BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc (2)

Status: upstream: reported on 2026/08/01 00:02
Subsystems: afs net
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+86abcd2aa855d0add658@syzkaller.appspotmail.com
First crash: 5d04h, last: 4d17h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
b3bffb0f assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc (2) 2026/08/01 02:00 2026/08/01 02:00 2026/08/01 02:46 7664cf44

			
		
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [afs?] [net?] BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc (2) 0 (1) 2026/08/01 00:02
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc net arm-msm 4 syz, C done done 544 1914d 2251d 20/29 fixed on 2021/11/10 00:50

Sample crash report:
BUG: using smp_processor_id() in preemptible [00000000] code: krxrpcio/0/5331
caller is radix_tree_node_alloc+0x1b3/0x3a0 lib/radix-tree.c:263
CPU: 0 UID: 0 PID: 5331 Comm: krxrpcio/0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 check_preemption_disabled+0xd3/0xe0 lib/smp_processor_id.c:47
 radix_tree_node_alloc+0x1b3/0x3a0 lib/radix-tree.c:263
 idr_get_free+0x28f/0xa10 lib/radix-tree.c:1506
 idr_alloc_u32+0x18a/0x330 lib/idr.c:48
 idr_alloc_cyclic+0x9c/0x1b0 lib/idr.c:127
 rxrpc_alloc_client_connection net/rxrpc/conn_client.c:165 [inline]
 rxrpc_add_conn_to_bundle net/rxrpc/conn_client.c:353 [inline]
 rxrpc_bundle_has_space net/rxrpc/conn_client.c:404 [inline]
 rxrpc_connect_client_calls+0x74f/0x12c0 net/rxrpc/conn_client.c:524
 rxrpc_io_thread+0x2d9a/0x3290 net/rxrpc/io_thread.c:536
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/30 14:17 upstream 11028ab62899 0a1bc234 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc
2026/07/30 03:26 upstream fc46aed51f62 2377cd3d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc
* Struck through repros no longer work on HEAD.