syzbot


panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM

Status: fixed on 2025/07/29 23:20
Reported-by: syzbot+fb35cce6a6f5075a6692@syzkaller.appspotmail.com
Fix commit: 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
First crash: 47d, last: 46d

Sample crash report:
panic: handle_workitem_remove: directory ino 94 negative i_nlink -1
cpuid = 0
time = 11
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056c527d0
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056c52930
vpanic() at vpanic+0x257/frame 0xfffffe0056c52af0
panic() at panic+0xb5/frame 0xfffffe0056c52bb0
handle_workitem_remove() at handle_workitem_remove+0xd72/frame 0xfffffe0056c52cf0
process_worklist_item() at process_worklist_item+0x525/frame 0xfffffe0056c52e40
softdep_process_worklist() at softdep_process_worklist+0xfd/frame 0xfffffe0056c52e90
softdep_flush() at softdep_flush+0x1a4/frame 0xfffffe0056c52ef0
fork_exit() at fork_exit+0xcc/frame 0xfffffe0056c52f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0056c52f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 14 tid 100094 ]
Stopped at      kdb_enter+0x6e: movq    $0,0x25c45c7(%rip)
db> 
db> set $lines = 0
db> set $maxwidth = 0
db> 

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/29 22:41 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 22:12 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 22:10 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 22:10 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 22:09 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 21:33 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 21:14 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 20:06 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 19:43 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 19:34 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 19:33 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 19:33 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 18:17 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 18:15 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 18:08 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 15:11 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 14:07 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 13:18 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 12:04 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 09:54 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 09:54 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 09:54 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
2025/07/29 09:32 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-i386 panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM
* Struck through repros no longer work on HEAD.