[v5.15] WARNING in do_mknodat (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3b8db0e4f263 Linux 5.15.182
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12202cd4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=dd5e00a2e31fafd7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5e7caced7e104629877
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ff1afedf7b4d/disk-3b8db0e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/19cb045784cf/vmlinux-3b8db0e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43c663d2f6a5/Image-3b8db0e4.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5e7ca...@syzkaller.appspotmail.com

DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff0000de7a0a90, owner = 0x0, curr 0xffff0000db07d1c0, list empty
WARNING: CPU: 1 PID: 8077 at kernel/locking/rwsem.c:1350 __up_write kernel/locking/rwsem.c:1349 [inline]
WARNING: CPU: 1 PID: 8077 at kernel/locking/rwsem.c:1350 up_write+0x4e8/0x644 kernel/locking/rwsem.c:1604
Modules linked in:
CPU: 1 PID: 8077 Comm: syz.7.1124 Not tainted 5.15.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_write kernel/locking/rwsem.c:1349 [inline]
pc : up_write+0x4e8/0x644 kernel/locking/rwsem.c:1604
lr : __up_write kernel/locking/rwsem.c:1349 [inline]
lr : up_write+0x4e8/0x644 kernel/locking/rwsem.c:1604
sp : ffff80001ba77c00
x29: ffff80001ba77c10 x28: ffff0000c0fb9100 x27: 0000000000000000
x26: dfff800000000000 x25: 1fffe0001bcf415f x24: ffff0000de7a0ae8
x23: 0000000000000000 x22: 0000000000000000 x21: ffff0000db07d1c0
x20: ffff0000de7a0a90 x19: ffff0000de7a0a90 x18: 0000000000000002
x17: 0000000040000000 x16: ffff8000111a53fc x15: 0000000000000002
x14: 0000000000ff0100 x13: 1ffff0000282a06b x12: 0000000000080000
x11: 000000000002250d x10: ffff800029962000 x9 : 6567a7d0607a1f00
x8 : 6567a7d0607a1f00 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff80000a731dc4
x2 : ffff0001a111cd10 x1 : 0000000100000000 x0 : 00000000000000bd
Call trace:
__up_write kernel/locking/rwsem.c:1349 [inline]
up_write+0x4e8/0x644 kernel/locking/rwsem.c:1604
inode_unlock include/linux/fs.h:792 [inline]
done_path_create fs/namei.c:3886 [inline]
do_mknodat+0x484/0x5ac fs/namei.c:4009
__do_sys_mknodat fs/namei.c:4022 [inline]
__se_sys_mknodat fs/namei.c:4019 [inline]
__arm64_sys_mknodat+0xb0/0xcc fs/namei.c:4019
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 674
hardirqs last enabled at (673): [<ffff80000824410c>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1338 [inline]
hardirqs last enabled at (673): [<ffff80000824410c>] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:4784
hardirqs last disabled at (674): [<ffff8000111a0cd0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (578): [<ffff80000819d0d8>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (578): [<ffff80000819d0d8>] handle_softirqs+0xa4c/0xbf0 kernel/softirq.c:586
softirqs last disabled at (445): [<ffff80000819d6dc>] __do_softirq kernel/softirq.c:592 [inline]
softirqs last disabled at (445): [<ffff80000819d6dc>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (445): [<ffff80000819d6dc>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (445): [<ffff80000819d6dc>] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:641
---[ end trace 29673e937f67fed3 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 98f47d0e9b8c Linux 5.15.184
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12d6e8e8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6d966a9f787a9782
dashboard link: https://syzkaller.appspot.com/bug?extid=d5e7caced7e104629877
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17aabad4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5e51314fa9b0/disk-98f47d0e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3348ed80ea4e/vmlinux-98f47d0e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3e02a814f2cc/bzImage-98f47d0e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/fcf20df14982/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5e7ca...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff8880585c91f0, owner = 0x0, curr 0xffff888026b83b80, list empty
WARNING: CPU: 0 PID: 4541 at kernel/locking/rwsem.c:1350 __up_write kernel/locking/rwsem.c:1349 [inline]
WARNING: CPU: 0 PID: 4541 at kernel/locking/rwsem.c:1350 up_write+0x3a1/0x420 kernel/locking/rwsem.c:1604
Modules linked in:
CPU: 0 PID: 4541 Comm: syz.0.91 Not tainted 5.15.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__up_write kernel/locking/rwsem.c:1349 [inline]
RIP: 0010:up_write+0x3a1/0x420 kernel/locking/rwsem.c:1604
Code: 44 d0 48 c7 c7 40 05 0b 8a 48 c7 c6 00 08 0b 8a 48 8b 14 24 4c 89 f1 4d 89 e0 4c 8b 4c 24 08 41 52 e8 03 26 3b 08 48 83 c4 08 <0f> 0b e9 6b fd ff ff 48 c7 c1 48 de 68 8d 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc900036cfdb0 EFLAGS: 00010292
RAX: 0c09b17100414e00 RBX: ffff8880585c91f0 RCX: ffff888026b83b80
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed10172067a8
R10: ffffed10172067a8 R11: 1ffff110172067a7 R12: 0000000000000000
R13: ffff8880585c9248 R14: ffff8880585c91f0 R15: 1ffff1100b0b923f
FS: 00007f77174226c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0a2f9dd000 CR3: 000000001ecb5000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

inode_unlock include/linux/fs.h:792 [inline]
done_path_create fs/namei.c:3886 [inline]

do_mknodat+0x408/0x620 fs/namei.c:4009

__do_sys_mknodat fs/namei.c:4022 [inline]
__se_sys_mknodat fs/namei.c:4019 [inline]

__x64_sys_mknodat+0xa5/0xc0 fs/namei.c:4019
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f77181d3969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7717422038 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
RAX: ffffffffffffffda RBX: 00007f77183fb080 RCX: 00007f77181d3969
RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004
RBP: 00007f7718255ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000700 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f77183fb080 R15: 00007fff644d3698
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13c04fd4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3b1215b3cf4119f
dashboard link: https://syzkaller.appspot.com/bug?extid=d5e7caced7e104629877
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1058f722580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17c04fd4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fa511d2a8893/disk-c7964837.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f14b6c77bbb9/vmlinux-c7964837.xz
kernel image: https://storage.googleapis.com/syzbot-assets/388987ba15c6/bzImage-c7964837.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/ba38e31be4c4/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5e7ca...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff8880684a36d0, owner = 0x0, curr 0xffff888022d05940, list empty
WARNING: CPU: 0 PID: 4760 at kernel/locking/rwsem.c:1350 __up_write kernel/locking/rwsem.c:1349 [inline]
WARNING: CPU: 0 PID: 4760 at kernel/locking/rwsem.c:1350 up_write+0x3a1/0x420 kernel/locking/rwsem.c:1604
Modules linked in:
CPU: 0 PID: 4760 Comm: syz.4.183 Not tainted 5.15.189-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__up_write kernel/locking/rwsem.c:1349 [inline]
RIP: 0010:up_write+0x3a1/0x420 kernel/locking/rwsem.c:1604

Code: 44 d0 48 c7 c7 40 09 0b 8a 48 c7 c6 00 0c 0b 8a 48 8b 14 24 4c 89 f1 4d 89 e0 4c 8b 4c 24 08 41 52 e8 33 15 42 08 48 83 c4 08 <0f> 0b e9 6b fd ff ff 48 c7 c1 48 a2 69 8d 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc9000504fdd0 EFLAGS: 00010292
RAX: 05f4beffd67f4900 RBX: ffff8880684a36d0 RCX: ffff888022d05940

RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed10172067a8
R10: ffffed10172067a8 R11: 1ffff110172067a7 R12: 0000000000000000

R13: ffff8880684a3728 R14: ffff8880684a36d0 R15: 1ffff1100d0946db
FS: 00007ffbab77b6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000020000003a000 CR3: 00000000242e8000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

inode_unlock include/linux/fs.h:792 [inline]
done_path_create fs/namei.c:3886 [inline]

do_mknodat+0x408/0x620 fs/namei.c:4009
__do_sys_mknod fs/namei.c:4027 [inline]
__se_sys_mknod fs/namei.c:4025 [inline]
__x64_sys_mknod+0x8a/0xa0 fs/namei.c:4025

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

RIP: 0033:0x7ffbac52c9a9

Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ffbab77b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000085
RAX: ffffffffffffffda RBX: 00007ffbac754080 RCX: 00007ffbac52c9a9
RDX: 0000000000000708 RSI: 0000000000000000 RDI: 000020000009e000
RBP: 00007ffbac5aed69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007ffbac754080 R15: 00007ffdbb3686b8