Internal error in ata_sff_freeze

Status: upstream: reported C repro on 2026/08/17 07:46
Subsystems: ide
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+891c7b195b408052e519@syzkaller.appspotmail.com
First crash: 13d, last: 9h37m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
526106e4 repro-c 💥 Internal error in ata_sff_freeze 2026/08/18 08:25 2026/08/18 08:25 2026/08/18 09:16 1e72964b
163e6682 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ✅ VMHostTrigger: ✅ Internal error in ata_sff_freeze 2026/08/15 00:01 2026/08/15 00:01 2026/08/15 00:40 746171ee
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [ide?] Internal error in ata_sff_freeze 0 (3) 2026/08/26 09:17

Sample crash report:
EXT4-fs (vda): shut down requested (2)
Aborting journal on device vda-8.
Internal error: synchronous external abort: 0000000096000050 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 3665 Comm: syz.2.17 Tainted: G   M    W           syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK, [W]=WARN
Hardware name: linux,dummy-virt (DT)
pstate: 414020c9 (nZcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __raw_writeb arch/arm64/include/asm/io.h:29 [inline]
pc : writeb include/asm-generic/io.h:265 [inline]
pc : iowrite8 include/asm-generic/io.h:924 [inline]
pc : ata_sff_set_devctl drivers/ata/libata-sff.c:233 [inline]
pc : ata_sff_freeze+0x7c/0x90 drivers/ata/libata-sff.c:1616
lr : __ata_port_freeze drivers/ata/libata-eh.c:1124 [inline]
lr : ata_eh_freeze_port+0x34/0x5c drivers/ata/libata-eh.c:1167
sp : ffff800089c3b900
x29: ffff800089c3b900 x28: fcf000000690d500 x27: 0000000000000000
x26: 0000000000000001 x25: ffff800081f5bac0 x24: ffff8000827b1910
x23: 0000000000000000 x22: 0000000000000000 x21: fdf0000008db0000
x20: 0000000000000000 x19: fdf0000008db0000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: fdf0000008db23f6
x14: 0000000000000000 x13: 0000000000066e8b x12: 0000000000004308
x11: fff000000315b808 x10: ffff800082eb0000 x9 : 0000000000000000
x8 : fcf0000005aa6000 x7 : f7f0000003f950d0 x6 : ffffc1ffc016a940
x5 : 00000c0000000000 x4 : 01fffc0000000000 x3 : ffff800082d56c88
x2 : 0000000000000000 x1 : 000000000000000a x0 : ffff800083edd002
Call trace:
 writeb include/asm-generic/io.h:264 [inline] (P)
 iowrite8 include/asm-generic/io.h:924 [inline] (P)
 ata_sff_set_devctl drivers/ata/libata-sff.c:233 [inline] (P)
 ata_sff_freeze+0x7c/0x90 drivers/ata/libata-sff.c:1616 (P)
 __ata_port_freeze drivers/ata/libata-eh.c:1124 [inline]
 ata_eh_freeze_port+0x34/0x5c drivers/ata/libata-eh.c:1167
 ata_host_start+0x13c/0x228 drivers/ata/libata-core.c:6110
 ata_pci_sff_activate_host+0x50/0x340 drivers/ata/libata-sff.c:2285
 ata_pci_init_one+0x19c/0x1d4 drivers/ata/libata-sff.c:2412
 ata_pci_bmdma_init_one+0x14/0x20 drivers/ata/libata-sff.c:3180
 ata_generic_init_one+0xc4/0x1ac drivers/ata/ata_generic.c:209
 local_pci_probe+0x40/0xa8 drivers/pci/pci-driver.c:354
 pci_call_probe+0x68/0x198 drivers/pci/pci-driver.c:416
 __pci_device_probe drivers/pci/pci-driver.c:478 [inline]
 pci_device_probe+0xb8/0x158 drivers/pci/pci-driver.c:512
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0xbc/0x2bc drivers/base/dd.c:706
 __driver_probe_device+0x11c/0x184 drivers/base/dd.c:868
 device_driver_attach+0x48/0xac drivers/base/dd.c:1203
 bind_store+0x7c/0xd8 drivers/base/bus.c:267
 drv_attr_store+0x24/0x40 drivers/base/bus.c:125
 sysfs_kf_write+0x7c/0x98 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x138/0x200 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x244/0x36c fs/read_write.c:687
 ksys_write+0x70/0x108 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x18/0x24 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140
 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590
Code: d65f03c0 f9404800 b4fffe60 d50332bf (39000001) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d65f03c0 	ret
   4:	f9404800 	ldr	x0, [x0, #144]
   8:	b4fffe60 	cbz	x0, 0xffffffffffffffd4
   c:	d50332bf 	dmb	oshst
* 10:	39000001 	strb	w1, [x0] <-- trapping instruction

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/26 09:17 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 73ae59e97596 6a91adb4 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/23 07:04 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 66fb95a52111 1e72964b .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/21 21:01 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 818bebeb63dd 1e72964b .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/26 06:13 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 73ae59e97596 6a91adb4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/26 06:13 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 73ae59e97596 6a91adb4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/23 04:10 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 66fb95a52111 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/23 04:10 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 66fb95a52111 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/21 18:38 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 818bebeb63dd 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/21 18:38 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 818bebeb63dd 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/14 19:09 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 2f1baf1fc892 2cf1fbb7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/14 19:08 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 2f1baf1fc892 2cf1fbb7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/13 07:44 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 3d6d817622b0 359b2492 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/13 07:42 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 3d6d817622b0 359b2492 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
2026/08/13 07:38 https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master 3d6d817622b0 359b2492 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte Internal error in ata_sff_freeze
* Struck through repros no longer work on HEAD.