syzbot

 sign-in | mailing list | source | docs
🐞 Open [821]
🐞 Fixed [86]
🐞 Invalid [1163]
⬇ Missing Backports [135]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: unable to handle kernel paging request in device_move

Status: upstream: reported syz repro on 2024/12/16 11:50
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+6face46c1d2f28e76643@syzkaller.appspotmail.com
First crash: 378d, last: 25d
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/12/04 linux-5.15.y (ToT) cc5ec8769306 syz [report] general protection fault in device_move
2025/12/04 upstream (ToT) 559e608c4655 syz Didn't crash
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in device_move kernel 8 syz error 6290 17m 403d 0/29 upstream: reported syz repro on 2024/11/20 18:53
linux-6.1 general protection fault in device_move 8 49 15d 363d 0/3 upstream: reported on 2024/12/31 11:47
linux-6.6 general protection fault in device_move 2 13 7d12h 178d 0/2 upstream: reported on 2025/07/04 01:12
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2025/12/12 06:11 3h03m fix candidate upstream OK (0) job log

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 0 PID: 10130 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:klist_put lib/klist.c:212 [inline]
RIP: 0010:klist_del lib/klist.c:230 [inline]
RIP: 0010:klist_remove+0x144/0x2f0 lib/klist.c:249
Code: b6 05 4d 89 f4 49 c1 ec 03 43 80 3c 2c 00 74 08 4c 89 f7 e8 7e 46 c0 fd 4d 8b 3e 49 83 e7 fe 49 8d 7f 58 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 60 46 c0 fd 49 8b 47 58 48 89 44 24 08 4c
RSP: 0018:ffffc9000ca0f660 EFLAGS: 00010202
RAX: 000000000000000b RBX: ffff888023a49dc0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058
RBP: ffffc9000ca0f748 R08: dffffc0000000000 R09: fffffbfff18e70bd
R10: fffffbfff18e70bd R11: 1ffffffff18e70bc R12: 1ffff11003c1178c
R13: dffffc0000000000 R14: ffff88801e08bc60 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffda37ebb38 CR3: 000000005d5f1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 device_move+0x18f/0x6f0 drivers/base/core.c:4338
 hci_conn_del_sysfs+0xab/0x160 net/bluetooth/hci_sysfs.c:73
 hci_conn_cleanup+0x4d1/0x680 net/bluetooth/hci_conn.c:140
 hci_conn_del+0x2ab/0x3e0 net/bluetooth/hci_conn.c:678
 hci_conn_hash_flush+0x185/0x220 net/bluetooth/hci_conn.c:1623
 hci_dev_do_close+0x991/0x1030 net/bluetooth/hci_core.c:1795
 hci_unregister_dev+0x2d7/0x580 net/bluetooth/hci_core.c:4040
 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345
 __fput+0x234/0x930 fs/file_table.c:311
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0x61e/0x20a0 kernel/exit.c:883
 do_group_exit+0x12e/0x300 kernel/exit.c:997
 get_signal+0x6ca/0x12c0 kernel/signal.c:2900
 arch_do_signal_or_restart+0xc1/0x1300 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f6c21dbf48a
Code: Unable to access opcode bytes at RIP 0x7f6c21dbf460.
RSP: 002b:00007ffe7faba928 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f6c21dbf48a
RDX: 0000000000000061 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffe7faba990 R08: 00007ffe7faba93c R09: 00007ffe7fabad27
R10: 00007ffe7faba990 R11: 0000000000000212 R12: 00007ffe7faba93c
R13: 00000000000927c0 R14: 000000000005e1b1 R15: 00007ffe7fabb070
 </TASK>
Modules linked in:
---[ end trace 07b12697f4f5c7e4 ]---
RIP: 0010:klist_put lib/klist.c:212 [inline]
RIP: 0010:klist_del lib/klist.c:230 [inline]
RIP: 0010:klist_remove+0x144/0x2f0 lib/klist.c:249
Code: b6 05 4d 89 f4 49 c1 ec 03 43 80 3c 2c 00 74 08 4c 89 f7 e8 7e 46 c0 fd 4d 8b 3e 49 83 e7 fe 49 8d 7f 58 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 60 46 c0 fd 49 8b 47 58 48 89 44 24 08 4c
RSP: 0018:ffffc9000ca0f660 EFLAGS: 00010202
RAX: 000000000000000b RBX: ffff888023a49dc0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058
RBP: ffffc9000ca0f748 R08: dffffc0000000000 R09: fffffbfff18e70bd
R10: fffffbfff18e70bd R11: 1ffffffff18e70bc R12: 1ffff11003c1178c
R13: dffffc0000000000 R14: ffff88801e08bc60 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005603ebe5c010 CR3: 000000005c11c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	b6 05                	mov    $0x5,%dh
   2:	4d 89 f4             	mov    %r14,%r12
   5:	49 c1 ec 03          	shr    $0x3,%r12
   9:	43 80 3c 2c 00       	cmpb   $0x0,(%r12,%r13,1)
   e:	74 08                	je     0x18
  10:	4c 89 f7             	mov    %r14,%rdi
  13:	e8 7e 46 c0 fd       	call   0xfdc04696
  18:	4d 8b 3e             	mov    (%r14),%r15
  1b:	49 83 e7 fe          	and    $0xfffffffffffffffe,%r15
  1f:	49 8d 7f 58          	lea    0x58(%r15),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 05                	je     0x36
  31:	e8 60 46 c0 fd       	call   0xfdc04696
  36:	49 8b 47 58          	mov    0x58(%r15),%rax
  3a:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  3f:	4c                   	rex.WR

Crashes (44):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/01 05:23 linux-5.15.y cc5ec8769306 d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/06/28 00:59 linux-5.15.y 3dea0e7f549e fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/06/25 19:00 linux-5.15.y 1c700860e8bc 26d77996 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/05/07 18:36 linux-5.15.y 16fdf2c7111b dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/04/04 12:58 linux-5.15.y 0c935c049b5c 1c4febdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/03/28 20:12 linux-5.15.y 0c935c049b5c 9a1a9e31 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/03/21 21:53 linux-5.15.y 0c935c049b5c c6512ef7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/02/14 06:54 linux-5.15.y c16c81c81336 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/01/31 20:32 linux-5.15.y 003148680b79 aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2024/12/16 11:49 linux-5.15.y 963e654022cc eec85da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: unable to handle kernel paging request in device_move
2025/12/01 03:03 linux-5.15.y cc5ec8769306 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/11/10 19:59 linux-5.15.y cc5ec8769306 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/08/20 19:13 linux-5.15.y c79648372d02 0b9605c8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/08/19 06:30 linux-5.15.y c79648372d02 523f460e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/08/06 14:25 linux-5.15.y c79648372d02 ffe1dd46 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/07/16 23:42 linux-5.15.y 89950c454265 44f8051e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/07/15 06:17 linux-5.15.y 89950c454265 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/07/07 19:23 linux-5.15.y 3dea0e7f549e 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/07/04 05:38 linux-5.15.y 3dea0e7f549e 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/07/04 00:34 linux-5.15.y 3dea0e7f549e 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/07/01 19:03 linux-5.15.y 3dea0e7f549e 091a06cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/06/28 02:01 linux-5.15.y 3dea0e7f549e fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/06/26 16:20 linux-5.15.y 1c700860e8bc 803ce19b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/06/24 22:06 linux-5.15.y 1c700860e8bc 26d77996 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/06/19 01:27 linux-5.15.y 1c700860e8bc ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/06/02 00:48 linux-5.15.y 98f47d0e9b8c 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/05/12 22:18 linux-5.15.y 3b8db0e4f263 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/05/11 21:20 linux-5.15.y 3b8db0e4f263 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/04/14 06:18 linux-5.15.y f7347f400572 0bd6db41 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/04/05 21:30 linux-5.15.y 0c935c049b5c 1c65791e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/04/01 19:40 linux-5.15.y 0c935c049b5c b8645499 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/03/28 17:16 linux-5.15.y 0c935c049b5c 9a1a9e31 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/03/25 00:15 linux-5.15.y 0c935c049b5c 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/03/17 05:13 linux-5.15.y 0c935c049b5c e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/03/14 02:31 linux-5.15.y 0c935c049b5c e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/03/04 21:17 linux-5.15.y c16c81c81336 c3901742 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/02/08 08:07 linux-5.15.y c16c81c81336 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/02/04 10:26 linux-5.15.y c16c81c81336 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/02/03 14:47 linux-5.15.y c16c81c81336 a21a8419 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/01/24 16:57 linux-5.15.y 003148680b79 1293872d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2025/01/03 19:39 linux-5.15.y 91786f140358 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2024/12/24 00:24 linux-5.15.y 91786f140358 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2024/12/20 10:13 linux-5.15.y 91786f140358 0f61b415 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
2024/12/17 13:18 linux-5.15.y 963e654022cc f93b2b55 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in device_move
* Struck through repros no longer work on HEAD.