BUG: corrupted list in __dentry_kill

Status: upstream: reported C repro on 2024/03/27 10:55
Reported-by: syzbot+b64ce08e31a10a8d28c6@syzkaller.appspotmail.com
First crash: 952d, last: 2d04h
Fix bisection: the issue occurs on the latest tested release (bisect log)
  
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 BUG: corrupted list in __dentry_kill (2) origin:downstream 8 syz, C 217 22h53m 282d 0/2 upstream: reported C repro on 2026/01/26 16:31
upstream BUG: corrupted list in __dentry_kill fs 8 syz, C 35 3120d 3140d 5/29 fixed on 2018/05/08 18:30
android-54 BUG: corrupted list in __dentry_kill (2) 8 syz, C 11 543d 952d 0/2 upstream: reported C repro on 2024/03/27 11:32
android-6-1 BUG: corrupted list in __dentry_kill (3) origin:downstream 8 syz, C 182 15h20m 276d 0/2 upstream: reported C repro on 2026/02/01 13:41
linux-4.19 BUG: corrupted list in __dentry_kill 8 1 2393d 2393d 0/1 auto-closed as invalid on 2020/08/15 07:34
android-5-15 BUG: corrupted list in __dentry_kill 8 1 675d 675d 0/2 auto-obsoleted due to no activity on 2025/03/30 08:49
upstream BUG: corrupted list in __dentry_kill (2) driver-core fs 8 syz, C done 4945 2520d 2520d 15/29 fixed on 2020/02/18 14:31
android-6-1 BUG: corrupted list in __dentry_kill (2) 8 2 563d 633d 0/2 auto-obsoleted due to no activity on 2025/07/20 02:58
android-54 BUG: corrupted list in __dentry_kill 8 1 1311d 1311d 0/2 auto-obsoleted due to no activity on 2023/08/01 17:00
android-6-1 BUG: corrupted list in __dentry_kill 8 2 817d 845d 0/2 auto-obsoleted due to no activity on 2024/11/07 13:03
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2025/07/15 05:42 11m retest repro android13-5.10-lts report log
2025/04/27 16:45 7m retest repro android13-5.10-lts report log
2025/01/26 10:52 5m retest repro android13-5.10-lts report log
2024/10/15 03:35 0m retest repro android13-5.10-lts error
2024/08/04 21:20 10m retest repro android13-5.10-lts report log
2024/04/10 19:53 5m retest repro android13-5.10-lts report log

Sample crash report:
overlayfs: failed to create directory ./bus/work (errno: 17); mounting read-only
list_del corruption. prev->next should be ffff8881264d76f0, but was ffff88811acc53d0
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3994 Comm: syz.5.1209 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__list_del_entry_valid+0x10c/0x120 lib/list_debug.c:59
Code: 48 89 de e8 a6 2f 32 02 0f 0b 48 c7 c7 a0 32 20 85 48 89 de e8 95 2f 32 02 0f 0b 48 c7 c7 00 33 20 85 48 89 de e8 84 2f 32 02 <0f> 0b 48 c7 c7 60 33 20 85 48 89 de e8 73 2f 32 02 0f 0b 00 55 48
RSP: 0018:ffffc90001d17d20 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881264d76f0 RCX: dc18c9e420362f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90001d17d40 R08: dffffc0000000000 R09: ffffed103ee2a5f8
R10: ffffed103ee2a5f8 R11: 1ffff1103ee2a5f7 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88811acc53d0 R15: ffff8881265eee60
FS:  00007f5f443306c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff319f8988 CR3: 00000001207f8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_del_entry include/linux/list.h:132 [inline]
 dentry_unlist fs/dcache.c:526 [inline]
 __dentry_kill+0x24c/0x650 fs/dcache.c:579
 dentry_kill+0xc0/0x2a0 fs/dcache.c:-1
 dput+0x42/0x80 fs/dcache.c:883
 __fput+0x4fe/0x770 fs/file_table.c:294
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f5f444c0749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5f44330038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: 0000000000000000 RBX: 00007f5f44716fa0 RCX: 00007f5f444c0749
RDX: 0000200000000b80 RSI: 0000200000000000 RDI: 0000000000000000
RBP: 00007f5f44544f91 R08: 0000200000000a80 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5f44717038 R14: 00007f5f44716fa0 R15: 00007fff75f4b3c8
Modules linked in:
---[ end trace 0e6e1e1342d4e3a4 ]---
RIP: 0010:__list_del_entry_valid+0x10c/0x120 lib/list_debug.c:59
Code: 48 89 de e8 a6 2f 32 02 0f 0b 48 c7 c7 a0 32 20 85 48 89 de e8 95 2f 32 02 0f 0b 48 c7 c7 00 33 20 85 48 89 de e8 84 2f 32 02 <0f> 0b 48 c7 c7 60 33 20 85 48 89 de e8 73 2f 32 02 0f 0b 00 55 48
RSP: 0018:ffffc90001d17d20 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881264d76f0 RCX: dc18c9e420362f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90001d17d40 R08: dffffc0000000000 R09: ffffed103ee2a5f8
R10: ffffed103ee2a5f8 R11: 1ffff1103ee2a5f7 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88811acc53d0 R15: ffff8881265eee60
FS:  00007f5f443306c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff319f8988 CR3: 00000001207f8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (663):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/16 18:36 android13-5.10-lts e253c52bbdfc d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/12/16 11:34 android13-5.10-lts 9286af17ed5f d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/09/24 17:07 android13-5.10-lts 911f602c2237 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (clean fs)] [mounted in repro #2 (corrupt fs)] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/09/24 15:22 android13-5.10-lts 911f602c2237 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (clean fs)] [mounted in repro #2 (corrupt fs)] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/09/24 14:35 android13-5.10-lts 911f602c2237 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (clean fs)] [mounted in repro #2 (corrupt fs)] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2025/08/29 06:13 android13-5.10-lts 1154f779f3f3 d401b9d7 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2024/03/27 10:50 android13-5.10-lts e7daca75b4c3 454571b6 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/02/06 19:28 android13-5.10-lts 58c592510fcd 97745f52 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/01/02 02:09 android13-5.10-lts e253c52bbdfc d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/11/03 06:03 android13-5.10-lts f61a392235e0 6969b601 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/11/01 21:29 android13-5.10-lts f61a392235e0 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/11/01 17:36 android13-5.10-lts f61a392235e0 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/30 03:43 android13-5.10-lts f61a392235e0 b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/29 23:09 android13-5.10-lts f61a392235e0 b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/29 21:34 android13-5.10-lts f61a392235e0 b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/29 15:53 android13-5.10-lts f61a392235e0 b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/29 09:54 android13-5.10-lts f61a392235e0 b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/28 19:01 android13-5.10-lts f61a392235e0 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/27 20:24 android13-5.10-lts f61a392235e0 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/27 13:04 android13-5.10-lts f61a392235e0 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/27 04:03 android13-5.10-lts f61a392235e0 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/27 01:16 android13-5.10-lts f61a392235e0 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/26 14:56 android13-5.10-lts f61a392235e0 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/25 19:55 android13-5.10-lts f61a392235e0 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/25 10:10 android13-5.10-lts d3231d350eb8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/25 07:39 android13-5.10-lts d3231d350eb8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/24 17:20 android13-5.10-lts d3231d350eb8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/24 11:01 android13-5.10-lts d3231d350eb8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/24 07:42 android13-5.10-lts d3231d350eb8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/24 02:44 android13-5.10-lts d3231d350eb8 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/22 21:59 android13-5.10-lts d3231d350eb8 b55fad29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/22 10:08 android13-5.10-lts 30b93835619a 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/21 04:46 android13-5.10-lts 30b93835619a df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/21 01:46 android13-5.10-lts 30b93835619a df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/20 04:43 android13-5.10-lts 30b93835619a 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/20 00:44 android13-5.10-lts 30b93835619a 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/19 11:12 android13-5.10-lts 30b93835619a 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/18 19:14 android13-5.10-lts 30b93835619a 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/16 10:56 android13-5.10-lts f5932bf046b5 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/11 20:46 android13-5.10-lts b677692288f7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/11 03:44 android13-5.10-lts b677692288f7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/10 13:13 android13-5.10-lts b677692288f7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/10 04:46 android13-5.10-lts b677692288f7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/09 16:31 android13-5.10-lts b677692288f7 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/09 00:17 android13-5.10-lts b677692288f7 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/08 11:53 android13-5.10-lts b677692288f7 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/07 21:47 android13-5.10-lts b677692288f7 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/06 08:20 android13-5.10-lts 207de56dd089 f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/06 05:42 android13-5.10-lts 207de56dd089 f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/04 05:28 android13-5.10-lts 8ddf8d57c49c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/04 03:43 android13-5.10-lts 8ddf8d57c49c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/03 06:21 android13-5.10-lts df334e630ed3 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2026/10/03 02:32 android13-5.10-lts df334e630ed3 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
2024/03/27 10:29 android13-5.10-lts e7daca75b4c3 454571b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: corrupted list in __dentry_kill
* Struck through repros no longer work on HEAD.