BUG: spinlock bad magic on CPU#1, gfs2_quotad/5810
lock: 0xffff0000d8d50b98, .magic: ffff0000, .owner: /400637872, .owner_cpu: -177266680
CPU: 1 PID: 5810 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call trace:
dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
spin_dump+0x110/0x208 kernel/locking/spinlock_debug.c:69
spin_bug kernel/locking/spinlock_debug.c:77 [inline]
debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
do_raw_spin_lock+0x1ec/0x2f8 kernel/locking/spinlock_debug.c:114
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb0 kernel/locking/spinlock.c:162
finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9
index 15706 is out of range for type 'unsigned long[8]'
CPU: 1 PID: 5810 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call trace:
dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
decode_tail kernel/locking/qspinlock.c:131 [inline]
queued_spin_lock_slowpath+0x8a8/0xc18 kernel/locking/qspinlock.c:471
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x2f4/0x2f8 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb0 kernel/locking/spinlock.c:162
finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
================================================================================
Unable to handle kernel paging request at virtual address ffff700102a313f7
KASAN: maybe wild-memory-access in range [0xffff800815189fb8-0xffff800815189fbf]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005
CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000002229cd000
[ffff700102a313f7] pgd=000000023ea48003, p4d=000000023ea48003, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5810 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x580/0xc18 kernel/locking/qspinlock.c:474
lr : decode_tail kernel/locking/qspinlock.c:131 [inline]
lr : queued_spin_lock_slowpath+0x8a8/0xc18 kernel/locking/qspinlock.c:471
sp : ffff8000210f7a80
x29: ffff8000210f7b20 x28: ffff800015189fb0 x27: 1fffe0001b1aa173
x26: ffff800015220f40 x25: 1fffe00033eacdf0 x24: dfff800000000000
x23: ffff70000421ef54 x22: ffff00019f566f88 x21: ffff800815189fb8
x20: ffff00019f566f80 x19: ffff0000d8d50b98 x18: ffff800011b9bf60
x17: 3d3d3d3d3d3d3d3d x16: ffff800008193848 x15: 0000000000000000
x14: ffff700002fc1cbc x13: 1ffff00002fc1cbc x12: 0000000000ff0100
x11: ff008000081938cc x10: ffff800015189f80 x9 : 0000000000000003
x8 : 1ffff00102a313f7 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000210f74d8 x4 : ffff800015304cc0 x3 : ffff800008193894
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 00000000ffffffff
Call trace:
queued_spin_lock_slowpath+0x580/0xc18 kernel/locking/qspinlock.c:474
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x2f4/0x2f8 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb0 kernel/locking/spinlock.c:162
finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: 979340f1 f94002a8 8b1c0115 d343fea8 (38786908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 979340f1 bl 0xfffffffffe4d03c4
4: f94002a8 ldr x8, [x21]
8: 8b1c0115 add x21, x8, x28
c: d343fea8 lsr x8, x21, #3
* 10: 38786908 ldrb w8, [x8, x24] <-- trapping instruction