Re: [syzbot] [mtd?] WARNING in add_mtd_device

From: syzbot

Date: Sat Jun 20 2026 - 05:10:34 EST


syzbot has found a reproducer for the following issue on:

HEAD commit: a975094bf98c Merge tag 'exfat-for-7.2-rc1' of git://git.ke..
git tree: https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master
console output: https://syzkaller.appspot.com/x/log.txt?x=146d82fe580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3c66dc15e483c558
dashboard link: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
compiler: aarch64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13d3dd56580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17a9050e580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/fa3fbcfdac58/non_bootable_disk-a975094b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/56fd6dc1b679/vmlinux-a975094b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b1422518a402/Image-a975094b.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3ae80219c633aca5431c@xxxxxxxxxxxxxxxxxxxxxxxxx

mtd partition "" doesn't have enough space: 0x8000003 < 0x8000084bb, disabled
------------[ cut here ]------------
WARNING: drivers/mtd/mtdcore.c:719 at add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719, CPU#0: syz.2.17/3665
Modules linked in:
CPU: 0 UID: 0 PID: 3665 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719
lr : mtd_add_partition+0x218/0x48c drivers/mtd/mtdpart.c:280
sp : ffff8000a2c276f0
x29: ffff8000a2c277b0 x28: ffff0000158a8000 x27: ffff00001ef34004
x26: 1fffe00003de683f x25: ffff00001ef34014 x24: 0000000000000004
x23: ffff00001ef34000 x22: 1ffff00014584f02 x21: 0000000000000000
x20: ffff00001ef341a0 x19: 0000000000000c00 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008764b708
x14: 1ffff00010ec96e1 x13: 0000000000000004 x12: ffff700014584ee9
x11: 1ffff00014584ee8 x10: ffff700014584ee8 x9 : dfff800000000000
x8 : ffff8000a2c27747 x7 : 1ffff00014584eea x6 : 0000000041b58ab3
x5 : ffff700014584eea x4 : ffff8000a2c27750 x3 : 1fffe00003de6800
x2 : 0000000000000000 x1 : 0000000000000007 x0 : 0000000000000000
Call trace:
add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719 (P)
mtd_add_partition+0x218/0x48c drivers/mtd/mtdpart.c:280
mtdchar_blkpg_ioctl+0x17c/0x1b8 drivers/mtd/mtdchar.c:562
mtdchar_ioctl+0x2f8/0x1ed8 drivers/mtd/mtdchar.c:1218
mtdchar_unlocked_ioctl+0xa0/0xfc drivers/mtd/mtdchar.c:1241
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__arm64_sys_ioctl+0x124/0x1a4 fs/ioctl.c:583
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:140
el0_svc+0x58/0x2a4 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [<ffff800080215cc8>] copy_process+0x16a8/0x5700 kernel/fork.c:2232
softirqs last enabled at (0): [<ffff800080215ce8>] copy_process+0x16c8/0x5700 kernel/fork.c:2233
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.