syzbot


kernel BUG in set_ps_flags

Status: moderation: reported on 2026/03/15 15:30
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+752fac0e14c568144eb1@syzkaller.appspotmail.com
First crash: 71d, last: 5d19h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
4bdc1f49-794c-4328-8f36-f1c8768ef28b assessment-security 💥 kernel BUG in set_ps_flags 2026/05/14 14:36 2026/05/14 14:36 2026/05/14 14:38 6ccb967e465e832a7bfd7a116ad00d52a0923a5d failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/9f7bc6f888dda60e125e404e9b67c8c2d560f8bb" "-s" "bzImage" "compile_commands.json"]: exit status 2 * * Restart config... * * * General architecture-dependent options * SMT (Hyperthreading) scheduler support (SCHED_SMT) [Y/?] y Cluster scheduler support (SCHED_CLUSTER) [Y/n/?] y Multi-Core Cache (MC) scheduler support (SCHED_MC) [Y/n/?] y Kprobes (KPROBES) [N/y/?] n Optimize very unlikely/likely branches (JUMP_LABEL) [Y/n/?] y Static key selftest (STATIC_KEYS_SELFTEST) [N/y/?] n Static call selftest (STATIC_CALL_SELFTEST) [N/y/?] n Enable seccomp to safely execute untrusted bytecode (SECCOMP) [Y/n/?] y Show seccomp filter cache status in /proc/pid/seccomp_cache (SECCOMP_CACHE_DEBUG) [N/y/?] n Stack Protector buffer overflow detection (STACKPROTECTOR) [Y/n/?] y Strong Stack Protector (STACKPROTECTOR_STRONG) [Y/n/?] y Link Time Optimization (LTO) > 1. None (LTO_NONE) choice[1]: 1 Enable Clang's AutoFDO build (EXPERIMENTAL) (AUTOFDO_CLANG) [N/y/?] (NEW) Error in reading or end of file. Enable Clang's Propeller build (PROPELLER_CLANG) [N/y/?] (NEW) Error in reading or end of file. Use Kernel Control Flow Integrity (kCFI) (CFI) [N/y/?] (NEW) Error in reading or end of file. Number of bits to use for ASLR of mmap base address (ARCH_MMAP_RND_BITS) [28] 28 Number of bits to use for ASLR of mmap base address for compatible applications (ARCH_MMAP_RND_COMPAT_BITS) [8] 8 MMU page size > 1. 4KiB pages (PAGE_SIZE_4KB) choice[1]: 1 Provide system calls for 32-bit time_t (COMPAT_32BIT_TIME) [Y/n/?] y Use a virtually-mapped stack (VMAP_STACK) [Y/n/?] y Support for randomizing kernel stack offset on syscall entry (RANDOMIZE_KSTACK_OFFSET) [Y/n/?] y Default state of kernel stack offset randomization (RANDOMIZE_KSTACK_OFFSET_DEFAULT) [N/y/?] n Locking event counts collection (LOCK_EVENT_COUNTS) [N/y/?] n * * Memory initialization * Initialize kernel stack variables at function entry 1. no automatic stack variable initialization (weakest) (INIT_STACK_NONE) 2. pattern-init everything (strongest) (INIT_STACK_ALL_PATTERN) > 3. zero-init everything (strongest and safest) (INIT_STACK_ALL_ZERO) choice[1-3?]: 3 Poison kernel stack before returning from syscalls (KSTACK_ERASE) [N/y/?] (NEW) Error in reading or end of file. Enable heap memory zeroing on allocation by default (INIT_ON_ALLOC_DEFAULT_ON) [Y/n/?] y Enable heap memory zeroing on free by default (INIT_ON_FREE_DEFAULT_ON) [N/y/?] n Enable register zeroing on function exit (ZERO_CALL_USED_REGS) [N/y/?] n * * Kernel hardening options * Randomize layout of sensitive kernel structures > 1. Disable structure layout randomization (RANDSTRUCT_NONE) 2. Fully randomize structure layout (RANDSTRUCT_FULL) (NEW) choice[1-2?]: Error in reading or end of file. /app/workdir/cache/src/4111b32774ae1844a2add6b27927b194013c4571/security/apparmor/apparmorfs.c:177:28: warning: unused function 'get_loaddata_common_ref' [-Wunused-function] 177 | static struct aa_loaddata *get_loaddata_common_ref(struct aa_common_ref *ref) | ^~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. /app/workdir/cache/src/4111b32774ae1844a2add6b27927b194013c4571/lib/maple_tree.c:3514:20: warning: stack frame size (2424) exceeds limit (2048) in 'mas_wr_store_entry' [-Wframe-larger-than] 3514 | static inline void mas_wr_store_entry(struct ma_wr_state *wr_mas) | ^ 1 warning generated. /app/workdir/cache/src/4111b32774ae1844a2add6b27927b194013c4571/sound/usb/mixer_s1810c.c:634:5: warning: stack frame size (2360) exceeds limit (2048) in 'snd_sc1810_init_mixer' [-Wframe-larger-than] 634 | int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer) | ^ 1 warning generated. fixdep: not all data was written to the output make[5]: *** [/app/workdir/cache/src/4111b32774ae1844a2add6b27927b194013c4571/scripts/Makefile.build:289: arch/x86/kernel/process.o] Error 1 make[5]: *** Deleting

Sample crash report:
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
 get_signal+0x20ff/0x2210 kernel/signal.c:3037
 arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x8b/0x4f0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x6f2/0xf80 arch/x86/entry/syscall_64.c:100
------------[ cut here ]------------
kernel BUG at ./include/linux/page-flags.h:345!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 20691 Comm: syz.2.3195 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_idle include/linux/page-flags.h:667 [inline]
RIP: 0010:set_ps_flags+0x242/0x290 mm/util.c:1297
Code: 03 80 3c 02 00 0f 84 5f fe ff ff e8 28 19 24 00 e9 55 fe ff ff e8 de 4f b7 ff 48 c7 c6 c0 83 be 8b 48 89 df e8 af 78 05 00 90 <0f> 0b e8 d7 18 24 00 e9 ed fd ff ff e8 fd 18 24 00 e9 57 fe ff ff
RSP: 0018:ffffc900032178f8 EFLAGS: 00010246
RAX: 0000000000080000 RBX: ffffea00025e92c0 RCX: ffffc90006233000
RDX: 0000000000080000 RSI: ffffffff82563428 RDI: ffff888035b384c4
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc900032179d0
R13: 0000000000000001 R14: ffffea00025e8034 R15: dffffc0000000000
FS:  00007f0b021ee6c0(0000) GS:ffff888124374000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3250cff8 CR3: 0000000078e50000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 snapshot_page+0x463/0x560 mm/util.c:1333
 get_kpage_count+0x94/0x240 fs/proc/page.c:50
 kpage_read.isra.0+0x1b8/0x2b0 fs/proc/page.c:93
 pde_read fs/proc/inode.c:308 [inline]
 proc_reg_read+0x120/0x330 fs/proc/inode.c:318
 do_loop_readv_writev fs/read_write.c:849 [inline]
 do_loop_readv_writev fs/read_write.c:837 [inline]
 vfs_readv+0x5d8/0x8d0 fs/read_write.c:1022
 do_readv+0x13e/0x340 fs/read_write.c:1082
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0b03f9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0b021ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00007f0b04215fa0 RCX: 00007f0b03f9ce59
RDX: 0000000100000007 RSI: 00002000000001c0 RDI: 0000000000000003
RBP: 00007f0b04032d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0b04216038 R14: 00007f0b04215fa0 R15: 00007ffd04bc4e58
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_idle include/linux/page-flags.h:667 [inline]
RIP: 0010:set_ps_flags+0x242/0x290 mm/util.c:1297
Code: 03 80 3c 02 00 0f 84 5f fe ff ff e8 28 19 24 00 e9 55 fe ff ff e8 de 4f b7 ff 48 c7 c6 c0 83 be 8b 48 89 df e8 af 78 05 00 90 <0f> 0b e8 d7 18 24 00 e9 ed fd ff ff e8 fd 18 24 00 e9 57 fe ff ff
RSP: 0018:ffffc900032178f8 EFLAGS: 00010246
RAX: 0000000000080000 RBX: ffffea00025e92c0 RCX: ffffc90006233000
RDX: 0000000000080000 RSI: ffffffff82563428 RDI: ffff888035b384c4
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc900032179d0
R13: 0000000000000001 R14: ffffea00025e8034 R15: dffffc0000000000
FS:  00007f0b021ee6c0(0000) GS:ffff888124374000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc30c1ec4b8 CR3: 0000000078e50000 CR4: 00000000003526f0

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/16 16:48 upstream 6916d5703ddf a15a64a6 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto kernel BUG in set_ps_flags
2026/04/16 12:22 upstream 1d51b370a0f8 4743f87d .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto kernel BUG in set_ps_flags
2026/04/15 13:44 upstream 1f5ffc672165 2b1eb0ca .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto kernel BUG in set_ps_flags
2026/04/12 15:07 upstream f5459048c38a 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto kernel BUG in set_ps_flags
2026/03/11 15:19 upstream b29fb8829bff 2d88ab01 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto kernel BUG in set_ps_flags
* Struck through repros no longer work on HEAD.