KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy

Status: upstream: reported C repro on 2026/10/25 11:46
Subsystems: dm
[Documentation on labels]
Reported-by: syzbot+a2626a25eb2595e3ec3c@syzkaller.appspotmail.com
First crash: 14d, last: 3h44m
Cause bisection: failed (error log, bisect log)
  
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
cb5f29e5 repro-c Reproduced: ✅ ❓ KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 2026/10/24 02:54 2026/10/24 02:54 2026/10/24 05:15 1d9ca40b
7828aa52 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 2026/10/23 00:00 2026/10/23 00:00 2026/10/23 00:06 33f73a1b
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [dm?] KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 1 (3) 2026/10/26 07:05
[PATCH] dm: reject kcopyd client destory if it setup failed 1 (1) 2026/10/26 04:21
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 11 syz, C 29 15h21m 11d 0/3 upstream: reported C repro on 2026/10/24 19:51
linux-5.15 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 11 syz, C 19 1d00h 11d 0/3 upstream: reported C repro on 2026/10/24 11:58
linux-6.6 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy 11 syz, C 5 6d01h 11d 0/2 upstream: reported C repro on 2026/10/24 20:11
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/10/26 01:59 4h56m eadavis@sina.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4169c9c90532 OK job log log
2026/10/24 05:32 2h58m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4169c9c90532df9585c0a2ae513337a58f5e59ab report job log log

Sample crash report:
workqueue: Failed to create a rescuer kthread for wq "kcopyd": -EINTR
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in dm_kcopyd_client_destroy+0xae/0x480 drivers/md/dm-kcopyd.c:980
Read of size 4 at addr 0000000000000174 by task syz.2.19/6560

CPU: 0 UID: 0 PID: 6560 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
 instrument_atomic_read include/linux/instrumented.h:82 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 dm_kcopyd_client_destroy+0xae/0x480 drivers/md/dm-kcopyd.c:980
 __destroy+0x172/0x2f0 drivers/md/dm-cache-target.c:1973
 cache_create drivers/md/dm-cache-target.c:2604 [inline]
 cache_ctr+0x1674/0x2bf0 drivers/md/dm-cache-target.c:2649
 dm_table_add_target+0x58d/0xc70 drivers/md/dm-table.c:749
 populate_table drivers/md/dm-ioctl.c:1602 [inline]
 table_load+0x325/0x8a0 drivers/md/dm-ioctl.c:1645
 ctl_ioctl drivers/md/dm-ioctl.c:2221 [inline]
 dm_ctl_ioctl+0x9ec/0xe10 drivers/md/dm-ioctl.c:2243
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb5b039f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb5b11ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fb5b0626180 RCX: 00007fb5b039f559
RDX: 0000200000000280 RSI: 00000000c138fd09 RDI: 0000000000000004
RBP: 00007fb5b0436b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb5b0626218 R14: 00007fb5b0626180 R15: 00007fff197480a8
 </TASK>
==================================================================

Crashes (299):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/24 08:30 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4169c9c90532 61c200c7 .config console log report C ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 16:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6628e7d4c6b2 5af5b6c6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/22 04:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 61c200c7 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 15:46 upstream 05441d697f7f 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 14:30 upstream 05441d697f7f 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 13:21 upstream 05441d697f7f 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 03:06 upstream 05441d697f7f d02c3949 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 00:18 upstream 05441d697f7f d02c3949 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/03 13:31 upstream 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/03 10:08 upstream 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/03 06:26 upstream 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/03 01:10 upstream 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 22:54 upstream 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 21:24 upstream 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 18:28 upstream 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 10:47 upstream 46fec1c3029b 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 06:48 upstream 46fec1c3029b 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 03:10 upstream 46fec1c3029b 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 12:02 upstream cbbddb6b08cc 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 10:00 upstream cbbddb6b08cc 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/31 22:48 upstream 36aad21d50d1 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/31 06:52 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/31 03:24 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/31 01:37 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/31 00:35 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/30 22:32 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/30 20:12 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/30 06:41 upstream 4dd16e31135e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/30 03:06 upstream 4dd16e31135e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/29 21:49 upstream c339f4010dea b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/29 17:40 upstream c339f4010dea b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/29 17:08 upstream c339f4010dea b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/29 14:02 upstream c339f4010dea b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/29 07:09 upstream c339f4010dea b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/29 00:37 upstream c339f4010dea 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/28 22:54 upstream 65ba8f34ec88 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/21 11:42 upstream 9e947d96915a 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 21:57 upstream 05441d697f7f 73438ed0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 09:06 upstream 46fec1c3029b 25a0ae84 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 17:27 upstream cbbddb6b08cc 25a0ae84 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/03 11:30 upstream 6628e7d4c6b2 e2d35131 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 03:50 linux-next d6bcfc94eb4d d02c3949 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 14:36 linux-next 7649ba73f9e7 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 22:54 linux-next 7649ba73f9e7 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 18:44 linux-next 7649ba73f9e7 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 06:12 linux-next 7649ba73f9e7 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 00:49 linux-next 7649ba73f9e7 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/31 14:14 linux-next 7649ba73f9e7 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/31 10:23 linux-next 7649ba73f9e7 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/28 07:00 linux-next 151a134a4e6e 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 07:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6628e7d4c6b2 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/04 07:23 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6628e7d4c6b2 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/02 16:32 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6628e7d4c6b2 0a94d799 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/11/01 06:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
2026/10/28 17:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy
* Struck through repros no longer work on HEAD.