BUG: corrupted list in __dentry_kill

Status: upstream: reported C repro on 2024/03/27 10:55
Reported-by: syzbot+b64ce08e31a10a8d28c6@syzkaller.appspotmail.com
First crash: 860d, last: 7m
Fix bisection: the issue occurs on the latest tested release (bisect log)
  
Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 BUG: corrupted list in __dentry_kill (2) origin:downstream 8 syz, C 127 5h47m 190d 0/2 upstream: reported C repro on 2026/01/26 16:31
upstream BUG: corrupted list in __dentry_kill fs 8 syz, C 35 3027d 3047d 5/29 fixed on 2018/05/08 18:30
android-54 BUG: corrupted list in __dentry_kill (2) 8 syz, C 11 451d 860d 0/2 upstream: reported C repro on 2024/03/27 11:32
android-6-1 BUG: corrupted list in __dentry_kill (3) origin:downstream 8 syz, C 105 1d14h 184d 0/2 upstream: reported C repro on 2026/02/01 13:41
linux-4.19 BUG: corrupted list in __dentry_kill 8 1 2300d 2300d 0/1 auto-closed as invalid on 2020/08/15 07:34
android-5-15 BUG: corrupted list in __dentry_kill 8 1 582d 582d 0/2 auto-obsoleted due to no activity on 2025/03/30 08:49
upstream BUG: corrupted list in __dentry_kill (2) fs 8 syz, C done 4945 2427d 2427d 15/29 fixed on 2020/02/18 14:31
android-6-1 BUG: corrupted list in __dentry_kill (2) 8 2 470d 540d 0/2 auto-obsoleted due to no activity on 2025/07/20 02:58
android-54 BUG: corrupted list in __dentry_kill 8 1 1219d 1219d 0/2 auto-obsoleted due to no activity on 2023/08/01 17:00
android-6-1 BUG: corrupted list in __dentry_kill 8 2 725d 752d 0/2 auto-obsoleted due to no activity on 2024/11/07 13:03
Last patch testing requests (6)
Created Duration User Patch Repo Result
2025/07/15 05:42 11m retest repro android13-5.10-lts report log
2025/04/27 16:45 7m retest repro android13-5.10-lts report log
2025/01/26 10:52 5m retest repro android13-5.10-lts report log
2024/10/15 03:35 0m retest repro android13-5.10-lts error
2024/08/04 21:20 10m retest repro android13-5.10-lts report log
2024/04/10 19:53 5m retest repro android13-5.10-lts report log

Sample crash report:
overlayfs: failed to create directory ./bus/work (errno: 17); mounting read-only
list_del corruption. prev->next should be ffff8881264d76f0, but was ffff88811acc53d0
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3994 Comm: syz.5.1209 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__list_del_entry_valid+0x10c/0x120 lib/list_debug.c:59
Code: 48 89 de e8 a6 2f 32 02 0f 0b 48 c7 c7 a0 32 20 85 48 89 de e8 95 2f 32 02 0f 0b 48 c7 c7 00 33 20 85 48 89 de e8 84 2f 32 02 <0f> 0b 48 c7 c7 60 33 20 85 48 89 de e8 73 2f 32 02 0f 0b 00 55 48
RSP: 0018:ffffc90001d17d20 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881264d76f0 RCX: dc18c9e420362f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90001d17d40 R08: dffffc0000000000 R09: ffffed103ee2a5f8
R10: ffffed103ee2a5f8 R11: 1ffff1103ee2a5f7 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88811acc53d0 R15: ffff8881265eee60
FS:  00007f5f443306c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff319f8988 CR3: 00000001207f8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_del_entry include/linux/list.h:132 [inline]
 dentry_unlist fs/dcache.c:526 [inline]
 __dentry_kill+0x24c/0x650 fs/dcache.c:579
 dentry_kill+0xc0/0x2a0 fs/dcache.c:-1
 dput+0x42/0x80 fs/dcache.c:883
 __fput+0x4fe/0x770 fs/file_table.c:294
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f5f444c0749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5f44330038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: 0000000000000000 RBX: 00007f5f44716fa0 RCX: 00007f5f444c0749
RDX: 0000200000000b80 RSI: 0000200000000000 RDI: 0000000000000000
RBP: 00007f5f44544f91 R08: 0000200000000a80 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5f44717038 R14: 00007f5f44716fa0 R15: 00007fff75f4b3c8
Modules linked in:
---[ end trace 0e6e1e1342d4e3a4 ]---
RIP: 0010:__list_del_entry_valid+0x10c/0x120 lib/list_debug.c:59
Code: 48 89 de e8 a6 2f 32 02 0f 0b 48 c7 c7 a0 32 20 85 48 89 de e8 95 2f 32 02 0f 0b 48 c7 c7 00 33 20 85 48 89 de e8 84 2f 32 02 <0f> 0b 48 c7 c7 60 33 20 85 48 89 de e8 73 2f 32 02 0f 0b 00 55 48
RSP: 0018:ffffc90001d17d20 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881264d76f0 RCX: dc18c9e420362f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90001d17d40 R08: dffffc0000000000 R09: ffffed103ee2a5f8
R10: ffffed103ee2a5f8 R11: 1ffff1103ee2a5f7 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88811acc53d0 R15: ffff8881265eee60
FS:  00007f5f443306c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff319f8988 CR3: 00000001207f8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (536):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/16 18:36 android13-5.10-lts e253c52bbdfc d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/12/16 11:34 android13-5.10-lts 9286af17ed5f d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/09/24 17:07 android13-5.10-lts 911f602c2237 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (clean fs)] [mounted in repro #2 (corrupt fs)] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/09/24 15:22 android13-5.10-lts 911f602c2237 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (clean fs)] [mounted in repro #2 (corrupt fs)] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/09/24 14:35 android13-5.10-lts 911f602c2237 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (clean fs)] [mounted in repro #2 (corrupt fs)] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/08/29 06:13 android13-5.10-lts 1154f779f3f3 d401b9d7 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2024/03/27 10:50 android13-5.10-lts e7daca75b4c3 454571b6 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/02/06 19:28 android13-5.10-lts 58c592510fcd 97745f52 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/01/02 02:09 android13-5.10-lts e253c52bbdfc d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/08/04 17:02 android13-5.10-lts 0f73d4924a74 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/08/04 09:25 android13-5.10-lts 0f73d4924a74 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/08/04 06:16 android13-5.10-lts 0f73d4924a74 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/08/02 22:12 android13-5.10-lts 50b3a256e550 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/08/02 12:29 android13-5.10-lts 50b3a256e550 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/08/01 01:00 android13-5.10-lts 50b3a256e550 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/30 06:38 android13-5.10-lts 50b3a256e550 6ef5c1e2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/29 12:00 android13-5.10-lts 50b3a256e550 19622d9d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/26 22:49 android13-5.10-lts 50b3a256e550 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/26 08:54 android13-5.10-lts 50b3a256e550 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/25 23:58 android13-5.10-lts 50b3a256e550 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/24 08:22 android13-5.10-lts 50b3a256e550 544adce9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/23 11:11 android13-5.10-lts 50b3a256e550 881ce5c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/23 03:38 android13-5.10-lts 50b3a256e550 881ce5c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/22 17:04 android13-5.10-lts 50b3a256e550 4a865b71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/22 04:28 android13-5.10-lts 50b3a256e550 b561ce9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/22 01:20 android13-5.10-lts 50b3a256e550 b561ce9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/20 23:55 android13-5.10-lts 50b3a256e550 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/20 17:45 android13-5.10-lts 50b3a256e550 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/19 21:20 android13-5.10-lts 50b3a256e550 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/19 19:22 android13-5.10-lts 50b3a256e550 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/19 01:24 android13-5.10-lts 50b3a256e550 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/17 22:40 android13-5.10-lts 50b3a256e550 8aaff637 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/17 11:54 android13-5.10-lts 50b3a256e550 7f27c57a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/16 21:15 android13-5.10-lts 50b3a256e550 71b49442 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/16 05:18 android13-5.10-lts 50b3a256e550 27a8bd60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/15 13:55 android13-5.10-lts 50b3a256e550 a4ed0f4f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/15 07:42 android13-5.10-lts 50b3a256e550 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/15 05:28 android13-5.10-lts 50b3a256e550 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/15 01:45 android13-5.10-lts 50b3a256e550 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/14 12:49 android13-5.10-lts 50b3a256e550 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/13 21:39 android13-5.10-lts 50b3a256e550 cc4833d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/13 18:45 android13-5.10-lts 50b3a256e550 cc4833d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/13 03:37 android13-5.10-lts 50b3a256e550 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/13 00:59 android13-5.10-lts 50b3a256e550 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/12 21:20 android13-5.10-lts 50b3a256e550 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/11 18:23 android13-5.10-lts 50b3a256e550 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/11 13:29 android13-5.10-lts 50b3a256e550 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/11 10:07 android13-5.10-lts 50b3a256e550 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/10 21:35 android13-5.10-lts 50b3a256e550 99e64375 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/10 18:52 android13-5.10-lts 50b3a256e550 99e64375 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/10 10:23 android13-5.10-lts 50b3a256e550 4167ee25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/09 09:03 android13-5.10-lts 50b3a256e550 b9f1ceaa .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/07 06:11 android13-5.10-lts 88f75e4d3eca 8e71ce95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/06 09:43 android13-5.10-lts 1bb06dbd8c78 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/07/06 07:59 android13-5.10-lts 1bb06dbd8c78 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2024/03/27 10:29 android13-5.10-lts e7daca75b4c3 454571b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
* Struck through repros no longer work on HEAD.