syzbot
kernel BUG in set_ps_flags
Status:
moderation: reported on 2026/03/15 15:30
Subsystems:
fs
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+752fac0e14c568144eb1@syzkaller.appspotmail.com
First crash: 146d, last: 39d
▶
▼
✨ AI Jobs (2)
| ID |
Workflow |
Result |
Correct |
Bug |
Created |
Started |
Finished |
Revision |
Error |
| 4a901236 |
assessment-security |
DenialOfService: ❌
Exploitable: ❌
FilesystemTrigger: ❌
NetworkTrigger: ❌
PeripheralTrigger: ❌
RemoteTrigger: ❌
Unprivileged: ❌
UserNamespace: ❌
VMGuestTrigger: ❌
VMHostTrigger: ❌
|
❓ |
kernel BUG in set_ps_flags |
2026/05/31 07:09 |
2026/05/31 07:09 |
2026/05/31 08:27 |
6b4a8443 |
|
| 4bdc1f49 |
assessment-security |
|
💥 |
kernel BUG in set_ps_flags |
2026/05/14 14:36 |
2026/05/14 14:36 |
2026/05/14 14:38 |
6ccb967e |
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/9f7bc6f888dda60e12...
truncated to first 200 bytes; open job for full error
|
Sample crash report:
arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x139/0x6f0 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x652/0x840 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at ./include/linux/page-flags.h:345!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 11490 Comm: syz.0.1115 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_idle include/linux/page-flags.h:667 [inline]
RIP: 0010:set_ps_flags+0x242/0x290 mm/util.c:1298
Code: 03 80 3c 02 00 0f 84 5f fe ff ff e8 18 60 24 00 e9 55 fe ff ff e8 0e e7 b4 ff 48 c7 c6 a0 c1 be 8b 48 89 df e8 5f 89 05 00 90 <0f> 0b e8 c7 5f 24 00 e9 ed fd ff ff e8 ed 5f 24 00 e9 57 fe ff ff
RSP: 0018:ffffc90005b1f8f8 EFLAGS: 00010246
RAX: 0000000000080000 RBX: ffffea0000e35200 RCX: ffffc900077c9000
RDX: 0000000000080000 RSI: ffffffff82598ea8 RDI: ffff8880334223c4
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90005b1f9d0
R13: 0000000000000000 R14: ffffea0000e35234 R15: dffffc0000000000
FS: 00007fa0ab0606c0(0000) GS:ffff8881242ed000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b34919ff8 CR3: 0000000077522000 CR4: 00000000003526f0
Call Trace:
<TASK>
snapshot_page+0x463/0x560 mm/util.c:1334
get_kpage_count+0x94/0x240 fs/proc/page.c:50
kpage_read.isra.0+0x1b8/0x2b0 fs/proc/page.c:93
pde_read fs/proc/inode.c:308 [inline]
proc_reg_read+0x120/0x330 fs/proc/inode.c:318
do_loop_readv_writev fs/read_write.c:848 [inline]
do_loop_readv_writev fs/read_write.c:836 [inline]
vfs_readv+0x5d8/0x8d0 fs/read_write.c:1021
do_readv+0x13e/0x340 fs/read_write.c:1081
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x840 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa0aa19ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa0ab060028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00007fa0aa416090 RCX: 00007fa0aa19ce59
RDX: 0000000100000007 RSI: 00002000000001c0 RDI: 0000000000000003
RBP: 00007fa0aa232e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa0aa416128 R14: 00007fa0aa416090 R15: 00007ffe29827908
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_idle include/linux/page-flags.h:667 [inline]
RIP: 0010:set_ps_flags+0x242/0x290 mm/util.c:1298
Code: 03 80 3c 02 00 0f 84 5f fe ff ff e8 18 60 24 00 e9 55 fe ff ff e8 0e e7 b4 ff 48 c7 c6 a0 c1 be 8b 48 89 df e8 5f 89 05 00 90 <0f> 0b e8 c7 5f 24 00 e9 ed fd ff ff e8 ed 5f 24 00 e9 57 fe ff ff
RSP: 0018:ffffc90005b1f8f8 EFLAGS: 00010246
RAX: 0000000000080000 RBX: ffffea0000e35200 RCX: ffffc900077c9000
RDX: 0000000000080000 RSI: ffffffff82598ea8 RDI: ffff8880334223c4
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90005b1f9d0
R13: 0000000000000000 R14: ffffea0000e35234 R15: dffffc0000000000
FS: 00007fa0ab0606c0(0000) GS:ffff8881242ed000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff7e2bea2f8 CR3: 0000000077522000 CR4: 00000000003526f0
* Struck through repros no longer work on HEAD.