syzbot


KASAN: null-ptr-deref Read in __wait_on_buffer

Status: upstream: reported on 2025/09/14 17:21
Reported-by: syzbot+e72c01cff764acdfa94a@syzkaller.appspotmail.com
First crash: 49d, last: 7d23h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Read in __wait_on_buffer fs 11 5 782d 934d 0/29 auto-obsoleted due to no activity on 2023/12/22 05:12

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: null-ptr-deref in test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
BUG: KASAN: null-ptr-deref in wait_on_bit_io include/linux/wait_bit.h:99 [inline]
BUG: KASAN: null-ptr-deref in __wait_on_buffer+0x30/0x90 fs/buffer.c:122
Read of size 8 at addr 0000000000000000 by task kworker/1:16/4898

CPU: 1 PID: 4898 Comm: kworker/1:16 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: reiserfs/loop1 flush_async_commits
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:438 [inline]
 kasan_report+0xd5/0x130 mm/kasan/report.c:451
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x27b/0x290 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
 wait_on_bit_io include/linux/wait_bit.h:99 [inline]
 __wait_on_buffer+0x30/0x90 fs/buffer.c:122
 flush_commit_list+0xf3c/0x1d70 fs/reiserfs/journal.c:1069
 flush_async_commits+0xa0/0xc0 fs/reiserfs/journal.c:3552
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
==================================================================
Kernel panic - not syncing: KASAN: panic_on_warn set ...
CPU: 1 PID: 4898 Comm: kworker/1:16 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: reiserfs/loop1 flush_async_commits
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 panic+0x2c9/0x7f0 kernel/panic.c:309
 check_panic_on_warn+0x80/0xa0 kernel/panic.c:229
 end_report+0x6d/0xf0 mm/kasan/report.c:121
 __kasan_report mm/kasan/report.c:441 [inline]
 kasan_report+0x102/0x130 mm/kasan/report.c:451
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x27b/0x290 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
 wait_on_bit_io include/linux/wait_bit.h:99 [inline]
 __wait_on_buffer+0x30/0x90 fs/buffer.c:122
 flush_commit_list+0xf3c/0x1d70 fs/reiserfs/journal.c:1069
 flush_async_commits+0xa0/0xc0 fs/reiserfs/journal.c:3552
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/26 11:33 linux-5.15.y ac56c046adf4 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: null-ptr-deref Read in __wait_on_buffer
2025/09/14 17:21 linux-5.15.y 43bb85222e53 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: null-ptr-deref Read in __wait_on_buffer
* Struck through repros no longer work on HEAD.