[moderation] [ocfs2?] BUG: unable to handle kernel paging request in ocfs2_inode_lock_full_nested
0 views
Skip to first unread message
syzbot
May 19, 2026, 3:55:29 AM (yesterday) May 19
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 70eda68668d1 Merge tag 'hid-for-linus-2026051401' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1668d7ba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb5b551cf65fa040
dashboard link: https://syzkaller.appspot.com/bug?extid=2fdccbb67d94c4d49796
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
CC: [jl...@evilplan.org jose...@linux.alibaba.com linux-...@vger.kernel.org ma...@fasheh.com ocfs2...@lists.linux.dev]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eeb8072c5e5a/disk-70eda686.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0628a3bc44db/vmlinux-70eda686.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bcfe3a936919/bzImage-70eda686.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2fdccb...@syzkaller.appspotmail.com
loop1: detected capacity change from 0 to 1024
BUG: unable to handle page fault for address: ffffffff9f188cd0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD e599067 P4D e599067 PUD e59a063 PMD 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 20841 Comm: syz.1.6323 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:222 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:233 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:__lock_acquire+0x4be/0x2630 kernel/locking/lockdep.c:5207
Code: 00 00 48 89 de 48 89 ef 89 4c 24 08 e8 eb ee ff ff 8b 4c 24 08 85 c0 0f 84 d8 fe ff ff 8b 05 49 37 36 19 85 c0 75 11 4d 63 ed <4c> 0f a3 2d 1a 8b 2d 14 0f 83 aa 0b 00 00 48 8b 95 80 0b 00 00 85
RSP: 0018:ffffc90004f6f6c8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888020f78b90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888020f78b90 RDI: ffff888020f78000
RBP: ffff888020f78000 R08: ffffffff96179dc8 R09: 000000000000000b
R10: 0000000000000004 R11: 0000000000000001 R12: 0000000000000000
R13: 000000004835abb4 R14: 0000000000000000 R15: 0000000000000005
FS: 00007f6915dd06c0(0000) GS:ffff888124370000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff9f188cd0 CR3: 000000008ac2e000 CR4: 0000000000350ef0
Call Trace:
<TASK>
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
spin_lock include/linux/spinlock.h:342 [inline]
ocfs2_is_hard_readonly fs/ocfs2/ocfs2.h:665 [inline]
ocfs2_inode_lock_full_nested+0x102/0x1d20 fs/ocfs2/dlmglue.c:2446
ocfs2_inode_lock_tracker+0x224/0x6f0 fs/ocfs2/dlmglue.c:2691
ocfs2_permission+0xcf/0x1c0 fs/ocfs2/file.c:1356
do_inode_permission fs/namei.c:578 [inline]
inode_permission+0x3f1/0x620 fs/namei.c:648
xattr_permission+0x1a1/0x230 fs/xattr.c:173
vfs_getxattr+0xa5/0x2a0 fs/xattr.c:452
do_getxattr+0x164/0x3c0 fs/xattr.c:800
filename_getxattr+0xee/0x1a0 fs/xattr.c:829
path_getxattrat+0x20d/0x430 fs/xattr.c:868
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6914f9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6915dd0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000c0
RAX: ffffffffffffffda RBX: 00007f6915215fa0 RCX: 00007f6914f9ce59
RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000200000000180
RBP: 00007f6915032d6f R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffe3 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6915216038 R14: 00007f6915215fa0 R15: 00007fff0a704ed8
</TASK>
Modules linked in:
CR2: ffffffff9f188cd0
---[ end trace 0000000000000000 ]---
RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:222 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:233 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:__lock_acquire+0x4be/0x2630 kernel/locking/lockdep.c:5207
Code: 00 00 48 89 de 48 89 ef 89 4c 24 08 e8 eb ee ff ff 8b 4c 24 08 85 c0 0f 84 d8 fe ff ff 8b 05 49 37 36 19 85 c0 75 11 4d 63 ed <4c> 0f a3 2d 1a 8b 2d 14 0f 83 aa 0b 00 00 48 8b 95 80 0b 00 00 85
RSP: 0018:ffffc90004f6f6c8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888020f78b90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888020f78b90 RDI: ffff888020f78000
RBP: ffff888020f78000 R08: ffffffff96179dc8 R09: 000000000000000b
R10: 0000000000000004 R11: 0000000000000001 R12: 0000000000000000
R13: 000000004835abb4 R14: 0000000000000000 R15: 0000000000000005
FS: 00007f6915dd06c0(0000) GS:ffff888124370000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff9f188cd0 CR3: 000000008ac2e000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 48 89 de mov %rbx,%rsi
5: 48 89 ef mov %rbp,%rdi
8: 89 4c 24 08 mov %ecx,0x8(%rsp)
c: e8 eb ee ff ff call 0xffffeefc
11: 8b 4c 24 08 mov 0x8(%rsp),%ecx
15: 85 c0 test %eax,%eax
17: 0f 84 d8 fe ff ff je 0xfffffef5
1d: 8b 05 49 37 36 19 mov 0x19363749(%rip),%eax # 0x1936376c
23: 85 c0 test %eax,%eax
25: 75 11 jne 0x38
27: 4d 63 ed movslq %r13d,%r13
* 2a: 4c 0f a3 2d 1a 8b 2d bt %r13,0x142d8b1a(%rip) # 0x142d8b4c <-- trapping instruction
31: 14
32: 0f 83 aa 0b 00 00 jae 0xbe2
38: 48 8b 95 80 0b 00 00 mov 0xb80(%rbp),%rdx
3f: 85 .byte 0x85
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 70eda68668d1 Merge tag 'hid-for-linus-2026051401' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1668d7ba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb5b551cf65fa040
dashboard link: https://syzkaller.appspot.com/bug?extid=2fdccbb67d94c4d49796
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
CC: [jl...@evilplan.org jose...@linux.alibaba.com linux-...@vger.kernel.org ma...@fasheh.com ocfs2...@lists.linux.dev]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eeb8072c5e5a/disk-70eda686.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0628a3bc44db/vmlinux-70eda686.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bcfe3a936919/bzImage-70eda686.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2fdccb...@syzkaller.appspotmail.com
loop1: detected capacity change from 0 to 1024
BUG: unable to handle page fault for address: ffffffff9f188cd0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD e599067 P4D e599067 PUD e59a063 PMD 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 20841 Comm: syz.1.6323 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:222 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:233 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:__lock_acquire+0x4be/0x2630 kernel/locking/lockdep.c:5207
Code: 00 00 48 89 de 48 89 ef 89 4c 24 08 e8 eb ee ff ff 8b 4c 24 08 85 c0 0f 84 d8 fe ff ff 8b 05 49 37 36 19 85 c0 75 11 4d 63 ed <4c> 0f a3 2d 1a 8b 2d 14 0f 83 aa 0b 00 00 48 8b 95 80 0b 00 00 85
RSP: 0018:ffffc90004f6f6c8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888020f78b90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888020f78b90 RDI: ffff888020f78000
RBP: ffff888020f78000 R08: ffffffff96179dc8 R09: 000000000000000b
R10: 0000000000000004 R11: 0000000000000001 R12: 0000000000000000
R13: 000000004835abb4 R14: 0000000000000000 R15: 0000000000000005
FS: 00007f6915dd06c0(0000) GS:ffff888124370000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff9f188cd0 CR3: 000000008ac2e000 CR4: 0000000000350ef0
Call Trace:
<TASK>
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
spin_lock include/linux/spinlock.h:342 [inline]
ocfs2_is_hard_readonly fs/ocfs2/ocfs2.h:665 [inline]
ocfs2_inode_lock_full_nested+0x102/0x1d20 fs/ocfs2/dlmglue.c:2446
ocfs2_inode_lock_tracker+0x224/0x6f0 fs/ocfs2/dlmglue.c:2691
ocfs2_permission+0xcf/0x1c0 fs/ocfs2/file.c:1356
do_inode_permission fs/namei.c:578 [inline]
inode_permission+0x3f1/0x620 fs/namei.c:648
xattr_permission+0x1a1/0x230 fs/xattr.c:173
vfs_getxattr+0xa5/0x2a0 fs/xattr.c:452
do_getxattr+0x164/0x3c0 fs/xattr.c:800
filename_getxattr+0xee/0x1a0 fs/xattr.c:829
path_getxattrat+0x20d/0x430 fs/xattr.c:868
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6914f9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6915dd0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000c0
RAX: ffffffffffffffda RBX: 00007f6915215fa0 RCX: 00007f6914f9ce59
RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000200000000180
RBP: 00007f6915032d6f R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffe3 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6915216038 R14: 00007f6915215fa0 R15: 00007fff0a704ed8
</TASK>
Modules linked in:
CR2: ffffffff9f188cd0
---[ end trace 0000000000000000 ]---
RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:222 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:233 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:__lock_acquire+0x4be/0x2630 kernel/locking/lockdep.c:5207
Code: 00 00 48 89 de 48 89 ef 89 4c 24 08 e8 eb ee ff ff 8b 4c 24 08 85 c0 0f 84 d8 fe ff ff 8b 05 49 37 36 19 85 c0 75 11 4d 63 ed <4c> 0f a3 2d 1a 8b 2d 14 0f 83 aa 0b 00 00 48 8b 95 80 0b 00 00 85
RSP: 0018:ffffc90004f6f6c8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888020f78b90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888020f78b90 RDI: ffff888020f78000
RBP: ffff888020f78000 R08: ffffffff96179dc8 R09: 000000000000000b
R10: 0000000000000004 R11: 0000000000000001 R12: 0000000000000000
R13: 000000004835abb4 R14: 0000000000000000 R15: 0000000000000005
FS: 00007f6915dd06c0(0000) GS:ffff888124370000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff9f188cd0 CR3: 000000008ac2e000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 48 89 de mov %rbx,%rsi
5: 48 89 ef mov %rbp,%rdi
8: 89 4c 24 08 mov %ecx,0x8(%rsp)
c: e8 eb ee ff ff call 0xffffeefc
11: 8b 4c 24 08 mov 0x8(%rsp),%ecx
15: 85 c0 test %eax,%eax
17: 0f 84 d8 fe ff ff je 0xfffffef5
1d: 8b 05 49 37 36 19 mov 0x19363749(%rip),%eax # 0x1936376c
23: 85 c0 test %eax,%eax
25: 75 11 jne 0x38
27: 4d 63 ed movslq %r13d,%r13
* 2a: 4c 0f a3 2d 1a 8b 2d bt %r13,0x142d8b1a(%rip) # 0x142d8b4c <-- trapping instruction
31: 14
32: 0f 83 aa 0b 00 00 jae 0xbe2
38: 48 8b 95 80 0b 00 00 mov 0xb80(%rbp),%rdx
3f: 85 .byte 0x85
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages