WARNING in __virt_to_phys (2)

Status: upstream: reported C repro on 2024/04/27 00:06
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+30c4e2d7a249cce8b266@syzkaller.appspotmail.com
First crash: 923d, last: 1d21h
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2024/04/27 linux-6.1.y (ToT) 6741e066ec76 C [report] WARNING in __virt_to_phys
2024/04/27 upstream (ToT) 5eb4573ea63d C Didn't crash
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in __virt_to_phys (2) ntfs3 -1 syz, C 2 1277d 1273d 0/29 auto-obsoleted due to no activity on 2023/08/23 09:02
linux-6.1 WARNING in __virt_to_phys origin:lts-only -1 syz, C done 1 1267d 1274d 3/3 fixed on 2023/06/19 12:27
upstream WARNING in __virt_to_phys (4) fs -1 syz, C 2 858d 854d 26/29 fixed on 2024/07/13 18:41
upstream WARNING in __virt_to_phys (3) fs -1 syz, C 447 883d 916d 25/29 fixed on 2024/06/05 13:52
upstream WARNING in __virt_to_phys (5) fs -1 4 814d 810d 27/29 fixed on 2024/08/29 18:29
upstream WARNING in __virt_to_phys (6) prio:high net -1 1 91d 87d 0/29 upstream: reported on 2026/08/11 00:24
linux-5.15 WARNING in __virt_to_phys -1 syz, C error 4 758d 1271d 0/3 auto-obsoleted due to no activity on 2025/01/16 21:32
upstream WARNING in __virt_to_phys nilfs -1 syz, C 19 1425d 1509d 0/29 closed as dup on 2022/09/19 06:44
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2024/07/23 15:29 2h12m fix candidate upstream OK (0) job log
2024/05/30 22:50 12m bisect fix linux-6.1.y error job log

Sample crash report:
------------[ cut here ]------------
virt_to_phys used for non-linear address: 0000000085b192ed (0xdead4ead00000000)
WARNING: CPU: 0 PID: 4480 at arch/arm64/mm/physaddr.c:15 __virt_to_phys+0x88/0xa0 arch/arm64/mm/physaddr.c:17
Modules linked in:
CPU: 0 PID: 4480 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __virt_to_phys+0x88/0xa0 arch/arm64/mm/physaddr.c:17
lr : __virt_to_phys+0x84/0xa0 arch/arm64/mm/physaddr.c:12
sp : ffff8000217f73d0
x29: ffff8000217f73d0 x28: ffff0000e16df878 x27: ffff800012007540
x26: ffff0000e16df928 x25: ffff800012007540 x24: dfff800000000000
x23: dfff800000000000 x22: ffff7000042feea0 x21: 0000000000040000
x20: deae4ead00000000 x19: dead4ead00000000 x18: 1fffe00033c2177e
x17: 6564783028206465 x16: ffff800011ba16d0 x15: 303030303030203a
x14: 0000000000000001 x13: 1fffe00033c217a3 x12: 0000000000000000
x11: ff0080000819676c x10: 0000000000000000 x9 : 564e4c34e1308900
x8 : ffff800014db2000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000217f6e58 x4 : ffff8000164c4fa0 x3 : ffff800008545104
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
 __virt_to_phys+0x88/0xa0 arch/arm64/mm/physaddr.c:17
 virt_to_folio include/linux/mm.h:913 [inline]
 kfree+0x8c/0x1a8 mm/slab_common.c:980
 kvfree+0x40/0x50 mm/util.c:627
 run_close fs/ntfs3/ntfs_fs.h:938 [inline]
 indx_clear+0x40/0x8c fs/ntfs3/index.c:910
 ni_clear+0x238/0x550 fs/ntfs3/frecord.c:123
 ntfs_evict_inode+0x8c/0xb8 fs/ntfs3/inode.c:1794
 evict+0x3d8/0x81c fs/inode.c:703
 iput_final fs/inode.c:1832 [inline]
 iput+0x728/0x7e8 fs/inode.c:1858
 dentry_unlink_inode+0x360/0x438 fs/dcache.c:405
 __dentry_kill+0x318/0x590 fs/dcache.c:611
 shrink_dentry_list+0x404/0x7d0 fs/dcache.c:1206
 shrink_dcache_parent+0xb0/0x364 fs/dcache.c:-1
 do_one_tree+0x2c/0xf4 fs/dcache.c:1689
 shrink_dcache_for_umount+0x6c/0x118 fs/dcache.c:1706
 generic_shutdown_super+0x6c/0x32c fs/super.c:473
 kill_block_super+0x78/0xe0 fs/super.c:1481
 deactivate_locked_super+0xb4/0x128 fs/super.c:332
 deactivate_super+0xe4/0x104 fs/super.c:363
 cleanup_mnt+0x3a8/0x430 fs/namespace.c:1191
 __cleanup_mnt+0x20/0x30 fs/namespace.c:1198
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 get_signal+0x1140/0x133c kernel/signal.c:2661
 do_signal arch/arm64/kernel/signal.c:1110 [inline]
 do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1163
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589
irq event stamp: 177222
hardirqs last  enabled at (177221): [<ffff800008316468>] __up_console_sem+0xb4/0xfc kernel/printk/printk.c:261
hardirqs last disabled at (177222): [<ffff800011b9d7f8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (177158): [<ffff8000081aec5c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (177158): [<ffff8000081aec5c>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (176575): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address 007ab33abad70008
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[007ab33abad70008] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4480 Comm: syz-executor Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : _compound_head include/linux/page-flags.h:253 [inline]
pc : virt_to_folio include/linux/mm.h:915 [inline]
pc : kfree+0xa0/0x1a8 mm/slab_common.c:980
lr : virt_to_folio include/linux/mm.h:913 [inline]
lr : kfree+0x8c/0x1a8 mm/slab_common.c:980
sp : ffff8000217f73f0
x29: ffff8000217f73f0 x28: ffff0000e16df878 x27: ffff800012007540
x26: ffff0000e16df928 x25: ffff800012007540 x24: dfff800000000000
x23: dfff800000000000 x22: ffff7000042feea0 x21: 0000000000040000
x20: ffff80000878b090 x19: dead4ead00000000 x18: 1fffe00033c2177e
x17: 6564783028206465 x16: ffff800011ba16d0 x15: 303030303030203a
x14: 0000000000000001 x13: 1fffe00033c217a3 x12: 0000000000000000
x11: ff0080000819676c x10: 0000000000000000 x9 : 037ab73abad70000
x8 : 037ab33abad70000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000217f6e58 x4 : ffff8000164c4fa0 x3 : ffff800008545104
x2 : 0000000000000001 x1 : 0000000100000000 x0 : deadceaef5c00000
Call trace:
 virt_to_folio include/linux/mm.h:913 [inline]
 kfree+0xa0/0x1a8 mm/slab_common.c:980
 kvfree+0x40/0x50 mm/util.c:627
 run_close fs/ntfs3/ntfs_fs.h:938 [inline]
 indx_clear+0x40/0x8c fs/ntfs3/index.c:910
 ni_clear+0x238/0x550 fs/ntfs3/frecord.c:123
 ntfs_evict_inode+0x8c/0xb8 fs/ntfs3/inode.c:1794
 evict+0x3d8/0x81c fs/inode.c:703
 iput_final fs/inode.c:1832 [inline]
 iput+0x728/0x7e8 fs/inode.c:1858
 dentry_unlink_inode+0x360/0x438 fs/dcache.c:405
 __dentry_kill+0x318/0x590 fs/dcache.c:611
 shrink_dentry_list+0x404/0x7d0 fs/dcache.c:1206
 shrink_dcache_parent+0xb0/0x364 fs/dcache.c:-1
 do_one_tree+0x2c/0xf4 fs/dcache.c:1689
 shrink_dcache_for_umount+0x6c/0x118 fs/dcache.c:1706
 generic_shutdown_super+0x6c/0x32c fs/super.c:473
 kill_block_super+0x78/0xe0 fs/super.c:1481
 deactivate_locked_super+0xb4/0x128 fs/super.c:332
 deactivate_super+0xe4/0x104 fs/super.c:363
 cleanup_mnt+0x3a8/0x430 fs/namespace.c:1191
 __cleanup_mnt+0x20/0x30 fs/namespace.c:1198
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 get_signal+0x1140/0x133c kernel/signal.c:2661
 do_signal arch/arm64/kernel/signal.c:1110 [inline]
 do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1163
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589
Code: b25657e8 927acd29 cb151929 8b080128 (f9400509) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	b25657e8 	mov	x8, #0xfffffc0000000000    	// #-4398046511104
   4:	927acd29 	and	x9, x9, #0x3ffffffffffffc0
   8:	cb151929 	sub	x9, x9, x21, lsl #6
   c:	8b080128 	add	x8, x9, x8
* 10:	f9400509 	ldr	x9, [x8, #8] <-- trapping instruction

Crashes (29):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/31 03:01 linux-6.1.y 08889840163e 0ec395f8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2024/04/27 00:31 linux-6.1.y 6741e066ec76 059e9963 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/04 11:09 linux-6.1.y 08889840163e 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/04 11:08 linux-6.1.y 08889840163e 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/02 18:46 linux-6.1.y 08889840163e 6969b601 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/02 18:44 linux-6.1.y 08889840163e 6969b601 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/01 21:22 linux-6.1.y 08889840163e 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/01 14:42 linux-6.1.y 08889840163e 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/01 14:39 linux-6.1.y 08889840163e 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/01 14:39 linux-6.1.y 08889840163e 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/01 07:43 linux-6.1.y 08889840163e 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/11/01 03:27 linux-6.1.y 08889840163e 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/31 18:24 linux-6.1.y 08889840163e 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/31 18:17 linux-6.1.y 08889840163e 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/31 10:16 linux-6.1.y 08889840163e 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/31 10:16 linux-6.1.y 08889840163e 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/31 10:15 linux-6.1.y 08889840163e 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/31 10:15 linux-6.1.y 08889840163e 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 17:34 linux-6.1.y 08889840163e 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 17:33 linux-6.1.y 08889840163e 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 17:33 linux-6.1.y 08889840163e 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 17:31 linux-6.1.y 08889840163e 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 17:31 linux-6.1.y 08889840163e 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 14:47 linux-6.1.y 08889840163e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 14:45 linux-6.1.y 08889840163e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 14:45 linux-6.1.y 08889840163e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2026/10/30 14:45 linux-6.1.y 08889840163e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2024/04/27 21:33 linux-6.1.y f2295faba5e8 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
2024/04/27 00:06 linux-6.1.y 6741e066ec76 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __virt_to_phys
* Struck through repros no longer work on HEAD.