general protection fault in smack_inode_permission (4)

Status: upstream: reported on 2026/10/04 02:47
Subsystems: lsm
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+fc1d5d9a7ebabbc27458@syzkaller.appspotmail.com
First crash: 4d04h, last: 1d14h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
2125dee2 repro-c 💥 general protection fault in smack_inode_permission (4) 2026/10/03 02:33 2026/10/03 02:33 2026/10/03 08:56 57bbd979
a6e3f315 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ general protection fault in smack_inode_permission (4) 2026/10/02 00:00 2026/10/02 00:00 2026/10/02 01:08 6d32eb1f
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [lsm?] general protection fault in smack_inode_permission (4) 0 (1) 2026/10/04 02:47
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in smack_inode_permission lsm 8 13 626d 880d 0/29 auto-obsoleted due to no activity on 2025/04/25 12:24
upstream general protection fault in smack_inode_permission (3) lsm 2 4 288d 331d 0/29 auto-obsoleted due to no activity on 2026/03/19 18:36
upstream general protection fault in smack_inode_permission (2) lsm 2 1 453d 449d 0/29 auto-obsoleted due to no activity on 2025/10/05 23:45
upstream BUG: unable to handle kernel NULL pointer dereference in smack_inode_permission lsm mm 10 syz, C 1 1424d 1420d 22/29 fixed on 2023/02/24 13:50

Sample crash report:
ERROR: (device loop4): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3
ERROR: (device loop4): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 5
ERROR: (device loop4): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 6
Oops: general protection fault, probably for non-canonical address 0xdffffc018bd1a30b: 0000 [#1] SMP KASAN PTI
KASAN: probably user-memory-access in range [0x0000000c5e8d1858-0x0000000c5e8d185f]
CPU: 1 UID: 0 PID: 5607 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:smk_of_inode security/smack/smack.h:411 [inline]
RIP: 0010:smack_inode_permission+0x265/0x320 security/smack/smack_lsm.c:1260
Code: 83 c5 38 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 1d 99 ab fd 44 8b 3d 66 df 2c 09 4d 03 7d 00 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ff e8 fd 98 ab fd 49 8b 3f 44 89 f6 48 8d
RSP: 0018:ffffc900058c7920 EFLAGS: 00010202
RAX: 000000018bd1a30b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900058c7978
RBP: ffffc900058c7a28 R08: ffffc900058c79af R09: 0000000000000000
R10: ffffc900058c7980 R11: fffff52000b18f36 R12: 1ffff92000b18f28
R13: ffff888040368e20 R14: 0000000000000001 R15: 0000000c5e8d1858
FS:  0000555564dc7500(0000) GS:ffff888125cc3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc8c0efcf0 CR3: 000000002ad9e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 security_inode_permission+0xf4/0x2e0 security/security.c:1842
 lookup_inode_permission_may_exec fs/namei.c:696 [inline]
 may_lookup fs/namei.c:1961 [inline]
 link_path_walk+0xc30/0x1910 fs/namei.c:2604
 path_lookupat+0xe4/0x8c0 fs/namei.c:2812
 filename_lookup+0x265/0x5d0 fs/namei.c:2842
 user_path_at+0x40/0x160 fs/namei.c:3641
 ksys_umount fs/namespace.c:2067 [inline]
 __do_sys_umount fs/namespace.c:2075 [inline]
 __se_sys_umount fs/namespace.c:2073 [inline]
 __x64_sys_umount+0xf6/0x170 fs/namespace.c:2073
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fabd8aaf397
Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffc8c0f0348 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 00007fabd8b444bb RCX: 00007fabd8aaf397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc8c0f0400
RBP: 00007ffc8c0f0400 R08: 00007ffc8c0f1400 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc8c0f14f0
R13: 00007fabd8b444bb R14: 00000000000345b3 R15: 00007ffc8c0f25c0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:smk_of_inode security/smack/smack.h:411 [inline]
RIP: 0010:smack_inode_permission+0x265/0x320 security/smack/smack_lsm.c:1260
Code: 83 c5 38 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 1d 99 ab fd 44 8b 3d 66 df 2c 09 4d 03 7d 00 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ff e8 fd 98 ab fd 49 8b 3f 44 89 f6 48 8d
RSP: 0018:ffffc900058c7920 EFLAGS: 00010202
RAX: 000000018bd1a30b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900058c7978
RBP: ffffc900058c7a28 R08: ffffc900058c79af R09: 0000000000000000
R10: ffffc900058c7980 R11: fffff52000b18f36 R12: 1ffff92000b18f28
R13: ffff888040368e20 R14: 0000000000000001 R15: 0000000c5e8d1858
FS:  0000555564dc7500(0000) GS:ffff888125cc3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc8c0efcf0 CR3: 000000002ad9e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	83 c5 38             	add    $0x38,%ebp
   3:	4c 89 e8             	mov    %r13,%rax
   6:	48 c1 e8 03          	shr    $0x3,%rax
   a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1)
   e:	74 08                	je     0x18
  10:	4c 89 ef             	mov    %r13,%rdi
  13:	e8 1d 99 ab fd       	call   0xfdab9935
  18:	44 8b 3d 66 df 2c 09 	mov    0x92cdf66(%rip),%r15d        # 0x92cdf85
  1f:	4d 03 7d 00          	add    0x0(%r13),%r15
  23:	4c 89 f8             	mov    %r15,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	4c 89 ff             	mov    %r15,%rdi
  33:	e8 fd 98 ab fd       	call   0xfdab9935
  38:	49 8b 3f             	mov    (%r15),%rdi
  3b:	44 89 f6             	mov    %r14d,%esi
  3e:	48                   	rex.W
  3f:	8d                   	.byte 0x8d

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/02 16:37 upstream ce1e0223d8ad 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in smack_inode_permission
2026/10/01 12:08 upstream 551c722f4080 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in smack_inode_permission
2026/10/01 05:36 upstream 551c722f4080 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in smack_inode_permission
2026/09/30 17:23 upstream 551c722f4080 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in smack_inode_permission
2026/09/30 12:59 upstream 551c722f4080 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in smack_inode_permission
2026/09/30 02:42 upstream 6f8319e3e9a4 328436b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in smack_inode_permission
* Struck through repros no longer work on HEAD.