WARNING: ODEBUG bug in lookup_object_or_alloc

Status: moderation: reported on 2026/09/11 10:40
Subsystems: pm
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+84a1b8c44507d107a5ce@syzkaller.appspotmail.com
First crash: 4d10h, last: 4d10h
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
d66d7f26 repro-c Reproduced: ✅ WARNING: ODEBUG bug in lookup_object_or_alloc 2026/09/11 20:00 2026/09/11 20:00 2026/09/11 20:38 6816f32e
a70b6b78 repro-c Reproduced: ✅ WARNING: ODEBUG bug in lookup_object_or_alloc 2026/09/11 14:12 2026/09/11 14:12 2026/09/11 15:16 6816f32e
156dce5a assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ WARNING: ODEBUG bug in lookup_object_or_alloc 2026/09/09 00:54 2026/09/09 00:54 2026/09/09 00:58 243b72f1
Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/09/11 15:19 13m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 08df884136f1c1197bab2a27814404fd329d9aac report job log log
2026/09/11 21:10 retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3026c6e4f223bdded6448fefe53ff85d9cbe51bd running

Sample crash report:
 common_startup_64+0x13e/0x158
 </TASK>
ODEBUG: object ffffc90000708a60 is NOT on stack ffffc900001a0000, but annotated.
------------[ cut here ]------------
1
WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#3: swapper/3/0
WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705, CPU#3: swapper/3/0
Modules linked in:
CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline]
RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705
Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f e9 99 e0 9c 0a 83 c5 01 89 2d 90 c4 7c 1a 4c 89 e6 48 c7 c7 c0 1b 62 8c e8 11 b3 eb ff 90 <0f> 0b 90 e9 92 a5 fd 03 83 c5 01 89 2d 6f c4 7c 1a 49 39 c4 73 da
RSP: 0018:ffffc900007088f0 EFLAGS: 00010082
RAX: 0000000000000050 RBX: ffff888059dcee00 RCX: 0000000000000000
RDX: 0000000000000050 RSI: ffffffff81ea06f9 RDI: fffff520000e110f
RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000102 R11: 0000000000000001 R12: ffffc90000708a60
R13: ffff88801f698000 R14: 0000000000000001 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d5e5d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33419ff8 CR3: 000000005a55f000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 lookup_object_or_alloc lib/debugobjects.c:682 [inline]
 __debug_object_init+0x2a9/0x3d0 lib/debugobjects.c:798
 __synchronize_srcu+0x1c3/0x300 kernel/rcu/srcutree.c:1475
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237
 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236
 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69
 device_release+0xd2/0x270 drivers/base/core.c:2640
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1f7/0x640 lib/kobject.c:737
 put_device+0x1f/0x30 drivers/base/core.c:3884
 vub300_delete drivers/mmc/host/vub300.c:379 [inline]
 kref_put include/linux/kref.h:65 [inline]
 vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline]
 vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742
 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers+0x757/0xb00 kernel/time/timer.c:2374
 __run_timer_base kernel/time/timer.c:2386 [inline]
 __run_timer_base kernel/time/timer.c:2378 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2395
 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 58 9b 02 e9 43 50 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d c3 76 1b 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 00000202
RAX: 000000000007d049 RBX: ffff88801f698000 RCX: ffffffff8bd04185
RDX: 0000000000000001 RSI: ffffffff8e3ec063 RDI: ffffffff8c621080
RBP: ffffed1003ed3000 R08: 0000000000000001 R09: ffffed100d4e67bd
R10: ffff88806a733deb R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000034fc4 R15: dffffc0000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 default_idle+0x9/0x10 arch/x86/kernel/process.c:768
 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x158
 </TASK>
----------------
Code disassembly (best guess):
   0:	58                   	pop    %rax
   1:	9b                   	fwait
   2:	02 e9                	add    %cl,%ch
   4:	43 50                	rex.XB push %r8
   6:	03 00                	add    (%rax),%eax
   8:	0f 1f 00             	nopl   (%rax)
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d c3 76 1b 00 	verw   0x1b76c3(%rip)        # 0x1b76eb
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	ret <-- trapping instruction
  2b:	cc                   	int3
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  36:	00 00 00
  39:	66 90                	xchg   %ax,%ax
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/07 10:28 upstream df2908090cda 5e4626f5 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: ODEBUG bug in lookup_object_or_alloc
* Struck through repros no longer work on HEAD.