BUG: corrupted list in io_poll_remove

ID	Workflow	Correct	Bug	Created	Started	Finished	Revision	Error
bd7dc79a-d940-45ef-8442-32458b345025	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/15 03:32	2026/02/15 03:32	2026/02/15 04:31	unknown	Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To moni... truncated to first 200 bytes; open job for full error
911d57db-8216-4b94-b598-cc30743f8b33	patching	🏃	BUG: corrupted list in io_poll_remove_entries	2026/02/13 13:25	2026/02/13 13:25		54290dbc8f9e8d4533df2bb39cf823e93897fb2c
9f8ce044-c5e3-4556-88a3-f7ebb56bea12	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/13 13:25	2026/02/13 13:25	2026/02/13 13:28	unknown	Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To moni... truncated to first 200 bytes; open job for full error
62e9826b-6a8b-4ae5-9091-50e08baf2ef3	patching-summary	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/13 12:59	2026/02/13 13:02	2026/02/13 13:04	unknown	Error 400, Message: * GenerateContentRequest.contents[8].parts[0].data: required oneof field 'data' must have one initialized field , Status: INVALID_ARGUMENT, Details: [map[@type:type.googleapis.com/... truncated to first 200 bytes; open job for full error
4b02474c-4a82-4a73-aea4-2aa306da9302	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/13 12:59	2026/02/13 12:59	2026/02/13 13:02	unknown	Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To moni... truncated to first 200 bytes; open job for full error
aa5819f1-0829-48b6-b463-120b5f1c2551	patching-summary	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/13 12:38	2026/02/13 12:41	2026/02/13 12:42	unknown	Error 400, Message: * GenerateContentRequest.contents[8].parts[0].data: required oneof field 'data' must have one initialized field , Status: INVALID_ARGUMENT, Details: [map[@type:type.googleapis.com/... truncated to first 200 bytes; open job for full error
5beb8e96-5311-4a0c-8ffd-ace3590566df	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/13 12:37	2026/02/13 12:38	2026/02/13 12:40	unknown	Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To moni... truncated to first 200 bytes; open job for full error
e81434b6-4bd7-4067-afb9-304548cd61e6	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/13 04:02	2026/02/13 04:02	2026/02/13 04:07	unknown	Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To moni... truncated to first 200 bytes; open job for full error
eef818fc-144e-40fb-97a4-19c741ccfd60	patching-summary	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/13 01:17	2026/02/13 01:17	2026/02/13 03:28	unknown	Error 400, Message: * GenerateContentRequest.contents[8].parts[0].data: required oneof field 'data' must have one initialized field , Status: INVALID_ARGUMENT, Details: [map[@type:type.googleapis.com/... truncated to first 200 bytes; open job for full error
ded97f95-a124-4516-93b5-5ece24a8a383	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/12 23:53	2026/02/12 23:53	2026/02/12 23:56	unknown	Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To moni... truncated to first 200 bytes; open job for full error
cc9adb52-50bb-4f70-827b-929db7220cc1	patching	🏃	BUG: corrupted list in io_poll_remove_entries	2026/02/12 17:10	2026/02/12 17:10		unknown
dd7f95ff-f8ec-4f40-a2ce-25187666555d	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/12 16:25	2026/02/12 16:25	2026/02/12 16:50	unknown	set GOOGLE_API_KEY env var to use with Gemini (see https://ai.google.dev/gemini-api/docs/api-key)
3ce649d1-e388-44ef-bc22-6090ce0f7aa4	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/10 17:48	2026/02/10 18:09	2026/02/10 18:10	unknown	fork/exec ./syz-agent: no such file or directory
a7b38802-5806-4dad-b8bb-fbcbbeedeae6	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/10 17:48	2026/02/10 17:48	2026/02/10 18:09	unknown	fork/exec ./syz-agent: no such file or directory
8e4e7d72-b62a-4af3-9440-140e0b7298fa	patching-summary	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/10 10:47	2026/02/10 10:47	2026/02/10 10:47	91d776d358daef41852d3c6541e561a616f5f523+	drivers/gpu/drm/drm_panel.c: exit status 1 Error while trying to load a compilation database: Could not auto-detect compilation database from directory "/usr/local/google/home/dvyukov/syzkaller/agent/... truncated to first 200 bytes; open job for full error
91c3ac4b-1676-44b6-b966-3b1843c067ab	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/10 10:47	2026/02/10 10:47	2026/02/10 10:47	91d776d358daef41852d3c6541e561a616f5f523+	virt/kvm/irqchip.c: exit status 1 Error while trying to load a compilation database: Could not auto-detect compilation database from directory "/usr/local/google/home/dvyukov/syzkaller/agent/workdir/c... truncated to first 200 bytes; open job for full error
333c8d5a-94fb-4cdb-b8da-92e2a7a875ac	patching-summary	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/10 07:17	2026/02/10 07:25	2026/02/10 07:25	97745f52f5b9361548048f53f0b3b51b9313fedf	fork/exec ./syz-agent: no such file or directory
f4eae230-0603-4845-9246-9625f8d60004	patching	💥	BUG: corrupted list in io_poll_remove_entries	2026/02/10 07:16	2026/02/10 07:16	2026/02/10 07:25	97745f52f5b9361548048f53f0b3b51b9313fedf	fork/exec ./syz-agent: no such file or directory

Title	Replies (including bot)	Last reply
[PATCH 5.15.y] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen	1 (1)	2026/04/01 06:12
Re: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen	1 (1)	2026/02/25 16:03
[PATCH] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen	1 (1)	2026/02/24 18:51
[syzbot] [io-uring?] BUG: corrupted list in io_poll_remove_entries	6 (8)	2026/02/21 13:39
[PATCH] media: dvb-core: protect dvr_buffer reinitialization with lock	1 (1)	2026/02/12 12:31
[PATCH] io_uring: fix list corruption race in io_pollfree_wake()	2 (2)	2026/02/12 12:02

Title

Replies (including bot)

Last reply

[PATCH 5.15.y] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen

1 (1)

2026/04/01 06:12

Re: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen

1 (1)

2026/02/25 16:03

[PATCH] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen

1 (1)

2026/02/24 18:51

[syzbot] [io-uring?] BUG: corrupted list in io_poll_remove_entries

6 (8)

2026/02/21 13:39

[PATCH] media: dvb-core: protect dvr_buffer reinitialization with lock

1 (1)

2026/02/12 12:31

[PATCH] io_uring: fix list corruption race in io_pollfree_wake()

2 (2)

2026/02/12 12:02

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: use-after-free Read in io_poll_remove_entries io-uring	19	C	done	done	751	1178d	1557d	0/29	auto-obsoleted due to no activity on 2023/07/04 23:32
linux-5.15	BUG: corrupted list in io_poll_remove_entries origin:lts-only	8	C		error	6	124d	124d	0/3	auto-obsoleted due to no activity on 2026/06/02 18:40
linux-6.1	general protection fault in io_poll_remove_entries	11	C		done	21	1181d	1200d	3/3	fixed on 2023/05/02 21:55
upstream	KASAN: slab-use-after-free Read in io_poll_remove_entries comedi	19	C			12	333d	342d	29/29	fixed on 2025/09/04 16:57
upstream	KASAN: slab-use-after-free Read in io_poll_remove_entries (2) io-uring	19				1	211d	210d	0/29	closed as invalid on 2025/12/19 03:22
linux-5.15	KASAN: use-after-free Read in io_poll_remove_entries origin:lts-only	19	C		error	5	306d	333d	0/3	auto-obsoleted due to no activity on 2025/12/08 02:55

Rank 🛈

upstream

KASAN: use-after-free Read in io_poll_remove_entries io-uring

done

751

1178d

1557d

0/29

auto-obsoleted due to no activity on 2023/07/04 23:32

linux-5.15

BUG: corrupted list in io_poll_remove_entries origin:lts-only

error

124d

0/3

auto-obsoleted due to no activity on 2026/06/02 18:40

linux-6.1

general protection fault in io_poll_remove_entries

done

1181d

1200d

3/3

fixed on 2023/05/02 21:55

upstream

KASAN: slab-use-after-free Read in io_poll_remove_entries comedi

333d

342d

29/29

fixed on 2025/09/04 16:57

upstream

KASAN: slab-use-after-free Read in io_poll_remove_entries (2) io-uring

211d

210d

0/29

closed as invalid on 2025/12/19 03:22

linux-5.15

KASAN: use-after-free Read in io_poll_remove_entries origin:lts-only

error

306d

333d

0/3

auto-obsoleted due to no activity on 2025/12/08 02:55

Created	Duration	User	Patch	Repo	Result
2026/02/09 20:18	30m	axboe@kernel.dk	patch	upstream	OK log

Created

Duration

User

Patch

Repo

Result

2026/02/09 20:18

30m

axboe@kernel.dk

patch

upstream

OK log

list_del corruption. prev->next should be ffff88807dc6c3f0, but was ffff888146b205c8. (prev=ffff888146b205c8) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:62! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5969 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:__list_del_entry_valid_or_report+0x14a/0x1d0 lib/list_debug.c:62 Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 40 3d fa 8b e8 37 b0 32 fc 90 <0f> 0b 4c 89 e7 e8 3c 24 5d fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc90003bffaa8 EFLAGS: 00010082 RAX: 000000000000006d RBX: ffff88807dc6c3f0 RCX: 0000000000000000 RDX: 000000000000006d RSI: ffffffff81e5d6c9 RDI: fffff5200077ff46 RBP: ffff888146b205c8 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000001 R11: 0000000000000000 R12: ffff88807dc6c2b0 R13: ffff88807dc6c408 R14: ffff88807dc6c3f0 R15: ffff88807dc6c3c8 FS: 0000000000000000(0000) GS:ffff8881245d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f60e56708c0 CR3: 000000006b065000 CR4: 00000000003526f0 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_init include/linux/list.h:295 [inline] io_poll_remove_waitq io_uring/poll.c:149 [inline] io_poll_remove_entry io_uring/poll.c:166 [inline] io_poll_remove_entries.part.0+0x156/0x7e0 io_uring/poll.c:197 io_poll_remove_entries io_uring/poll.c:177 [inline] io_poll_task_func+0x39e/0xe30 io_uring/poll.c:343 io_handle_tw_list+0x194/0x580 io_uring/io_uring.c:1122 tctx_task_work_run+0x57/0x2b0 io_uring/io_uring.c:1182 tctx_task_work+0x7a/0xd0 io_uring/io_uring.c:1200 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x829/0x2a30 kernel/exit.c:971 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112 __do_sys_exit_group kernel/exit.c:1123 [inline] __se_sys_exit_group kernel/exit.c:1121 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121 x64_sys_call+0x14fd/0x1510 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f60e579aeb9 Code: Unable to access opcode bytes at 0x7f60e579ae8f. RSP: 002b:00007ffc2d47ddf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f60e579aeb9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f60e59e1280 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f60e59e1280 R14: 0000000000000003 R15: 00007ffc2d47deb0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0x14a/0x1d0 lib/list_debug.c:62 Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 40 3d fa 8b e8 37 b0 32 fc 90 <0f> 0b 4c 89 e7 e8 3c 24 5d fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc90003bffaa8 EFLAGS: 00010082 RAX: 000000000000006d RBX: ffff88807dc6c3f0 RCX: 0000000000000000 RDX: 000000000000006d RSI: ffffffff81e5d6c9 RDI: fffff5200077ff46 RBP: ffff888146b205c8 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000001 R11: 0000000000000000 R12: ffff88807dc6c2b0 R13: ffff88807dc6c408 R14: ffff88807dc6c3f0 R15: ffff88807dc6c3c8 FS: 0000000000000000(0000) GS:ffff8881245d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f60e56708c0 CR3: 000000006b065000 CR4: 00000000003526f0

Crashes (8):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/02/08 17:56	upstream	e7aa57247700	4c131dc4	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	BUG: corrupted list in io_poll_remove_entries
2026/02/08 16:52	upstream	e7aa57247700	4c131dc4	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	BUG: corrupted list in io_poll_remove_entries
2026/02/08 15:10	upstream	e7aa57247700	4c131dc4	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	BUG: corrupted list in io_poll_remove_entries
2026/02/21 06:30	upstream	a95f71ad3e2e	6e7b5511	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	BUG: corrupted list in io_poll_remove_entries
2026/02/08 14:08	upstream	e7aa57247700	4c131dc4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	BUG: corrupted list in io_poll_remove_entries
2026/02/08 14:08	upstream	e7aa57247700	4c131dc4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	BUG: corrupted list in io_poll_remove_entries
2026/02/08 14:07	upstream	e7aa57247700	4c131dc4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	BUG: corrupted list in io_poll_remove_entries
2026/02/11 07:51	linux-next	fd9678829d6d	441e25b7	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	BUG: corrupted list in io_poll_remove_entries

Crashes (8):

Assets (help?)