syzbot


VFS: Busy inodes after unmount (use-after-free) (3)

Status: upstream: reported C repro on 2025/09/30 20:17
Subsystems: isofs
[Documentation on labels]
Reported-by: syzbot+1d79ebe5383fc016cf07@syzkaller.appspotmail.com
Fix commit: vfs: Don't leak disconnected dentries on umount
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 8d22h, last: 3d06h
Cause bisection: failed (error log, bisect log)
  
Discussions (3)
Title Replies (including bot) Last reply
[PATCH] vfs: Don't leak disconnected dentries on umount 4 (4) 2025/10/07 11:09
[PATCH] isofs: fix inode leak caused by disconnected dentries from exportfs 2 (2) 2025/10/01 12:26
[syzbot] [isofs?] VFS: Busy inodes after unmount (use-after-free) (3) 0 (2) 2025/10/01 08:59
Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 VFS: Busy inodes after unmount (use-after-free) 2 C 4 900d 956d 0/2 auto-obsoleted due to no activity on 2023/08/20 15:35
upstream VFS: Busy inodes after unmount (use-after-free) (2) btrfs 2 C error 277 39d 150d 29/29 fixed on 2025/09/04 16:57
linux-6.1 VFS: Busy inodes after unmount (use-after-free) origin:lts-only 2 C inconclusive 1731 18h39m 935d 0/3 upstream: reported C repro on 2023/03/18 09:53
android-5-15 VFS: Busy inodes after unmount (use-after-free) origin:downstream 2 C error done 2 854d 956d 0/2 auto-obsoleted due to no activity on 2023/09/15 20:27
android-5-10 VFS: Busy inodes after unmount (use-after-free) 2 C done inconclusive 1 956d 956d 0/2 auto-obsoleted due to no activity on 2023/06/25 23:02
linux-6.6 VFS: Busy inodes after unmount (use-after-free) origin:upstream missing-backport 2 C 18 3d11h 71d 0/2 upstream: reported C repro on 2025/07/29 23:52
upstream VFS: Busy inodes after unmount (use-after-free) bcachefs 2 C error 55684 156d 987d 28/29 fixed on 2025/05/06 15:33
linux-5.15 VFS: Busy inodes after unmount (use-after-free) missing-backport origin:upstream 2 C unreliable 2348 7d08h 934d 0/3 upstream: reported C repro on 2023/03/19 11:46
Last patch testing requests (1)
Created Duration User Patch Repo Result
2025/10/01 08:59 21m kartikey406@gmail.com patch upstream OK log

Sample crash report:
VFS: Busy inodes after unmount of loop0 (iso9660)
------------[ cut here ]------------
kernel BUG at fs/super.c:652!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5993 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:generic_shutdown_super+0x2bc/0x2c0 fs/super.c:650
Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 6e 15 f3 ff 49 8b 16 48 81 c3 c8 07 00 00 48 c7 c7 00 c9 d8 8a 48 89 de e8 b5 89 fb fe 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f
RSP: 0018:ffffc90004207d20 EFLAGS: 00010246
RAX: 0000000000000031 RBX: ffff88803b5427c8 RCX: 46a2dd125c835500
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff110076a851a R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000840f49 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8d5bb760 R15: ffff88803b5428d0
FS:  000055557fda8500(0000) GS:ffff888127120000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd211d7ff8 CR3: 000000003a6d8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 kill_block_super+0x44/0x90 fs/super.c:1722
 deactivate_locked_super+0xbc/0x130 fs/super.c:473
 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1327
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fad56b701f7
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fffeea386b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fad56bf1d7d RCX: 00007fad56b701f7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffeea38770
RBP: 00007fffeea38770 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffeea39800
R13: 00007fad56bf1d7d R14: 000000000001b2ee R15: 00007fffeea39840
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:generic_shutdown_super+0x2bc/0x2c0 fs/super.c:650
Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 6e 15 f3 ff 49 8b 16 48 81 c3 c8 07 00 00 48 c7 c7 00 c9 d8 8a 48 89 de e8 b5 89 fb fe 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f
RSP: 0018:ffffc90004207d20 EFLAGS: 00010246
RAX: 0000000000000031 RBX: ffff88803b5427c8 RCX: 46a2dd125c835500
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff110076a851a R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000840f49 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8d5bb760 R15: ffff88803b5428d0
FS:  000055557fda8500(0000) GS:ffff888127120000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd211d7ff8 CR3: 000000003a6d8000 CR4: 00000000003526f0

Crashes (70):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/06 00:51 upstream 6093a688a07d 49379ee0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/05 05:03 upstream d104e3d17f7b 49379ee0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/04 04:53 upstream 9b0d551bcc05 49379ee0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/03 01:04 upstream 7f7072574127 49379ee0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/02 09:21 upstream 080ffb4bec4d 267f56c6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/02 08:40 upstream 080ffb4bec4d 267f56c6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/02 08:04 upstream 080ffb4bec4d 267f56c6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/09/30 20:57 upstream 30d4efb2f5a5 65a0eece .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/09/30 20:10 upstream 30d4efb2f5a5 65a0eece .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/09/30 19:31 upstream 30d4efb2f5a5 65a0eece .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/09/30 08:58 upstream 1896ce8eb6c6 86341da6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/03 07:26 upstream e406d57be7bd 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/03 07:26 upstream e406d57be7bd 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/03 07:26 upstream e406d57be7bd 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/03 07:25 upstream e406d57be7bd 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/03 07:25 upstream e406d57be7bd 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/01 21:34 upstream 50c19e20ed2e a1859138 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root VFS: Busy inodes after unmount (use-after-free)
2025/10/01 17:56 upstream 50c19e20ed2e a1859138 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root VFS: Busy inodes after unmount (use-after-free)
2025/10/01 16:19 upstream 50c19e20ed2e a1859138 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/10/01 12:03 upstream 50c19e20ed2e a1859138 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/09/30 13:06 upstream 1896ce8eb6c6 86341da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs VFS: Busy inodes after unmount (use-after-free)
2025/09/30 12:38 upstream 1896ce8eb6c6 86341da6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root VFS: Busy inodes after unmount (use-after-free)
2025/09/30 12:35 upstream 1896ce8eb6c6 86341da6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root VFS: Busy inodes after unmount (use-after-free)
2025/10/05 03:10 linux-next 47a8d4b89844 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root VFS: Busy inodes after unmount (use-after-free)
2025/10/03 14:24 linux-next 47a8d4b89844 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root VFS: Busy inodes after unmount (use-after-free)
2025/10/03 08:12 linux-next 7396732143a2 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root VFS: Busy inodes after unmount (use-after-free)
2025/10/01 18:04 linux-next 3b9b1f8df454 a1859138 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:34 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:32 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:32 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:32 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/02 22:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
2025/10/01 16:18 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2213e57a69f0 a1859138 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 VFS: Busy inodes after unmount (use-after-free)
* Struck through repros no longer work on HEAD.