general protection fault in rxrpc_kernel_abort_call

Status: upstream: reported C repro on 2026/08/17 19:02
Reported-by: syzbot+2ee4b39c54a8433b3579@syzkaller.appspotmail.com
First crash: 39d, last: 18m
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call origin:lts-only 8 syz, C 62 1d15h 52d 0/3 upstream: reported C repro on 2026/08/04 19:32

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
CPU: 1 PID: 4210 Comm: kworker/1:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: kafsd afs_process_async_call
RIP: 0010:__mutex_lock_common+0x10c/0x2400 kernel/locking/mutex.c:575
Code: 03 42 0f b6 04 28 84 c0 0f 85 50 1c 00 00 4c 8d b4 24 e0 00 00 00 83 3d 81 d2 65 0c 00 75 29 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 48 9b f4 f7 48 39 5b 60 4c 8d b4 24 e0 00
RSP: 0018:ffffc90002f0f940 EFLAGS: 00010202
RAX: 0000000000000013 RBX: 0000000000000038 RCX: ffffffff962f7f03
RDX: ffff8880289d0000 RSI: ffffffff8a2b3e80 RDI: 0000000000000098
RBP: ffffc90002f0fad0 R08: ffffffff890815c6 R09: 0000000000000000
R10: 00000000fffffffb R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffc90002f0fa20 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f528c490e20 CR3: 000000001ec8c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 rxrpc_kernel_abort_call+0x26/0x70 net/rxrpc/sendmsg.c:853
 afs_deliver_to_call+0x55e/0x1100 fs/afs/rxrpc.c:-1
 afs_process_async_call+0x7e/0xe0 fs/afs/rxrpc.c:702
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Modules linked in:
---[ end trace ec8fac2f5325bbfd ]---
RIP: 0010:__mutex_lock_common+0x10c/0x2400 kernel/locking/mutex.c:575
Code: 03 42 0f b6 04 28 84 c0 0f 85 50 1c 00 00 4c 8d b4 24 e0 00 00 00 83 3d 81 d2 65 0c 00 75 29 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 48 9b f4 f7 48 39 5b 60 4c 8d b4 24 e0 00
RSP: 0018:ffffc90002f0f940 EFLAGS: 00010202
RAX: 0000000000000013 RBX: 0000000000000038 RCX: ffffffff962f7f03
RDX: ffff8880289d0000 RSI: ffffffff8a2b3e80 RDI: 0000000000000098
RBP: ffffc90002f0fad0 R08: ffffffff890815c6 R09: 0000000000000000
R10: 00000000fffffffb R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffc90002f0fa20 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f570700d368 CR3: 000000001f35e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	03 42 0f             	add    0xf(%rdx),%eax
   3:	b6 04                	mov    $0x4,%dh
   5:	28 84 c0 0f 85 50 1c 	sub    %al,0x1c50850f(%rax,%rax,8)
   c:	00 00                	add    %al,(%rax)
   e:	4c 8d b4 24 e0 00 00 	lea    0xe0(%rsp),%r14
  15:	00
  16:	83 3d 81 d2 65 0c 00 	cmpl   $0x0,0xc65d281(%rip)        # 0xc65d29e
  1d:	75 29                	jne    0x48
  1f:	48 8d 7b 60          	lea    0x60(%rbx),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 05                	je     0x36
  31:	e8 48 9b f4 f7       	call   0xf7f49b7e
  36:	48 39 5b 60          	cmp    %rbx,0x60(%rbx)
  3a:	4c                   	rex.WR
  3b:	8d                   	.byte 0x8d
  3c:	b4 24                	mov    $0x24,%ah
  3e:	e0 00                	loopne 0x40

Crashes (36):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/23 10:03 linux-5.15.y 0248c33e835e 5207b90e .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/08 05:58 linux-5.15.y 0996e0926f6b 680aa3e1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 11:43 linux-5.15.y 28c35638ec51 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 10:05 linux-5.15.y 28c35638ec51 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 08:26 linux-5.15.y 28c35638ec51 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 08:21 linux-5.15.y 28c35638ec51 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/22 23:04 linux-5.15.y 0eb903b5b519 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/18 13:27 linux-5.15.y aabd761612db 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/25 20:28 linux-5.15.y 0248c33e835e f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/25 20:27 linux-5.15.y 0248c33e835e f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/25 10:09 linux-5.15.y 0248c33e835e f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/24 12:51 linux-5.15.y 0248c33e835e 0281b448 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/10 02:31 linux-5.15.y 0996e0926f6b 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/08 21:12 linux-5.15.y 0996e0926f6b 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/07 22:37 linux-5.15.y 0996e0926f6b 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/07 22:35 linux-5.15.y 0996e0926f6b 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/01 20:07 linux-5.15.y 28c35638ec51 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/01 18:05 linux-5.15.y 28c35638ec51 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/01 17:17 linux-5.15.y 28c35638ec51 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/01 17:17 linux-5.15.y 28c35638ec51 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/01 05:10 linux-5.15.y 28c35638ec51 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/09/01 00:27 linux-5.15.y 28c35638ec51 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 05:31 linux-5.15.y 28c35638ec51 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 05:29 linux-5.15.y 28c35638ec51 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 05:23 linux-5.15.y 28c35638ec51 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 05:23 linux-5.15.y 28c35638ec51 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/29 02:48 linux-5.15.y 28c35638ec51 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/28 14:16 linux-5.15.y 28c35638ec51 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/28 12:53 linux-5.15.y 28c35638ec51 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/25 19:33 linux-5.15.y 945fa863f02c a9a1fc32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/23 03:39 linux-5.15.y 0eb903b5b519 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/21 20:41 linux-5.15.y 0eb903b5b519 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/19 13:05 linux-5.15.y aabd761612db 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/19 12:57 linux-5.15.y aabd761612db 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/19 11:48 linux-5.15.y aabd761612db 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
2026/08/17 19:01 linux-5.15.y aabd761612db 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in rxrpc_kernel_abort_call
* Struck through repros no longer work on HEAD.