KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class

Status: upstream: reported on 2026/08/26 02:44
Reported-by: syzbot+aafeb7aa5585236caac6@syzkaller.appspotmail.com
First crash: 17h54m, last: 17h54m
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class prio:low rdma 11 syz, C 9 18h07m 3d21h 0/29 upstream: reported C repro on 2026/08/22 22:56

Sample crash report:
rtrs_client L2076: <s1>: Failed to resolve address, err: -19
rtrs_client L2619: <s1>: init_conns() failed: err=-19 path=<invalid address family>@ip:127.0.0.1 [:0]
==================================================================
BUG: KASAN: null-ptr-deref in do_trace_event_raw_event_rtrs_clt_conn_class drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:58 [inline]
BUG: KASAN: null-ptr-deref in trace_event_raw_event_rtrs_clt_conn_class+0x21c/0x408 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36
Read of size 255 at addr 0000000000000000 by task syz.0.518/6117

CPU: 0 PID: 6117 Comm: syz.0.518 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_report+0x40/0x68 mm/kasan/report.c:423
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memcpy+0x48/0x90 mm/kasan/shadow.c:65
 do_trace_event_raw_event_rtrs_clt_conn_class drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:58 [inline]
 trace_event_raw_event_rtrs_clt_conn_class+0x21c/0x408 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36
 __traceiter_rtrs_clt_close_conns+0x74/0xc8 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:77
 trace_rtrs_clt_close_conns drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:77 [inline]
 rtrs_clt_close_conns+0x38c/0x45c drivers/infiniband/ulp/rtrs/rtrs-clt.c:1953
 rtrs_clt_open+0xac8/0xeac drivers/infiniband/ulp/rtrs/rtrs-clt.c:2836
 find_and_get_or_create_sess drivers/block/rnbd/rnbd-clt.c:1267 [inline]
 rnbd_clt_map_device+0xe34/0x23a8 drivers/block/rnbd/rnbd-clt.c:1567
 rnbd_clt_map_device_store+0x8d8/0xab4 drivers/block/rnbd/rnbd-clt-sysfs.c:602
 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x200/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/26 02:44 linux-6.1.y 05208478041c 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/26 02:44 linux-6.1.y 05208478041c 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
* Struck through repros no longer work on HEAD.