[moderation] [fs?] [mm?] WARNING in do_mmap

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8bc67e4db64a Merge tag 'erofs-for-7.1-rc5-fixes' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c6cc2e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0f0911eedbc130a
dashboard link: https://syzkaller.appspot.com/bug?extid=fc7402f3b27717a82129
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
CC: [bra...@kernel.org ja...@suse.cz ke...@kernel.org linux-...@vger.kernel.org linux-...@vger.kernel.org linu...@kvack.org vi...@zeniv.linux.org.uk]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8bc67e4d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d7bf8056aaa7/vmlinux-8bc67e4d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/36467696551f/bzImage-8bc67e4d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fc7402...@syzkaller.appspotmail.com

------------[ cut here ]------------
((d_inode(path->dentry))->i_flags & (1 << 19)) && !(path->mnt->mnt_sb->s_iflags & 0x00000002)
WARNING: fs/exec.c:118 at path_noexec+0x1cf/0x230 fs/exec.c:118, CPU#2: syz.0.28/6032
Modules linked in:
CPU: 2 UID: 0 PID: 6032 Comm: syz.0.28 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Code: 58 31 ff 83 e3 02 48 89 de 48 d1 eb e8 fa 76 7e ff 83 e3 01 e8 12 7c 7e ff 89 d8 5b 5d 41 5c c3 cc cc cc cc e8 02 7c 7e ff 90 <0f> 0b 90 e9 46 ff ff ff e8 c4 43 eb ff e9 a3 fe ff ff e8 ba 43 eb
RSP: 0018:ffffc90003cdfc00 EFLAGS: 00010283
RAX: 00000000000000ae RBX: 0000000000000000 RCX: ffffc90007941000
RDX: 0000000000080000 RSI: ffffffff8289907e RDI: ffff888024708000
RBP: ffff8880204ff1a0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000080000
R13: 0000000000000001 R14: ffff8880521f5008 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888097374000(0063) knlGS:00000000f545db40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f73b00fc CR3: 000000004cdd3000 CR4: 0000000000352ef0
Call Trace:
<TASK>
do_mmap+0x857/0x12f0 mm/mmap.c:471
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x3cb/0x610 mm/mmap.c:606
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0xe7/0x950 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf706ef7c
Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8
RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000c0
RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000003000
RDX: 000000000300000f RSI: 0000000000000011 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess):
0: d2 74 05 c1 shlb %cl,-0x3f(%rbp,%rax,1)
4: e8 0c 89 02 8b call 0x8b028915
9: 5d pop %rbp
a: fc cld
b: 31 c0 xor %eax,%eax
d: c9 leave
e: c3 ret
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 0f 1f 00 nopl (%rax)
21: 51 push %rcx
22: 52 push %rdx
23: 55 push %rbp
24: 89 e5 mov %esp,%ebp
26: 0f 34 sysenter
28: cd 80 int $0x80
* 2a: 5d pop %rbp <-- trapping instruction
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 ret
2e: 90 nop
2f: 2e 8d b4 26 00 00 00 cs lea 0x0(%rsi,%riz,1),%esi
36: 00
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
3e: 58 pop %rax
3f: b8 .byte 0xb8


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup