general protection fault in __run_timers (4)

Status: moderation: reported on 2026/08/04 00:10
Subsystems: netfilter
[Documentation on labels]
Reported-by: syzbot+e53e8221436aa398a8be@syzkaller.appspotmail.com
First crash: 4d22h, last: 4d22h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
94ae3e82 assessment-security 💥 general protection fault in __run_timers (4) 2026/08/02 01:08 2026/08/02 01:08 2026/08/02 01:08 e611ffe1 
dashboard requested TargetOS "linux" TargetArch "386", but agent does not support it
cd07e557 assessment-security 💥 general protection fault in __run_timers (4) 2026/08/01 01:03 2026/08/01 01:03 2026/08/01 01:03 7664cf44 
dashboard requested TargetOS "linux" TargetArch "386", but agent does not support it
▶ ▼ Similar bugs (13)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in __run_timers kernel 2 35 3240d 3262d 0/29 closed as invalid on 2017/10/22 12:45
upstream KMSAN: uninit-value in __run_timers (3) net 7 syz, C error 4 1064d 1100d 0/29 auto-obsoleted due to no activity on 2024/01/10 00:11
upstream BUG: unable to handle kernel paging request in __run_timers (2) sound virt net 21 4 185d 281d 0/29 auto-obsoleted due to no activity on 2026/05/01 08:57
upstream general protection fault in __run_timers (2) kernel 2 syz, C 5 2901d 2916d 0/29 closed as invalid on 2018/09/05 12:51
upstream general protection fault in __run_timers (3) kernel 2 1 2154d 2150d 0/29 auto-closed as invalid on 2020/12/09 00:33
android-54 KASAN: use-after-free Write in __run_timers (2) 22 syz, C 752 435d 524d 0/2 upstream: reported C repro on 2025/02/25 14:17
android-54 KASAN: use-after-free Write in __run_timers 22 syz 449 762d 2214d 0/2 auto-obsoleted due to no activity on 2024/09/11 00:16
upstream KASAN: invalid-access Write in __run_timers kernel -1 8 1992d 1998d 0/29 auto-closed as invalid on 2021/05/20 13:15
android-6-1 KASAN: use-after-free Write in __run_timers origin:lts 22 syz, C 1029 1d11h 611d 0/2 upstream: reported C repro on 2024/12/01 07:19
upstream KASAN: slab-use-after-free Write in __run_timers net 22 1 521d 521d 0/29 closed as invalid on 2025/03/30 10:14
linux-5.15 KASAN: use-after-free Write in __run_timers origin:lts-only 22 syz, C error 1 202d 235d 0/3 auto-obsoleted due to no activity on 2026/06/03 21:03
android-54 KASAN: slab-out-of-bounds Write in __run_timers 21 4 1863d 2053d 0/2 auto-closed as invalid on 2021/10/26 12:53
upstream BUG: unable to handle kernel NULL pointer dereference in __run_timers arm 10 1 797d 793d 0/29 auto-obsoleted due to no activity on 2024/08/27 10:03

Sample crash report:
Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000025: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead000000000128-0xdead00000000012f]
CPU: 3 UID: 0 PID: 5743 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__hlist_del include/linux/list.h:1031 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:891 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1782 [inline]
RIP: 0010:__run_timers+0x6ac/0xb00 kernel/time/timer.c:2374
Code: 22 00 0f 85 db 02 00 00 4c 89 38 48 89 44 24 08 4d 85 ff 74 24 e8 b4 d2 14 00 49 8d 7f 08 48 8b 44 24 08 48 89 fa 48 c1 ea 03 <42> 80 3c 22 00 0f 85 f8 02 00 00 49 89 47 08 e8 90 d2 14 00 48 8d
RSP: 0000:ffffc900005e8d48 EFLAGS: 00010802
RAX: ffffc900005e8e08 RBX: ffff88802b323440 RCX: ffffffff81f4dbe4
RDX: 1bd5a00000000025 RSI: ffffffff81f4d9ac RDI: dead00000000012a
RBP: ffffc900005e8e08 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000
R13: fffff520000bd1c1 R14: ffff88802b5251c0 R15: dead000000000122
FS:  0000000000000000(0000) GS:ffff888096ee3000(0063) knlGS:0000000057a73480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f74072f0 CR3: 0000000065ffa000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __run_timer_base kernel/time/timer.c:2386 [inline]
 __run_timer_base kernel/time/timer.c:2378 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2395
 run_timer_softirq+0x10/0x50 kernel/time/timer.c:2403
 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270
Code: 00 e8 b1 07 2a 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 af b4 21 00 48 85 ed 0f 85 d7 01 00 00 e8 01 ba 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b
RSP: 0000:ffffc9000451ed60 EFLAGS: 00000293
RAX: ffffffff8f9af798 RBX: ffffffff8f9af740 RCX: ffffffff81e7f251
RDX: ffff888029df2540 RSI: ffffffff81e7f25f RDI: ffff888029df2540
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000002cea
R13: ffffffff8f9af798 R14: ffffc9000451ede0 R15: dffffc0000000000
 console_flush_all kernel/printk/printk.c:3343 [inline]
 __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
 console_unlock+0x103/0x260 kernel/printk/printk.c:3413
 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
 _printk+0xcf/0x110 kernel/printk/printk.c:2504
 warn_alloc.cold+0x7e/0xa8 mm/page_alloc.c:4016
 __vmalloc_node_range_noprof+0xccd/0x1630 mm/vmalloc.c:4047
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4143
 xt_compat_init_offsets+0xe2/0x1f0 net/netfilter/x_tables.c:779
 ebt_compat_init_offsets net/bridge/netfilter/ebtables.c:1840 [inline]
 compat_table_info+0x11b/0x870 net/bridge/netfilter/ebtables.c:1851
 compat_copy_everything_to_user+0xf42/0x1100 net/bridge/netfilter/ebtables.c:1891
 compat_do_ebt_get_ctl+0x9e8/0xbb0 net/bridge/netfilter/ebtables.c:2474
 do_ebt_get_ctl+0x243/0x7a0 net/bridge/netfilter/ebtables.c:2504
 nf_getsockopt+0x7c/0xe0 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0x192/0x1e0 net/ipv4/ip_sockglue.c:1777
 tcp_getsockopt+0xa1/0x110 net/ipv4/tcp.c:4864
 do_sock_getsockopt+0x50a/0x6e0 net/socket.c:2474
 __sys_getsockopt+0x133/0x1d0 net/socket.c:2505
 __do_compat_sys_socketcall net/compat.c:493 [inline]
 __se_compat_sys_socketcall net/compat.c:422 [inline]
 __ia32_compat_sys_socketcall+0x6af/0x770 net/compat.c:422
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f75fec
Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8
RSP: 002b:00000000fff30540 EFLAGS: 00000286 ORIG_RAX: 0000000000000066
RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000fff30578
RDX: 00000000f7406ff4 RSI: 00000000fff30600 RDI: 00000000fff305fc
RBP: 00000000fff30600 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__hlist_del include/linux/list.h:1031 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:891 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1782 [inline]
RIP: 0010:__run_timers+0x6ac/0xb00 kernel/time/timer.c:2374
Code: 22 00 0f 85 db 02 00 00 4c 89 38 48 89 44 24 08 4d 85 ff 74 24 e8 b4 d2 14 00 49 8d 7f 08 48 8b 44 24 08 48 89 fa 48 c1 ea 03 <42> 80 3c 22 00 0f 85 f8 02 00 00 49 89 47 08 e8 90 d2 14 00 48 8d
RSP: 0000:ffffc900005e8d48 EFLAGS: 00010802
RAX: ffffc900005e8e08 RBX: ffff88802b323440 RCX: ffffffff81f4dbe4
RDX: 1bd5a00000000025 RSI: ffffffff81f4d9ac RDI: dead00000000012a
RBP: ffffc900005e8e08 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000
R13: fffff520000bd1c1 R14: ffff88802b5251c0 R15: dead000000000122
FS:  0000000000000000(0000) GS:ffff888096ee3000(0063) knlGS:0000000057a73480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f74072f0 CR3: 0000000065ffa000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	22 00                	and    (%rax),%al
   2:	0f 85 db 02 00 00    	jne    0x2e3
   8:	4c 89 38             	mov    %r15,(%rax)
   b:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  10:	4d 85 ff             	test   %r15,%r15
  13:	74 24                	je     0x39
  15:	e8 b4 d2 14 00       	call   0x14d2ce
  1a:	49 8d 7f 08          	lea    0x8(%r15),%rdi
  1e:	48 8b 44 24 08       	mov    0x8(%rsp),%rax
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	42 80 3c 22 00       	cmpb   $0x0,(%rdx,%r12,1) <-- trapping instruction
  2f:	0f 85 f8 02 00 00    	jne    0x32d
  35:	49 89 47 08          	mov    %rax,0x8(%r15)
  39:	e8 90 d2 14 00       	call   0x14d2ce
  3e:	48                   	rex.W
  3f:	8d                   	.byte 0x8d

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/30 15:25 upstream 11028ab62899 abc81b93 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in __run_timers
* Struck through repros no longer work on HEAD.