VFS: Busy inodes after unmount (use-after-free)

Status: upstream: reported C repro on 2023/03/18 09:53
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+8f448a401cc209730b34@syzkaller.appspotmail.com
First crash: 1320d, last: 37m
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2023/09/15 linux-6.1.y (ToT) 09045dae0d90 C [report] VFS: Busy inodes after unmount (use-after-free)
2023/09/15 upstream (ToT) 9fdfb15a3dbf C Didn't crash
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 VFS: Busy inodes after unmount (use-after-free) 2 syz, C 4 1285d 1340d 0/2 auto-obsoleted due to no activity on 2023/08/20 15:35
upstream VFS: Busy inodes after unmount (use-after-free) (2) btrfs 2 syz, C error 277 423d 535d 29/29 fixed on 2025/09/04 16:57
android-5-15 VFS: Busy inodes after unmount (use-after-free) origin:downstream 2 syz, C error done 2 1238d 1340d 0/2 auto-obsoleted due to no activity on 2023/09/15 20:27
android-5-10 VFS: Busy inodes after unmount (use-after-free) 2 syz, C done inconclusive 1 1340d 1340d 0/2 auto-obsoleted due to no activity on 2023/06/25 23:02
linux-6.6 VFS: Busy inodes after unmount (use-after-free) origin:upstream missing-backport 2 syz, C inconclusive 2340 2h17m 455d 0/2 upstream: reported C repro on 2025/07/29 23:52
upstream VFS: Busy inodes after unmount (use-after-free) (3) fs 2 syz, C error 85 363d 392d 29/29 fixed on 2025/11/18 08:45
upstream VFS: Busy inodes after unmount (use-after-free) (4) prio:high fs 2 syz, C error 7509 1h15m 307d 0/29 upstream: reported C repro on 2025/12/25 14:06
upstream VFS: Busy inodes after unmount (use-after-free) fs 2 syz, C error 55684 540d 1372d 28/29 fixed on 2025/05/06 15:33
linux-5.15 VFS: Busy inodes after unmount (use-after-free) missing-backport origin:lts-only 2 syz, C done 5254 2h05m 1319d 0/3 upstream: reported C repro on 2023/03/19 11:46
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2023/10/08 00:57 7h55m fix candidate upstream OK (3) job log

Sample crash report:
ocfs2: Unmounting device (7,0) on (node local)
VFS: Busy inodes after unmount of loop0 (ocfs2)
------------[ cut here ]------------
kernel BUG at fs/super.c:505!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4471 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:generic_shutdown_super+0x334/0x340 fs/super.c:503
Code: e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 a5 66 f1 ff 49 8b 16 48 81 c3 a8 06 00 00 48 c7 c7 a0 5d b9 8a 48 89 de e8 8c 6a 4d 08 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 55 41 57 41 56 53 48 89 fb 49
RSP: 0018:ffffc90003517868 EFLAGS: 00010246
RAX: 000000000000002f RBX: ffff888024d806a8 RCX: 273f7ee9afd56500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff110049b00fb R08: ffff8880b8d279db R09: 1ffff110171a4f3b
R10: dffffc0000000000 R11: ffffed10171a4f3c R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8e02d780 R15: ffff888024d807d8
FS:  0000000000000000(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c8f4559168 CR3: 000000007e6e2000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kill_block_super+0x7c/0xe0 fs/super.c:1481
 deactivate_locked_super+0x93/0xf0 fs/super.c:332
 cleanup_mnt+0x471/0x4f0 fs/namespace.c:1191
 task_work_run+0x1d0/0x260 kernel/task_work.c:203
 exit_task_work include/linux/task_work.h:39 [inline]
 do_exit+0x9d5/0x2570 kernel/exit.c:887
 do_group_exit+0x229/0x2e0 kernel/exit.c:1030
 get_signal+0x1259/0x1340 kernel/signal.c:2884
 arch_do_signal_or_restart+0xc4/0x1310 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:319
 exc_page_fault+0x88/0x100 arch/x86/mm/fault.c:1485
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f832099f561
Code: Unable to access opcode bytes at 0x7f832099f537.
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f8320c25fa0 RCX: 00007f832099f559
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007f8320a36b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f8320c25fac R14: 00007f8320c25fa0 R15: 00007f8320c25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:generic_shutdown_super+0x334/0x340 fs/super.c:503
Code: e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 a5 66 f1 ff 49 8b 16 48 81 c3 a8 06 00 00 48 c7 c7 a0 5d b9 8a 48 89 de e8 8c 6a 4d 08 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 55 41 57 41 56 53 48 89 fb 49
RSP: 0018:ffffc90003517868 EFLAGS: 00010246
RAX: 000000000000002f RBX: ffff888024d806a8 RCX: 273f7ee9afd56500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff110049b00fb R08: ffff8880b8d279db R09: 1ffff110171a4f3b
R10: dffffc0000000000 R11: ffffed10171a4f3c R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8e02d780 R15: ffff888024d807d8
FS:  0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c8f30e3660 CR3: 00000000240eb000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (8683):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/27 01:17 linux-6.1.y 79807e970724 168cb7a2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/09/08 02:45 linux-6.1.y cf82dcca9634 680aa3e1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2024/12/13 04:09 linux-6.1.y e4d90d63d385 530e80f8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2024/12/13 01:31 linux-6.1.y e4d90d63d385 530e80f8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2024/12/03 14:56 linux-6.1.y e4d90d63d385 578925bc .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2023/09/14 20:40 linux-6.1.y 09045dae0d90 0b6a67ac .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/08/29 23:34 linux-6.1.y d64a499eea6b 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/08/16 04:40 linux-6.1.y e4f7d8be268e 746171ee .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/08/05 12:55 linux-6.1.y fb28aa725e05 52aa2820 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/04/26 20:25 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/01/16 15:53 linux-6.1.y bec0e10ee67e d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/08 12:20 linux-6.1.y 882efbdd9d34 7e2882b3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/06/26 04:53 linux-6.1.y 58485ff1a74f 26d77996 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2024/11/02 04:44 linux-6.1.y 7c15117f9468 f00eed24 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2024/11/02 04:10 linux-6.1.y 7c15117f9468 f00eed24 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2023/07/09 21:29 linux-6.1.y 61fd484b2cf6 668cb1fa .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/03/12 17:43 linux-6.1.y 6ae7ac5c4251 ee70e6db .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/28 11:21 linux-6.1.y 79807e970724 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/27 17:59 linux-6.1.y 79807e970724 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/27 17:58 linux-6.1.y 79807e970724 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/27 16:52 linux-6.1.y 79807e970724 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/26 18:26 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/26 14:39 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/26 13:34 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/26 12:56 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/25 21:27 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/25 20:15 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/25 15:21 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/25 15:18 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
2026/10/28 15:18 linux-6.1.y 79807e970724 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/28 15:03 linux-6.1.y 79807e970724 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/28 12:59 linux-6.1.y 79807e970724 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/28 11:58 linux-6.1.y 79807e970724 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/28 06:39 linux-6.1.y 79807e970724 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 20:59 linux-6.1.y 79807e970724 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 20:47 linux-6.1.y 79807e970724 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 19:00 linux-6.1.y 79807e970724 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 14:09 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 12:46 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 11:35 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 09:47 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 07:04 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 06:00 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/27 03:50 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 17:14 linux-6.1.y 79807e970724 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 10:26 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 08:24 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 07:13 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 06:54 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 05:07 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 03:21 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 02:12 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/26 00:56 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/25 23:44 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/25 18:37 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/25 16:38 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/25 16:23 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/25 14:17 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/25 12:45 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2026/10/25 11:20 linux-6.1.y 79807e970724 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 VFS: Busy inodes after unmount (use-after-free)
2023/03/18 09:53 linux-6.1.y 7eaef76fbc46 7939252e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan VFS: Busy inodes after unmount (use-after-free)
* Struck through repros no longer work on HEAD.