KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy

Status: upstream: reported C repro on 2026/10/25 11:46
Subsystems: dm
[Documentation on labels]
Reported-by: syzbot+a2626a25eb2595e3ec3c@syzkaller.appspotmail.com
First crash: 4d04h, last: 19m
Cause bisection: failed (error log, bisect log)
  
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
cb5f29e5 repro-c Reproduced: ✅ ❓ KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 2026/10/24 02:54 2026/10/24 02:54 2026/10/24 05:15 1d9ca40b
7828aa52 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 2026/10/23 00:00 2026/10/23 00:00 2026/10/23 00:06 33f73a1b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [dm?] KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 0 (1) 2026/10/25 11:46
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 11 syz, C 8 4h09m 20h03m 0/3 upstream: reported C repro on 2026/10/24 19:51
linux-5.15 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 11 syz, C 7 1h42m 1d03h 0/3 upstream: reported C repro on 2026/10/24 11:58
linux-6.6 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 11 syz, C 3 4h34m 19h43m 0/2 upstream: reported C repro on 2026/10/24 20:11
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/24 05:32 2h58m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4169c9c90532df9585c0a2ae513337a58f5e59ab report job log log

Sample crash report:
workqueue: Failed to create a rescuer kthread for wq "kcopyd": -EINTR
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in dm_kcopyd_client_destroy+0xae/0x480 drivers/md/dm-kcopyd.c:980
Read of size 4 at addr 0000000000000174 by task syz.2.19/6560

CPU: 0 UID: 0 PID: 6560 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
 instrument_atomic_read include/linux/instrumented.h:82 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 dm_kcopyd_client_destroy+0xae/0x480 drivers/md/dm-kcopyd.c:980
 __destroy+0x172/0x2f0 drivers/md/dm-cache-target.c:1973
 cache_create drivers/md/dm-cache-target.c:2604 [inline]
 cache_ctr+0x1674/0x2bf0 drivers/md/dm-cache-target.c:2649
 dm_table_add_target+0x58d/0xc70 drivers/md/dm-table.c:749
 populate_table drivers/md/dm-ioctl.c:1602 [inline]
 table_load+0x325/0x8a0 drivers/md/dm-ioctl.c:1645
 ctl_ioctl drivers/md/dm-ioctl.c:2221 [inline]
 dm_ctl_ioctl+0x9ec/0xe10 drivers/md/dm-ioctl.c:2243
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb5b039f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb5b11ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fb5b0626180 RCX: 00007fb5b039f559
RDX: 0000200000000280 RSI: 00000000c138fd09 RDI: 0000000000000004
RBP: 00007fb5b0436b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb5b0626218 R14: 00007fb5b0626180 R15: 00007fff197480a8
 </TASK>
==================================================================

Crashes (125):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/24 08:30 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4169c9c90532 61c200c7 .config console log report C ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/22 04:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 61c200c7 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 15:33 upstream 21a7f44fd076 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 04:12 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 02:37 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 01:47 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 00:15 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 22:58 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 20:27 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 20:27 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 18:09 upstream 4da9dedf3fc5 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 17:36 upstream 4169c9c90532 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 16:36 upstream 4da9dedf3fc5 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 16:09 upstream 4da9dedf3fc5 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 15:52 upstream 4da9dedf3fc5 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 15:48 upstream 4da9dedf3fc5 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 13:36 upstream 26344c0dd32a 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 04:08 upstream 26344c0dd32a d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 01:45 upstream 734bef548a96 d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 21:41 upstream 734bef548a96 d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 15:55 upstream 734bef548a96 d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 04:13 upstream 2a08195e4db5 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/22 21:00 upstream 2a08195e4db5 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/21 18:40 upstream 9e947d96915a 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/21 14:39 upstream 9e947d96915a 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/21 11:42 upstream 9e947d96915a 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/21 11:42 upstream 9e947d96915a 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 12:12 upstream 330517c63aa9 1d9ca40b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 14:26 upstream 26344c0dd32a 1d9ca40b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 06:42 upstream 330517c63aa9 1d9ca40b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 12:56 upstream 4da9dedf3fc5 1d9ca40b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 08:45 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 21:58 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 21:42 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 21:27 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 21:26 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 21:25 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 21:25 linux-next 20a33c6b6cbe 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/22 23:24 linux-next bd1ecbb61afe 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/25 10:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 08:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 07:40 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 07:24 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 07:18 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 07:18 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 07:18 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/24 07:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 20:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 16:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 16:52 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 16:50 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/23 16:48 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/22 03:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
* Struck through repros no longer work on HEAD.