syzbot
panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
Status:
fixed on 2025/07/29 23:20
Reported-by: syzbot+fb35cce6a6f5075a6692@syzkaller.appspotmail.com
Fix commit:
2bc355c0182a
ufs: Pass the new parent inode number to ufs_dirrewrite()
First crash: 403d, last: 402d
Sample crash report:
panic: handle_workitem_remove: directory ino 94 negative i_nlink -1
cpuid = 0
time = 11
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056c527d0
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056c52930
vpanic() at vpanic+0x257/frame 0xfffffe0056c52af0
panic() at panic+0xb5/frame 0xfffffe0056c52bb0
handle_workitem_remove() at handle_workitem_remove+0xd72/frame 0xfffffe0056c52cf0
process_worklist_item() at process_worklist_item+0x525/frame 0xfffffe0056c52e40
softdep_process_worklist() at softdep_process_worklist+0xfd/frame 0xfffffe0056c52e90
softdep_flush() at softdep_flush+0x1a4/frame 0xfffffe0056c52ef0
fork_exit() at fork_exit+0xcc/frame 0xfffffe0056c52f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0056c52f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 14 tid 100094 ]
Stopped at kdb_enter+0x6e: movq $0,0x25c45c7(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db>
* Struck through repros no longer work on HEAD.