general protection fault in step_into

Based on kernel commit 84abb955b101:

Root Cause Analysis

1. Relevant Subsystems, Functions, and Files

Faulty logic location: fs/squashfs/namei.c in function squashfs_lookup()
Underlying helper: fs/squashfs/cache.c in function squashfs_read_metadata()
VFS manifestation path: fs/namei.c in functions finish_lookup(), walk_component(), step_into(), step_into_slowpath(), handle_mounts(), and traverse_mounts()

2. Root Cause Mechanism and Triggering Chain

In squashfs_lookup() (fs/squashfs/namei.c):

Uninitialized variable and positive assignment: The local variable int err; is declared at line 175 without initialization:
```
int err;
```
During directory entry lookup, metadata reads are performed by calling squashfs_read_metadata() (fs/squashfs/cache.c:438):
```
err = squashfs_read_metadata(dir->i_sb, &dirh, &block, &offset, sizeof(dirh));
...
err = squashfs_read_metadata(dir->i_sb, dire, &block, &offset, sizeof(*dire));
...
err = squashfs_read_metadata(dir->i_sb, dire->name, &block, &offset, size);
```
On success, squashfs_read_metadata() returns res = length, which is a positive integer (the number of bytes successfully read). Hence, after reading an entry name of length 6, err holds 6.
Improper error jump on bounds check failure: Before reading directory headers and directory entries, boundary checks against inode size are performed via squashfs_dir_space(dir, length, ...) (fs/squashfs/namei.c:205, 224, 239). If a directory has a corrupted or truncated i_size such that squashfs_dir_space() returns false, the code executes:
```
if (!squashfs_dir_space(dir, length, sizeof(*dire)))
    goto read_failure;
```
Notice that it jumps directly to read_failure:, completely bypassing data_error:, which is the label responsible for setting err = -EIO;:
```
data_error:
    err = -EIO;

read_failure:
    ERROR("Unable to read directory block [%llx:%x]\n",
        squashfs_i(dir)->start, squashfs_i(dir)->offset);
failed:
    kfree(dire);
    return ERR_PTR(err);
```
Consequently:
- If squashfs_dir_space() fails after one or more successful reads, err contains the positive byte count returned by squashfs_read_metadata() (e.g., err = 6).
- If squashfs_dir_space() fails on line 205 prior to any squashfs_read_metadata() invocation, err contains whatever garbage was on the stack.
VFS pointer confusion and crash propagation:
- squashfs_lookup() returns ERR_PTR(err). Because err == 6, ERR_PTR(6) evaluates to (struct dentry *)0x0000000000000006.
- In finish_lookup() (fs/namei.c:1936):
```
res = dir->i_op->lookup(dir, dentry, flags);
d_lookup_done(dentry);
if (unlikely(res)) {
    dput(dentry);
    return res;
}
```
  res is non-NULL (0x6), so finish_lookup() drops the allocated dentry and returns (struct dentry *)0x6.
- In walk_component() (fs/namei.c:2326):
```
dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
if (IS_ERR(dentry))
    return ERR_CAST(dentry);
...
return step_into(nd, flags, dentry);
```
  IS_ERR(0x6) evaluates to false because 0x6 is not within [-4095, -1]. walk_component() assumes 0x6 is a valid struct dentry * and passes it to step_into().
- step_into() invokes step_into_slowpath() -> handle_mounts() -> traverse_mounts() (fs/namei.c:1665):
```
unsigned flags = smp_load_acquire(&path->dentry->d_flags);
```
  Offset 0 of struct dentry is d_flags. KASAN checks the shadow address for 0x6: (0x6 >> 3) + 0xdffffc0000000000 = 0xdffffc0000000000. Because 0xdffffc0000000000 is non-canonical on x86_64, the CPU triggers a general protection fault (#GP), reported by KASAN as a null-ptr-deref in range [0x0000000000000000-0x0000000000000007].

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
6b1a37da	assessment-security	DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ✅ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	general protection fault in step_into_slowpath	2026/11/15 20:42	2026/11/15 20:42	2026/11/15 20:53	819ebe34

assessment-security

DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ✅ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

general protection fault in step_into_slowpath

2026/11/15 20:42

2026/11/15 20:53

819ebe34

Title	Replies (including bot)	Last reply
[syzbot] [squashfs?] general protection fault in step_into_slowpath	0 (1)	2026/11/15 21:57

Title

Replies (including bot)

Last reply

[syzbot] [squashfs?] general protection fault in step_into_slowpath

0 (1)

2026/11/15 21:57

loop0: detected capacity change from 0 to 8 SQUASHFS error: Unable to read directory block [0:26] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 5644 Comm: syz-executor134 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 RIP: 0010:traverse_mounts fs/namei.c:1665 [inline] RIP: 0010:handle_mounts fs/namei.c:1777 [inline] RIP: 0010:step_into_slowpath+0x112/0x810 fs/namei.c:2146 Code: 24 1f 00 49 bf 00 00 00 00 00 fc ff df 43 0f b6 04 3c 84 c0 0f 85 75 05 00 00 45 8b 75 00 4c 8b 6c 24 48 4c 89 e8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 76 05 00 00 45 8b 6d 00 44 89 ee 81 e6 RSP: 0018:ffffc90003ba7a40 EFLAGS: 00010247 RAX: 0000000000000000 RBX: ffffc90003ba7c20 RCX: ffff888037d43e80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003ba7af0 R08: ffff888078fd331f R09: 1ffff1100f1fa663 R10: dffffc0000000000 R11: ffffed100f1fa664 R12: 1ffff92000774f8b R13: 0000000000000006 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555564c07400(0000) GS:ffff8881234cd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff34166e74 CR3: 000000007b074000 CR4: 00000000003526f0 Call Trace: <TASK> step_into fs/namei.c:2194 [inline] walk_component fs/namei.c:2331 [inline] lookup_last fs/namei.c:2839 [inline] path_lookupat+0x433/0x8c0 fs/namei.c:2864 filename_lookup+0x265/0x5d0 fs/namei.c:2893 user_path_at+0x40/0x160 fs/namei.c:3692 do_mount fs/namespace.c:4467 [inline] __do_sys_mount fs/namespace.c:4683 [inline] __se_sys_mount+0x2dc/0x420 fs/namespace.c:4660 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x171/0x540 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x00007fdbf37e4949 Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff0f8baee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fdbf37e4949 RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004000 R11: 0000000000000246 R12: 00007fff0f8baf20 R13: 0000000000000002 R14: 431bde82d7b634db R15: 00007fdbf384404b </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:traverse_mounts fs/namei.c:1665 [inline] RIP: 0010:handle_mounts fs/namei.c:1777 [inline] RIP: 0010:step_into_slowpath+0x112/0x810 fs/namei.c:2146 Code: 24 1f 00 49 bf 00 00 00 00 00 fc ff df 43 0f b6 04 3c 84 c0 0f 85 75 05 00 00 45 8b 75 00 4c 8b 6c 24 48 4c 89 e8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 76 05 00 00 45 8b 6d 00 44 89 ee 81 e6 RSP: 0018:ffffc90003ba7a40 EFLAGS: 00010247 RAX: 0000000000000000 RBX: ffffc90003ba7c20 RCX: ffff888037d43e80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003ba7af0 R08: ffff888078fd331f R09: 1ffff1100f1fa663 R10: dffffc0000000000 R11: ffffed100f1fa664 R12: 1ffff92000774f8b R13: 0000000000000006 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555564c07400(0000) GS:ffff8881234cd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff34166e74 CR3: 000000007b074000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 24 1f and $0x1f,%al 2: 00 49 bf add %cl,-0x41(%rcx) 5: 00 00 add %al,(%rax) 7: 00 00 add %al,(%rax) 9: 00 fc add %bh,%ah b: ff lcall (bad) c: df 43 0f filds 0xf(%rbx) f: b6 04 mov $0x4,%dh 11: 3c 84 cmp $0x84,%al 13: c0 0f 85 rorb $0x85,(%rdi) 16: 75 05 jne 0x1d 18: 00 00 add %al,(%rax) 1a: 45 8b 75 00 mov 0x0(%r13),%r14d 1e: 4c 8b 6c 24 48 mov 0x48(%rsp),%r13 23: 4c 89 e8 mov %r13,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 76 05 00 00 jne 0x5ad 37: 45 8b 6d 00 mov 0x0(%r13),%r13d 3b: 44 89 ee mov %r13d,%esi 3e: 81 .byte 0x81 3f: e6 .byte 0xe6

Crashes (3):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/11/15 21:56	linux-next	84abb955b101	819ebe34	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro]	ci-upstream-linux-next-kasan-gce-root	general protection fault in step_into_slowpath
2026/11/15 22:23	linux-next	84abb955b101	819ebe34	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	general protection fault in step_into_slowpath
2026/11/15 20:42	linux-next	84abb955b101	819ebe34	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	general protection fault in step_into_slowpath

Crashes (3):

Assets (help?)