Internal error in mtd_read_oob_std

Status: upstream: reported C repro on 2026/10/20 18:20
Subsystems: mtd
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+eaaabe90f486cb6f31b2@syzkaller.appspotmail.com
First crash: 4d03h, last: 3d23h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
edc3d699 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ Internal error in mtd_read_oob_std 2026/10/17 00:08 2026/10/17 00:08 2026/10/17 00:43 432c0077
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mtd?] Internal error in mtd_read_oob_std 0 (1) 2026/10/20 18:20

Sample crash report:
Internal error: synchronous external abort: 0000000096000010 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 3660 Comm: syz.2.17 Tainted: G   M                syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK
Hardware name: linux,dummy-virt (DT)
pstate: 81402009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __memcpy+0xc/0x44 arch/arm64/lib/memcpy.S:251
lr : phram_read+0x28/0x40 drivers/mtd/devices/phram.c:70
sp : ffff80008671b7c0
x29: ffff80008671b7c0 x28: f7f0000012970000 x27: 0000000000000000
x26: 0000000000003030 x25: 0000000000002000 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000000 x21: ffff80008671b830
x20: ffff80008671b840 x19: 0000000000000044 x18: 00000000ffffffff
x17: ffff800083ab372d x16: ffff800083ab3708 x15: f9f0000006deb280
x14: ffff80008671b600 x13: f9f0000006deba1c x12: 0000550855e43902
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : dead000000000122 x6 : 0000000000000000
x5 : ffff8000c0000000 x4 : ffff80008671b8e4 x3 : ffff80008671b8e4
x2 : 0000000000000044 x1 : ffff8000c0000000 x0 : ffff80008671b8e4
Call trace:
 __memcpy+0xc/0x44 arch/arm64/lib/memcpy.S:250 (P)
 mtd_read_oob_std+0x84/0x9c drivers/mtd/mtdcore.c:1702
 mtd_read_oob+0x8c/0x15c drivers/mtd/mtdcore.c:1811
 mtd_read+0x68/0xc4 drivers/mtd/mtdcore.c:1603
 scan_header drivers/mtd/ftl.c:164 [inline]
 ftl_add_mtd+0xec/0x6a8 drivers/mtd/ftl.c:1017
 blktrans_notify_add drivers/mtd/mtd_blkdevs.c:464 [inline]
 blktrans_notify_add+0x50/0x74 drivers/mtd/mtd_blkdevs.c:456
 add_mtd_device+0x45c/0x7a8 drivers/mtd/mtdcore.c:828
 mtd_device_parse_register+0x294/0x35c drivers/mtd/mtdcore.c:1156
 register_device+0x104/0x260 drivers/mtd/devices/phram.c:162
 phram_setup+0x16c/0x2a0 drivers/mtd/devices/phram.c:324
 phram_param_call+0x60/0x84 drivers/mtd/devices/phram.c:349
 param_attr_store+0xa4/0x100 kernel/params.c:591
 module_attr_store+0x24/0x40 kernel/params.c:906
 sysfs_kf_write+0x7c/0x98 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x138/0x200 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x244/0x36c fs/read_write.c:687
 ksys_write+0x70/0x108 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x18/0x24 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140
 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590
Code: d65f03c0 d503245f d503201f aa0003e3 (1d010443) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d65f03c0 	ret
   4:	d503245f 	bti	c
   8:	d503201f 	nop
   c:	aa0003e3 	mov	x3, x0
* 10:	1d010443 	cpyp	[x3]!, [x1]!, x2! <-- trapping instruction

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/16 21:37 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 2f2f7eeef8b0 b1757810 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in mtd_read_oob_std
2026/10/16 20:43 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 2f2f7eeef8b0 b1757810 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in mtd_read_oob_std
2026/10/16 18:15 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 2f2f7eeef8b0 b1757810 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in mtd_read_oob_std
2026/10/16 18:15 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 2f2f7eeef8b0 b1757810 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in mtd_read_oob_std
* Struck through repros no longer work on HEAD.