WARNING in pci_scan_single_device

Status: upstream: reported C repro on 2026/08/23 11:33
Reported-by: syzbot+c365cfd1bd16dc4dc6db@syzkaller.appspotmail.com
First crash: 29d, last: 3d06h
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in pci_scan_single_device pci -1 1 480d 476d 0/29 auto-obsoleted due to no activity on 2025/09/06 17:08
upstream WARNING in pci_scan_single_device (2) prio:high pci -1 syz, C 149 6h12m 244d 0/29 upstream: reported C repro on 2026/01/21 00:08

Sample crash report:
pci (null): [1af4:1005] type 00 class 0x00ff00
pci (null): BAR 0 [io  0x1000-0x101f]
pci (null): BAR 1 [mem 0x10110080-0x101100bf]
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4518 at drivers/pci/probe.c:2631 pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
Modules linked in:
CPU: 0 PID: 4518 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
lr : pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
sp : ffff800020f57660
x29: ffff800020f57720 x28: ffff0000df53c9e1 x27: dfff800000000000
x26: ffff7000041eaed0 x25: 1fffe0001bea793c x24: ffff0000df53c090
x23: 1fffe000188d3a06 x22: ffff0000df53c008 x21: ffff0000df53c9e0
x20: ffff0000c08e6c00 x19: 00000000ffffffea x18: 1fffe00033e6df7e
x17: ffff80001539d000 x16: ffff8000082dd25c x15: ffff8000089b6798
x14: 0000000000000001 x13: 1fffe0001bea7821 x12: 0000000000000000
x11: ff0080000ad9a14c x10: 0000000000000000 x9 : ffff80000ad9a14c
x8 : ffff0000d5cf9c00 x7 : ffff80000805a700 x6 : ffff80000805a910
x5 : ffff0000c3dd3478 x4 : ffff800020f57310 x3 : ffff800011a4d390
x2 : 0000000000000001 x1 : 00000000ffffffea x0 : 0000000000000000
Call trace:
 pci_device_add+0x149c/0x19b4 drivers/pci/probe.c:2631
 pci_scan_single_device+0x37c/0x44c drivers/pci/probe.c:2648
 pci_scan_slot+0x198/0x578 drivers/pci/probe.c:2731
 pci_scan_child_bus_extend+0x78/0x858 drivers/pci/probe.c:2950
 pci_scan_child_bus drivers/pci/probe.c:3064 [inline]
 pci_rescan_bus+0x24/0x4c drivers/pci/probe.c:3342
 rescan_store+0xd0/0x158 drivers/pci/pci-sysfs.c:465
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4394
hardirqs last  enabled at (4393): [<ffff8000088f6370>] kasan_quarantine_put+0xc4/0x200 mm/kasan/quarantine.c:242
hardirqs last disabled at (4394): [<ffff800011b9d0cc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (4232): [<ffff8000081ae3b4>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (4232): [<ffff8000081ae3b4>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (4211): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
pci (null): BAR 1 [mem 0x10110080-0x101100bf]: assigned
pci (null): BAR 0 [io  0x1000-0x101f]: assigned
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4518 at fs/sysfs/file.c:570 sysfs_create_bin_file+0x134/0x33c fs/sysfs/file.c:570
Modules linked in:
CPU: 0 PID: 4518 Comm: syz.0.17 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : sysfs_create_bin_file+0x134/0x33c fs/sysfs/file.c:570
lr : sysfs_create_bin_file+0x300/0x33c fs/sysfs/file.c:570
sp : ffff800020f57780
x29: ffff800020f57810 x28: ffff800020f57b68 x27: dfff800000000000
x26: dfff800000000000 x25: ffff7000041eaef4 x24: 0000000000000020
x23: 1fffe0001bea7820 x22: ffff800020f577a0 x21: ffff0000df53c100
x20: ffff0000df53c0d0 x19: ffff0000cf81f600 x18: 1fffe00033e6df7e
x17: 0000000000000000 x16: ffff800011ba0e90 x15: 0000000000000000
x14: 0000000000000003 x13: 1ffff000041eaebc x12: 0000000000000000
x11: ff00800008be8d14 x10: 0000000000000000 x9 : ffff800008be8d14
x8 : ffff0000d5cf9c00 x7 : 0000000000000000 x6 : 656372756f736572
x5 : ffff0000cf81f660 x4 : 0000000000000000 x3 : 0000000000000010
x2 : 0000000000000008 x1 : ffff0000cf81f600 x0 : ffff0000df53c0d0
Call trace:
 sysfs_create_bin_file+0x134/0x33c fs/sysfs/file.c:570
 pci_create_attr+0x2e4/0x458 drivers/pci/pci-sysfs.c:1250
 pci_create_resource_files+0x108/0x64c drivers/pci/pci-sysfs.c:1282
 pci_create_sysfs_dev_files+0x30/0x4c drivers/pci/pci-sysfs.c:1538
 pci_bus_add_device+0x34/0x118 drivers/pci/bus.c:340
 pci_bus_add_devices+0x84/0x198 drivers/pci/bus.c:368
 pci_rescan_bus+0x38/0x4c drivers/pci/probe.c:3344
 rescan_store+0xd0/0x158 drivers/pci/pci-sysfs.c:465
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4680
hardirqs last  enabled at (4679): [<ffff800011c88254>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (4679): [<ffff800011c88254>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (4680): [<ffff800011b9d0cc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (4644): [<ffff8000081ae3b4>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (4644): [<ffff8000081ae3b4>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (4637): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address dfff800000000021
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000021] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4518 Comm: syz.0.17 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __device_attach+0xac/0x3d8 drivers/base/dd.c:1010
lr : device_lock include/linux/device.h:885 [inline]
lr : __device_attach+0x88/0x3d8 drivers/base/dd.c:1009
sp : ffff800020f57860
x29: ffff800020f578b0 x28: ffff800020f57b68 x27: 1fffe0001b82cd80
x26: 0000000000000000 x25: ffff0000c2e97050 x24: dfff800000000000
x23: ffff7000041eaf0c x22: 0000000000000108 x21: 0000000000000000
x20: ffff800020f57860 x19: ffff0000df53c0d0 x18: 1fffe00033e6df7e
x17: 0000000000000000 x16: ffff800011ba0e90 x15: 000000000004ffff
x14: 0000000000000001 x13: 1ffff000041eaec0 x12: 0000000000000000
x11: ff0080000a977920 x10: 0000000000000001 x9 : cd17a35187ebd600
x8 : 0000000000000021 x7 : ffff80000bfd116c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082d44c8
x2 : ffff0000d5cf9c00 x1 : ffff8000121f2440 x0 : 0000000000000000
Call trace:
 __device_attach+0xac/0x3d8 drivers/base/dd.c:1010
 device_attach+0x24/0x34 drivers/base/dd.c:1077
 pci_bus_add_device+0x6c/0x118 drivers/pci/bus.c:345
 pci_bus_add_devices+0x84/0x198 drivers/pci/bus.c:368
 pci_rescan_bus+0x38/0x4c drivers/pci/probe.c:3344
 rescan_store+0xd0/0x158 drivers/pci/pci-sysfs.c:465
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 97249143 f94002da 91042356 d343fec8 (38f86908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	97249143 	bl	0xfffffffffc92450c
   4:	f94002da 	ldr	x26, [x22]
   8:	91042356 	add	x22, x26, #0x108
   c:	d343fec8 	lsr	x8, x22, #3
* 10:	38f86908 	ldrsb	w8, [x8, x24] <-- trapping instruction

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/05 09:18 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in pci_scan_single_device
2026/09/19 00:51 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in pci_scan_single_device
2026/09/05 08:50 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in pci_scan_single_device
2026/08/23 11:33 linux-6.1.y 7e6e67054721 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in pci_scan_single_device
* Struck through repros no longer work on HEAD.