Internal error in phram_read

Status: upstream: reported C repro on 2026/10/16 10:24
Reported-by: syzbot+74c7865bee5ae5a63eac@syzkaller.appspotmail.com
First crash: 1d14h, last: 1d13h

Sample crash report:
Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4556 Comm: syz.0.17 Tainted: G   M               syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 22400005 (nzCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __memcpy+0x90/0x250 arch/arm64/lib/memcpy.S:112
lr : memcpy+0x74/0x90 mm/kasan/shadow.c:69
sp : ffff8000226f6e30
x29: ffff8000226f6e30 x28: dfff800000000000 x27: ffff8000226f6f90
x26: ffff0000d448b000 x25: ffff0000d448b000 x24: dfff800000000000
x23: ffff0000d448b190 x22: ffff80000c5eb8a4 x21: ffff8000226f71b0
x20: ffff800040000000 x19: 0000000000000044 x18: 1fffe00033c1c97e
x17: 00000000ffff0000 x16: ffff8000082dd38c x15: ffff8000089ba740
x14: ffff7000044dee3e x13: 1ffff000044dee36 x12: 0000000000000004
x11: ffffffffffffffff x10: dfff800000000000 x9 : 0000000000000004
x8 : 0000000000000001 x7 : 0000000000000000 x6 : ffff80000805a7f8
x5 : ffff8000226f71f4 x4 : ffff800040000044 x3 : ffff80000c5eb8a4
x2 : 0000000000000044 x1 : ffff800040000000 x0 : ffff8000226f71b0
Call trace:
 __memcpy+0x90/0x250 arch/arm64/lib/memcpy.S:107
 phram_read+0x64/0x98 drivers/mtd/devices/phram.c:69
 mtd_read_oob_std drivers/mtd/mtdcore.c:1565 [inline]
 mtd_read_oob+0x37c/0x65c drivers/mtd/mtdcore.c:1674
 mtd_read+0xd0/0x154 drivers/mtd/mtdcore.c:1470
 scan_header drivers/mtd/ftl.c:164 [inline]
 ftl_add_mtd+0x1e8/0x1714 drivers/mtd/ftl.c:1020
 blktrans_notify_add+0xa8/0xf8 drivers/mtd/mtd_blkdevs.c:470
 add_mtd_device+0xdcc/0x130c drivers/mtd/mtdcore.c:745
 mtd_device_parse_register+0x798/0x8f8 drivers/mtd/mtdcore.c:1044
 register_device+0x344/0x560 drivers/mtd/devices/phram.c:161
 phram_setup+0x638/0x880 drivers/mtd/devices/phram.c:323
 phram_param_call+0x34/0x90 drivers/mtd/devices/phram.c:348
 param_attr_store+0x1cc/0x2ac kernel/params.c:585
 module_attr_store+0x6c/0x94 kernel/params.c:905
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 382e6808 381ff0aa d65f03c0 d503201f (a9401c26) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	382e6808 	strb	w8, [x0, x14]
   4:	381ff0aa 	sturb	w10, [x5, #-1]
   8:	d65f03c0 	ret
   c:	d503201f 	nop
* 10:	a9401c26 	ldp	x6, x7, [x1] <-- trapping instruction

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/16 10:46 linux-6.1.y 79807e970724 3f2522c6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 Internal error in phram_read
2026/10/16 10:23 linux-6.1.y 79807e970724 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 Internal error in phram_read
2026/10/16 10:23 linux-6.1.y 79807e970724 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 Internal error in phram_read
* Struck through repros no longer work on HEAD.