syzbot
WARNING: ODEBUG bug in cifs_demultiplex_thread
Status:
upstream: reported on 2026/11/10 12:27
Reported-by: syzbot+2fafec2a39173565e095@syzkaller.appspotmail.com
First crash: 3d00h, last: 3d00h
Sample crash report:
------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: work_struct hint: smb2_reconnect_server+0x0/0x13b0
WARNING: CPU: 0 PID: 5339 at lib/debugobjects.c:518 debug_print_object lib/debugobjects.c:515 [inline]
WARNING: CPU: 0 PID: 5339 at lib/debugobjects.c:518 __debug_check_no_obj_freed lib/debugobjects.c:1045 [inline]
WARNING: CPU: 0 PID: 5339 at lib/debugobjects.c:518 debug_check_no_obj_freed+0x395/0x520 lib/debugobjects.c:1075
Modules linked in:
CPU: 0 PID: 5339 Comm: cifsd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:debug_print_object lib/debugobjects.c:515 [inline]
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1045 [inline]
RIP: 0010:debug_check_no_obj_freed+0x395/0x520 lib/debugobjects.c:1075
Code: e8 60 52 be fd 4c 8b 45 00 48 c7 c7 60 7c fe 8a 48 c7 c6 c0 78 fe 8a 48 c7 c2 c0 7d fe 8a 8b 4c 24 1c 4d 89 e9 e8 2b 50 38 fd <0f> 0b 4c 8b 6c 24 10 48 b9 00 00 00 00 00 fc ff df ff 05 0c fc 0c
RSP: 0018:ffffc9000dec78f8 EFLAGS: 00010246
RAX: 0a66c7a542d23d00 RBX: ffffffff97ec2eb0 RCX: ffff88801bf50000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffffff8aab4f60 R08: ffffc9000dec7587 R09: 1ffff92001bd8eb0
R10: dffffc0000000000 R11: fffff52001bd8eb1 R12: 0000000000000001
R13: ffffffff8297a420 R14: ffff888075cc4000 R15: ffff888075cc45b0
FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff83c77d000 CR3: 000000001a7b6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
slab_free_hook mm/slub.c:1710 [inline]
slab_free_freelist_hook+0xd2/0x1b0 mm/slub.c:1761
slab_free mm/slub.c:3694 [inline]
__kmem_cache_free+0xb6/0x200 mm/slub.c:3707
clean_demultiplex_info fs/smb/client/connect.c:1072 [inline]
cifs_demultiplex_thread+0x316f/0x36c0 fs/smb/client/connect.c:1362
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
* Struck through repros no longer work on HEAD.