general protection fault in raid5_make_request

Status: moderation: reported on 2026/10/02 10:04
Subsystems: raid
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+8037922de62e45d7430e@syzkaller.appspotmail.com
First crash: 4d01h, last: 4d01h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
dc6bb6b8 repro-c 🏃 general protection fault in raid5_make_request 2026/10/02 10:24 2026/10/02 10:24 6d32eb1f
098fdf49 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ general protection fault in raid5_make_request 2026/09/30 07:08 2026/09/30 07:08 2026/09/30 07:48 7808aef4

Sample crash report:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000013b: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x00000000000009d8-0x00000000000009df]
CPU: 1 UID: 0 PID: 9196 Comm: syz.7.945 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:raid5_make_request+0x316/0x4080 drivers/md/raid5.c:6277
Code: e8 cf 1e a2 f9 48 89 9c 24 b8 01 00 00 48 c7 03 00 00 00 00 49 8d 9e d8 09 00 00 48 89 d8 48 c1 e8 03 48 89 84 24 c0 01 00 00 <42> 80 3c 20 00 74 08 48 89 df e8 ab 1d a2 f9 48 89 9c 24 78 01 00
RSP: 0018:ffffc90003d96b60 EFLAGS: 00010202
RAX: 000000000000013b RBX: 00000000000009d8 RCX: 0000000000080000
RDX: ffffc9001ebb2000 RSI: 0000000000000e7d RDI: ffff88807688e2a8
RBP: ffffc90003d970f0 R08: ffff88807111e267 R09: 1ffff1100e223c4c
R10: dffffc0000000000 R11: ffffed100e223c4d R12: dffffc0000000000
R13: 1ffff1100ed11c60 R14: 0000000000000000 R15: ffff88807688e280
FS:  00007fbbfcf136c0(0000) GS:ffff88812472e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2dc1cff8 CR3: 0000000051852000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 md_handle_request+0xb05/0xe60 drivers/md/md.c:417
 __submit_bio+0x27f/0x340 block/blk-core.c:681
 __submit_bio_noacct block/blk-core.c:724 [inline]
 submit_bio_noacct_nocheck+0x4e8/0xa40 block/blk-core.c:792
 bh_submit fs/buffer.c:1151 [inline]
 block_read_full_folio+0x83a/0x8c0 fs/buffer.c:2375
 filemap_read_folio+0x12c/0x3a0 mm/filemap.c:2538
 do_read_cache_folio+0x354/0x590 mm/filemap.c:4174
 read_mapping_folio include/linux/pagemap.h:1012 [inline]
 read_part_sector+0xb6/0x2b0 block/partitions/core.c:724
 adfspart_check_ICS+0xb1/0x960 block/partitions/acorn.c:357
 check_partition block/partitions/core.c:143 [inline]
 blk_add_partitions block/partitions/core.c:591 [inline]
 bdev_disk_changed+0x851/0x17a0 block/partitions/core.c:695
 blkdev_get_whole+0x372/0x510 block/bdev.c:793
 bdev_open+0x324/0xd70 block/bdev.c:1002
 blkdev_open+0x461/0x600 block/fops.c:696
 do_dentry_open+0x80e/0x1360 fs/open.c:1000
 vfs_open_consume+0x4a/0x350 fs/open.c:1131
 do_open fs/namei.c:4844 [inline]
 path_openat+0x14a6/0x1da0 fs/namei.c:5009
 do_file_open+0x23e/0x4a0 fs/namei.c:5038
 do_sys_openat2+0x115/0x200 fs/open.c:1442
 do_sys_open fs/open.c:1448 [inline]
 __do_sys_openat fs/open.c:1464 [inline]
 __se_sys_openat fs/open.c:1459 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1459
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbbfbf9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbbfcf13028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fbbfc225fa0 RCX: 00007fbbfbf9e159
RDX: 0000000000004002 RSI: 0000200000000300 RDI: ffffffffffffff9c
RBP: 00007fbbfc03506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbbfc226038 R14: 00007fbbfc225fa0 R15: 00007ffd33840fb8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:raid5_make_request+0x316/0x4080 drivers/md/raid5.c:6277
Code: e8 cf 1e a2 f9 48 89 9c 24 b8 01 00 00 48 c7 03 00 00 00 00 49 8d 9e d8 09 00 00 48 89 d8 48 c1 e8 03 48 89 84 24 c0 01 00 00 <42> 80 3c 20 00 74 08 48 89 df e8 ab 1d a2 f9 48 89 9c 24 78 01 00
RSP: 0018:ffffc90003d96b60 EFLAGS: 00010202
RAX: 000000000000013b RBX: 00000000000009d8 RCX: 0000000000080000
RDX: ffffc9001ebb2000 RSI: 0000000000000e7d RDI: ffff88807688e2a8
RBP: ffffc90003d970f0 R08: ffff88807111e267 R09: 1ffff1100e223c4c
R10: dffffc0000000000 R11: ffffed100e223c4d R12: dffffc0000000000
R13: 1ffff1100ed11c60 R14: 0000000000000000 R15: ffff88807688e280
FS:  00007fbbfcf136c0(0000) GS:ffff88812472e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2dc1cff8 CR3: 0000000051852000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	e8 cf 1e a2 f9       	call   0xf9a21ed4
   5:	48 89 9c 24 b8 01 00 	mov    %rbx,0x1b8(%rsp)
   c:	00
   d:	48 c7 03 00 00 00 00 	movq   $0x0,(%rbx)
  14:	49 8d 9e d8 09 00 00 	lea    0x9d8(%r14),%rbx
  1b:	48 89 d8             	mov    %rbx,%rax
  1e:	48 c1 e8 03          	shr    $0x3,%rax
  22:	48 89 84 24 c0 01 00 	mov    %rax,0x1c0(%rsp)
  29:	00
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 ab 1d a2 f9       	call   0xf9a21de4
  39:	48                   	rex.W
  3a:	89                   	.byte 0x89
  3b:	9c                   	pushf
  3c:	24 78                	and    $0x78,%al
  3e:	01 00                	add    %eax,(%rax)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/28 10:00 linux-next f5f84daefcd9 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce general protection fault in raid5_make_request
* Struck through repros no longer work on HEAD.