syzbot

 sign-in | mailing list | source | docs
🐞 Open [77]
🐞 Fixed [22]
🐞 Invalid [338]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: null-ptr-deref Write in vfs_rmdir

Status: upstream: reported C repro on 2024/04/11 05:33
Reported-by: syzbot+adaf68663d8cf867260f@syzkaller.appspotmail.com
First crash: 364d, last: 5h26m
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 KASAN: null-ptr-deref Write in vfs_rmdir origin:downstream C 14700 5h34m 364d 0/2 upstream: reported C repro on 2024/04/11 17:58
android-6-1 KASAN: null-ptr-deref Write in vfs_rmdir origin:downstream C 14420 29m 364d 0/2 upstream: reported C repro on 2024/04/11 09:39
android-5-10 KASAN: null-ptr-deref Write in vfs_rmdir C 61725 23m 364d 0/2 upstream: reported C repro on 2024/04/11 05:14
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2025/01/06 11:42 2m retest repro android12-5.4 error
2025/01/06 11:42 1m retest repro android12-5.4 error
2025/01/06 11:42 42m retest repro android12-5.4 error
2024/10/28 10:51 11m retest repro android12-5.4 report log
2024/10/28 10:51 17m retest repro android12-5.4 report log
2024/10/28 10:51 13m retest repro android12-5.4 report log
2024/08/18 23:12 27m retest repro android12-5.4 report log
2024/08/18 23:12 23m retest repro android12-5.4 report log
2024/08/18 23:12 18m retest repro android12-5.4 report log
2024/06/09 20:42 20m retest repro android12-5.4 report log

Sample crash report:
RBP: 00007fffaba12450 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fffaba134c0
R13: 000055556f2f66c0 R14: 00007fffaba134c0 R15: 0000000000000001
---[ end trace e40979302ea2223c ]---
==================================================================
BUG: KASAN: null-ptr-deref in atomic_add_return include/asm-generic/atomic-instrumented.h:71 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic-fallback.h:284 [inline]
BUG: KASAN: null-ptr-deref in ihold+0x1b/0x50 fs/inode.c:421
Write of size 4 at addr 0000000000000160 by task syz-executor698/359

CPU: 0 PID: 359 Comm: syz-executor698 Tainted: G        W         5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 __kasan_report+0xe9/0x120 mm/kasan/report.c:520
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 check_memory_region_inline mm/kasan/generic.c:141 [inline]
 check_memory_region+0x272/0x280 mm/kasan/generic.c:191
 atomic_add_return include/asm-generic/atomic-instrumented.h:71 [inline]
 atomic_inc_return include/linux/atomic-fallback.h:284 [inline]
 ihold+0x1b/0x50 fs/inode.c:421
 d_delete_notify include/linux/fsnotify.h:227 [inline]
 vfs_rmdir+0x1e0/0x3c0 fs/namei.c:4040
 incfs_kill_sb+0x105/0x200 fs/incfs/vfs.c:1944
 deactivate_locked_super+0xa8/0x110 fs/super.c:335
 deactivate_super+0x1e2/0x2a0 fs/super.c:366
 cleanup_mnt+0x44e/0x500 fs/namespace.c:1102
 task_work_run+0x140/0x170 kernel/task_work.c:113
 ptrace_notify+0x29e/0x350 kernel/signal.c:2274
 ptrace_report_syscall include/linux/tracehook.h:66 [inline]
 tracehook_report_syscall_exit include/linux/tracehook.h:129 [inline]
 syscall_slow_exit_work+0x167/0x400 arch/x86/entry/common.c:246
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x19d/0x1c0 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f84da748a87
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fffaba12398 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f84da748a87
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffaba12450
RBP: 00007fffaba12450 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fffaba134c0
R13: 000055556f2f66c0 R14: 00007fffaba134c0 R15: 0000000000000001
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000160
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 359 Comm: syz-executor698 Tainted: G    B   W         5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:167 [inline]
RIP: 0010:atomic_add_return include/asm-generic/atomic-instrumented.h:72 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic-fallback.h:284 [inline]
RIP: 0010:ihold+0x20/0x50 fs/inode.c:421
Code: 0f 1f 84 00 00 00 00 00 66 90 55 53 48 89 fb e8 36 d4 c2 ff 48 8d bb 60 01 00 00 be 04 00 00 00 e8 c5 91 f2 ff bd 01 00 00 00 <f0> 0f c1 ab 60 01 00 00 ff c5 bf 02 00 00 00 89 ee e8 fa d6 c2 ff
RSP: 0018:ffff8881ee627ba0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881f5cdee40
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: 0000000000000001 R08: ffffffff813ae545 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8881deb50060 R15: 0000000000000000
FS:  000055556f2f5380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000160 CR3: 00000001deb91000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 d_delete_notify include/linux/fsnotify.h:227 [inline]
 vfs_rmdir+0x1e0/0x3c0 fs/namei.c:4040
 incfs_kill_sb+0x105/0x200 fs/incfs/vfs.c:1944
 deactivate_locked_super+0xa8/0x110 fs/super.c:335
 deactivate_super+0x1e2/0x2a0 fs/super.c:366
 cleanup_mnt+0x44e/0x500 fs/namespace.c:1102
 task_work_run+0x140/0x170 kernel/task_work.c:113
 ptrace_notify+0x29e/0x350 kernel/signal.c:2274
 ptrace_report_syscall include/linux/tracehook.h:66 [inline]
 tracehook_report_syscall_exit include/linux/tracehook.h:129 [inline]
 syscall_slow_exit_work+0x167/0x400 arch/x86/entry/common.c:246
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x19d/0x1c0 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f84da748a87
Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fffaba12398 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f84da748a87
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffaba12450
RBP: 00007fffaba12450 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fffaba134c0
R13: 000055556f2f66c0 R14: 00007fffaba134c0 R15: 0000000000000001
Modules linked in:
CR2: 0000000000000160
---[ end trace e40979302ea2223d ]---
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:167 [inline]
RIP: 0010:atomic_add_return include/asm-generic/atomic-instrumented.h:72 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic-fallback.h:284 [inline]
RIP: 0010:ihold+0x20/0x50 fs/inode.c:421
Code: 0f 1f 84 00 00 00 00 00 66 90 55 53 48 89 fb e8 36 d4 c2 ff 48 8d bb 60 01 00 00 be 04 00 00 00 e8 c5 91 f2 ff bd 01 00 00 00 <f0> 0f c1 ab 60 01 00 00 ff c5 bf 02 00 00 00 89 ee e8 fa d6 c2 ff
RSP: 0018:ffff8881ee627ba0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881f5cdee40
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: 0000000000000001 R08: ffffffff813ae545 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8881deb50060 R15: 0000000000000000
FS:  000055556f2f5380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000160 CR3: 00000001deb91000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
   7:	00
   8:	66 90                	xchg   %ax,%ax
   a:	55                   	push   %rbp
   b:	53                   	push   %rbx
   c:	48 89 fb             	mov    %rdi,%rbx
   f:	e8 36 d4 c2 ff       	call   0xffc2d44a
  14:	48 8d bb 60 01 00 00 	lea    0x160(%rbx),%rdi
  1b:	be 04 00 00 00       	mov    $0x4,%esi
  20:	e8 c5 91 f2 ff       	call   0xfff291ea
  25:	bd 01 00 00 00       	mov    $0x1,%ebp
* 2a:	f0 0f c1 ab 60 01 00 	lock xadd %ebp,0x160(%rbx) <-- trapping instruction
  31:	00
  32:	ff c5                	inc    %ebp
  34:	bf 02 00 00 00       	mov    $0x2,%edi
  39:	89 ee                	mov    %ebp,%esi
  3b:	e8 fa d6 c2 ff       	call   0xffc2d73a

Crashes (6203):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/25 01:27 android12-5.4 6b07fcd94a6a d34966d1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/02/14 07:53 android12-5.4 39762b7a60e9 d9a046cf .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/02/13 11:59 android12-5.4 39762b7a60e9 b27c2402 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/02/01 20:02 android12-5.4 3f2c17e79750 aa47157c .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/02/01 01:02 android12-5.4 49530c73f82d aa47157c .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/01/26 07:32 android12-5.4 49530c73f82d 9fbd772e .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2024/04/11 18:14 android12-5.4 d0d34dcb02cc 95ed9ece .config strace log report syz C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2024/04/11 09:54 android12-5.4 d0d34dcb02cc 33b9e058 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2024/04/11 05:32 android12-5.4 d0d34dcb02cc 33b9e058 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/10 16:44 android12-5.4 41adfeb3d639 1ef3ab4d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/10 16:44 android12-5.4 41adfeb3d639 1ef3ab4d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/10 15:43 android12-5.4 41adfeb3d639 988b336c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/10 14:35 android12-5.4 41adfeb3d639 988b336c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/10 11:53 android12-5.4 41adfeb3d639 988b336c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/10 09:59 android12-5.4 41adfeb3d639 988b336c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/10 07:14 android12-5.4 41adfeb3d639 988b336c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 23:55 android12-5.4 41adfeb3d639 988b336c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 22:54 android12-5.4 41adfeb3d639 988b336c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 22:00 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 20:52 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 19:38 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 17:53 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 17:14 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 15:01 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 11:54 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 10:25 android12-5.4 41adfeb3d639 47d015b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 09:25 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 09:25 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 07:58 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 06:54 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 05:40 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 05:30 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 04:22 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/09 03:08 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 21:25 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 19:34 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 19:24 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 19:14 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 19:08 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 09:57 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 09:54 android12-5.4 41adfeb3d639 a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 08:15 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 06:52 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 03:22 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 02:08 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 00:39 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/08 00:29 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/07 23:21 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/07 21:22 android12-5.4 41adfeb3d639 a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/07 12:30 android12-5.4 41adfeb3d639 1c65791e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
2025/04/07 11:56 android12-5.4 41adfeb3d639 1c65791e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: null-ptr-deref Write in vfs_rmdir
* Struck through repros no longer work on HEAD.