* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
[not found] <CAO7_G+zpXKbKY8ggsBsprzCw9M7NSvCyQ-f4KQSM8Etx6GEqKA@mail.gmail.com>
@ 2026-11-10 19:07 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-11-10 19:07 UTC (permalink / raw)
To: linux-kernel, nenkov2004, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
Warning: Permanently added '[localhost]:6819' (ED25519) to the list of known hosts.
2026/11/10 19:04:41 parsed 1 programs
2026/11/10 19:04:41 serving rpc on tcp://42245
[ 55.963375][ T5742] cgroup: Unknown subsys name 'net'
[ 56.074706][ T5742] cgroup: Unknown subsys name 'cpuset'
[ 56.080672][ T5742] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 57.409559][ T5742] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 59.695528][ T5753] br_netfilter no longer supported in user namespaces
[ 59.875947][ T5753] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 59.936142][ T5753] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 59.936380][ T5753] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 59.936642][ T5753] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 59.936863][ T5753] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 60.511799][ T5755] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.512258][ T5755] bridge0: port 1(bridge_slave_0) entered disabled state
[ 60.512367][ T5755] bridge_slave_0: entered allmulticast mode
[ 60.513749][ T5755] bridge_slave_0: entered promiscuous mode
[ 60.517106][ T5755] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.517184][ T5755] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.517279][ T5755] bridge_slave_1: entered allmulticast mode
[ 60.518687][ T5755] bridge_slave_1: entered promiscuous mode
[ 60.627709][ T5755] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 60.634100][ T5755] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 60.653715][ T5755] team0: Port device team_slave_0 added
[ 60.655721][ T5755] team0: Port device team_slave_1 added
[ 60.667483][ T5755] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 60.667493][ T5755] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 60.667507][ T5755] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 60.669146][ T5755] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 60.669154][ T5755] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 60.669168][ T5755] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 60.705286][ T5755] hsr_slave_0: entered promiscuous mode
[ 60.706202][ T5755] hsr_slave_1: entered promiscuous mode
[ 60.942218][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 60.942232][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 61.091172][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 61.091187][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 61.183299][ T5755] netdevsim netdevsim3 netdevsim0: renamed from eth0
[ 61.188345][ T5755] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 61.189037][ T5755] netdevsim netdevsim3 netdevsim1: renamed from eth1
[ 61.195751][ T5755] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 61.213344][ T5755] netdevsim netdevsim3 netdevsim2: renamed from eth2
[ 61.219620][ T5755] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 61.221457][ T5755] netdevsim netdevsim3 netdevsim3: renamed from eth3
[ 61.227586][ T5755] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 61.301564][ T65] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 61.303404][ T65] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 61.304783][ T65] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 61.309632][ T65] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 61.316544][ T65] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 61.412526][ T5755] 8021q: adding VLAN 0 to HW filter on device bond0
[ 61.422578][ T5755] 8021q: adding VLAN 0 to HW filter on device team0
[ 61.430476][ T57] bridge0: port 1(bridge_slave_0) entered blocking state
[ 61.430588][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 61.437671][ T57] bridge0: port 2(bridge_slave_1) entered blocking state
[ 61.437766][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 62.030796][ T5755] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 62.065809][ T5755] veth0_vlan: entered promiscuous mode
[ 62.104328][ T5755] veth1_vlan: entered promiscuous mode
[ 62.119783][ T5755] veth0_macvtap: entered promiscuous mode
[ 62.123188][ T5755] veth1_macvtap: entered promiscuous mode
[ 62.131833][ T5755] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 62.135888][ T5755] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 62.164634][ T5771] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.164916][ T5771] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.164938][ T5771] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.164958][ T5771] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.261207][ T14] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
[ 63.811497][ T14] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 65.287829][ T14] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 65.371984][ T14] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 65.503178][ T14] bridge_slave_1: left allmulticast mode
[ 65.503231][ T14] bridge_slave_1: left promiscuous mode
[ 65.503831][ T14] bridge0: port 2(bridge_slave_1) entered disabled state
[ 65.507795][ T14] bridge_slave_0: left allmulticast mode
[ 65.507817][ T14] bridge_slave_0: left promiscuous mode
[ 65.507980][ T14] bridge0: port 1(bridge_slave_0) entered disabled state
[ 65.634809][ T14] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 65.637628][ T14] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 65.639515][ T14] bond0 (unregistering): Released all slaves
[ 65.727181][ T14] hsr_slave_0: left promiscuous mode
[ 65.728327][ T14] hsr_slave_1: left promiscuous mode
[ 65.729104][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 65.729125][ T14] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 65.730246][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 65.730262][ T14] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 65.741743][ T14] veth1_macvtap: left promiscuous mode
[ 65.741806][ T14] veth0_macvtap: left promiscuous mode
[ 65.741943][ T14] veth1_vlan: left promiscuous mode
[ 65.742076][ T14] veth0_vlan: left promiscuous mode
[ 65.935455][ T14] team0 (unregistering): Port device team_slave_1 removed
[ 65.945027][ T14] team0 (unregistering): Port device team_slave_0 removed
[ 66.043375][ T5444] 8021q: adding VLAN 0 to HW filter on device eth2
[ 66.242059][ T5444] 8021q: adding VLAN 0 to HW filter on device eth3
[ 66.430099][ T5444] 8021q: adding VLAN 0 to HW filter on device eth4
[ 66.642015][ T5444] 8021q: adding VLAN 0 to HW filter on device eth5
[ 71.222149][ T1439] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.222242][ T1439] ieee802154 phy1 wpan1: encryption failed: -22
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build845281019=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d2e5fb956a
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_386
x86_64-linux-gnu-g++ -o ./bin/linux_386/syz-executor executor/executor.cc \
-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_386=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d2e5fb956ad222b37a913979e04dc012f4868836\"
/usr/bin/ld: /tmp/cc4F8CFT.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x145): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
[INFO] Unsupported architecture '386', skipping check.
Tested on:
commit: 067c5c24 Merge tag 'page_alloc-for-7.4-rc2' of git://g..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c40cb9cd7a4b919a
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=1777944d580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
[not found] <CAO7_G+yzCcvqn1+e0EtEk6=BxyK0yFEZPC7hVU7fma5zk-MnBA@mail.gmail.com>
@ 2026-11-10 19:45 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-11-10 19:45 UTC (permalink / raw)
To: linux-kernel, nenkov2004, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
Warning: Permanently added '[localhost]:55209' (ED25519) to the list of known hosts.
2026/11/10 19:43:45 parsed 1 programs
2026/11/10 19:43:45 serving rpc on tcp://44245
[ 46.806227][ T5734] cgroup: Unknown subsys name 'net'
[ 46.893911][ T5734] cgroup: Unknown subsys name 'cpuset'
[ 46.897550][ T5734] cgroup: Unknown subsys name 'rlimit'
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[ 47.058702][ T1130] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 47.058717][ T1130] ata1: failed to read log page 10h (errno=-5)
[ 47.058729][ T1130] ata1.00: exception Emask 0x1 SAct 0x380 SErr 0x0 action 0x0
[ 47.058739][ T1130] ata1.00: irq_stat 0x41000000
[ 47.058751][ T1130] ata1.00: failed command: WRITE FPDMA QUEUED
[ 47.058757][ T1130] ata1.00: cmd 61/00:38:36:81:05/20:00:00:00:00/40 tag 7 ncq dma 4194304 ou
[ 47.058757][ T1130] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 47.058788][ T1130] ata1.00: status: { DRDY }
[ 47.058797][ T1130] ata1.00: failed command: WRITE FPDMA QUEUED
[ 47.058803][ T1130] ata1.00: cmd 61/00:40:36:a1:05/20:00:00:00:00/40 tag 8 ncq dma 4194304 ou
[ 47.058803][ T1130] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 47.058833][ T1130] ata1.00: status: { DRDY }
[ 47.058842][ T1130] ata1.00: failed command: WRITE FPDMA QUEUED
[ 47.058848][ T1130] ata1.00: cmd 61/c8:48:36:c1:05/0f:00:00:00:00/40 tag 9 ncq dma 2068480 ou
[ 47.058848][ T1130] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 47.058878][ T1130] ata1.00: status: { DRDY }
[ 47.059522][ T1130] ata1.00: configured for UDMA/100
[ 47.060364][ T1130] ata1: EH complete
[ 71.140054][ T1442] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.140114][ T1442] ieee802154 phy1 wpan1: encryption failed: -22
[ 76.260682][ T2395] cfg80211: failed to load regulatory.db
[ 77.598236][ T1130] ata1.00: NCQ disabled due to excessive errors
[ 77.598250][ T1130] ata1.00: exception Emask 0x0 SAct 0x40000 SErr 0x0 action 0x6 frozen
[ 77.598265][ T1130] ata1.00: failed command: WRITE FPDMA QUEUED
[ 77.598272][ T1130] ata1.00: cmd 61/00:90:36:a1:05/20:00:00:00:00/40 tag 18 ncq dma 4194304 ou
[ 77.598272][ T1130] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 77.598303][ T1130] ata1.00: status: { DRDY }
[ 77.598338][ T1130] ata1: hard resetting link
[ 77.923282][ T1130] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 77.924116][ T1130] ata1.00: configured for UDMA/100
[ 77.924338][ T1130] ata1: EH complete
Setting up swapspace version 1, size = 127995904 bytes
[ 78.684000][ T5734] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 80.705164][ T5753] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 80.743728][ T5753] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 80.745528][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 80.745540][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 80.761605][ T5753] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 80.826474][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 80.826488][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 81.255232][ T5783] br_netfilter no longer supported in user namespaces
[ 81.421318][ T5783] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 81.421570][ T5783] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 81.619224][ T5815] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 81.620095][ T5815] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 81.620778][ T5815] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 81.621504][ T5815] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 81.621954][ T5815] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 82.036534][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.037138][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state
[ 82.037206][ T5784] bridge_slave_0: entered allmulticast mode
[ 82.038224][ T5784] bridge_slave_0: entered promiscuous mode
[ 82.041159][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.041225][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state
[ 82.041283][ T5784] bridge_slave_1: entered allmulticast mode
[ 82.042083][ T5784] bridge_slave_1: entered promiscuous mode
[ 82.056544][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 82.057858][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 82.071287][ T5784] team0: Port device team_slave_0 added
[ 82.072573][ T5784] team0: Port device team_slave_1 added
[ 82.083563][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 82.083574][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 82.083588][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 82.085206][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 82.085215][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 82.085229][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 82.116630][ T5784] hsr_slave_0: entered promiscuous mode
[ 82.117141][ T5784] hsr_slave_1: entered promiscuous mode
[ 82.369913][ T5784] netdevsim netdevsim9 netdevsim0: renamed from eth0
[ 82.376209][ T5784] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 82.377262][ T5784] netdevsim netdevsim9 netdevsim1: renamed from eth1
[ 82.380116][ T5784] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 82.380866][ T5784] netdevsim netdevsim9 netdevsim2: renamed from eth2
[ 82.386962][ T5784] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 82.388402][ T5784] netdevsim netdevsim9 netdevsim3: renamed from eth3
[ 82.391729][ T5784] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 82.416527][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.416645][ T5784] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 82.417096][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.417193][ T5784] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 82.469095][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0
[ 82.484256][ T63] bridge0: port 1(bridge_slave_0) entered disabled state
[ 82.485301][ T63] bridge0: port 2(bridge_slave_1) entered disabled state
[ 82.502895][ T5784] 8021q: adding VLAN 0 to HW filter on device team0
[ 82.507456][ T63] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.507546][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 82.515219][ T63] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.515287][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 82.794103][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 82.944564][ T5784] veth0_vlan: entered promiscuous mode
[ 82.948109][ T5784] veth1_vlan: entered promiscuous mode
[ 82.962868][ T5784] veth0_macvtap: entered promiscuous mode
[ 82.965747][ T5784] veth1_macvtap: entered promiscuous mode
[ 82.973689][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 82.978359][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.028783][ T14] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.029066][ T14] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.029087][ T14] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.029105][ T14] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.066068][ T13] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
[ 83.164702][ T13] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.258043][ T13] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 83.319660][ T13] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.441016][ T13] bridge_slave_1: left allmulticast mode
[ 84.441041][ T13] bridge_slave_1: left promiscuous mode
[ 84.441512][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.444540][ T13] bridge_slave_0: left allmulticast mode
[ 84.444553][ T13] bridge_slave_0: left promiscuous mode
[ 84.444976][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.541766][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 84.546845][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 84.548305][ T13] bond0 (unregistering): Released all slaves
[ 84.613074][ T13] hsr_slave_0: left promiscuous mode
[ 84.613487][ T13] hsr_slave_1: left promiscuous mode
[ 84.613915][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 84.613931][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 84.614532][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 84.614542][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 84.618239][ T13] veth1_macvtap: left promiscuous mode
[ 84.618278][ T13] veth0_macvtap: left promiscuous mode
[ 84.618325][ T13] veth1_vlan: left promiscuous mode
[ 84.618363][ T13] veth0_vlan: left promiscuous mode
[ 84.755242][ T13] team0 (unregistering): Port device team_slave_1 removed
[ 84.765279][ T13] team0 (unregistering): Port device team_slave_0 removed
[ 84.829397][ T5441] 8021q: adding VLAN 0 to HW filter on device eth2
[ 84.996382][ T5441] 8021q: adding VLAN 0 to HW filter on device eth3
[ 85.136235][ T5441] 8021q: adding VLAN 0 to HW filter on device eth4
[ 85.264192][ T5441] 8021q: adding VLAN 0 to HW filter on device eth5
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1399445064=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d2e5fb956a
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_386
x86_64-linux-gnu-g++ -o ./bin/linux_386/syz-executor executor/executor.cc \
-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_386=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d2e5fb956ad222b37a913979e04dc012f4868836\"
/usr/bin/ld: /tmp/cclh0b8o.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x145): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
[INFO] Unsupported architecture '386', skipping check.
Tested on:
commit: 067c5c24 Merge tag 'page_alloc-for-7.4-rc2' of git://g..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c40cb9cd7a4b919a
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=166c044d580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
[not found] <CAO7_G+yrCB_-fcq2Fh+pKgYmkd8a7RpCNh1jJgnJ30wHrUSQuQ@mail.gmail.com>
@ 2026-11-10 19:32 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-11-10 19:32 UTC (permalink / raw)
To: linux-kernel, nenkov2004, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x301000)
[ 41.844215][ T1129] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 41.844240][ T1129] qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
ata1: failed to read log page 10h (errno=-5)
[ 41.844257][ T1129] ata1.00: exception Emask 0x1 SAct 0x40000001 SErr 0x0 action 0x0
[ 41.844276][ T1129] ata1.00: irq_stat 0x40000000
[ 41.844292][ T1129] ata1.00: failed command: WRITE FPDMA QUEUED
[ 41.844304][ T1129] ata1.00: cmd 61/10:00:3e:99:04/0f:00:00:00:00/40 tag 0 ncq dma 1974272 ou
[ 41.844304][ T1129] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 41.844356][ T1129] ata1.00: status: { DRDY }
[ 41.844375][ T1129] ata1.00: failed command: WRITE FPDMA QUEUED
[ 41.844385][ T1129] ata1.00: cmd 61/08:f0:36:81:04/18:00:00:00:00/40 tag 30 ncq dma 3149824 ou
[ 41.844385][ T1129] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 41.844439][ T1129] ata1.00: status: { DRDY }
[ 41.845428][ T1129] ata1.00: configured for UDMA/100
[ 41.846224][ T1129] ata1: EH complete
[ 71.003538][ T856] cfg80211: failed to load regulatory.db
[ 72.321505][ T1129] ata1.00: exception Emask 0x0 SAct 0x40000000 SErr 0x0 action 0x6 frozen
[ 72.321540][ T1129] ata1.00: failed command: WRITE FPDMA QUEUED
[ 72.321551][ T1129] ata1.00: cmd 61/00:f0:36:21:05/20:00:00:00:00/40 tag 30 ncq dma 4194304 ou
[ 72.321551][ T1129] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 72.321601][ T1129] ata1.00: status: { DRDY }
[ 72.321649][ T1129] ata1: hard resetting link
[ 72.646494][ T1129] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 72.647439][ T1129] ata1.00: configured for UDMA/100
[ 72.647691][ T1129] ata1: EH complete
Warning: Permanently added '[localhost]:31181' (ED25519) to the list of known hosts.
2026/11/10 19:31:24 parsed 1 programs
2026/11/10 19:31:24 serving rpc on tcp://46365
[ 79.004885][ T5750] cgroup: Unknown subsys name 'net'
[ 79.134080][ T5750] cgroup: Unknown subsys name 'cpuset'
[ 79.139134][ T5750] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 80.470828][ T5750] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 82.853082][ T5760] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 82.870654][ T5760] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 82.879298][ T5760] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 83.020826][ T5773] br_netfilter no longer supported in user namespaces
[ 83.154564][ T5773] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 83.154852][ T5773] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 83.780501][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 83.780523][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 83.875702][ T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 83.875718][ T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.091124][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 84.092413][ T5832] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 84.092833][ T5832] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 84.093874][ T5832] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 84.094321][ T5832] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 84.121156][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.122077][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.122180][ T5780] bridge_slave_0: entered allmulticast mode
[ 84.123151][ T5780] bridge_slave_0: entered promiscuous mode
[ 84.141075][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.141171][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.141612][ T5780] bridge_slave_1: entered allmulticast mode
[ 84.142798][ T5780] bridge_slave_1: entered promiscuous mode
[ 84.215418][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 84.221957][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 84.248965][ T5780] team0: Port device team_slave_0 added
[ 84.254455][ T5780] team0: Port device team_slave_1 added
[ 84.280176][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 84.280193][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 84.280214][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 84.284994][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 84.285014][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 84.285035][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 84.423649][ T5780] hsr_slave_0: entered promiscuous mode
[ 84.426706][ T5780] hsr_slave_1: entered promiscuous mode
[ 84.684141][ T5780] netdevsim netdevsim6 netdevsim0: renamed from eth0
[ 84.689820][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 84.690609][ T5780] netdevsim netdevsim6 netdevsim1: renamed from eth1
[ 84.694534][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 84.695342][ T5780] netdevsim netdevsim6 netdevsim2: renamed from eth2
[ 84.699510][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 84.700415][ T5780] netdevsim netdevsim6 netdevsim3: renamed from eth3
[ 84.702833][ T5780] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 84.826990][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0
[ 84.846339][ T5780] 8021q: adding VLAN 0 to HW filter on device team0
[ 84.852806][ T38] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.853180][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 84.862643][ T38] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.862698][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 85.186557][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 85.383527][ T5780] veth0_vlan: entered promiscuous mode
[ 85.390385][ T5780] veth1_vlan: entered promiscuous mode
[ 85.415572][ T5780] veth0_macvtap: entered promiscuous mode
[ 85.419971][ T5780] veth1_macvtap: entered promiscuous mode
[ 85.430797][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 85.437743][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 85.491628][ T14] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 85.521992][ T14] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 85.522034][ T14] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 85.522064][ T14] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 85.558282][ T5812] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
[ 85.635294][ T5812] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 85.696264][ T5812] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 85.841148][ T5812] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 87.595495][ T5812] bridge_slave_1: left allmulticast mode
[ 87.595530][ T5812] bridge_slave_1: left promiscuous mode
[ 87.596427][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state
[ 87.599943][ T5812] bridge_slave_0: left allmulticast mode
[ 87.599965][ T5812] bridge_slave_0: left promiscuous mode
[ 87.600143][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state
[ 87.708233][ T5812] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 87.710902][ T5812] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 87.714475][ T5812] bond0 (unregistering): Released all slaves
[ 87.787731][ T5812] hsr_slave_0: left promiscuous mode
[ 87.788517][ T5812] hsr_slave_1: left promiscuous mode
[ 87.789254][ T5812] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 87.789275][ T5812] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 87.790212][ T5812] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 87.790222][ T5812] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 87.798747][ T5812] veth1_macvtap: left promiscuous mode
[ 87.798783][ T5812] veth0_macvtap: left promiscuous mode
[ 87.798830][ T5812] veth1_vlan: left promiscuous mode
[ 87.798867][ T5812] veth0_vlan: left promiscuous mode
[ 87.974363][ T5812] team0 (unregistering): Port device team_slave_1 removed
[ 87.979464][ T5812] team0 (unregistering): Port device team_slave_0 removed
[ 88.038058][ T5445] 8021q: adding VLAN 0 to HW filter on device eth2
[ 88.225642][ T5445] 8021q: adding VLAN 0 to HW filter on device eth3
[ 88.407846][ T5445] 8021q: adding VLAN 0 to HW filter on device eth5
[ 88.609210][ T5445] 8021q: adding VLAN 0 to HW filter on device eth4
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1302820052=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d2e5fb956a
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_386
x86_64-linux-gnu-g++ -o ./bin/linux_386/syz-executor executor/executor.cc \
-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_386=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d2e5fb956ad222b37a913979e04dc012f4868836\"
/usr/bin/ld: /tmp/ccGyTJVs.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x145): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
[INFO] Unsupported architecture '386', skipping check.
Tested on:
commit: 067c5c24 Merge tag 'page_alloc-for-7.4-rc2' of git://g..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c40cb9cd7a4b919a
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=15e43369580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
[not found] <CAO7_G+zVhxDF7obCuC6gyTByFqw7G4fLrSKRRYxpdgt8B-iRig@mail.gmail.com>
@ 2026-11-10 19:19 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-11-10 19:19 UTC (permalink / raw)
To: linux-kernel, nenkov2004, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xa4000)
[ 40.695586][ T1132] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 40.695609][ T1132] ata1: failed to read log page 10h (errno=-5)
[ 40.695625][ T1132] ata1.00: exception Emask 0x1 SAct 0x40000001 SErr 0x0 action 0x0
[ 40.695642][ T1132] ata1.00: irq_stat 0x41000000
[ 40.695657][ T1132] ata1.00: failed command: WRITE FPDMA QUEUED
[ 40.695668][ T1132] ata1.00: cmd 61/c0:00:d6:d4:04/02:00:00:00:00/40 tag 0 ncq dma 360448 out
[ 40.695668][ T1132] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 40.695725][ T1132] ata1.00: status: { DRDY }
[ 40.695744][ T1132] ata1.00: failed command: WRITE FPDMA QUEUED
[ 40.695754][ T1132] ata1.00: cmd 61/20:f0:b6:cf:04/05:00:00:00:00/40 tag 30 ncq dma 671744 out
[ 40.695754][ T1132] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 40.695804][ T1132] ata1.00: status: { DRDY }
[ 40.698151][ T1132] ata1.00: configured for UDMA/100
[ 40.699728][ T1132] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x74000)
[ 41.145768][ T1132] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 41.145794][ T1132] ata1: failed to read log page 10h (errno=-5)
[ 41.145811][ T1132] ata1.00: NCQ disabled due to excessive errors
[ 41.145827][ T1132] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0
[ 41.145847][ T1132] ata1.00: irq_stat 0x41000000
[ 41.145865][ T1132] ata1.00: failed command: WRITE FPDMA QUEUED
[ 41.145877][ T1132] ata1.00: cmd 61/a0:70:76:23:05/03:00:00:00:00/40 tag 14 ncq dma 475136 out
[ 41.145877][ T1132] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 41.145936][ T1132] ata1.00: status: { DRDY }
[ 41.145953][ T1132] ata1.00: failed command: WRITE FPDMA QUEUED
[ 41.145965][ T1132] ata1.00: cmd 61/a0:78:16:27:05/01:00:00:00:00/40 tag 15 ncq dma 212992 out
[ 41.145965][ T1132] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 41.146021][ T1132] ata1.00: status: { DRDY }
[ 41.147166][ T1132] ata1.00: configured for UDMA/100
[ 41.147598][ T1132] ata1: EH complete
Warning: Permanently added '[localhost]:10258' (ED25519) to the list of known hosts.
2026/11/10 19:18:00 parsed 1 programs
2026/11/10 19:18:00 serving rpc on tcp://40647
[ 49.837740][ T5740] cgroup: Unknown subsys name 'net'
[ 49.959097][ T5740] cgroup: Unknown subsys name 'cpuset'
[ 49.965851][ T5740] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 51.285808][ T5740] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 54.028891][ T5749] br_netfilter no longer supported in user namespaces
[ 54.237822][ T5750] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 54.247672][ T5750] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 54.256697][ T5749] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 54.257053][ T5749] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 54.257585][ T5749] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 54.822081][ T5780] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 54.824858][ T5780] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 54.825442][ T5780] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 54.826993][ T5780] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 54.828355][ T5780] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 55.710030][ T58] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.710052][ T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 55.796138][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.796159][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.105302][ T5792] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.105995][ T5792] bridge0: port 1(bridge_slave_0) entered disabled state
[ 56.106127][ T5792] bridge_slave_0: entered allmulticast mode
[ 56.107440][ T5792] bridge_slave_0: entered promiscuous mode
[ 56.112162][ T5792] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.112277][ T5792] bridge0: port 2(bridge_slave_1) entered disabled state
[ 56.112364][ T5792] bridge_slave_1: entered allmulticast mode
[ 56.113667][ T5792] bridge_slave_1: entered promiscuous mode
[ 56.243179][ T5792] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 56.249968][ T5792] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 56.279929][ T5792] team0: Port device team_slave_0 added
[ 56.284745][ T5792] team0: Port device team_slave_1 added
[ 56.336955][ T5792] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 56.336971][ T5792] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 56.336993][ T5792] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 56.339364][ T5792] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 56.339379][ T5792] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 56.339399][ T5792] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 56.444453][ T5792] hsr_slave_0: entered promiscuous mode
[ 56.445602][ T5792] hsr_slave_1: entered promiscuous mode
[ 56.680553][ T5792] netdevsim netdevsim6 netdevsim0: renamed from eth0
[ 56.688922][ T5792] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 56.690068][ T5792] netdevsim netdevsim6 netdevsim1: renamed from eth1
[ 56.699110][ T5792] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 56.699933][ T5792] netdevsim netdevsim6 netdevsim2: renamed from eth2
[ 56.704044][ T5792] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 56.706330][ T5792] netdevsim netdevsim6 netdevsim3: renamed from eth3
[ 56.720592][ T5792] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 56.792642][ T5792] 8021q: adding VLAN 0 to HW filter on device bond0
[ 56.806874][ T5792] 8021q: adding VLAN 0 to HW filter on device team0
[ 56.812901][ T38] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.813038][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 56.821070][ T38] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.821208][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 57.141849][ T5792] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 57.318971][ T5792] veth0_vlan: entered promiscuous mode
[ 57.326614][ T5792] veth1_vlan: entered promiscuous mode
[ 57.347385][ T5792] veth0_macvtap: entered promiscuous mode
[ 57.353637][ T5792] veth1_macvtap: entered promiscuous mode
[ 57.371911][ T5792] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 57.379296][ T5792] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 57.395826][ T5763] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.415584][ T5763] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.466761][ T5763] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.466810][ T5763] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.486746][ T5763] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
[ 57.578846][ T5763] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 57.644338][ T5763] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 57.731907][ T5763] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 58.942574][ T5763] bridge_slave_1: left allmulticast mode
[ 58.942609][ T5763] bridge_slave_1: left promiscuous mode
[ 58.943154][ T5763] bridge0: port 2(bridge_slave_1) entered disabled state
[ 58.953895][ T5763] bridge_slave_0: left allmulticast mode
[ 58.953921][ T5763] bridge_slave_0: left promiscuous mode
[ 58.954168][ T5763] bridge0: port 1(bridge_slave_0) entered disabled state
[ 59.093813][ T5763] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 59.100475][ T5763] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 59.101961][ T5763] bond0 (unregistering): Released all slaves
[ 59.186544][ T5763] hsr_slave_0: left promiscuous mode
[ 59.187330][ T5763] hsr_slave_1: left promiscuous mode
[ 59.188152][ T5763] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 59.188175][ T5763] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 59.189445][ T5763] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 59.189461][ T5763] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 59.197738][ T5763] veth1_macvtap: left promiscuous mode
[ 59.197837][ T5763] veth0_macvtap: left promiscuous mode
[ 59.197946][ T5763] veth1_vlan: left promiscuous mode
[ 59.198079][ T5763] veth0_vlan: left promiscuous mode
[ 59.400764][ T5763] team0 (unregistering): Port device team_slave_1 removed
[ 59.411607][ T5763] team0 (unregistering): Port device team_slave_0 removed
[ 59.482765][ T5444] 8021q: adding VLAN 0 to HW filter on device eth2
[ 59.705030][ T5444] 8021q: adding VLAN 0 to HW filter on device eth3
[ 59.930489][ T5444] 8021q: adding VLAN 0 to HW filter on device eth4
[ 60.141057][ T5444] 8021q: adding VLAN 0 to HW filter on device eth5
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4239141871=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d2e5fb956a
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d2e5fb956ad222b37a913979e04dc012f4868836 -X github.com/google/syzkaller/prog.gitRevisionDate=20260903-102143" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_386
x86_64-linux-gnu-g++ -o ./bin/linux_386/syz-executor executor/executor.cc \
-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_386=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d2e5fb956ad222b37a913979e04dc012f4868836\"
/usr/bin/ld: /tmp/ccLPlc5j.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x145): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
[INFO] Unsupported architecture '386', skipping check.
Tested on:
commit: 067c5c24 Merge tag 'page_alloc-for-7.4-rc2' of git://g..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c40cb9cd7a4b919a
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=1632d84d580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-04 9:10 ` Edward Adam Davis
@ 2026-09-04 9:33 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-09-04 9:33 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in nvme_loop_reset_ctrl_work
------------[ cut here ]------------
1
WARNING: drivers/nvme/target/loop.c:457 at nvme_loop_reset_ctrl_work+0x1d4/0x620 drivers/nvme/target/loop.c:457, CPU#3: kworker/u33:3/62
Modules linked in:
CPU: 3 UID: 0 PID: 62 Comm: kworker/u33:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme-reset-wq nvme_loop_reset_ctrl_work
RIP: 0010:nvme_loop_reset_ctrl_work+0x1d4/0x620 drivers/nvme/target/loop.c:457
Code: 7c 08 84 d2 0f 85 b2 03 00 00 8b 9b dc f8 ff ff bf 01 00 00 00 83 eb 04 89 de e8 c7 fb 59 fb 83 fb 01 76 09 e8 4d 01 5a fb 90 <0f> 0b 90 e8 44 01 5a fb 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffffc900007dfbd8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: ffff888020f72580 RSI: ffffffff86b13ae3 RDI: ffff888020f72580
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000001
R10: 00000000ffffffff R11: 00000000000075fb R12: ffff8880299f83e8
R13: ffff8880299f83ec R14: 0000000000000000 R15: ffff88802886b800
FS: 0000000000000000(0000) GS:ffff888096c67000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f7f6e210 CR3: 000000004d58f000 CR4: 0000000000352ef0
Call Trace:
<TASK>
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
process_scheduled_works kernel/workqueue.c:3479 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=116438f9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=100438f9580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-03 20:59 syzbot
` (2 preceding siblings ...)
2026-09-04 4:41 ` Edward Adam Davis
@ 2026-09-04 9:10 ` Edward Adam Davis
2026-09-04 9:33 ` syzbot
3 siblings, 1 reply; 13+ messages in thread
From: Edward Adam Davis @ 2026-09-04 9:10 UTC (permalink / raw)
To: syzbot+fefa0af09f7891b1800e; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 940de590b839
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index fcb1f8186fdd..39447a72f91c 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -443,6 +443,8 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
container_of(work, struct nvme_loop_ctrl, ctrl.reset_work);
int ret;
+ if (!ctrl->ctrl.admin_q)
+ return;
nvme_stop_ctrl(&ctrl->ctrl);
nvme_loop_shutdown_ctrl(ctrl);
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-04 4:41 ` Edward Adam Davis
@ 2026-09-04 5:05 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-09-04 5:05 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+fefa0af09f7891b1800e@syzkaller.appspotmail.com
Tested-by: syzbot+fefa0af09f7891b1800e@syzkaller.appspotmail.com
Tested on:
commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=128808f9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=13e7d0f9580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-03 20:59 syzbot
2026-09-04 1:31 ` Edward Adam Davis
2026-09-04 2:38 ` Edward Adam Davis
@ 2026-09-04 4:41 ` Edward Adam Davis
2026-09-04 5:05 ` syzbot
2026-09-04 9:10 ` Edward Adam Davis
3 siblings, 1 reply; 13+ messages in thread
From: Edward Adam Davis @ 2026-09-04 4:41 UTC (permalink / raw)
To: syzbot+fefa0af09f7891b1800e; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 940de590b839
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 1322c678f4eb..0ad905d62e72 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -600,7 +600,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
break;
case NVME_CTRL_RESETTING:
switch (old_state) {
- case NVME_CTRL_NEW:
case NVME_CTRL_LIVE:
changed = true;
atomic_long_inc(&ctrl->nr_reset);
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index fcb1f8186fdd..685f5e8f5302 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -561,8 +561,6 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
ctrl->ctrl.opts = opts;
INIT_LIST_HEAD(&ctrl->list);
- INIT_WORK(&ctrl->ctrl.reset_work, nvme_loop_reset_ctrl_work);
-
ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops,
0 /* no quirks, we're perfect! */);
if (ret) {
@@ -570,12 +568,16 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
goto out;
}
+ INIT_WORK(&ctrl->ctrl.reset_work, nvme_loop_reset_ctrl_work);
ret = nvme_add_ctrl(&ctrl->ctrl);
if (ret)
goto out_put_ctrl;
- if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
+ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
WARN_ON_ONCE(1);
+ ret = -EINTR;
+ goto out_uninit_ctrl;
+ }
ret = -ENOMEM;
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-04 2:38 ` Edward Adam Davis
@ 2026-09-04 3:09 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-09-04 3:09 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in nvme_reset_ctrl_sync
------------[ cut here ]------------
!list_empty(&work->entry)
WARNING: kernel/workqueue.c:2432 at __queue_work+0xee4/0x1370 kernel/workqueue.c:2432, CPU#0: syz-executor138/15710
Modules linked in:
CPU: 0 UID: 0 PID: 15710 Comm: syz-executor138 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__queue_work+0xee4/0x1370 kernel/workqueue.c:2432
Code: 44 89 f6 e8 9e 35 3b 00 45 84 f6 0f 85 f7 f1 ff ff e9 54 7f 51 ff e8 7b 3b 3b 00 90 0f 0b 90 e9 7c f4 ff ff e8 6d 3b 3b 00 90 <0f> 0b 90 e9 95 f5 ff ff e8 5f 3b 3b 00 4c 89 e2 48 b8 00 00 00 00
RSP: 0018:ffffc90006c27af8 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffff888028a59800 RCX: 0000000000000001
RDX: ffff888047318000 RSI: ffffffff81d000c3 RDI: ffff888047318000
RBP: ffff88806de38b10 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88806de38b18
R13: 1ffff92000d84f69 R14: ffff8880277bb800 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888096967000(0063) knlGS:00000000f7e0eb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7e0eda4 CR3: 0000000053b7d000 CR4: 0000000000352ef0
Call Trace:
<TASK>
queue_work_on+0x180/0x1e0 kernel/workqueue.c:2501
queue_work include/linux/workqueue.h:700 [inline]
nvme_reset_ctrl drivers/nvme/host/core.c:226 [inline]
nvme_reset_ctrl_sync+0x51/0xe0 drivers/nvme/host/core.c:236
nvme_sysfs_reset+0x35/0x80 drivers/nvme/host/sysfs.c:21
dev_attr_store+0x58/0x80 drivers/base/core.c:2509
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7e37fec
Code: Unable to access opcode bytes at 0xf7e37fc2.
RSP: 002b:00000000f7e0e69c EFLAGS: 00000293 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000480
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000f7e3cd89 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Tested on:
commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16baa125580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=1172a125580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-03 20:59 syzbot
2026-09-04 1:31 ` Edward Adam Davis
@ 2026-09-04 2:38 ` Edward Adam Davis
2026-09-04 3:09 ` syzbot
2026-09-04 4:41 ` Edward Adam Davis
2026-09-04 9:10 ` Edward Adam Davis
3 siblings, 1 reply; 13+ messages in thread
From: Edward Adam Davis @ 2026-09-04 2:38 UTC (permalink / raw)
To: syzbot+fefa0af09f7891b1800e; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 940de590b839
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index fcb1f8186fdd..31f310904412 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -561,8 +561,6 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
ctrl->ctrl.opts = opts;
INIT_LIST_HEAD(&ctrl->list);
- INIT_WORK(&ctrl->ctrl.reset_work, nvme_loop_reset_ctrl_work);
-
ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops,
0 /* no quirks, we're perfect! */);
if (ret) {
@@ -574,8 +572,11 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
if (ret)
goto out_put_ctrl;
- if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
+ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
WARN_ON_ONCE(1);
+ ret = -EINVAL;
+ goto out_uninit_ctrl;
+ }
ret = -ENOMEM;
@@ -593,6 +594,8 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
if (ret)
goto out_free_queues;
+ INIT_WORK(&ctrl->ctrl.reset_work, nvme_loop_reset_ctrl_work);
+
ret = nvme_loop_configure_admin_queue(ctrl);
if (ret)
goto out_remove_admin_tagset;
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-04 1:31 ` Edward Adam Davis
@ 2026-09-04 1:57 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2026-09-04 1:57 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in nvme_reset_ctrl_sync
------------[ cut here ]------------
!list_empty(&work->entry)
WARNING: kernel/workqueue.c:2432 at __queue_work+0xee4/0x1370 kernel/workqueue.c:2432, CPU#0: syz.3.20/6407
Modules linked in:
CPU: 0 UID: 0 PID: 6407 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__queue_work+0xee4/0x1370 kernel/workqueue.c:2432
Code: 44 89 f6 e8 9e 35 3b 00 45 84 f6 0f 85 f7 f1 ff ff e9 54 7f 51 ff e8 7b 3b 3b 00 90 0f 0b 90 e9 7c f4 ff ff e8 6d 3b 3b 00 90 <0f> 0b 90 e9 95 f5 ff ff e8 5f 3b 3b 00 4c 89 e2 48 b8 00 00 00 00
RSP: 0018:ffffc90003f57af8 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffff888029078800 RCX: 0000000000000001
RDX: ffff8880290a0000 RSI: ffffffff81d000c3 RDI: ffff8880290a0000
RBP: ffff88804c6c8b10 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88804c6c8b18
R13: 1ffff920007eaf69 R14: ffff8880280cd000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888096967000(0063) knlGS:00000000f6804b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007f04c5506e9c CR3: 000000004e47d000 CR4: 0000000000352ef0
Call Trace:
<TASK>
queue_work_on+0x180/0x1e0 kernel/workqueue.c:2501
queue_work include/linux/workqueue.h:700 [inline]
nvme_reset_ctrl drivers/nvme/host/core.c:226 [inline]
nvme_reset_ctrl_sync+0x51/0xe0 drivers/nvme/host/core.c:236
nvme_sysfs_reset+0x35/0x80 drivers/nvme/host/sysfs.c:21
dev_attr_store+0x58/0x80 drivers/base/core.c:2509
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf702efec
Code: Unable to access opcode bytes at 0xf702efc2.
RSP: 002b:00000000f680450c EFLAGS: 00000292 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000480
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Tested on:
commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16cecb49580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
patch: https://syzkaller.appspot.com/x/patch.diff?x=14cca125580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
2026-09-03 20:59 syzbot
@ 2026-09-04 1:31 ` Edward Adam Davis
2026-09-04 1:57 ` syzbot
2026-09-04 2:38 ` Edward Adam Davis
` (2 subsequent siblings)
3 siblings, 1 reply; 13+ messages in thread
From: Edward Adam Davis @ 2026-09-04 1:31 UTC (permalink / raw)
To: syzbot+fefa0af09f7891b1800e; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 940de590b839
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index fcb1f8186fdd..ec56085add72 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -561,8 +561,6 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
ctrl->ctrl.opts = opts;
INIT_LIST_HEAD(&ctrl->list);
- INIT_WORK(&ctrl->ctrl.reset_work, nvme_loop_reset_ctrl_work);
-
ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops,
0 /* no quirks, we're perfect! */);
if (ret) {
@@ -593,6 +591,8 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
if (ret)
goto out_free_queues;
+ INIT_WORK(&ctrl->ctrl.reset_work, nvme_loop_reset_ctrl_work);
+
ret = nvme_loop_configure_admin_queue(ctrl);
if (ret)
goto out_remove_admin_tagset;
^ permalink raw reply [flat|nested] 13+ messages in thread
* [syzbot] [block?] general protection fault in blk_mq_quiesce_queue
@ 2026-09-03 20:59 syzbot
2026-09-04 1:31 ` Edward Adam Davis
` (3 more replies)
0 siblings, 4 replies; 13+ messages in thread
From: syzbot @ 2026-09-03 20:59 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 940de590b839 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13df50f9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9
dashboard link: https://syzkaller.appspot.com/bug?extid=fefa0af09f7891b1800e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=166a48f9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=116a48f9580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-940de590.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f3f674f98efb/vmlinux-940de590.xz
kernel image: https://storage.googleapis.com/syzbot-assets/132222426e71/bzImage-940de590.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fefa0af09f7891b1800e@syzkaller.appspotmail.com
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
Oops: general protection fault, probably for non-canonical address 0xdffffc000000001c: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000e0-0x00000000000000e7]
CPU: 1 UID: 0 PID: 1158 Comm: kworker/u33:8 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme-reset-wq nvme_loop_reset_ctrl_work
RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 0e 36 53 09 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc90002c2fae0 EFLAGS: 00010082
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8bd0370a RDI: dffffc000000001c
RBP: 00000000000000e0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff91452c5f R11: 0000000000000001 R12: ffffffff8bd0370a
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888096a67000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f6824da4 CR3: 000000004c4f1000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__kasan_check_byte+0x13/0x50 mm/kasan/common.c:573
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5882 [inline]
lock_acquire+0x132/0x380 kernel/locking/lockdep.c:5865
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:155 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:181
blk_mq_quiesce_queue_nowait block/blk-mq.c:265 [inline]
blk_mq_quiesce_queue+0x21/0x1c0 block/blk-mq.c:301
nvme_quiesce_admin_queue+0x6e/0x100 drivers/nvme/host/core.c:5412
nvme_loop_shutdown_ctrl drivers/nvme/target/loop.c:415 [inline]
nvme_loop_reset_ctrl_work+0xa2/0x5d0 drivers/nvme/target/loop.c:447
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
process_scheduled_works kernel/workqueue.c:3479 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 0e 36 53 09 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc90002c2fae0 EFLAGS: 00010082
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8bd0370a RDI: dffffc000000001c
RBP: 00000000000000e0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff91452c5f R11: 0000000000000001 R12: ffffffff8bd0370a
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888096a67000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f6824da4 CR3: 000000004c4f1000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 0f 1f 00 nopl (%rax)
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 0f 1f 40 d6 nopl -0x2a(%rax)
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 c1 ef 03 shr $0x3,%rdi
27: 48 01 c7 add %rax,%rdi
* 2a: 0f b6 07 movzbl (%rdi),%eax <-- trapping instruction
2d: 3c 07 cmp $0x7,%al
2f: 0f 96 c0 setbe %al
32: e9 0e 36 53 09 jmp 0x9533645
37: 66 data16
38: 66 data16
39: 2e cs
3a: 0f .byte 0xf
3b: 1f (bad)
3c: 84 00 test %al,(%rax)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2026-11-10 19:45 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CAO7_G+zpXKbKY8ggsBsprzCw9M7NSvCyQ-f4KQSM8Etx6GEqKA@mail.gmail.com>
2026-11-10 19:07 ` [syzbot] [block?] general protection fault in blk_mq_quiesce_queue syzbot
[not found] <CAO7_G+yzCcvqn1+e0EtEk6=BxyK0yFEZPC7hVU7fma5zk-MnBA@mail.gmail.com>
2026-11-10 19:45 ` syzbot
[not found] <CAO7_G+yrCB_-fcq2Fh+pKgYmkd8a7RpCNh1jJgnJ30wHrUSQuQ@mail.gmail.com>
2026-11-10 19:32 ` syzbot
[not found] <CAO7_G+zVhxDF7obCuC6gyTByFqw7G4fLrSKRRYxpdgt8B-iRig@mail.gmail.com>
2026-11-10 19:19 ` syzbot
2026-09-03 20:59 syzbot
2026-09-04 1:31 ` Edward Adam Davis
2026-09-04 1:57 ` syzbot
2026-09-04 2:38 ` Edward Adam Davis
2026-09-04 3:09 ` syzbot
2026-09-04 4:41 ` Edward Adam Davis
2026-09-04 5:05 ` syzbot
2026-09-04 9:10 ` Edward Adam Davis
2026-09-04 9:33 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®