77
 config_item_cleanup+0x146/0x240 fs/configfs/item.c:128
 config_item_release fs/configfs/item.c:137 [inline]
 kref_put include/linux/kref.h:65 [inline]
 config_item_put fs/configfs/item.c:149 [inline]
 config_item_put+0x93/0xb0 fs/configfs/item.c:146
 configfs_rmdir+0x5e3/0x950 fs/configfs/dir.c:1580
 vfs_rmdir fs/namei.c:5533 [inline]
 vfs_rmdir+0x328/0x8e0 fs/namei.c:5506
 filename_rmdir+0x31a/0x610 fs/namei.c:5590
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd0b959e0d9
RSP: 002b:00007fd0ba4be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007fd0b9825fa0 RCX: 00007fd0b959e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007fd0b9635024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd0b9826038 R14: 00007fd0b9825fa0 R15: 00007fff1721ba98
 </TASK>
INFO: task syz.1.1664:10891 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1664      state:D stack:26744 pid:10891 tgid:10890 ppid:6193   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f89dd19e0d9
RSP: 002b:00007f89de0d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f89dd425fa0 RCX: 00007f89dd19e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f89dd235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f89dd426038 R14: 00007f89dd425fa0 R15: 00007ffc3f5b6758
 </TASK>
INFO: task syz.0.1666:10893 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1666      state:D stack:28728 pid:10893 tgid:10892 ppid:6190   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f13e1d9e0d9
RSP: 002b:00007f13e2c38028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f13e2025fa0 RCX: 00007f13e1d9e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007f13e1e35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f13e2026038 R14: 00007f13e2025fa0 R15: 00007ffd983da538
 </TASK>
INFO: task syz.0.1666:10896 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1666      state:D stack:28728 pid:10896 tgid:10892 ppid:6190   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f13e1d9e0d9
RSP: 002b:00007f13e2c17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f13e2026090 RCX: 00007f13e1d9e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f13e1e35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f13e2026128 R14: 00007f13e2026090 R15: 00007ffd983da538
 </TASK>
INFO: task syz.3.1667:10895 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1667      state:D stack:28728 pid:10895 tgid:10894 ppid:6199   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f53afd9e0d9
RSP: 002b:00007f53af3fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f53b0025fa0 RCX: 00007f53afd9e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007f53afe35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f53b0026038 R14: 00007f53b0025fa0 R15: 00007ffd6da8b958
 </TASK>
INFO: task syz.3.1667:10897 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1667      state:D stack:28728 pid:10897 tgid:10894 ppid:6199   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f53afd9e0d9
RSP: 002b:00007f53af3dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f53b0026090 RCX: 00007f53afd9e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f53afe35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f53b0026128 R14: 00007f53b0026090 R15: 00007ffd6da8b958
 </TASK>
INFO: task syz-executor240:10918 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10918 tgid:10917 ppid:10908  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fd91d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f7a340b4b28 RCX: 00007f7a340040b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f7a340b4b20 R08: 33203a6b63617473 R09: 33203a6b63617473
R10: 33203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor240:10925 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10925 tgid:10917 ppid:10908  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fb81d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f7a340b4b38 RCX: 00007f7a340040b9
RDX: 00007f7a340040b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f7a340b4b30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor240:10921 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10921 tgid:10920 ppid:10907  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fd91d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f7a340b4b28 RCX: 00007f7a340040b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f7a340b4b20 R08: 33203a6b63617473 R09: 33203a6b63617473
R10: 33203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor240:10928 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10928 tgid:10920 ppid:10907  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fb81d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f7a340b4b38 RCX: 00007f7a340040b9
RDX: 00007f7a340040b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f7a340b4b30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor240:10924 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10924 tgid:10923 ppid:10906  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fd91d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f7a340b4b28 RCX: 00007f7a340040b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f7a340b4b20 R08: 33203a6b63617473 R09: 33203a6b63617473
R10: 33203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor240:10929 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10929 tgid:10923 ppid:10906  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fb81d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f7a340b4b38 RCX: 00007f7a340040b9
RDX: 00007f7a340040b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f7a340b4b30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor240:10927 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10927 tgid:10926 ppid:10909  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fd91d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f7a340b4b28 RCX: 00007f7a340040b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f7a340b4b20 R08: 33203a6b63617473 R09: 33203a6b63617473
R10: 33203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor240:10930 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor240 state:D stack:28728 pid:10930 tgid:10926 ppid:10909  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a340040b9
RSP: 002b:00007f7a33fb81d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f7a340b4b38 RCX: 00007f7a340040b9
RDX: 00007f7a340040b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f7a340b4b30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f7a34081720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>

Showing all locks held in the system:
locks held by khungtaskd/44: 1, last CPU#2:
 #0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by getty/5527: 2, on CPU#2:
 #0: ffff88802b5c80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900000dd2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1540 drivers/tty/n_tty.c:2211
locks held by syz.2.1663/10888: 3, on CPU#0:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
 #2: ffff888052874d40 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1026 [inline]
 #2: ffff888052874d40 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_rmdir fs/namei.c:5518 [inline]
 #2: ffff888052874d40 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8e0 fs/namei.c:5506
locks held by syz.1.1664/10891: 2, on CPU#3:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.0.1666/10893: 2, on CPU#3:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.0.1666/10896: 2, on CPU#1:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.3.1667/10895: 2, on CPU#2:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.3.1667/10897: 2, on CPU#1:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor240/10918: 2, on CPU#2:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor240/10925: 2, on CPU#2:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor240/10921: 2, on CPU#0:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor240/10928: 2, on CPU#3:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor240/10924: 2, on CPU#3:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor240/10929: 2, on CPU#0:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor240/10927: 2, on CPU#2:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor240/10930: 2, on CPU#0:
 #0: ffff88802434c478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803f4c0600 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583

=============================================

NMI backtrace for cpu 2
CPU: 2 UID: 0 PID: 44 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline]
 watchdog+0xd0f/0x10c0 kernel/hung_task.c:598
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 2 to CPUs 0-1,3:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:clockevents_program_event+0x1e8/0x820 kernel/time/clockevents.c:350
Code: ff 31 ff 41 89 c5 89 c6 e8 e5 84 10 00 45 84 ed 74 5f e8 cb 8a 10 00 48 8b 44 24 70 b9 e0 06 00 00 48 89 c2 48 c1 ea 20 0f 30 <31> db e8 b1 8a 10 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00
RSP: 0018:ffffffff8ec07af8 EFLAGS: 00000002
RAX: 000001617e6ee9ae RBX: ffff88806a224040 RCX: 00000000000006e0
RDX: 0000000000000161 RSI: ffffffff81fcfb35 RDI: 0000000000000001
RBP: 0000008761b77d00 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffffffff1d80f69
R13: 0000000000000001 R14: 0000000000000001 R15: ffff88806a224080
FS:  0000000000000000(0000) GS:ffff8880d56fc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558079d28660 CR3: 000000000ed96000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 tick_program_event+0xa9/0x140 kernel/time/tick-oneshot.c:48
 hrtimer_rearm_event kernel/time/hrtimer.c:710 [inline]
 __hrtimer_reprogram kernel/time/hrtimer.c:738 [inline]
 __hrtimer_reprogram kernel/time/hrtimer.c:713 [inline]
 hrtimer_reprogram+0x460/0x6c0 kernel/time/hrtimer.c:903
 hrtimer_start_range_ns+0x2bf/0x460 kernel/time/hrtimer.c:1540
 hrtimer_start include/linux/hrtimer.h:222 [inline]
 tick_nohz_restart kernel/time/tick-sched.c:777 [inline]
 tick_nohz_restart_sched_tick+0x152/0x2a0 kernel/time/tick-sched.c:1035
 tick_nohz_idle_update_tick kernel/time/tick-sched.c:1364 [inline]
 tick_nohz_idle_exit+0x393/0x4d0 kernel/time/tick-sched.c:1399
 do_idle+0x357/0x5b0 kernel/sched/idle.c:369
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
 rest_init+0x2d3/0x2e0 init/main.c:789
 start_kernel+0x48e/0x490 init/main.c:1247
 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x158
 </TASK>
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 43 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:432
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d e9 96 f6 23 06 e8 e1 2d c6 fc eb a0 e8 6a 2e c6
RSP: 0018:ffffc900007bfa18 EFLAGS: 00000006
RAX: 0000000000000000 RBX: 00000000000003f9 RCX: 0000000000000000
RDX: 00000000000003f9 RSI: ffffffff85c04215 RDI: ffffffff9becc980
RBP: ffffffff9becc940 R08: 000000000000001f R09: 0000000000000000
R10: 0000000000000003 R11: 6174203a4f464e49 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000056 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d57fc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005580b301d168 CR3: 000000000ed96000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 serial_out drivers/tty/serial/8250/8250.h:139 [inline]
 __serial8250_clear_IER+0xa7/0xd0 drivers/tty/serial/8250/8250_port.c:739
 serial8250_console_write+0x106/0x14f0 drivers/tty/serial/8250/8250_port.c:3484
 nbcon_emit_next_record+0x8f7/0xa70 kernel/printk/nbcon.c:1070
 nbcon_emit_one+0x1a8/0x2b0 kernel/printk/nbcon.c:1157
 nbcon_kthread_func+0x5ef/0x7f0 kernel/printk/nbcon.c:1271
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
NMI backtrace for cpu 3
CPU: 3 UID: 0 PID: 5125 Comm: klogd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:number+0x689/0xc90 lib/vsprintf.c:531
Code: 83 c3 01 89 ee e8 87 b2 30 f6 83 fd ff 75 b6 8b 44 24 14 48 8b 4c 24 18 c7 44 24 14 ff ff ff ff 48 8d 44 01 01 48 89 44 24 18 <e8> f2 b7 30 f6 0f b6 5c 24 47 31 ff 89 de e8 f4 b1 30 f6 84 db 74
RSP: 0018:ffffc90027cf7748 EFLAGS: 00000282
RAX: 0000000000000000 RBX: 00000000fffffffd RCX: ffff888028570000
RDX: 00000000fffffffd RSI: ffffffff8bdccd89 RDI: 0000000000000005
RBP: 00000000fffffffd R08: 0000000000000000 R09: 00000000fffffffd
R10: ffffc90027cf7b70 R11: 0000000000000000 R12: 0000000000000003
R13: ffffc900a7cf7b6f R14: 0000000000000001 R15: 0000000000000000
FS:  00007f5c4e138c80(0000) GS:ffff8880d59fc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91bc31e708 CR3: 0000000035a07000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 vsnprintf+0x30e/0x1300 lib/vsprintf.c:2912
 sprintf+0xcc/0x100 lib/vsprintf.c:3115
 print_syslog kernel/printk/printk.c:1352 [inline]
 info_print_prefix+0x2e4/0x350 kernel/printk/printk.c:1382
 record_print_text+0x143/0x3c0 kernel/printk/printk.c:1434
 syslog_print+0x467/0x610 kernel/printk/printk.c:1645
 do_syslog+0x5bd/0x6d0 kernel/printk/printk.c:1763
 __do_sys_syslog kernel/printk/printk.c:1855 [inline]
 __se_sys_syslog kernel/printk/printk.c:1853 [inline]
 __x64_sys_syslog+0x74/0xb0 kernel/printk/printk.c:1853
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5c4e302a37
Code: 73 01 c3 48 8b 0d c1 f3 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 67 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 f3 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fff47c1b498 EFLAGS: 00000206 ORIG_RAX: 0000000000000067
RAX: ffffffffffffffda RBX: 00007f5c4e4a2490 RCX: 00007f5c4e302a37
RDX: 00000000000003ff RSI: 00007f5c4e4a2490 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000206 R12: 00007f5c4e4a2490
R13: 00007f5c4e47fdfe R14: 00007f5c4e4a2520 R15: 00007f5c4e4a2520
 </TASK>


Tested on:

commit:         cbbddb6b Merge tag 'power-utilities-2026.10.31' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14e0b5e1580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=245a52f53bb4b06b
dashboard link: https://syzkaller.appspot.com/bug?extid=39a2135de1558208d3b3
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15cb4959580000


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty_count
       [not found] <CAD8CXU=YL+6KG+ny7DfRKqAEqBp0Qeu2y8Ej97+bB+xM1JcksQ@mail.gmail.com>
@ 2026-11-01 17:23 ` syzbot
  0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-11-01 17:23 UTC (permalink / raw)
  To: linux-kernel, syzkaller-bugs, varun.singh10011

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+39a2135de1558208d3b3@syzkaller.appspotmail.com
Tested-by: syzbot+39a2135de1558208d3b3@syzkaller.appspotmail.com

Tested on:

commit:         cbbddb6b Merge tag 'power-utilities-2026.10.31' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=165ce62d580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=245a52f53bb4b06b
dashboard link: https://syzkaller.appspot.com/bug?extid=39a2135de1558208d3b3
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17f6dc8d580000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty_count
       [not found] <CAD8CXUkW04biA+gmiBbKRCn7FsXqyQUse1orNKytFn09QBG1bg@mail.gmail.com>
@ 2026-11-01 15:15 ` syzbot
  0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-11-01 15:15 UTC (permalink / raw)
  To: linux-kernel, syzkaller-bugs, varun.singh10011

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in gserial_free_port

INFO: task syz-executor106:10885 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:27992 pid:10885 tgid:10880 ppid:10849  task_flags:0x400040 flags:0x00080802
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 gserial_free_port+0x1fd/0x2e0 drivers/usb/gadget/function/u_serial.c:1292
 gserial_free_line+0x107/0x1e0 drivers/usb/gadget/function/u_serial.c:1312
 acm_free_instance+0x3b/0x60 drivers/usb/gadget/function/f_acm.c:875
 usb_put_function_instance+0x97/0xc0 drivers/usb/gadget/functions.c:77
 config_item_cleanup+0x146/0x240 fs/configfs/item.c:128
 config_item_release fs/configfs/item.c:137 [inline]
 kref_put include/linux/kref.h:65 [inline]
 config_item_put fs/configfs/item.c:149 [inline]
 config_item_put+0x93/0xb0 fs/configfs/item.c:146
 configfs_rmdir+0x5e3/0x950 fs/configfs/dir.c:1580
 vfs_rmdir fs/namei.c:5533 [inline]
 vfs_rmdir+0x328/0x8e0 fs/namei.c:5506
 filename_rmdir+0x31a/0x610 fs/namei.c:5590
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor106:10886 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28664 pid:10886 tgid:10883 ppid:10854  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz.1.1632:10888 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1632      state:D stack:28728 pid:10888 tgid:10887 ppid:6233   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f100bb9e0d9
RSP: 002b:00007f100c9c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f100be25fa0 RCX: 00007f100bb9e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007f100bc35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f100be26038 R14: 00007f100be25fa0 R15: 00007fff66dc0bb8
 </TASK>
INFO: task syz.1.1632:10899 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1632      state:D stack:28728 pid:10899 tgid:10887 ppid:6233   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f100bb9e0d9
RSP: 002b:00007f100c9a0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f100be26090 RCX: 00007f100bb9e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f100bc35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f100be26128 R14: 00007f100be26090 R15: 00007fff66dc0bb8
 </TASK>
INFO: task syz.2.1633:10891 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.1633      state:D stack:28664 pid:10891 tgid:10889 ppid:6240   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa118b9e0d9
RSP: 002b:00007fa119b30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fa118e25fa0 RCX: 00007fa118b9e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007fa118c35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa118e26038 R14: 00007fa118e25fa0 R15: 00007ffe9a94aa68
 </TASK>
INFO: task syz.2.1633:10900 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.1633      state:D stack:28728 pid:10900 tgid:10889 ppid:6240   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa118b9e0d9
RSP: 002b:00007fa119b0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007fa118e26090 RCX: 00007fa118b9e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007fa118c35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa118e26128 R14: 00007fa118e26090 R15: 00007ffe9a94aa68
 </TASK>
INFO: task syz.0.1635:10894 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1635      state:D stack:26744 pid:10894 tgid:10890 ppid:6231   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f009799e0d9
RSP: 002b:00007f00988e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f0097c25fa0 RCX: 00007f009799e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f0097a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0097c26038 R14: 00007f0097c25fa0 R15: 00007ffce222f5b8
 </TASK>
INFO: task syz.3.1634:10893 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1634      state:D stack:28728 pid:10893 tgid:10892 ppid:6243   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f647799e0d9
RSP: 002b:00007f647883f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f6477c25fa0 RCX: 00007f647799e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007f6477a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6477c26038 R14: 00007f6477c25fa0 R15: 00007fff36631a88
 </TASK>
INFO: task syz.3.1634:10901 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1634      state:D stack:28728 pid:10901 tgid:10892 ppid:6243   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f647799e0d9
RSP: 002b:00007f647881e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f6477c26090 RCX: 00007f647799e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f6477a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6477c26128 R14: 00007f6477c26090 R15: 00007fff36631a88
 </TASK>
INFO: task syz-executor106:10897 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10897 tgid:10895 ppid:10852  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197d0f1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f5197deab28 RCX: 00007f5197d3a0b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f5197deab20 R08: 36203a6b63617473 R09: 36203a6b63617473
R10: 36203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor106:10902 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10902 tgid:10895 ppid:10852  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 37203a6b63617473 R09: 37203a6b63617473
R10: 37203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor106:10898 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10898 tgid:10896 ppid:10853  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_create+0x1c0/0x400 fs/namei.c:5108
 filename_mkdirat+0xb9/0x630 fs/namei.c:5454
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197d0f1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f5197deab28 RCX: 00007f5197d3a0b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f5197deab20 R08: 36203a6b63617473 R09: 36203a6b63617473
R10: 36203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>
INFO: task syz-executor106:10903 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10903 tgid:10896 ppid:10853  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
 inode_lock_nested include/linux/fs.h:1071 [inline]
 __start_dirop fs/namei.c:2924 [inline]
 start_dirop fs/namei.c:2948 [inline]
 filename_rmdir+0x258/0x610 fs/namei.c:5583
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 37203a6b63617473 R09: 37203a6b63617473
R10: 37203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
 </TASK>

Showing all locks held in the system:
locks held by pr/ttyS0/44: 2, last CPU#2:
 #0: ffffffff8efd74d8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline]
 #0: ffffffff8efd74d8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline]
 #0: ffffffff8efd74d8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 kernel/printk/printk.c:291
 #1: ffffffff9becc958 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline]
 #1: ffffffff9becc958 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x64/0xc0 drivers/tty/serial/8250/8250_core.c:413
locks held by khungtaskd/45: 1, last CPU#1:
 #0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by syslogd/5114: 2, last CPU#3:
 #0: ffff888026059f78 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x298/0xd40 net/unix/af_unix.c:2591
 #1: ffff888026059a98 (rlock-AF_UNIX){+.+.}-{3:3}, at: psi_sched_switch kernel/sched/stats.h:218 [inline]
 #1: ffff888026059a98 (rlock-AF_UNIX){+.+.}-{3:3}, at: __schedule+0x2b79/0x6990 kernel/sched/core.c:7376
locks held by getty/5531: 2, on CPU#2:
 #0: ffff88802922d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000337b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1540 drivers/tty/n_tty.c:2211
locks held by syz-executor106/10885: 3, on CPU#0:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
 #2: ffff88802941f800 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1026 [inline]
 #2: ffff88802941f800 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_rmdir fs/namei.c:5518 [inline]
 #2: ffff88802941f800 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8e0 fs/namei.c:5506
locks held by syz-executor106/10886: 2, on CPU#1:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.1.1632/10888: 2, on CPU#0:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.1.1632/10899: 2, on CPU#3:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.2.1633/10891: 2, on CPU#0:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.2.1633/10900: 2, on CPU#0:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.0.1635/10894: 2, on CPU#1:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.3.1634/10893: 2, on CPU#3:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.3.1634/10901: 2, on CPU#3:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor106/10897: 2, on CPU#2:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor106/10902: 2, on CPU#0:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor106/10898: 2, on CPU#1:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor106/10903: 2, on CPU#3:
 #0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
 #1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 45 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline]
 watchdog+0xd0f/0x10c0 kernel/hung_task.c:598
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0,2-3:
NMI backtrace for cpu 2
CPU: 2 UID: 0 PID: 44 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:432
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d e9 96 f6 23 06 e8 e1 2d c6 fc eb a0 e8 6a 2e c6
RSP: 0018:ffffc900007cf9d8 EFLAGS: 00000002
RAX: 0000000000000039 RBX: 00000000000003f8 RCX: 0000000000000000
RDX: 00000000000003f8 RSI: ffffffff85c04215 RDI: ffffffff9becc980
RBP: ffffffff9becc940 R08: 000000000000001f R09: 0000000000000000
R10: 0000000000000003 R11: 6f4e202020202020 R12: 0000000000000000
R13: 0000000000000039 R14: 0000000000000009 R15: ffffc900007cfda8
FS:  0000000000000000(0000) GS:ffff8880d58fc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ba56071168 CR3: 000000000ed96000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 serial_port_out include/linux/serial_core.h:817 [inline]
 serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3311 [inline]
 __serial8250_console_fifo_write+0xd6/0x290 drivers/tty/serial/8250/8250_port.c:3383
 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3402 [inline]
 __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3456 [inline]
 serial8250_console_write+0x1108/0x14f0 drivers/tty/serial/8250/8250_port.c:3520
 nbcon_emit_next_record+0x8f7/0xa70 kernel/printk/nbcon.c:1070
 nbcon_emit_one+0x1a8/0x2b0 kernel/printk/nbcon.c:1157
 nbcon_kthread_func+0x5ef/0x7f0 kernel/printk/nbcon.c:1271
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 77 a5 02 e9 43 61 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d c3 cd 2a 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff8ec07cf0 EFLAGS: 00000202
RAX: 0000000000542de9 RBX: ffffffff8ec91540 RCX: ffffffff8be0f325
RDX: 0000000000000001 RSI: ffffffff8e599301 RDI: ffffffff8c832080
RBP: fffffbfff1d922a8 R08: 0000000000000001 R09: ffffed100d446825
R10: ffff88806a23412b R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffffffff1d80fa2 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880d56fc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ba40e20660 CR3: 000000000ed96000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 default_idle+0x9/0x10 arch/x86/kernel/process.c:768
 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
 rest_init+0x2d3/0x2e0 init/main.c:789
 start_kernel+0x48e/0x490 init/main.c:1247
 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x158
 </TASK>
NMI backtrace for cpu 3
CPU: 3 UID: 0 PID: 5121 Comm: klogd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__sanitizer_cov_trace_pc+0x6b/0x70 kernel/kcov.c:241
Code: 82 18 17 00 00 83 f8 02 75 20 48 8b 8a 20 17 00 00 8b 92 1c 17 00 00 48 8b 01 48 83 c0 01 48 39 d0 73 07 48 89 01 48 89 34 c1 <c3> cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
RSP: 0018:ffffc900035ffad0 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 1ffff920006bff5d RCX: 0000000000000000
RDX: ffff8880284b8000 RSI: ffffffff84ea2310 RDI: 0000000000000005
RBP: 0000000000000019 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000004
R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000004e
FS:  00007fb3ca47cc80(0000) GS:ffff8880d59fc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2b7092b708 CR3: 00000000378d6000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 avc_audit_required security/selinux/include/avc.h:94 [inline]
 avc_audit security/selinux/include/avc.h:129 [inline]
 avc_has_perm+0x100/0x1e0 security/selinux/avc.c:1205
 sock_has_perm+0x24d/0x320 security/selinux/hooks.c:5061
 selinux_socket_sendmsg+0x8f/0x2f0 security/selinux/hooks.c:5409
 security_socket_sendmsg+0xfb/0x230 security/security.c:4391
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x278/0x4e0 net/socket.c:2283
 __do_sys_sendto net/socket.c:2290 [inline]
 __se_sys_sendto net/socket.c:2286 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2286
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb3ca5cc407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcd43b78c0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fb3ca47cc80 RCX: 00007fb3ca5cc407
RDX: 00000000000000a0 RSI: 00007ffcd43b7a00 RDI: 0000000000000003
RBP: 00007ffcd43b7e30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffcd43b7e48
R13: 00007ffcd43b7a00 R14: 0000000000000085 R15: 00007ffcd43b7a00
 </TASK>


Tested on:

commit:         cbbddb6b Merge tag 'power-utilities-2026.10.31' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14d3b935580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=245a52f53bb4b06b
dashboard link: https://syzkaller.appspot.com/bug?extid=39a2135de1558208d3b3
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1256b5e1580000


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty_count
       [not found] <CAD8CXUk_NjipxtM_+BjrQc7fYebgxn+CCij+Q_t8AW8MyeJTLw@mail.gmail.com>
@ 2026-11-01  6:25 ` syzbot
  0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-11-01  6:25 UTC (permalink / raw)
  To: linux-kernel, syzkaller-bugs, varun.singh10011

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in check_tty_count

==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:82 [inline]
BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: slab-use-after-free in tty_port_kopened include/linux/tty_port.h:234 [inline]
BUG: KASAN: slab-use-after-free in check_tty_count+0x134/0x2b0 drivers/tty/tty_io.c:287
Read of size 8 at addr ffff88802fb2d230 by task syz.1.18/6460

CPU: 0 UID: 0 PID: 6460 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:186 [inline]
 kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
 instrument_atomic_read include/linux/instrumented.h:82 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 tty_port_kopened include/linux/tty_port.h:234 [inline]
 check_tty_count+0x134/0x2b0 drivers/tty/tty_io.c:287
 tty_release+0x95/0x1300 drivers/tty/tty_io.c:1703
 __fput+0x3fb/0xb50 fs/file_table.c:512
 fput_close_sync+0x118/0x250 fs/file_table.c:618
 filp_close_sync+0x75/0xa0 fs/open.c:1573
 __range_close+0x4a6/0x8b0 fs/file.c:919
 __do_sys_close_range fs/file.c:1003 [inline]
 __se_sys_close_range fs/file.c:954 [inline]
 __x64_sys_close_range+0x1f8/0x430 fs/file.c:954
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2c3f39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe8f94f768 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 00007f2c3f627da0 RCX: 00007f2c3f39e0d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f2c3f627da0 R08: 00007f2c3f626038 R09: 0000000000000000
R10: 000000000003fda0 R11: 0000000000000246 R12: 0000000000016d7e
R13: 00007f2c3f625fac R14: 0000000000016aa0 R15: 00007ffe8f94f870
 </TASK>

Allocated by task 6461:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5680
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 gs_port_alloc drivers/usb/gadget/function/u_serial.c:1218 [inline]
 gserial_alloc_line_no_console+0xac/0x710 drivers/usb/gadget/function/u_serial.c:1298
 gserial_alloc_line+0x16/0xa0 drivers/usb/gadget/function/u_serial.c:1332
 acm_alloc_instance+0xd9/0x160 drivers/usb/gadget/function/f_acm.c:891
 try_get_usb_function_instance+0x136/0x1f0 drivers/usb/gadget/functions.c:28
 usb_get_function_instance+0x16/0x70 drivers/usb/gadget/functions.c:44
 function_make+0x18c/0x3f0 drivers/usb/gadget/configfs.c:626
 configfs_mkdir+0x525/0xd40 fs/configfs/dir.c:1369
 vfs_mkdir+0x36d/0x8a0 fs/namei.c:5428
 filename_mkdirat+0x4c4/0x630 fs/namei.c:5461
 __do_sys_mkdirat fs/namei.c:5482 [inline]
 __se_sys_mkdirat fs/namei.c:5479 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6461:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2780 [inline]
 slab_free mm/slub.c:6630 [inline]
 kfree+0x22b/0x6d0 mm/slub.c:6923
 gserial_free_port+0x141/0x2f0 drivers/usb/gadget/function/u_serial.c:1262
 gserial_free_line+0xf8/0x1e0 drivers/usb/gadget/function/u_serial.c:1279
 acm_free_instance+0x3b/0x60 drivers/usb/gadget/function/f_acm.c:875
 usb_put_function_instance+0x97/0xc0 drivers/usb/gadget/functions.c:77
 config_item_cleanup+0x146/0x240 fs/configfs/item.c:128
 config_item_release fs/configfs/item.c:137 [inline]
 kref_put include/linux/kref.h:65 [inline]
 config_item_put fs/configfs/item.c:149 [inline]
 config_item_put+0x93/0xb0 fs/configfs/item.c:146
 configfs_rmdir+0x5e3/0x950 fs/configfs/dir.c:1580
 vfs_rmdir fs/namei.c:5533 [inline]
 vfs_rmdir+0x328/0x8e0 fs/namei.c:5506
 filename_rmdir+0x31a/0x610 fs/namei.c:5590
 __do_sys_rmdir fs/namei.c:5613 [inline]
 __se_sys_rmdir fs/namei.c:5610 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802fb2d000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 560 bytes inside of
 freed 2048-byte region [ffff88802fb2d000, ffff88802fb2d800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fb28
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801c442f00 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801c442f00 dead000000000100 dead000000000122
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5732, tgid 5732 (syz-executor), ts 48781510074
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1856
 prep_new_page mm/page_alloc.c:1864 [inline]
 get_page_from_freelist+0x1113/0x35e0 mm/page_alloc.c:3935
 __alloc_frozen_pages_noprof+0x2bd/0x3280 mm/page_alloc.c:5444
 alloc_slab_page mm/slub.c:3384 [inline]
 allocate_slab mm/slub.c:3499 [inline]
 new_slab+0xb1/0x6d0 mm/slub.c:3550
 refill_objects+0xe3/0x410 mm/slub.c:7539
 refill_sheaf mm/slub.c:2917 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4811
 alloc_from_pcs mm/slub.c:4887 [inline]
 slab_alloc_node mm/slub.c:5021 [inline]
 __do_kmalloc_node mm/slub.c:5530 [inline]
 __kmalloc_node_track_caller_noprof+0x6a3/0x870 mm/slub.c:5662
 kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:638
 __alloc_skb+0x185/0x710 net/core/skbuff.c:716
 alloc_skb include/linux/skbuff.h:1390 [inline]
 nlmsg_new include/net/netlink.h:1055 [inline]
 rtmsg_ifinfo_build_skb+0x81/0x260 net/core/rtnetlink.c:4617
 rtmsg_ifinfo_event net/core/rtnetlink.c:4659 [inline]
 rtmsg_ifinfo_event net/core/rtnetlink.c:4649 [inline]
 rtnetlink_event+0x137/0x1f0 net/core/rtnetlink.c:7229
 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:86
 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2313
 call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
 call_netdevice_notifiers net/core/dev.c:2365 [inline]
 netif_set_mac_address+0x370/0x4a0 net/core/dev.c:10235
 do_setlink.isra.0+0x75f/0x3f50 net/core/rtnetlink.c:3246
 rtnl_changelink net/core/rtnetlink.c:3942 [inline]
 __rtnl_newlink net/core/rtnetlink.c:4113 [inline]
 rtnl_newlink+0x13c1/0x2620 net/core/rtnetlink.c:4252
page last free pid 5726 tgid 5722 ts 45751756529 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1403 [inline]
 __free_frozen_pages+0x7b4/0x1110 mm/page_alloc.c:2954
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4720 [inline]
 slab_alloc_node mm/slub.c:5033 [inline]
 kmem_cache_alloc_lru_noprof+0x265/0x6a0 mm/slub.c:5066
 __d_alloc+0x34/0xad0 fs/dcache.c:1945
 __d_alloc_parallel+0x105/0x15e0 fs/dcache.c:2879
 lookup_open+0x6c4/0x19e0 fs/namei.c:4479
 open_last_lookups fs/namei.c:4774 [inline]
 path_openat+0xe75/0x23f0 fs/namei.c:5013
 do_file_open+0x20e/0x430 fs/namei.c:5045
 do_sys_openat2+0x163/0x1d0 fs/open.c:1442
 do_sys_open fs/open.c:1448 [inline]
 __do_sys_openat fs/open.c:1464 [inline]
 __se_sys_openat fs/open.c:1459 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1459
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802fb2d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802fb2d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802fb2d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff88802fb2d280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802fb2d300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         cbbddb6b Merge tag 'power-utilities-2026.10.31' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=176eed29580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=245a52f53bb4b06b
dashboard link: https://syzkaller.appspot.com/bug?extid=39a2135de1558208d3b3
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty_count
@ 2026-08-17 13:05 syzbot
  0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-17 13:05 UTC (permalink / raw)
  To: gregkh, jirislaby, linux-kernel, linux-serial, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    3d6d817622b0 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12961c79580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
dashboard link: https://syzkaller.appspot.com/bug?extid=39a2135de1558208d3b3
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=171ff479580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15f92c79580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-3d6d8176.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f486efba4dfc/vmlinux-3d6d8176.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9b9dcf9ee9f3/bzImage-3d6d8176.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+39a2135de1558208d3b3@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:82 [inline]
BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: slab-use-after-free in tty_port_kopened include/linux/tty_port.h:234 [inline]
BUG: KASAN: slab-use-after-free in check_tty_count+0x134/0x2b0 drivers/tty/tty_io.c:287
Read of size 8 at addr ffff88802e4c4230 by task syz.2.21/6005

CPU: 0 UID: 0 PID: 6005 Comm: syz.2.21 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:186 [inline]
 kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
 instrument_atomic_read include/linux/instrumented.h:82 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 tty_port_kopened include/linux/tty_port.h:234 [inline]
 check_tty_count+0x134/0x2b0 drivers/tty/tty_io.c:287
 tty_release+0x95/0x1300 drivers/tty/tty_io.c:1728
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce91f9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc8e0021f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fce92227da0 RCX: 00007fce91f9e0d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fce92227da0 R08: 00007fce92226038 R09: 0000000000000000
R10: 000000000003fd94 R11: 0000000000000246 R12: 000000000000e659
R13: 00007fce92225fac R14: 000000000000e352 R15: 00007ffc8e002300
 </TASK>

Allocated by task 6007:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 gs_port_alloc drivers/usb/gadget/function/u_serial.c:1218 [inline]
 gserial_alloc_line_no_console+0xac/0x710 drivers/usb/gadget/function/u_serial.c:1298
 gserial_alloc_line+0x16/0xa0 drivers/usb/gadget/function/u_serial.c:1332
 acm_alloc_instance+0xd9/0x160 drivers/usb/gadget/function/f_acm.c:891
 try_get_usb_function_instance+0x136/0x1f0 drivers/usb/gadget/functions.c:28
 usb_get_function_instance+0x16/0x70 drivers/usb/gadget/functions.c:44
 function_make+0x18c/0x3f0 drivers/usb/gadget/configfs.c:626
 configfs_mkdir+0x51e/0xb70 fs/configfs/dir.c:1360
 vfs_mkdir+0x361/0x850 fs/namei.c:5276
 filename_mkdirat+0x48b/0x5e0 fs/namei.c:5309
 __do_sys_mkdirat fs/namei.c:5330 [inline]
 __se_sys_mkdirat fs/namei.c:5327 [inline]
 __x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5327
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6007:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6692
 gserial_free_port+0x146/0x2f0 drivers/usb/gadget/function/u_serial.c:1262
 gserial_free_line+0xf8/0x1e0 drivers/usb/gadget/function/u_serial.c:1279
 acm_free_instance+0x3b/0x60 drivers/usb/gadget/function/f_acm.c:875
 usb_put_function_instance+0x89/0xc0 drivers/usb/gadget/functions.c:77
 config_item_cleanup+0x146/0x240 fs/configfs/item.c:128
 config_item_release fs/configfs/item.c:137 [inline]
 kref_put include/linux/kref.h:65 [inline]
 config_item_put fs/configfs/item.c:149 [inline]
 config_item_put+0x93/0xb0 fs/configfs/item.c:146
 configfs_rmdir+0x5e3/0x950 fs/configfs/dir.c:1571
 vfs_rmdir fs/namei.c:5381 [inline]
 vfs_rmdir+0x328/0x8a0 fs/namei.c:5354
 filename_rmdir+0x31a/0x5c0 fs/namei.c:5438
 __do_sys_rmdir fs/namei.c:5461 [inline]
 __se_sys_rmdir fs/namei.c:5458 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5458
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802e4c4000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 560 bytes inside of
 freed 2048-byte region [ffff88802e4c4000, ffff88802e4c4800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2e4c0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801bc42f00 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801bc42f00 dead000000000100 dead000000000122
head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5827, tgid 5827 (kworker/2:4), ts 58184228669, free_ts 57556351194
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x640 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_node_track_caller_noprof+0x679/0x830 mm/slub.c:5471
 kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:637
 __alloc_skb+0x185/0x710 net/core/skbuff.c:715
 alloc_skb include/linux/skbuff.h:1384 [inline]
 mld_newpack.isra.0+0x18e/0xa20 net/ipv6/mcast.c:1789
 add_grhead+0x299/0x340 net/ipv6/mcast.c:1900
 add_grec+0x1389/0x1930 net/ipv6/mcast.c:2039
 mld_send_cr net/ipv6/mcast.c:2164 [inline]
 mld_ifc_work+0x3c5/0xc10 net/ipv6/mcast.c:2710
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
page last free pid 5850 tgid 5850 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 slab_alloc_node mm/slub.c:4917 [inline]
 kmem_cache_alloc_noprof+0x26b/0x6a0 mm/slub.c:4931
 __kernfs_new_node+0xd2/0xa10 fs/kernfs/dir.c:665
 kernfs_new_node+0x117/0x150 fs/kernfs/dir.c:751
 __kernfs_create_file+0x53/0x350 fs/kernfs/file.c:1050
 sysfs_add_file_mode_ns+0x207/0x3c0 fs/sysfs/file.c:316
 create_files fs/sysfs/group.c:82 [inline]
 internal_create_group+0x593/0xfb0 fs/sysfs/group.c:189
 internal_create_groups+0x9d/0x150 fs/sysfs/group.c:229
 device_add_groups drivers/base/core.c:2907 [inline]
 device_add_attrs drivers/base/core.c:2971 [inline]
 device_add+0x71a/0x1970 drivers/base/core.c:3711
 netdev_register_kobject+0x1df/0x410 net/core/net-sysfs.c:2340
 register_netdevice+0x15b6/0x25a0 net/core/dev.c:11446
 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
 nsim_create+0xc93/0x1420 drivers/net/netdevsim/netdev.c:1152
 __nsim_dev_port_add+0x3ba/0x8f0 drivers/net/netdevsim/dev.c:1509

Memory state around the buggy address:
 ffff88802e4c4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802e4c4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802e4c4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff88802e4c4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802e4c4300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-11-01 17:23 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <CAD8CXU=ceJ1wD00HKsdhRE5yzOxGiOQiUBso9UAX0K96G6E8ew@mail.gmail.com>
2026-11-01  7:39 ` [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty_count syzbot
     [not found] <CAD8CXU=YL+6KG+ny7DfRKqAEqBp0Qeu2y8Ej97+bB+xM1JcksQ@mail.gmail.com>
2026-11-01 17:23 ` syzbot
     [not found] <CAD8CXUkW04biA+gmiBbKRCn7FsXqyQUse1orNKytFn09QBG1bg@mail.gmail.com>
2026-11-01 15:15 ` syzbot
     [not found] <CAD8CXUk_NjipxtM_+BjrQc7fYebgxn+CCij+Q_t8AW8MyeJTLw@mail.gmail.com>
2026-11-01  6:25 ` syzbot
2026-08-17 13:05 syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®