syzbot

 sign-in | mailing list | source | docs
🐞 Open [309]
🐞 Fixed [2]
🐞 Invalid [1]
⬇ Missing Backports [9]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

VFS: Busy inodes after unmount (use-after-free)

Status: upstream: reported C repro on 2025/07/29 23:52
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+07910bd70ef5a5789202@syzkaller.appspotmail.com
First crash: 29d, last: 26d
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2025/07/30 upstream (ToT) 4b290aae788e C [report] VFS: Busy inodes after unmount (use-after-free)
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 VFS: Busy inodes after unmount (use-after-free) 2 C 4 858d 914d 0/2 auto-obsoleted due to no activity on 2023/08/20 15:35
upstream VFS: Busy inodes after unmount (use-after-free) (2) btrfs 2 C error 276 11d 109d 28/29 upstream: reported C repro on 2025/05/11 08:46
linux-6.1 VFS: Busy inodes after unmount (use-after-free) origin:lts-only 2 C inconclusive 1706 2d19h 894d 0/3 upstream: reported C repro on 2023/03/18 09:53
android-5-15 VFS: Busy inodes after unmount (use-after-free) origin:downstream 2 C error done 2 812d 914d 0/2 auto-obsoleted due to no activity on 2023/09/15 20:27
android-5-10 VFS: Busy inodes after unmount (use-after-free) 2 C done inconclusive 1 914d 914d 0/2 auto-obsoleted due to no activity on 2023/06/25 23:02
upstream VFS: Busy inodes after unmount (use-after-free) bcachefs 2 C error 55684 114d 946d 28/29 fixed on 2025/05/06 15:33
linux-5.15 VFS: Busy inodes after unmount (use-after-free) missing-backport origin:upstream 2 C unreliable 2346 2d07h 893d 0/3 upstream: reported C repro on 2023/03/19 11:46

Sample crash report:
VFS: Lookup of '.' in ocfs2 loop0 would have caused loop
VFS: Lookup of '.' in ocfs2 loop0 would have caused loop
ocfs2: Unmounting device (7,0) on (node local)
VFS: Busy inodes after unmount of loop0 (ocfs2)
------------[ cut here ]------------
kernel BUG at fs/super.c:697!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5905 Comm: syz-executor Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:generic_shutdown_super+0x2ad/0x2b0 fs/super.c:695
Code: e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 1c 73 f0 ff 49 8b 16 48 81 c3 60 06 00 00 48 c7 c7 60 ab b7 8a 48 89 de e8 b3 62 75 08 <0f> 0b 90 66 0f 1f 00 55 41 57 41 56 53 48 89 fb 49 bf 00 00 00 00
RSP: 0018:ffffc9000489fbc0 EFLAGS: 00010246
RAX: 000000000000002f RBX: ffff88807c1b8660 RCX: 232767d03879e500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100f8370f2 R08: ffffc9000489f7c7 R09: 1ffff92000913ef8
R10: dffffc0000000000 R11: fffff52000913ef9 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8d232f60 R15: ffff88807c1b8790
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc4da359a0 CR3: 000000000cb30000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 kill_block_super+0x44/0x90 fs/super.c:1660
 deactivate_locked_super+0x97/0x100 fs/super.c:481
 cleanup_mnt+0x429/0x4c0 fs/namespace.c:1250
 task_work_run+0x1ce/0x250 kernel/task_work.c:239
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x90b/0x23c0 kernel/exit.c:883
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 __do_sys_exit_group kernel/exit.c:1035 [inline]
 __se_sys_exit_group kernel/exit.c:1033 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1033
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd5bcd8eb69
Code: Unable to access opcode bytes at 0x7fd5bcd8eb3f.
RSP: 002b:00007ffc4da37a98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007fd5bce11c02 RCX: 00007fd5bcd8eb69
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000028 R08: 00007ffc4da35836 R09: 00007ffc4da38d50
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4da38d50
R13: 00007fd5bce11bdd R14: 0000000000024b91 R15: 00007ffc4da39e20
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:generic_shutdown_super+0x2ad/0x2b0 fs/super.c:695
Code: e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 1c 73 f0 ff 49 8b 16 48 81 c3 60 06 00 00 48 c7 c7 60 ab b7 8a 48 89 de e8 b3 62 75 08 <0f> 0b 90 66 0f 1f 00 55 41 57 41 56 53 48 89 fb 49 bf 00 00 00 00
RSP: 0018:ffffc9000489fbc0 EFLAGS: 00010246
RAX: 000000000000002f RBX: ffff88807c1b8660 RCX: 232767d03879e500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100f8370f2 R08: ffffc9000489f7c7 R09: 1ffff92000913ef8
R10: dffffc0000000000 R11: fffff52000913ef9 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8d232f60 R15: ffff88807c1b8790
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc4da359a0 CR3: 000000000cb30000 CR4: 00000000003506e0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/02 11:32 linux-6.6.y 3a8ababb8b6a 7368264b .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/07/30 11:21 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
2025/07/29 23:52 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan VFS: Busy inodes after unmount (use-after-free)
* Struck through repros no longer work on HEAD.