general protection fault in tracing_release_file

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-5-15	general protection fault in tracing_release_file_tr origin:downstream	2	syz, C			21	3d03h	70d	0/2	upstream: reported C repro on 2026/08/03 03:48

general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 PID: 11257 Comm: syz.0.2632 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:tracing_release_file_tr+0x48/0x100 kernel/trace/trace.c:4499 Code: 81 c3 a8 02 00 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 d6 21 37 00 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 b9 21 37 00 48 8b 1b 48 85 db 74 RSP: 0018:ffffc90000fd7dd8 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88811b9ba800 RDX: 0000000000000000 RSI: ffff8881144c9c80 RDI: ffff88811c3cc680 RBP: ffffc90000fd7df8 R08: ffffc90000fd7d6f R09: ffffc90000fd7d40 R10: dffffc0000000000 R11: fffff520001fafae R12: ffff8881144c9c80 R13: ffff88811c3cc680 R14: 1ffff11022899395 R15: dffffc0000000000 FS: 00005555735a5500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2e8864 CR3: 00000001265e5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f73fa80b159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff136b4848 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff136b4930 RCX: 00007f73fa80b159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000c247d R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b2c720000 R11: 0000000000000246 R12: 00007fff136b4970 R13: 00007f73faa92fac R14: 00000000000c24cd R15: 00007f73faa92fa0 Modules linked in: ---[ end trace 6573156ea87c7542 ]--- RIP: 0010:tracing_release_file_tr+0x48/0x100 kernel/trace/trace.c:4499 Code: 81 c3 a8 02 00 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 d6 21 37 00 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 b9 21 37 00 48 8b 1b 48 85 db 74 RSP: 0018:ffffc90000fd7dd8 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88811b9ba800 RDX: 0000000000000000 RSI: ffff8881144c9c80 RDI: ffff88811c3cc680 RBP: ffffc90000fd7df8 R08: ffffc90000fd7d6f R09: ffffc90000fd7d40 R10: dffffc0000000000 R11: fffff520001fafae R12: ffff8881144c9c80 R13: ffff88811c3cc680 R14: 1ffff11022899395 R15: dffffc0000000000 FS: 00005555735a5500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3006d8 CR3: 00000001265e5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 81 c3 a8 02 00 00 add $0x2a8,%ebx 6: 48 89 d8 mov %rbx,%rax 9: 48 c1 e8 03 shr $0x3,%rax d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) 12: 74 08 je 0x1c 14: 48 89 df mov %rbx,%rdi 17: e8 d6 21 37 00 call 0x3721f2 1c: 48 8b 1b mov (%rbx),%rbx 1f: 48 83 c3 28 add $0x28,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 b9 21 37 00 call 0x3721f2 39: 48 8b 1b mov (%rbx),%rbx 3c: 48 85 db test %rbx,%rbx 3f: 74 .byte 0x74

Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Assets (help?)	Manager	Title
2026/09/24 05:45	android13-5.10-lts	452567d1985b	0281b448	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr
2026/09/24 05:44	android13-5.10-lts	452567d1985b	0281b448	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr
2026/09/16 02:46	android13-5.10-lts	452567d1985b	2daa4bb5	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr
2026/09/10 19:55	android13-5.10-lts	452567d1985b	1fe56c0a	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr
2026/09/06 21:19	android13-5.10-lts	452567d1985b	4f7b22a0	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr
2026/08/23 18:35	android13-5.10-lts	e334a66065d3	1e72964b	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr
2026/08/03 03:11	android13-5.10-lts	50b3a256e550	e611ffe1	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr
2026/08/03 03:10	android13-5.10-lts	50b3a256e550	e611ffe1	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-10	general protection fault in tracing_release_file_tr