WARNING in pci_scan_single_device

Status: upstream: reported on 2026/08/23 11:33
Reported-by: syzbot+c365cfd1bd16dc4dc6db@syzkaller.appspotmail.com
First crash: 5d16h, last: 5d16h
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in pci_scan_single_device pci -1 1 456d 452d 0/29 auto-obsoleted due to no activity on 2025/09/06 17:08
upstream WARNING in pci_scan_single_device (2) prio:high pci -1 syz, C 104 13h57m 220d 0/29 upstream: reported C repro on 2026/01/21 00:08

Sample crash report:
pci (null): [1af4:1005] type 00 class 0x00ff00
pci (null): BAR 0 [io  0x1000-0x101f]
pci (null): BAR 1 [mem 0x10110080-0x101100bf]
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4556 at drivers/pci/probe.c:2631 pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
Modules linked in:
CPU: 1 PID: 4556 Comm: syz.2.35 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
lr : pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
sp : ffff8000219d7660
x29: ffff8000219d7720 x28: ffff0000dd1829e1 x27: dfff800000000000
x26: ffff70000433aed0 x25: 1fffe0001ba3053c x24: ffff0000dd182090
x23: 1fffe000188cfa06 x22: ffff0000dd182008 x21: ffff0000dd1829e0
x20: ffff0000c08e6c00 x19: 00000000ffffffea x18: 1fffe00033e7217e
x17: ffff80001539d000 x16: ffff8000082dd264 x15: ffff8000089b6234
x14: 0000000000000001 x13: 1fffe0001ba30421 x12: 0000000000000000
x11: ff0080000ad9969c x10: 0000000000000000 x9 : ffff80000ad9969c
x8 : ffff0000c7880000 x7 : ffff80000805a700 x6 : ffff80000805a910
x5 : ffff0000eb199178 x4 : ffff8000219d7310 x3 : ffff800011a490d0
x2 : 0000000000000001 x1 : 00000000ffffffea x0 : 0000000000000000
Call trace:
 pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
 pci_scan_single_device+0x37c/0x44c drivers/pci/probe.c:2648
 pci_scan_slot+0x198/0x578 drivers/pci/probe.c:2731
 pci_scan_child_bus_extend+0x78/0x858 drivers/pci/probe.c:2950
 pci_scan_child_bus drivers/pci/probe.c:3064 [inline]
 pci_rescan_bus+0x24/0x4c drivers/pci/probe.c:3342
 rescan_store+0xd0/0x158 drivers/pci/pci-sysfs.c:465
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4280
hardirqs last  enabled at (4279): [<ffff8000088f5a88>] kasan_quarantine_put+0xc4/0x200 mm/kasan/quarantine.c:242
hardirqs last disabled at (4280): [<ffff800011b98ef4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (3358): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (3358): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (3281): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
pci (null): BAR 1 [mem 0x10110080-0x101100bf]: assigned
pci (null): BAR 0 [io  0x1000-0x101f]: assigned
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4556 at fs/sysfs/file.c:570 sysfs_create_bin_file+0x134/0x33c fs/sysfs/file.c:570
Modules linked in:
CPU: 1 PID: 4556 Comm: syz.2.35 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : sysfs_create_bin_file+0x134/0x33c fs/sysfs/file.c:570
lr : sysfs_create_bin_file+0x300/0x33c fs/sysfs/file.c:570
sp : ffff8000219d7780
x29: ffff8000219d7810 x28: ffff8000219d7b68 x27: dfff800000000000
x26: dfff800000000000 x25: ffff70000433aef4 x24: 0000000000000020
x23: 1fffe0001ba30420 x22: ffff8000219d77a0 x21: ffff0000dd182100
x20: ffff0000dd1820d0 x19: ffff0000d8202300 x18: 1fffe00033e7217e
x17: ffff80001539d000 x16: ffff800011b9ccb8 x15: 0000000000000000
x14: 0000000000000003 x13: 1ffff0000433aebc x12: 0000000000000000
x11: ff00800008be8480 x10: 0000000000000000 x9 : ffff800008be8480
x8 : ffff0000c7880000 x7 : 0000000000000000 x6 : 656372756f736572
x5 : ffff0000d8202360 x4 : 0000000000000000 x3 : 0000000000000010
x2 : 0000000000000008 x1 : ffff0000d8202300 x0 : ffff0000dd1820d0
Call trace:
 sysfs_create_bin_file+0x134/0x33c fs/sysfs/file.c:570
 pci_create_attr+0x2e4/0x458 drivers/pci/pci-sysfs.c:1250
 pci_create_resource_files+0x108/0x64c drivers/pci/pci-sysfs.c:1282
 pci_create_sysfs_dev_files+0x30/0x4c drivers/pci/pci-sysfs.c:1538
 pci_bus_add_device+0x34/0x118 drivers/pci/bus.c:340
 pci_bus_add_devices+0x84/0x198 drivers/pci/bus.c:368
 pci_rescan_bus+0x38/0x4c drivers/pci/probe.c:3344
 rescan_store+0xd0/0x158 drivers/pci/pci-sysfs.c:465
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4792
hardirqs last  enabled at (4791): [<ffff800011b9ae9c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (4791): [<ffff800011b9ae9c>] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (4792): [<ffff800011b98ef4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (3358): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (3358): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (3281): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address dfff800000000021
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000021] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4556 Comm: syz.2.35 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __device_attach+0xac/0x3d8 drivers/base/dd.c:1010
lr : device_lock include/linux/device.h:885 [inline]
lr : __device_attach+0x88/0x3d8 drivers/base/dd.c:1009
sp : ffff8000219d7860
x29: ffff8000219d78b0 x28: ffff8000219d7b68 x27: 1fffe0001ec38680
x26: 0000000000000000 x25: ffff0000c2e92850 x24: dfff800000000000
x23: ffff70000433af0c x22: 0000000000000108 x21: 0000000000000000
x20: ffff8000219d7860 x19: ffff0000dd1820d0 x18: 1fffe00033e7217e
x17: ffff80001539d000 x16: ffff800011b9ccb8 x15: 0000000000000000
x14: 0000000000000001 x13: 1ffff0000433aec0 x12: 0000000000000000
x11: ff0080000a976be0 x10: 0000000000000001 x9 : 3503de968dbe9c00
x8 : 0000000000000021 x7 : ffff80000bfd03b4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082d44d0
x2 : ffff0000c7880000 x1 : ffff8000121f2080 x0 : 0000000000000000
Call trace:
 __device_attach+0xac/0x3d8 drivers/base/dd.c:1010
 device_attach+0x24/0x34 drivers/base/dd.c:1077
 pci_bus_add_device+0x6c/0x118 drivers/pci/bus.c:345
 pci_bus_add_devices+0x84/0x198 drivers/pci/bus.c:368
 pci_rescan_bus+0x38/0x4c drivers/pci/probe.c:3344
 rescan_store+0xd0/0x158 drivers/pci/pci-sysfs.c:465
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 97249277 f94002da 91042356 d343fec8 (38f86908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	97249277 	bl	0xfffffffffc9249dc
   4:	f94002da 	ldr	x26, [x22]
   8:	91042356 	add	x22, x26, #0x108
   c:	d343fec8 	lsr	x8, x22, #3
* 10:	38f86908 	ldrsb	w8, [x8, x24] <-- trapping instruction

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/23 11:33 linux-6.1.y 7e6e67054721 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in pci_scan_single_device
* Struck through repros no longer work on HEAD.