[v5.15] WARNING: nested lock was not taken in ntfs_fill_super
2 views
Skip to first unread message
syzbot
Apr 27, 2025, 6:44:26 PM4/27/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: f7347f400572 Linux 5.15.180
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17c74374580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e0a09dd23d715b59
dashboard link: https://syzkaller.appspot.com/bug?extid=7c9108a48fe4bb58b147
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f174a25d1f90/disk-f7347f40.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2b5ffc4e5dc3/vmlinux-f7347f40.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b48f40123eb9/bzImage-f7347f40.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7c9108...@syzkaller.appspotmail.com
loop7: detected capacity change from 0 to 4096
==================================
WARNING: Nested lock was not taken
5.15.180-syzkaller #0 Not tainted
----------------------------------
syz.7.1602/11129 is trying to lock:
ffff888060ff62d0 (&sb->s_type->i_lock_key#43){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
ffff888060ff62d0 (&sb->s_type->i_lock_key#43){+.+.}-{2:2}, at: _atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
but this task is not holding:
general protection fault, probably for non-canonical address 0xdffffc0020000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000100000010-0x0000000100000017]
CPU: 1 PID: 11129 Comm: syz.7.1602 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:print_lock_nested_lock_not_held kernel/locking/lockdep.c:4844 [inline]
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
Code: 48 8b 9c 24 a8 00 00 00 74 12 48 89 df e8 34 33 61 00 48 b9 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <80> 3c 08 00 74 08 48 89 df e8 0e 33 61 00 48 8b 33 48 c7 c7 20 3e
RSP: 0018:ffffc9000332f720 EFLAGS: 00010003
RAX: 0000000020000002 RBX: 0000000100000017 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: ffffc9000332f970 R08: dffffc0000000000 R09: ffffed1017224f24
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 0000000000040a85
R13: ffff8880547bd940 R14: ffff8880547be458 R15: 1b445df7b0a3db02
FS: 00007f61c37d06c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001f000 CR3: 0000000023c0f000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:363 [inline]
_atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
iput+0x7e/0x8a0 fs/inode.c:1787
ntfs_fill_super+0x355c/0x3c10 fs/ntfs3/super.c:1185
get_tree_bdev+0x3f1/0x610 fs/super.c:1325
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x24a/0xa40 fs/namespace.c:3012
do_mount fs/namespace.c:3355 [inline]
__do_sys_mount fs/namespace.c:3563 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3540
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f61c596a10a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f61c37cfe68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f61c37cfef0 RCX: 00007f61c596a10a
RDX: 0000200000000000 RSI: 0000200000000280 RDI: 00007f61c37cfeb0
RBP: 0000200000000000 R08: 00007f61c37cfef0 R09: 0000000002010c14
R10: 0000000002010c14 R11: 0000000000000246 R12: 0000200000000280
R13: 00007f61c37cfeb0 R14: 000000000001f75b R15: 00002000000000c0
</TASK>
Modules linked in:
---[ end trace 9dec8878ea9505ee ]---
RIP: 0010:print_lock_nested_lock_not_held kernel/locking/lockdep.c:4844 [inline]
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
Code: 48 8b 9c 24 a8 00 00 00 74 12 48 89 df e8 34 33 61 00 48 b9 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <80> 3c 08 00 74 08 48 89 df e8 0e 33 61 00 48 8b 33 48 c7 c7 20 3e
RSP: 0018:ffffc9000332f720 EFLAGS: 00010003
RAX: 0000000020000002 RBX: 0000000100000017 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: ffffc9000332f970 R08: dffffc0000000000 R09: ffffed1017224f24
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 0000000000040a85
R13: ffff8880547bd940 R14: ffff8880547be458 R15: 1b445df7b0a3db02
FS: 00007f61c37d06c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001f000 CR3: 0000000023c0f000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 8b 9c 24 a8 00 00 mov 0xa8(%rsp),%rbx
7: 00
8: 74 12 je 0x1c
a: 48 89 df mov %rbx,%rdi
d: e8 34 33 61 00 call 0x613346
12: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
19: fc ff df
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 18 add $0x18,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 0e 33 61 00 call 0x613346
38: 48 8b 33 mov (%rbx),%rsi
3b: 48 rex.W
3c: c7 .byte 0xc7
3d: c7 (bad)
3e: 20 3e and %bh,(%rsi)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: f7347f400572 Linux 5.15.180
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17c74374580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e0a09dd23d715b59
dashboard link: https://syzkaller.appspot.com/bug?extid=7c9108a48fe4bb58b147
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f174a25d1f90/disk-f7347f40.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2b5ffc4e5dc3/vmlinux-f7347f40.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b48f40123eb9/bzImage-f7347f40.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7c9108...@syzkaller.appspotmail.com
loop7: detected capacity change from 0 to 4096
==================================
WARNING: Nested lock was not taken
5.15.180-syzkaller #0 Not tainted
----------------------------------
syz.7.1602/11129 is trying to lock:
ffff888060ff62d0 (&sb->s_type->i_lock_key#43){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
ffff888060ff62d0 (&sb->s_type->i_lock_key#43){+.+.}-{2:2}, at: _atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
but this task is not holding:
general protection fault, probably for non-canonical address 0xdffffc0020000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000100000010-0x0000000100000017]
CPU: 1 PID: 11129 Comm: syz.7.1602 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:print_lock_nested_lock_not_held kernel/locking/lockdep.c:4844 [inline]
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
Code: 48 8b 9c 24 a8 00 00 00 74 12 48 89 df e8 34 33 61 00 48 b9 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <80> 3c 08 00 74 08 48 89 df e8 0e 33 61 00 48 8b 33 48 c7 c7 20 3e
RSP: 0018:ffffc9000332f720 EFLAGS: 00010003
RAX: 0000000020000002 RBX: 0000000100000017 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: ffffc9000332f970 R08: dffffc0000000000 R09: ffffed1017224f24
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 0000000000040a85
R13: ffff8880547bd940 R14: ffff8880547be458 R15: 1b445df7b0a3db02
FS: 00007f61c37d06c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001f000 CR3: 0000000023c0f000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:363 [inline]
_atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
iput+0x7e/0x8a0 fs/inode.c:1787
ntfs_fill_super+0x355c/0x3c10 fs/ntfs3/super.c:1185
get_tree_bdev+0x3f1/0x610 fs/super.c:1325
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x24a/0xa40 fs/namespace.c:3012
do_mount fs/namespace.c:3355 [inline]
__do_sys_mount fs/namespace.c:3563 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3540
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f61c596a10a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f61c37cfe68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f61c37cfef0 RCX: 00007f61c596a10a
RDX: 0000200000000000 RSI: 0000200000000280 RDI: 00007f61c37cfeb0
RBP: 0000200000000000 R08: 00007f61c37cfef0 R09: 0000000002010c14
R10: 0000000002010c14 R11: 0000000000000246 R12: 0000200000000280
R13: 00007f61c37cfeb0 R14: 000000000001f75b R15: 00002000000000c0
</TASK>
Modules linked in:
---[ end trace 9dec8878ea9505ee ]---
RIP: 0010:print_lock_nested_lock_not_held kernel/locking/lockdep.c:4844 [inline]
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
Code: 48 8b 9c 24 a8 00 00 00 74 12 48 89 df e8 34 33 61 00 48 b9 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <80> 3c 08 00 74 08 48 89 df e8 0e 33 61 00 48 8b 33 48 c7 c7 20 3e
RSP: 0018:ffffc9000332f720 EFLAGS: 00010003
RAX: 0000000020000002 RBX: 0000000100000017 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: ffffc9000332f970 R08: dffffc0000000000 R09: ffffed1017224f24
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 0000000000040a85
R13: ffff8880547bd940 R14: ffff8880547be458 R15: 1b445df7b0a3db02
FS: 00007f61c37d06c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001f000 CR3: 0000000023c0f000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 8b 9c 24 a8 00 00 mov 0xa8(%rsp),%rbx
7: 00
8: 74 12 je 0x1c
a: 48 89 df mov %rbx,%rdi
d: e8 34 33 61 00 call 0x613346
12: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
19: fc ff df
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 18 add $0x18,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 0e 33 61 00 call 0x613346
38: 48 8b 33 mov (%rbx),%rsi
3b: 48 rex.W
3c: c7 .byte 0xc7
3d: c7 (bad)
3e: 20 3e and %bh,(%rsi)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
May 10, 2025, 6:50:28 PM5/10/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3b8db0e4f263 Linux 5.15.182
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=177c9670580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f93aaf95aed43225
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4b5fc99635e8/disk-3b8db0e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5351a5e4c264/vmlinux-3b8db0e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e022b133e1a6/bzImage-3b8db0e4.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/96e1d3ec9620/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/1b97ee68c6c7/mount_3.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1371b4d4580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7c9108...@syzkaller.appspotmail.com
loop2: detected capacity change from 0 to 4096
ntfs3: loop2: Different NTFS' sector size (2048) and media sector size (512)
----------------------------------
syz.2.184/4695 is trying to lock:
ffff888068e8b690 (&sb->s_type->i_lock_key#35){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
ffff888068e8b690 (&sb->s_type->i_lock_key#35){+.+.}-{2:2}, at: _atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
but this task is not holding:
general protection fault, probably for non-canonical address 0xdffffc0020000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000100000010-0x0000000100000017]
CPU: 1 PID: 4695 Comm: syz.2.184 Not tainted 5.15.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RSP: 0018:ffffc90004f9f720 EFLAGS: 00010003
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 000000000004092a
R13: ffff888022fc3b80 R14: ffff888022fc4698 R15: c5c99e871fce886c
FS: 00007efd49f576c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
do_mount fs/namespace.c:3356 [inline]
__do_sys_mount fs/namespace.c:3564 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3541
RAX: ffffffffffffffda RBX: 00007efd49f56ef0 RCX: 00007efd4ace910a
RDX: 000020000001f340 RSI: 0000200000000040 RDI: 00007efd49f56eb0
RBP: 000020000001f340 R08: 00007efd49f56ef0 R09: 0000000000000890
R10: 0000000000000890 R11: 0000000000000246 R12: 0000200000000040
R13: 00007efd49f56eb0 R14: 000000000001f331 R15: 0000200000000000
</TASK>
Modules linked in:
---[ end trace f2091f24b08d7822 ]---
RSP: 0018:ffffc90004f9f720 EFLAGS: 00010003
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 000000000004092a
R13: ffff888022fc3b80 R14: ffff888022fc4698 R15: c5c99e871fce886c
FS: 00007efd49f576c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 3b8db0e4f263 Linux 5.15.182
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=177c9670580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f93aaf95aed43225
dashboard link: https://syzkaller.appspot.com/bug?extid=7c9108a48fe4bb58b147
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14fc9670580000
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4b5fc99635e8/disk-3b8db0e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5351a5e4c264/vmlinux-3b8db0e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e022b133e1a6/bzImage-3b8db0e4.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/96e1d3ec9620/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/1b97ee68c6c7/mount_3.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1371b4d4580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7c9108...@syzkaller.appspotmail.com
ntfs3: loop2: Different NTFS' sector size (2048) and media sector size (512)
==================================
WARNING: Nested lock was not taken
5.15.182-syzkaller #0 Not tainted
WARNING: Nested lock was not taken
----------------------------------
syz.2.184/4695 is trying to lock:
ffff888068e8b690 (&sb->s_type->i_lock_key#35){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
ffff888068e8b690 (&sb->s_type->i_lock_key#35){+.+.}-{2:2}, at: _atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
but this task is not holding:
general protection fault, probably for non-canonical address 0xdffffc0020000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000100000010-0x0000000100000017]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:print_lock_nested_lock_not_held kernel/locking/lockdep.c:4844 [inline]
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
Code: 48 8b 9c 24 a8 00 00 00 74 12 48 89 df e8 d4 38 61 00 48 b9 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <80> 3c 08 00 74 08 48 89 df e8 ae 38 61 00 48 8b 33 48 c7 c7 20 3b
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
RSP: 0018:ffffc90004f9f720 EFLAGS: 00010003
RAX: 0000000020000002 RBX: 0000000100000017 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: ffffc90004f9f970 R08: dffffc0000000000 R09: ffffed1017224f24
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 000000000004092a
R13: ffff888022fc3b80 R14: ffff888022fc4698 R15: c5c99e871fce886c
FS: 00007efd49f576c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001b000 CR3: 000000002370e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:363 [inline]
_atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
iput+0x7e/0x8a0 fs/inode.c:1787
ntfs_fill_super+0x355c/0x3c10 fs/ntfs3/super.c:1185
get_tree_bdev+0x3f1/0x610 fs/super.c:1325
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x24a/0xa40 fs/namespace.c:3013
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:363 [inline]
_atomic_dec_and_lock+0xa5/0x110 lib/dec_and_lock.c:28
iput+0x7e/0x8a0 fs/inode.c:1787
ntfs_fill_super+0x355c/0x3c10 fs/ntfs3/super.c:1185
get_tree_bdev+0x3f1/0x610 fs/super.c:1325
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_mount fs/namespace.c:3356 [inline]
__do_sys_mount fs/namespace.c:3564 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3541
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7efd4ace910a
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efd49f56e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007efd49f56ef0 RCX: 00007efd4ace910a
RDX: 000020000001f340 RSI: 0000200000000040 RDI: 00007efd49f56eb0
RBP: 000020000001f340 R08: 00007efd49f56ef0 R09: 0000000000000890
R10: 0000000000000890 R11: 0000000000000246 R12: 0000200000000040
R13: 00007efd49f56eb0 R14: 000000000001f331 R15: 0000200000000000
</TASK>
Modules linked in:
---[ end trace f2091f24b08d7822 ]---
RIP: 0010:print_lock_nested_lock_not_held kernel/locking/lockdep.c:4844 [inline]
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
Code: 48 8b 9c 24 a8 00 00 00 74 12 48 89 df e8 d4 38 61 00 48 b9 00 00 00 00 00 fc ff df 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <80> 3c 08 00 74 08 48 89 df e8 ae 38 61 00 48 8b 33 48 c7 c7 20 3b
RIP: 0010:__lock_acquire+0x11d4/0x7c60 kernel/locking/lockdep.c:5003
RSP: 0018:ffffc90004f9f720 EFLAGS: 00010003
RAX: 0000000020000002 RBX: 0000000100000017 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: ffffc90004f9f970 R08: dffffc0000000000 R09: ffffed1017224f24
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
R10: ffffed1017224f24 R11: 1ffff11017224f23 R12: 000000000004092a
R13: ffff888022fc3b80 R14: ffff888022fc4698 R15: c5c99e871fce886c
FS: 00007efd49f576c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001b000 CR3: 000000002370e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 8b 9c 24 a8 00 00 mov 0xa8(%rsp),%rbx
7: 00
8: 74 12 je 0x1c
a: 48 89 df mov %rbx,%rdi
d: e8 d4 38 61 00 call 0x6138e6
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 8b 9c 24 a8 00 00 mov 0xa8(%rsp),%rbx
7: 00
8: 74 12 je 0x1c
a: 48 89 df mov %rbx,%rdi
12: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
19: fc ff df
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 18 add $0x18,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 ae 38 61 00 call 0x6138e6
19: fc ff df
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 18 add $0x18,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
38: 48 8b 33 mov (%rbx),%rsi
3b: 48 rex.W
3c: c7 .byte 0xc7
3d: c7 (bad)
3e: 20 3b and %bh,(%rbx)
3b: 48 rex.W
3c: c7 .byte 0xc7
3d: c7 (bad)
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Nov 19, 2025, 4:53:21 PM11/19/25
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages