syzbot


panic: handle_workitem_remove: directory ino ADDR negative i_nlink -NUM

Status: fixed on 2025/07/29 23:20
Reported-by: syzbot+fbfff9613b6dab616124@syzkaller.appspotmail.com
Fix commit: 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
First crash: 30d, last: 30d

Sample crash report:
panic: handle_workitem_remove: directory ino 198645 negative i_nlink -1
cpuid = 0
time = 12
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056c4b7d0
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056c4b930
vpanic() at vpanic+0x257/frame 0xfffffe0056c4baf0
panic() at panic+0xb5/frame 0xfffffe0056c4bbb0
handle_workitem_remove() at handle_workitem_remove+0xd72/frame 0xfffffe0056c4bcf0
process_worklist_item() at process_worklist_item+0x525/frame 0xfffffe0056c4be40
softdep_process_worklist() at softdep_process_worklist+0xfd/frame 0xfffffe0056c4be90
softdep_flush() at softdep_flush+0x1a4/frame 0xfffffe0056c4bef0
fork_exit() at fork_exit+0xcc/frame 0xfffffe0056c4bf30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0056c4bf30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 14 tid 100094 ]
Stopped at      kdb_enter+0x6e: movq    $0,0x25c45c7(%rip)
db> 
db> set $lines = 0
db> 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/29 12:31 freebsd-src 0ded4647215c 8e9d1dc1 console log report ci-freebsd-main panic: handle_workitem_remove: directory ino ADDR negative i_nlink -NUM
* Struck through repros no longer work on HEAD.