syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1303]
≡ Subsystems
🐞 Fixed [7211]
🐞 Invalid [19053]
⬇ Missing Backports [222]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

kernel BUG in jffs2_start_garbage_collect_thread

Status: upstream: reported C repro on 2024/04/08 05:37
Subsystems: jffs2
[Documentation on labels]
Reported-by: syzbot+61a9d95630970eece39d@syzkaller.appspotmail.com
First crash: 819d, last: 670d
Cause bisection: introduced by (bisect log) :
commit 9c8ad7a2ff0bfe58f019ec0abc1fb965114dde7d
Author: David Howells <dhowells@redhat.com>
Date: Thu May 16 11:52:27 2019 +0000

  uapi, x86: Fix the syscall numbering of the mount API syscalls [ver #2]

Crash: KASAN: use-after-free Read in jffs2_garbage_collect_pass (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ ✨ AI Jobs (5)
ID Workflow Result Correct Bug Created Started Finished Revision Error
49e39c87-3462-45a9-8672-77e5601cadd1 assessment-security 💥 kernel BUG in jffs2_start_garbage_collect_thread 2026/06/22 02:56 2026/06/22 02:56 2026/06/22 03:10 43bfcdb07c3552e4664e1029672054ac0924d543 
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/26ff704851aeea83da...
truncated to first 200 bytes; open job for full error
206196eb-7545-49c4-9edf-11b03ef37907 assessment-security 💥 kernel BUG in jffs2_start_garbage_collect_thread 2026/06/14 02:28 2026/06/14 02:28 2026/06/14 02:51 4f06757f683a802254a4c8edbfe67ff801904c5e 
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/26ff704851aeea83da...
truncated to first 200 bytes; open job for full error
073a96c1-d58e-492d-82de-3216c424bba1 assessment-security 💥 kernel BUG in jffs2_start_garbage_collect_thread 2026/06/09 18:24 2026/06/09 18:24 2026/06/09 18:41 c36c07f6c1f2230a36374cbd22235f635e8f9284 
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/26ff704851aeea83da...
truncated to first 200 bytes; open job for full error
0e86d8dd-49cb-4427-98f4-bb1718dfd422 assessment-security 💥 kernel BUG in jffs2_start_garbage_collect_thread 2026/06/02 15:33 2026/06/02 15:33 2026/06/02 15:56 62fe15281f5011cd203d8845b8767b10e7443aa5 
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/26ff704851aeea83da...
truncated to first 200 bytes; open job for full error
920d0240-8817-4816-83b0-d0c49327ad48 assessment-security 💥 kernel BUG in jffs2_start_garbage_collect_thread 2026/05/25 18:59 2026/05/25 18:59 2026/05/25 19:25 c69befb30ac10e158cc9d1557b508ee3f0eca1de 
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/26ff704851aeea83da...
truncated to first 200 bytes; open job for full error
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH 1/3] jffs2: always stop garbage collection thread on unmount 3 (3) 2026/05/01 11:02
[syzbot] [jffs2?] kernel BUG in jffs2_start_garbage_collect_thread 0 (2) 2026/04/30 23:58
[syzbot] Monthly jffs2 report (Sep 2024) 0 (1) 2024/09/09 08:12
[syzbot] Monthly jffs2 report (Aug 2024) 0 (1) 2024/08/06 12:39
[syzbot] Monthly jffs2 report (May 2024) 0 (1) 2024/05/16 12:44
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2026/05/25 01:31 56m retest repro upstream log
2026/04/30 23:58 26m tristmd@gmail.com patch upstream OK log
2026/02/28 10:14 11m retest repro upstream report log
2025/12/20 08:45 14m retest repro upstream report log
2025/10/11 00:34 13m retest repro upstream report log
2025/07/31 15:48 1h46m retest repro upstream report log
2025/05/21 05:03 14m retest repro upstream report log
2025/03/04 06:39 15m retest repro upstream report log
2024/12/24 01:45 12m retest repro upstream report log
2024/04/27 10:21 10m retest repro upstream report log
▶ ▼ Fix bisection attempts (5)
Created Duration User Patch Repo Result
2024/10/14 23:45 0m bisect fix upstream error job log
2024/09/03 05:56 1h26m bisect fix upstream OK (0) job log log
2024/07/29 22:57 2h31m bisect fix upstream OK (0) job log log
2024/06/22 17:23 2h19m bisect fix upstream OK (0) job log log
2024/05/16 04:15 1h20m bisect fix upstream OK (0) job log log

Sample crash report:
------------[ cut here ]------------
kernel BUG at fs/jffs2/background.c:40!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5060 Comm: syz-executor108 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:jffs2_start_garbage_collect_thread+0x1f5/0x200 fs/jffs2/background.c:40
Code: 03 ff e9 1b ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 64 ff ff ff 48 89 df e8 76 78 03 ff e9 57 ff ff ff e8 9c 77 a3 fe 90 <0f> 0b 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000422fd00 EFLAGS: 00010293
RAX: ffffffff82f17cb4 RBX: ffff8880240a6018 RCX: ffff8880242b5a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880240a6000
RBP: 0000000000000000 R08: ffffffff82f1c1c9 R09: 1ffff92000845f94
R10: dffffc0000000000 R11: fffff52000845f95 R12: ffff8880240a6000
R13: dffffc0000000000 R14: ffff8880240a6000 R15: ffff88802e7774f8
FS:  000055559415a380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f54dacad0d0 CR3: 000000007aeec000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 jffs2_do_remount_fs+0x15b/0x1d0 fs/jffs2/fs.c:415
 reconfigure_super+0x445/0x880 fs/super.c:1071
 vfs_cmd_reconfigure fs/fsopen.c:267 [inline]
 vfs_fsconfig_locked fs/fsopen.c:296 [inline]
 __do_sys_fsconfig fs/fsopen.c:476 [inline]
 __se_sys_fsconfig+0xab5/0xec0 fs/fsopen.c:349
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f54dac35cf9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc9713c8d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f54dac35cf9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000003
RBP: 0000000000010305 R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc9713c8ec
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jffs2_start_garbage_collect_thread+0x1f5/0x200 fs/jffs2/background.c:40
Code: 03 ff e9 1b ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 64 ff ff ff 48 89 df e8 76 78 03 ff e9 57 ff ff ff e8 9c 77 a3 fe 90 <0f> 0b 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000422fd00 EFLAGS: 00010293
RAX: ffffffff82f17cb4 RBX: ffff8880240a6018 RCX: ffff8880242b5a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880240a6000
RBP: 0000000000000000 R08: ffffffff82f1c1c9 R09: 1ffff92000845f94
R10: dffffc0000000000 R11: fffff52000845f95 R12: ffff8880240a6000
R13: dffffc0000000000 R14: ffff8880240a6000 R15: ffff88802e7774f8
FS:  000055559415a380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc9713c7d8 CR3: 000000007aeec000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/07 10:51 upstream fe46a7dd189e ca620dd8 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in jffs2_start_garbage_collect_thread
2024/04/13 06:20 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in jffs2_start_garbage_collect_thread
2024/04/11 15:05 upstream fe46a7dd189e 95ed9ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in jffs2_start_garbage_collect_thread
* Struck through repros no longer work on HEAD.