invalid opcode in __traceiter_sched_switch

Status: premoderation: reported C repro on 2026/08/03 18:20
Reported-by: syzbot+84503706870d335eb854@syzkaller.appspotmail.com
First crash: 3d16h, last: 7h53m
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 invalid opcode in __traceiter_sched_switch origin:lts 2 syz, C inconclusive 519 35m 468d 0/2 upstream: reported C repro on 2025/04/26 06:10

Sample crash report:
CFI failure at __traceiter_sched_switch+0xa2/0xe0 include/trace/events/sched.h:222 (target: tp_stub_func+0x0/0x20; expected type: 0x4637f3aa)
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 99 Comm: klogd Not tainted syzkaller #0 7f3b23dcf55806c758f3cdeb9210fc77c27c120f
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__traceiter_sched_switch+0xa2/0xe0 include/trace/events/sched.h:222
Code: 00 74 05 e8 20 01 86 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 49 89 db 41 ba 56 0c c8 b9 45 03 53 f1 74 02 <0f> 0b 41 ff d3 0f 1f 00 49 83 c6 18 4c 89 f0 48 c1 e8 03 42 80 3c
RSP: 0018:ffffc90000e2f670 EFLAGS: 00010007
RAX: 1ffff11021656863 RBX: ffffffff8188bff0 RCX: ffff88810b7c4c00
RDX: ffff88810cf5a600 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000e2f6b0 R08: 0000000000000000 R09: 1ffffffff0fd97dd
R10: 000000002af71e77 R11: ffffffff8188bff0 R12: 0000000000000001
R13: ffff88810b2b4310 R14: ffff88810b2b4310 R15: dffffc0000000000
FS:  00007f40f4ad6c80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005623e49c0000 CR3: 000000010d304000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 trace_sched_switch include/trace/events/sched.h:222 [inline]
 __schedule+0x1cb1/0x20b0 kernel/sched/core.c:7867
 preempt_schedule_common+0x2d/0x60 kernel/sched/core.c:8059
 preempt_schedule+0xc5/0xe0 kernel/sched/core.c:8083
 preempt_schedule_thunk+0x1a/0x40 arch/x86/entry/thunk.S:12
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x6c/0x70 kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:109 [inline]
 __wake_up_sync_key+0x1be/0x2c0 kernel/sched/wait.c:177
 sock_def_readable+0x14d/0x430 net/core/sock.c:3493
 unix_dgram_sendmsg+0x12fb/0x1a90 net/unix/af_unix.c:2180
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x68a/0x700 net/socket.c:2216
 __do_sys_sendto net/socket.c:2228 [inline]
 __se_sys_sendto net/socket.c:2224 [inline]
 __x64_sys_sendto+0xe9/0x100 net/socket.c:2224
 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f40f4c26407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcfd5136e0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f40f4ad6c80 RCX: 00007f40f4c26407
RDX: 000000000000008b RSI: 00007ffcfd513820 RDI: 0000000000000003
RBP: 00007ffcfd513c50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffcfd513c68
R13: 00007ffcfd513820 R14: 0000000000000070 R15: 00007ffcfd513820
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__traceiter_sched_switch+0xa2/0xe0 include/trace/events/sched.h:222
Code: 00 74 05 e8 20 01 86 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 49 89 db 41 ba 56 0c c8 b9 45 03 53 f1 74 02 <0f> 0b 41 ff d3 0f 1f 00 49 83 c6 18 4c 89 f0 48 c1 e8 03 42 80 3c
RSP: 0018:ffffc90000e2f670 EFLAGS: 00010007
RAX: 1ffff11021656863 RBX: ffffffff8188bff0 RCX: ffff88810b7c4c00
RDX: ffff88810cf5a600 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000e2f6b0 R08: 0000000000000000 R09: 1ffffffff0fd97dd
R10: 000000002af71e77 R11: ffffffff8188bff0 R12: 0000000000000001
R13: ffff88810b2b4310 R14: ffff88810b2b4310 R15: dffffc0000000000
FS:  00007f40f4ad6c80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005623e49c0000 CR3: 000000010d304000 CR4: 00000000003526b0

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/03 19:35 android16-6.12 5098494bc7f3 6b7c9f71 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust invalid opcode in __traceiter_sched_switch
2026/08/03 19:12 android16-6.12 5098494bc7f3 6b7c9f71 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust invalid opcode in __traceiter_sched_switch
2026/08/03 18:47 android16-6.12 5098494bc7f3 6b7c9f71 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust invalid opcode in __traceiter_sched_switch
2026/08/07 02:34 android16-6.12 749a6f9d41aa c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust invalid opcode in __traceiter_sched_switch
2026/08/07 02:33 android16-6.12 749a6f9d41aa c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust invalid opcode in __traceiter_sched_switch
2026/08/03 18:20 android16-6.12 5098494bc7f3 6b7c9f71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust invalid opcode in __traceiter_sched_switch
* Struck through repros no longer work on HEAD.