general protection fault in __schedule (4)

Status: moderation: reported on 2026/10/15 05:13
Subsystems: sound
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+6c4fbd30ca09e52dc131@syzkaller.appspotmail.com
First crash: 4d07h, last: 4d07h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
f8d5960f repro-c 💥 general protection fault in __schedule (4) 2026/10/15 06:01 2026/10/15 06:01 2026/10/15 07:10 8fb0ae89
141d0278 repro-c 💥 general protection fault in __schedule (4) 2026/10/13 17:59 2026/10/13 17:59 2026/10/13 18:20 7321cd29
2e05ea5c assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ general protection fault in __schedule (4) 2026/10/13 07:54 2026/10/13 07:54 2026/10/13 08:36 745a967f
▶ ▼ Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __schedule (5) net 22 syz, C 595 223d 918d 0/29 auto-obsoleted due to no activity on 2026/05/28 17:49
upstream general protection fault in __schedule (2) kernel 2 syz, C done done 1712 2943d 2987d 0/29 closed as dup on 2019/11/22 20:54
upstream general protection fault in __schedule (3) prio:low sound 2 1649 78d 124d 29/29 fixed on 2026/08/08 19:10
upstream general protection fault in __schedule mm 2 syz, C 722 3219d 3220d 0/29 closed as dup on 2017/12/21 00:34
upstream KMSAN: uninit-value in __schedule (4) sctp 17 syz, C error 4 1139d 1135d 0/29 auto-obsoleted due to no activity on 2023/12/10 17:35
linux-4.19 KASAN: use-after-free Read in __schedule 19 1 2053d 2053d 0/1 auto-closed as invalid on 2021/06/29 13:25
linux-6.1 KASAN: slab-out-of-bounds Write in __schedule origin:upstream 21 syz 4 471d 477d 0/3 auto-obsoleted due to no activity on 2025/10/09 02:03
linux-4.19 KASAN: use-after-free Read in __schedule (2) 19 1 1730d 1730d 0/1 auto-closed as invalid on 2022/05/18 22:28
android-54 BUG: unable to handle kernel paging request in __schedule 8 syz, C 12 2058d 2214d 0/2 auto-obsoleted due to no activity on 2023/04/17 21:57
upstream KMSAN: uninit-value in __schedule (3) trace net 7 2 1337d 1340d 0/29 auto-obsoleted due to no activity on 2023/05/17 02:32
upstream KMSAN: uninit-value in __schedule (2) kernel 7 1 1510d 1510d 0/29 auto-obsoleted due to no activity on 2022/11/24 18:35
upstream WARNING: locking bug in __schedule mm 4 1943 569d 858d 0/29 auto-obsoleted due to no activity on 2025/06/02 23:27

Sample crash report:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 UID: 0 PID: 12282 Comm: syz.7.1759 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:task_cpu include/linux/sched.h:2284 [inline]
RIP: 0010:is_task_rq_idle kernel/sched/core.c:6204 [inline]
RIP: 0010:cookie_equals kernel/sched/core.c:6209 [inline]
RIP: 0010:pick_next_task kernel/sched/core.c:6403 [inline]
RIP: 0010:__schedule+0x2083/0x6920 kernel/sched/core.c:7199
Code: 0f 85 70 3c 00 00 4d 8b ac 24 d0 0e 00 00 48 c7 c0 40 20 8f 95 48 ba 00 00 00 00 00 fc ff df 49 8d 7d 14 48 89 f9 48 c1 e9 03 <0f> b6 0c 11 48 89 fa 83 e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 32
RSP: 0000:ffffc900073cf890 EFLAGS: 00010003
RAX: ffffffff958f2040 RBX: 0000000000000001 RCX: 0000000000000002
RDX: dffffc0000000000 RSI: 1ffffffff1cd5324 RDI: 0000000000000014
RBP: ffffc900073cf9e0 R08: 0000000000000001 R09: 0000000000000000
R10: ffff88802b03cbd8 R11: 0000000000000000 R12: ffff88802b13c040
R13: 0000000000000000 R14: ffff88802b03c040 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88809574a000(0063) knlGS:00000000f5456b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f71c6400 CR3: 000000004fb11000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7376
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 snd_rawmidi_write+0x492/0xc60 sound/core/rawmidi.c:1619
 do_loop_readv_writev fs/read_write.c:851 [inline]
 do_loop_readv_writev fs/read_write.c:836 [inline]
 vfs_writev+0x5ed/0xdd0 fs/read_write.c:1060
 do_writev+0x28a/0x340 fs/read_write.c:1104
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf743efec
Code: Unable to access opcode bytes at 0xf743efc2.
RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000092
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000840
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:task_cpu include/linux/sched.h:2284 [inline]
RIP: 0010:is_task_rq_idle kernel/sched/core.c:6204 [inline]
RIP: 0010:cookie_equals kernel/sched/core.c:6209 [inline]
RIP: 0010:pick_next_task kernel/sched/core.c:6403 [inline]
RIP: 0010:__schedule+0x2083/0x6920 kernel/sched/core.c:7199
Code: 0f 85 70 3c 00 00 4d 8b ac 24 d0 0e 00 00 48 c7 c0 40 20 8f 95 48 ba 00 00 00 00 00 fc ff df 49 8d 7d 14 48 89 f9 48 c1 e9 03 <0f> b6 0c 11 48 89 fa 83 e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 32
RSP: 0000:ffffc900073cf890 EFLAGS: 00010003
RAX: ffffffff958f2040 RBX: 0000000000000001 RCX: 0000000000000002
RDX: dffffc0000000000 RSI: 1ffffffff1cd5324 RDI: 0000000000000014
RBP: ffffc900073cf9e0 R08: 0000000000000001 R09: 0000000000000000
R10: ffff88802b03cbd8 R11: 0000000000000000 R12: ffff88802b13c040
R13: 0000000000000000 R14: ffff88802b03c040 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88809574a000(0063) knlGS:00000000f5456b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f743f000 CR3: 000000004fb11000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	0f 85 70 3c 00 00    	jne    0x3c76
   6:	4d 8b ac 24 d0 0e 00 	mov    0xed0(%r12),%r13
   d:	00
   e:	48 c7 c0 40 20 8f 95 	mov    $0xffffffff958f2040,%rax
  15:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  1c:	fc ff df
  1f:	49 8d 7d 14          	lea    0x14(%r13),%rdi
  23:	48 89 f9             	mov    %rdi,%rcx
  26:	48 c1 e9 03          	shr    $0x3,%rcx
* 2a:	0f b6 0c 11          	movzbl (%rcx,%rdx,1),%ecx <-- trapping instruction
  2e:	48 89 fa             	mov    %rdi,%rdx
  31:	83 e2 07             	and    $0x7,%edx
  34:	83 c2 03             	add    $0x3,%edx
  37:	38 ca                	cmp    %cl,%dl
  39:	7c 08                	jl     0x43
  3b:	84 c9                	test   %cl,%cl
  3d:	0f                   	.byte 0xf
  3e:	85 32                	test   %esi,(%rdx)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/11 05:08 upstream a5ebb76233b7 4f92358f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in __schedule
* Struck through repros no longer work on HEAD.