syzbot
WARNING in bio_alloc_bioset
Status:
upstream: reported C repro on 2026/09/04 02:39
Reported-by: syzbot+15b965f5b03733725fd3@syzkaller.appspotmail.com
First crash: 23h22m, last: 16h57m
Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4459 at block/bio.c:479 bio_alloc_bioset+0xaa0/0xf24 block/bio.c:479
Modules linked in:
CPU: 0 PID: 4459 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : bio_alloc_bioset+0xaa0/0xf24 block/bio.c:479
lr : bio_alloc_bioset+0xaa0/0xf24 block/bio.c:479
sp : ffff8000213f7730
x29: ffff8000213f7740 x28: dfff800000000000 x27: 1fffe0001afca917
x26: dfff800000000000 x25: 0000000000000001 x24: 0000000000000c00
x23: 0000000000000001 x22: 0000000000069801 x21: ffff0000c0480b00
x20: 0000000000000000 x19: ffff0000d16a09e8 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082f2d54 x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe0001a2d407d x12: 0000000000000000
x11: ff0080000a7858dc x10: 0000000000000000 x9 : ffff80000a7858dc
x8 : ffff0000d36c3800 x7 : ffffffffffffffff x6 : 0000000000000000
x5 : ffff8000186a7d68 x4 : ffff0000d16a09e8 x3 : 0000000000000c00
x2 : 0000000000069801 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
bio_alloc_bioset+0xaa0/0xf24 block/bio.c:479
md_super_write+0xe4/0x2c0 drivers/md/md.c:966
md_update_sb+0x11a0/0x1c94 drivers/md/md.c:2838
state_store+0x1468/0x2a9c drivers/md/md.c:3159
rdev_attr_store+0x11c/0x158 drivers/md/md.c:3670
sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2271 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x3c8/0x7c8 fs/read_write.c:584
ksys_write+0x12c/0x228 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 2646
hardirqs last enabled at (2645): [<ffff80000805a664>] local_daif_restore arch/arm64/include/asm/daifflags.h:75 [inline]
hardirqs last enabled at (2645): [<ffff80000805a664>] el0_svc_common+0xa0/0x258 arch/arm64/kernel/syscall.c:105
hardirqs last disabled at (2646): [<ffff800011b9d0cc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (2636): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (2634): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address dfff800000000004
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4459 Comm: syz.0.18 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : md_super_write+0x110/0x2c0 drivers/md/md.c:974
lr : __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline]
lr : arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]
lr : arch_atomic_inc include/linux/atomic/atomic-arch-fallback.h:424 [inline]
lr : atomic_inc include/linux/atomic/atomic-instrumented.h:191 [inline]
lr : md_super_write+0x100/0x2c0 drivers/md/md.c:972
sp : ffff8000213f77a0
x29: ffff8000213f77a0 x28: ffff0000d7e54928 x27: 1fffe0001afca917
x26: dfff800000000000 x25: 0000000000000008 x24: fffffc0003689f80
x23: 0000000000000200 x22: ffff0000d7e54800 x21: 0000000000000000
x20: ffff0000d7e548b8 x19: ffff0000d16a0000 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082f2d54 x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe0001afca925 x12: 0000000000000000
x11: ff0080000eb331d8 x10: 0000000000000000 x9 : ffff80000eb331d8
x8 : 0000000000000004 x7 : ffffffffffffffff x6 : 0000000000000000
x5 : ffff8000186a7d68 x4 : ffff0000d16a09e8 x3 : ffff80000eb331d0
x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
md_super_write+0x110/0x2c0 drivers/md/md.c:974
md_update_sb+0x11a0/0x1c94 drivers/md/md.c:2838
state_store+0x1468/0x2a9c drivers/md/md.c:3159
rdev_attr_store+0x11c/0x158 drivers/md/md.c:3670
sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2271 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x3c8/0x7c8 fs/read_write.c:584
ksys_write+0x12c/0x228 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 52800028 b828039f 910082a8 d343fd08 (387a6908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 52800028 mov w8, #0x1 // #1
4: b828039f stadd w8, [x28]
8: 910082a8 add x8, x21, #0x20
c: d343fd08 lsr x8, x8, #3
* 10: 387a6908 ldrb w8, [x8, x26] <-- trapping instruction
Struck through repros no longer work on HEAD.