KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class

Status: upstream: reported C repro on 2026/08/22 22:56
Subsystems: rdma
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+1695193198994f4e7fed@syzkaller.appspotmail.com
Fix commit: RDMA/rtrs: guard against null kobj name
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 20d, last: 6h47m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
a29a34ab assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class 2026/08/19 03:37 2026/08/19 03:37 2026/08/19 03:40 1e72964b
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] RDMA/rtrs: guard against null kobj name 3 (3) 2026/09/02 13:25
[syzbot] [rdma?] KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class 0 (2) 2026/08/23 01:50
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class 11 3 6d10h 12d 0/3 upstream: reported on 2026/08/26 02:44
Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/08/23 01:50 29m ryan.mehri1@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci OK job log log

Sample crash report:
rtrs_client L2020: <test>: CM error (CM event: address error, err: -ENODEV)
==================================================================
BUG: KASAN: null-ptr-deref in do_trace_event_raw_event_rtrs_clt_conn_class drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:58 [inline]
BUG: KASAN: null-ptr-deref in trace_event_raw_event_rtrs_clt_conn_class+0x220/0x480 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36
Read of size 255 at addr 0000000000000000 by task kworker/u8:0/12

CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: ib_addr process_one_req
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_report+0x58/0x84 mm/kasan/report.c:485
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 do_trace_event_raw_event_rtrs_clt_conn_class drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:58 [inline]
 trace_event_raw_event_rtrs_clt_conn_class+0x220/0x480 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36
 __traceiter_rtrs_rdma_error_recovery+0x74/0xc8 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78
 __do_trace_rtrs_rdma_error_recovery drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78 [inline]
 trace_rtrs_rdma_error_recovery drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78 [inline]
 rtrs_rdma_error_recovery+0x2d4/0x400 drivers/infiniband/ulp/rtrs/rtrs-clt.c:311
 rtrs_clt_rdma_cm_handler+0x498/0x1a18 drivers/infiniband/ulp/rtrs/rtrs-clt.c:2062
 cma_cm_event_handler+0xbc/0x4c8 drivers/infiniband/core/cma.c:2181
 addr_handler+0x210/0x3b4 drivers/infiniband/core/cma.c:3552
 process_one_req+0x26c/0x440 drivers/infiniband/core/addr.c:624
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
==================================================================

Crashes (33):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/06 13:11 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 5445d6419962 587f6b29 .config console log report C ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/22 22:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/03 20:06 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8ab1afb2eb24 587f6b29 .config console log report C ci-qemu-upstream KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/28 16:05 upstream 818bebeb63dd 41d151d4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/01 05:39 upstream abdf623ddb75 316d9396 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/06 22:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/06 22:16 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/05 16:28 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/02 17:13 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/02 16:00 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/02 11:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/02 01:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/02 00:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/09/01 00:12 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/31 18:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/31 18:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/31 18:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/31 18:46 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/31 10:10 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/30 14:12 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/27 17:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/27 15:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/27 15:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/27 15:42 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/27 14:18 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/26 02:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/26 02:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/25 06:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/24 13:23 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/24 10:07 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/22 20:54 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/21 22:54 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
2026/08/17 15:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in trace_event_raw_event_rtrs_clt_conn_class
* Struck through repros no longer work on HEAD.