VFS: Busy inodes after unmount (use-after-free)

Status: upstream: reported C repro on 2025/07/29 23:52
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+07910bd70ef5a5789202@syzkaller.appspotmail.com
First crash: 414d, last: 2h27m
Fix bisection: the issue occurs on the latest tested release (bisect log)
Crash: VFS: Busy inodes after unmount (use-after-free) (log)
Repro: C syz .config
  
▶ ▼ Bug presence (3)
Date Name Commit Repro Result
2025/09/15 linux-6.6.y (ToT) 60a9e718726f C [report] VFS: Busy inodes after unmount (use-after-free)
2025/07/30 upstream (ToT) 4b290aae788e C [report] VFS: Busy inodes after unmount (use-after-free)
2025/09/15 upstream (ToT) f83ec76bf285 C Didn't crash
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 VFS: Busy inodes after unmount (use-after-free) 2 syz, C 4 1244d 1299d 0/2 auto-obsoleted due to no activity on 2023/08/20 15:35
upstream VFS: Busy inodes after unmount (use-after-free) (2) btrfs 2 syz, C error 277 382d 494d 29/29 fixed on 2025/09/04 16:57
linux-6.1 VFS: Busy inodes after unmount (use-after-free) origin:lts-only 2 syz, C inconclusive 5919 3h37m 1279d 0/3 upstream: reported C repro on 2023/03/18 09:53
android-5-15 VFS: Busy inodes after unmount (use-after-free) origin:downstream 2 syz, C error done 2 1198d 1299d 0/2 auto-obsoleted due to no activity on 2023/09/15 20:27
android-5-10 VFS: Busy inodes after unmount (use-after-free) 2 syz, C done inconclusive 1 1299d 1299d 0/2 auto-obsoleted due to no activity on 2023/06/25 23:02
upstream VFS: Busy inodes after unmount (use-after-free) (3) fs 2 syz, C error 85 322d 352d 29/29 fixed on 2025/11/18 08:45
upstream VFS: Busy inodes after unmount (use-after-free) (4) prio:high jfs 2 syz, C error 2812 21m 266d 0/29 upstream: reported C repro on 2025/12/25 14:06
upstream VFS: Busy inodes after unmount (use-after-free) fs 2 syz, C error 55684 499d 1331d 28/29 fixed on 2025/05/06 15:33
linux-5.15 VFS: Busy inodes after unmount (use-after-free) missing-backport origin:lts-only 2 syz, C done 3815 2h12m 1278d 0/3 upstream: reported C repro on 2023/03/19 11:46
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2025/12/17 00:08 1h19m fix candidate upstream OK (0) job log
2025/09/08 07:53 1h54m bisect fix linux-6.6.y OK (0) job log log

Sample crash report:
VFS: Lookup of '' in ocfs2 loop0 would have caused loop
VFS: Lookup of '' in ocfs2 loop0 would have caused loop
ocfs2: Unmounting device (7,0) on (node local)
VFS: Busy inodes after unmount of loop0 (ocfs2)
------------[ cut here ]------------
kernel BUG at fs/super.c:697!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5887 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:generic_shutdown_super+0x2ad/0x2b0 fs/super.c:695
Code: e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 dc 4e f0 ff 49 8b 16 48 81 c3 60 06 00 00 48 c7 c7 20 b6 d7 8a 48 89 de e8 d3 fa 95 08 <0f> 0b 90 66 0f 1f 00 55 41 57 41 56 53 48 89 fb 49 bf 00 00 00 00
RSP: 0018:ffffc900033a7bb0 EFLAGS: 00010246
RAX: 000000000000002f RBX: ffff88814c702660 RCX: bd71df4550264400
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff110298e04f2 R08: ffff8880b8f28c53 R09: 1ffff110171e518a
R10: dffffc0000000000 R11: ffffed10171e518b R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8d64ca80 R15: ffff88814c702790
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055dfda00f190 CR3: 000000000cf32000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 kill_block_super+0x44/0x90 fs/super.c:1668
 deactivate_locked_super+0x97/0x100 fs/super.c:481
 cleanup_mnt+0x3d7/0x460 fs/namespace.c:1259
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:890
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 __do_sys_exit_group kernel/exit.c:1043 [inline]
 __se_sys_exit_group kernel/exit.c:1041 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1041
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9fc499e159
Code: Unable to access opcode bytes at 0x7f9fc499e12f.
RSP: 002b:00007ffed7474e78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f9fc4a344b0 RCX: 00007f9fc499e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000028 R08: 0000000000000000 R09: 00007f9fc4a3448b
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffed7476130
R13: 00007f9fc4a3448b R14: 00000000000158f6 R15: 00007ffed7477200
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:generic_shutdown_super+0x2ad/0x2b0 fs/super.c:695
Code: e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 dc 4e f0 ff 49 8b 16 48 81 c3 60 06 00 00 48 c7 c7 20 b6 d7 8a 48 89 de e8 d3 fa 95 08 <0f> 0b 90 66 0f 1f 00 55 41 57 41 56 53 48 89 fb 49 bf 00 00 00 00
RSP: 0018:ffffc900033a7bb0 EFLAGS: 00010246
RAX: 000000000000002f RBX: ffff88814c702660 RCX: bd71df4550264400
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff110298e04f2 R08: ffff8880b8f28c53 R09: 1ffff110171e518a
R10: dffffc0000000000 R11: ffffed10171e518b R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8d64ca80 R15: ffff88814c702790
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055dfda00f190 CR3: 000000007a13c000 CR4: 00000000003506e0

Crashes (1233):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/15 11:43 linux-6.6.y 79643295eba1 81a27d1a .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/03/29 02:54 linux-6.6.y c09fbcd31ae6 b5ceaad2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/12/17 01:31 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/12/03 14:42 linux-6.6.y 4791134e4aeb d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/10/29 12:29 linux-6.6.y 4a243110dc88 fd2207e7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/08/02 11:32 linux-6.6.y 3a8ababb8b6a 7368264b .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/07/30 11:21 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/17 19:21 linux-6.6.y 79643295eba1 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/17 19:21 linux-6.6.y 79643295eba1 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/17 17:49 linux-6.6.y 79643295eba1 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/17 10:34 linux-6.6.y 79643295eba1 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/17 07:02 linux-6.6.y 79643295eba1 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/17 01:24 linux-6.6.y 79643295eba1 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/17 00:21 linux-6.6.y 79643295eba1 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/16 23:48 linux-6.6.y 79643295eba1 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/16 15:26 linux-6.6.y 79643295eba1 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/16 07:30 linux-6.6.y 79643295eba1 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/16 07:30 linux-6.6.y 79643295eba1 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/15 22:57 linux-6.6.y 79643295eba1 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/15 16:57 linux-6.6.y 79643295eba1 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/14 23:08 linux-6.6.y 79643295eba1 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/14 16:57 linux-6.6.y 79643295eba1 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/12 03:55 linux-6.6.y 8b73de7da85f 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/12 00:45 linux-6.6.y 8b73de7da85f b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/12 00:45 linux-6.6.y 8b73de7da85f b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/11 13:24 linux-6.6.y 8b73de7da85f b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/10 13:34 linux-6.6.y 8b73de7da85f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/09 19:59 linux-6.6.y 8b73de7da85f 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/09 10:31 linux-6.6.y 8b73de7da85f 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/08 18:48 linux-6.6.y 8b73de7da85f 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/07 14:58 linux-6.6.y 8b73de7da85f 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/05 01:26 linux-6.6.y 8b73de7da85f 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/04 11:54 linux-6.6.y 8b73de7da85f f65209a4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/03 23:35 linux-6.6.y 8b73de7da85f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/03 23:35 linux-6.6.y 8b73de7da85f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/03 06:41 linux-6.6.y 8b73de7da85f 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/02 17:56 linux-6.6.y 8b73de7da85f 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/01 13:36 linux-6.6.y a4a971135a2f 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/31 20:15 linux-6.6.y a4a971135a2f 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/31 18:50 linux-6.6.y a4a971135a2f 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/31 10:02 linux-6.6.y a4a971135a2f 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/28 22:55 linux-6.6.y a4a971135a2f 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/28 10:54 linux-6.6.y a4a971135a2f e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/27 15:42 linux-6.6.y 93e0c9521fa8 69a01293 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/27 15:39 linux-6.6.y 93e0c9521fa8 69a01293 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/27 12:24 linux-6.6.y dc6160265ffc 69a01293 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/27 02:07 linux-6.6.y dc6160265ffc a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/26 23:19 linux-6.6.y dc6160265ffc a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/26 08:48 linux-6.6.y dc6160265ffc 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/07/29 23:52 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
* Struck through repros no longer work on HEAD.