syzbot
kernel BUG in commit_creds (3)
Status:
upstream: reported C repro on 2026/09/17 19:30
Subsystems:
lsm
io-uring
[Documentation on labels]
Reported-by: syzbot+fa63184795283ac3f842@syzkaller.appspotmail.com
First crash: 15h10m, last: 11h32m
Sample crash report:
------------[ cut here ]------------
kernel BUG at kernel/cred.c:376!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4923 Comm: iou-wrk-4922 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : commit_creds+0x888/0x8d4 kernel/cred.c:376
lr : commit_creds+0x888/0x8d4 kernel/cred.c:376
sp : ffff800098287850
x29: ffff800098287860 x28: ffff0000d05e08c8 x27: ffff0000d05e0000
x26: dfff800000000000 x25: dfff800000000000 x24: ffff700013050f18
x23: ffff0000c7e6bac8 x22: ffff0000d05e08d0 x21: ffff0000d2bb7000
x20: ffff0000d2bb7000 x19: ffff0000d2bb7300 x18: 1fffe00035b9ec28
x17: ffff8000818fd3bc x16: ffff8000816109b4 x15: ffff800080391038
x14: ffff8000815de4b4 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff600018fcd751 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000004 x3 : ffff800080391048
x2 : 0000000000000000 x1 : ffff0000d05e0000 x0 : 0000000000000000
Call trace:
commit_creds+0x888/0x8d4 kernel/cred.c:376 (P)
smk_write_relabel_self+0x398/0x418 security/smack/smackfs.c:2709
loop_rw_iter+0x3c0/0x5c0 include/linux/uio.h:-1
io_write+0xd50/0x1364 io_uring/rw.c:1170
__io_issue_sqe+0x134/0x364 io_uring/io_uring.c:1386
io_issue_sqe+0x94/0x8f0 io_uring/io_uring.c:1409
io_wq_submit_work+0x4c4/0x690 io_uring/io_uring.c:1525
io_worker_handle_work+0x640/0xeb8 io_uring/io-wq.c:659
io_wq_worker+0x830/0xb44 io_uring/io-wq.c:752
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 91009280 9420ad5a 17fffe51 940b1fa2 (d4210000)
---[ end trace 0000000000000000 ]---
* Struck through repros no longer work on HEAD.