syzbot


WARNING in udf_process_sequence

Status: upstream: reported C repro on 2025/08/17 23:30
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+a66f771803158bb11e66@syzkaller.appspotmail.com
First crash: 10d, last: 5d00h
Bug presence (2)
Date Name Commit Repro Result
2025/08/23 linux-6.1.y (ToT) 0bc96de781b4 C [report] WARNING in udf_process_sequence
2025/08/23 upstream (ToT) 6debb6904172 C Didn't crash
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 WARNING in udf_process_sequence origin:lts-only -1 C 3 6d02h 10d 0/2 upstream: reported C repro on 2025/08/18 02:08
linux-5.15 WARNING in udf_process_sequence origin:lts-only -1 C 4 2d10h 10d 0/3 upstream: reported C repro on 2025/08/17 23:47
upstream WARNING in udf_process_sequence udf -1 C error 1 48d 47d 28/29 upstream: reported C repro on 2025/07/11 16:44

Sample crash report:
UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 98: 0x1f != 0x1e
UDF-fs: warning (device loop0): udf_verify_domain_identifier: Not OSTA UDF compliant logical volume descriptor.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4502 at mm/page_alloc.c:5590 __alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
Modules linked in:
CPU: 1 PID: 4502 Comm: syz.0.17 Not tainted 6.1.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 22400005 (nzCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
lr : __alloc_pages+0xac/0x53c mm/page_alloc.c:5584
sp : ffff800020817120
x29: ffff8000208171f0 x28: ffff700004102e7c x27: ffff800020817140
x26: ffff800020817980 x25: dfff800000000000 x24: ffff700004102e28
x23: ffff0000e2b622b8 x22: 0000000000000000 x21: 0000000000040dc0
x20: 0000000000000000 x19: 0000000000000013 x18: 00000000000000ff
x17: 6f4e203a72656966 x16: ffff8000082d2370 x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000000005
x11: 1ffff00004102e2c x10: 0000000000000000 x9 : 0000000000000001
x8 : ffff800017a78000 x7 : 0000000000000000 x6 : 0000000000000001
x5 : ffff800020816c58 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
 __alloc_pages_node include/linux/gfp.h:237 [inline]
 alloc_pages_node include/linux/gfp.h:260 [inline]
 __kmalloc_large_node+0xa8/0x1e0 mm/slab_common.c:1077
 __do_kmalloc_node mm/slab_common.c:924 [inline]
 __kmalloc+0x140/0x178 mm/slab_common.c:949
 kmalloc_array include/linux/slab.h:615 [inline]
 kcalloc include/linux/slab.h:646 [inline]
 udf_sb_alloc_partition_maps fs/udf/super.c:260 [inline]
 udf_load_logicalvol fs/udf/super.c:1434 [inline]
 udf_process_sequence+0x1774/0x3a94 fs/udf/super.c:1790
 udf_load_sequence fs/udf/super.c:1837 [inline]
 udf_check_anchor_block+0x2c4/0x56c fs/udf/super.c:1876
 udf_scan_anchors+0x124/0x4dc fs/udf/super.c:1909
 udf_find_anchor fs/udf/super.c:1965 [inline]
 udf_load_vrs+0x158/0x9f4 fs/udf/super.c:2030
 udf_fill_super+0x538/0x13c8 fs/udf/super.c:2208
 mount_bdev+0x264/0x358 fs/super.c:1443
 udf_mount+0x44/0x58 fs/udf/super.c:129
 legacy_get_tree+0xd4/0x16c fs/fs_context.c:632
 vfs_get_tree+0x90/0x274 fs/super.c:1573
 do_new_mount+0x228/0x810 fs/namespace.c:3063
 path_mount+0x5b4/0xe78 fs/namespace.c:3393
 do_mount fs/namespace.c:3406 [inline]
 __do_sys_mount fs/namespace.c:3614 [inline]
 __se_sys_mount fs/namespace.c:3591 [inline]
 __arm64_sys_mount+0x49c/0x584 fs/namespace.c:3591
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 8016
hardirqs last  enabled at (8015): [<ffff800008308488>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (8016): [<ffff800011948d00>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (7982): [<ffff8000081a9670>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (7982): [<ffff8000081a9670>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (7925): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512
UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256
UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512
UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
UDF-fs: Scanning with blocksize 4096 failed
UDF-fs: warning (device loop0): udf_fill_super: No partition found (1)

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/17 23:55 linux-6.1.y 0bc96de781b4 1804e95e .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 WARNING in udf_process_sequence
2025/08/17 23:41 linux-6.1.y 0bc96de781b4 1804e95e .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 WARNING in udf_process_sequence
2025/08/17 23:30 linux-6.1.y 0bc96de781b4 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in udf_process_sequence
2025/08/17 23:29 linux-6.1.y 0bc96de781b4 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in udf_process_sequence
* Struck through repros no longer work on HEAD.