syzbot
BUG: unable to handle kernel NULL pointer dereference in kthread_destroy_worker
Status:
moderation: reported on 2026/09/11 19:50
Subsystems:
virt
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+fcd718217fdd09d84a69@syzkaller.appspotmail.com
First crash: 4d02h, last: 4d02h
▶
▼
Last patch testing requests (1)
Sample crash report:
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read
[00000014] *pgd=86c61003
, *pmd=df68e003
Internal error: Oops: 205 [#1] SMP ARM
Modules linked in:
CPU: 1 UID: 0 PID: 9125 Comm: syz.1.1441 Not tainted syzkaller #0 PREEMPT
Hardware name: ARM-Versatile Express
PC is at kthread_destroy_worker+0xc/0xa8 kernel/kthread.c:1599
LR is at vdpasim_free+0x20/0x118 drivers/vdpa/vdpa_sim/vdpa_sim.c:750
pc : [<802825fc>] lr : [<80abaaac>] psr: 60000013
sp : fe5a5950 ip : fe5a5968 fp : fe5a5964
r10: 86130400 r9 : 86130638 r8 : 82b57ea4
r7 : 00000000 r6 : 86130400 r5 : 00000000 r4 : 86130400
r3 : 80abaa8c r2 : 00000000 r1 : 00000000 r0 : fffffffc
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 30c5387d Table: 86044b40 DAC: 00000000
Register r0 information: non-paged memory
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-slab/vmalloc memory
Register r4 information: slab kmalloc-1k start 86130400 pointer offset 0 size 1024
Register r5 information: NULL pointer
Register r6 information: slab kmalloc-1k start 86130400 pointer offset 0 size 1024
Register r7 information: NULL pointer
Register r8 information: non-slab/vmalloc memory
Register r9 information: slab kmalloc-1k start 86130400 pointer offset 568 size 1024
Register r10 information: slab kmalloc-1k start 86130400 pointer offset 0 size 1024
Register r11 information: 2-page vmalloc region starting at 0xfe5a4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766
Register r12 information: 2-page vmalloc region starting at 0xfe5a4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766
Process syz.1.1441 (pid: 9125, stack limit = 0xfe5a4000)
Stack: (0xfe5a5950 to 0xfe5a6000)
5940: 86130400 00000000 fe5a598c fe5a5968
5960: 80abaaac 802825fc 86130400 00000000 860aca00 00000000 82b57ea4 86130638
5980: fe5a59a4 fe5a5990 80ab77e4 80abaa98 86130400 00000000 fe5a59c4 fe5a59a8
59a0: 80bd729c 80ab77cc fe5a5a04 823a58f0 86130400 81d5b39c fe5a59f4 fe5a59c8
59c0: 81b458b0 80bd7268 fe5a5a04 fe5a59d8 fe5a5a04 fffffff4 fe5a5a50 00000000
59e0: fffffffc 82b57ea4 fe5a5a04 fe5a59f8 80bd7410 81b4581c fe5a5a4c fe5a5a08
5a00: 80abadcc 80bd7404 00000001 000002d8 84e824a8 00000001 00000002 8331e200
5a20: 86093d80 82b57ef0 00000001 84e824a4 00000000 fe5a5c48 82e3a4c0 8255276c
5a40: fe5a5aac fe5a5a50 80abbda8 80abac6c 82b57ef0 84e824a8 08007646 00000003
5a60: 000002d8 00000060 00000001 00000002 00000001 00000001 80abc0a8 80abbf9c
5a80: 00000000 00000000 80abc084 00000000 84e824a4 0fc6cca0 82b57ef0 fe5a5b20
5aa0: fe5a5b14 fe5a5ab0 80ab8388 80abbd1c 80a01e34 80a011a0 0000001f fe5a5c48
5ac0: 86093d80 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ae0: 00000000 00000000 fe5a5c48 0fc6cca0 84e82490 86093d80 8384c600 fe5a5bd8
5b00: fe5a5c48 82e3a4c0 fe5a5ba4 fe5a5b18 8176d5d8 80ab80d4 00000004 00000001
5b20: 00000000 000006d1 8255276c 84e82480 84e82490 86093d80 82e3a4c0 00000000
5b40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5b60: 00000000 00000000 00000000 fe5a5c48 80261030 0fc6cca0 0000000c 8255276c
5b80: 84e82480 00000000 fe5a5bd8 8384c600 82e3a4c0 00000002 fe5a5c44 fe5a5ba8
5ba0: 8176de1c 8176d4f4 fe5a5bd8 00000004 82e3a4c0 00c00000 00000004 fe5a5c48
5bc0: 00000000 82c09b00 fe5a5bfc fe5a5bd8 80290c5c 802d699c 00000000 80ab80c8
5be0: 00000000 81d252c0 00000025 00030003 fe5a5c1c fe5a5c00 804fabb4 8028f548
5c00: ffefd000 deda411c 00000001 82c85518 fe5a5c44 0fc6cca0 8052cfd0 00000000
5c20: 8384c600 8176dbdc 84e82480 8384c600 82e3a4c0 85733d84 fe5a5cd4 fe5a5c48
5c40: 8176c82c 8176dbe8 00000000 00000000 00000000 00000000 00000000 00000000
5c60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5c80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ca0: 00000000 00000000 00000000 00000000 00000000 0fc6cca0 8384c600 83393c64
5cc0: 00000030 83840bc0 fe5a5cec fe5a5cd8 8176d3c0 8176c778 83393c00 83393c64
5ce0: fe5a5d2c fe5a5cf0 8176bff8 8176d3a4 8384c600 00000000 7fffffff 0fc6cca0
5d00: 00000000 fe5a5f28 8384c600 00000030 85733c00 00000000 00000000 00000000
5d20: fe5a5d94 fe5a5d30 8176c2d0 8176bd94 fe5a5f28 8580cf40 00000000 00000000
5d40: 00000000 00000030 831dcc00 00000000 000006d1 00000000 00000000 00000000
5d60: 00000030 0fc6cca0 fe5a5d94 00000000 fe5a5f28 8580cf40 00000000 fe5a5dd4
5d80: 00000000 00000000 fe5a5db4 fe5a5d98 8162f7c4 8176c114 fe5a5f28 8580cf40
5da0: 00000000 00000000 fe5a5e24 fe5a5db8 81630864 8162f78c fe5a5e30 fe5a5f38
5dc0: 00000000 fe5a5de0 fe5a5e24 fe5a5dd8 81630b30 00000000 00000000 00000000
5de0: 00000000 00000000 00000000 00000000 00000000 0fc6cca0 00000000 00000000
5e00: fe5a5f28 8580cf40 00000000 00000000 20000280 00000128 fe5a5f1c fe5a5e28
5e20: 81630c64 81630638 00000000 00000001 00000000 20000300 00000030 00000000
5e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5e80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ee0: 00000000 00000000 00000000 00000000 00000000 0fc6cca0 00000005 863dc081
5f00: 20000280 00000000 863dc080 8409b100 fe5a5f94 fe5a5f20 81632e3c 81630bd4
5f20: 00000000 00000000 00000000 00000000 00000000 00000000 00010000 00000030
5f40: 20000300 00000000 00000001 00000000 00000000 00000001 00000000 00000000
5f60: 00000000 00000000 ecac8b10 0fc6cca0 ffffffff 00000000 00000000 003564f0
5f80: 00000128 8020029c fe5a5fa4 fe5a5f98 81632ea4 81632dbc 00000000 fe5a5fa8
5fa0: 80200060 81632e9c 00000000 00000000 00000005 20000280 00000000 00000000
5fc0: 00000000 00000000 003564f0 00000128 003564b8 00000000 003d0f00 76f440dc
5fe0: 76f43e88 76f43e78 00018fa0 00130a50 60000010 00000005 00000000 00000000
Call trace:
[<802825f0>] (kthread_destroy_worker) from [<80abaaac>] (vdpasim_free+0x20/0x118 drivers/vdpa/vdpa_sim/vdpa_sim.c:750)
r5:00000000 r4:86130400
[<80abaa8c>] (vdpasim_free) from [<80ab77e4>] (vdpa_release_dev+0x24/0x40 drivers/vdpa/vdpa.c:94)
r9:86130638 r8:82b57ea4 r7:00000000 r6:860aca00 r5:00000000 r4:86130400
[<80ab77c0>] (vdpa_release_dev) from [<80bd729c>] (device_release+0x40/0xb0 drivers/base/core.c:2636)
r5:00000000 r4:86130400
[<80bd725c>] (device_release) from [<81b458b0>] (kobject_cleanup lib/kobject.c:689 [inline])
[<80bd725c>] (device_release) from [<81b458b0>] (kobject_release lib/kobject.c:720 [inline])
[<80bd725c>] (device_release) from [<81b458b0>] (kref_put include/linux/kref.h:65 [inline])
[<80bd725c>] (device_release) from [<81b458b0>] (kobject_put+0xa0/0x258 lib/kobject.c:737)
r5:81d5b39c r4:86130400
[<81b45810>] (kobject_put) from [<80bd7410>] (put_device+0x18/0x1c drivers/base/core.c:3880)
r8:82b57ea4 r7:fffffffc r6:00000000 r5:fe5a5a50 r4:fffffff4
[<80bd73f8>] (put_device) from [<80abadcc>] (vdpasim_create+0x16c/0x2f8 drivers/vdpa/vdpa_sim/vdpa_sim.c:282)
[<80abac60>] (vdpasim_create) from [<80abbda8>] (vdpasim_blk_dev_add+0x98/0x140 drivers/vdpa/vdpa_sim/vdpa_sim_blk.c:423)
r10:8255276c r9:82e3a4c0 r8:fe5a5c48 r7:00000000 r6:84e824a4 r5:00000001
r4:82b57ef0
[<80abbd10>] (vdpasim_blk_dev_add) from [<80ab8388>] (vdpa_nl_cmd_dev_add_set_doit+0x2c0/0x480 drivers/vdpa/vdpa.c:662)
r5:fe5a5b20 r4:82b57ef0
[<80ab80c8>] (vdpa_nl_cmd_dev_add_set_doit) from [<8176d5d8>] (genl_family_rcv_msg_doit+0xf0/0x140 net/netlink/genetlink.c:1114)
r9:82e3a4c0 r8:fe5a5c48 r7:fe5a5bd8 r6:8384c600 r5:86093d80 r4:84e82490
[<8176d4e8>] (genl_family_rcv_msg_doit) from [<8176de1c>] (genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline])
[<8176d4e8>] (genl_family_rcv_msg_doit) from [<8176de1c>] (genl_rcv_msg+0x240/0x3a8 net/netlink/genetlink.c:1209)
r10:00000002 r9:82e3a4c0 r8:8384c600 r7:fe5a5bd8 r6:00000000 r5:84e82480
r4:8255276c
[<8176dbdc>] (genl_rcv_msg) from [<8176c82c>] (netlink_rcv_skb+0xc0/0x120 net/netlink/af_netlink.c:2556)
r10:85733d84 r9:82e3a4c0 r8:8384c600 r7:84e82480 r6:8176dbdc r5:8384c600
r4:00000000
[<8176c76c>] (netlink_rcv_skb) from [<8176d3c0>] (genl_rcv+0x28/0x38 net/netlink/genetlink.c:1218)
r7:83840bc0 r6:00000030 r5:83393c64 r4:8384c600
[<8176d398>] (genl_rcv) from [<8176bff8>] (netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline])
[<8176d398>] (genl_rcv) from [<8176bff8>] (netlink_unicast+0x270/0x380 net/netlink/af_netlink.c:1345)
r5:83393c64 r4:83393c00
[<8176bd88>] (netlink_unicast) from [<8176c2d0>] (netlink_sendmsg+0x1c8/0x444 net/netlink/af_netlink.c:1900)
r10:00000000 r9:00000000 r8:00000000 r7:85733c00 r6:00000030 r5:8384c600
r4:fe5a5f28
[<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (sock_sendmsg_nosec net/socket.c:800 [inline])
[<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (__sock_sendmsg+0x44/0x78 net/socket.c:815)
r10:00000000 r9:00000000 r8:fe5a5dd4 r7:00000000 r6:8580cf40 r5:fe5a5f28
r4:00000000
[<8162f780>] (__sock_sendmsg) from [<81630864>] (____sys_sendmsg+0x238/0x2c4 net/socket.c:2709)
r7:00000000 r6:00000000 r5:8580cf40 r4:fe5a5f28
[<8163062c>] (____sys_sendmsg) from [<81630c64>] (___sys_sendmsg+0x9c/0xd0 net/socket.c:2763)
r10:00000128 r9:20000280 r8:00000000 r7:00000000 r6:8580cf40 r5:fe5a5f28
r4:00000000
[<81630bc8>] (___sys_sendmsg) from [<81632e3c>] (__sys_sendmsg+0x8c/0xe0 net/socket.c:2795)
r9:8409b100 r8:863dc080 r7:00000000 r6:20000280 r5:863dc081 r4:00000005
[<81632db0>] (__sys_sendmsg) from [<81632ea4>] (__do_sys_sendmsg net/socket.c:2800 [inline])
[<81632db0>] (__sys_sendmsg) from [<81632ea4>] (sys_sendmsg+0x14/0x18 net/socket.c:2798)
r8:8020029c r7:00000128 r6:003564f0 r5:00000000 r4:00000000
[<81632e90>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xfe5a5fa8 to 0xfe5a5ff0)
5fa0: 00000000 00000000 00000005 20000280 00000000 00000000
5fc0: 00000000 00000000 003564f0 00000128 003564b8 00000000 003d0f00 76f440dc
5fe0: 76f43e88 76f43e78 00018fa0 00130a50
Code: e89da830 e1a0c00d e92dd830 e24cb004 (e5905018)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: e89da830 ldm sp, {r4, r5, fp, sp, pc}
4: e1a0c00d mov ip, sp
8: e92dd830 push {r4, r5, fp, ip, lr, pc}
c: e24cb004 sub fp, ip, #4
* 10: e5905018 ldr r5, [r0, #24] <-- trapping instruction
Struck through repros no longer work on HEAD.