KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class

Status: upstream: reported on 2026/08/26 02:44
Reported-by: syzbot+aafeb7aa5585236caac6@syzkaller.appspotmail.com
First crash: 37d, last: 2d12h
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class prio:low rdma 11 syz, C 40 11d 40d 24/29 upstream: reported C repro on 2026/08/22 22:56

Sample crash report:
rtrs_client L1783: <s+>: Resolving route failed, err: -19
==================================================================
BUG: KASAN: null-ptr-deref in do_trace_event_raw_event_rtrs_clt_conn_class drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:58 [inline]
BUG: KASAN: null-ptr-deref in trace_event_raw_event_rtrs_clt_conn_class+0x21c/0x408 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36
Read of size 255 at addr 0000000000000000 by task kworker/u4:7/5075

CPU: 0 PID: 5075 Comm: kworker/u4:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: rdma_cm cma_work_handler
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_report+0x40/0x68 mm/kasan/report.c:423
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memcpy+0x48/0x90 mm/kasan/shadow.c:65
 do_trace_event_raw_event_rtrs_clt_conn_class drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:58 [inline]
 trace_event_raw_event_rtrs_clt_conn_class+0x21c/0x408 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36
 __traceiter_rtrs_rdma_error_recovery+0x74/0xc8 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78
 trace_rtrs_rdma_error_recovery drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78 [inline]
 rtrs_rdma_error_recovery+0x55c/0x62c drivers/infiniband/ulp/rtrs/rtrs-clt.c:309
 rtrs_clt_rdma_cm_handler+0x1118/0x179c drivers/infiniband/ulp/rtrs/rtrs-clt.c:2041
 cma_cm_event_handler+0xb8/0x400 drivers/infiniband/core/cma.c:2137
 cma_work_handler+0x220/0x4dc drivers/infiniband/core/cma.c:2992
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
==================================================================

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/30 08:51 linux-6.1.y 1a8763b93150 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/30 08:49 linux-6.1.y 1a8763b93150 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/29 20:43 linux-6.1.y 1a8763b93150 328436b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/29 20:43 linux-6.1.y 1a8763b93150 328436b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/29 03:32 linux-6.1.y 1a8763b93150 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/29 03:32 linux-6.1.y 1a8763b93150 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/29 03:26 linux-6.1.y 1a8763b93150 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/29 03:26 linux-6.1.y 1a8763b93150 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/25 05:28 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/25 05:28 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/23 13:05 linux-6.1.y 1a8763b93150 abce1216 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/14 16:22 linux-6.1.y 1a8763b93150 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/14 16:22 linux-6.1.y 1a8763b93150 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/09 19:19 linux-6.1.y cf82dcca9634 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/31 18:58 linux-6.1.y d64a499eea6b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/26 02:44 linux-6.1.y 05208478041c 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/26 02:44 linux-6.1.y 05208478041c 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
* Struck through repros no longer work on HEAD.