syzbot

------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem)): count = 0x1, magic = 0xffff0000cb1e1ed0, owner = 0xffff0000c2a24e00, curr 0xffff0000c3a09a00, list empty
WARNING: CPU: 1 PID: 4407 at kernel/locking/rwsem.c:1336 __up_read+0x248/0x2ac kernel/locking/rwsem.c:1336
Modules linked in:
CPU: 1 PID: 4407 Comm: syz-executor242 Not tainted 6.2.0-rc2-syzkaller-16046-gae87308093bc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_read+0x248/0x2ac kernel/locking/rwsem.c:1336
lr : __up_read+0x248/0x2ac kernel/locking/rwsem.c:1336
sp : ffff80000feabb40
x29: ffff80000feabb40 x28: ffff0000c3a09a00 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: ffff0000c3a09a00
x23: 00000000ffffff9c x22: ffff0000cb1e1ed0 x21: ffff80000d50c000
x20: 0000000000000000 x19: ffff0000cb1e1ed0 x18: 000000000000009e
x17: 0000000000000000 x16: ffff80000dd76118 x15: ffff0000c3a09a00
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c3a09a00
x11: ff808000081cbbc8 x10: 0000000000000000 x9 : 1f1fd87e82259b00
x8 : 1f1fd87e82259b00 x7 : ffff80000816c254 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefdef08 x1 : 0000000100000000 x0 : 000000000000009b
Call trace:
 __up_read+0x248/0x2ac kernel/locking/rwsem.c:1336
 up_read+0x38/0x48 kernel/locking/rwsem.c:1605
 inode_unlock_shared include/linux/fs.h:771 [inline]
 lookup_slow+0x50/0x68 fs/namei.c:1703
 walk_component+0x178/0x1b0 fs/namei.c:1993
 lookup_last fs/namei.c:2450 [inline]
 path_lookupat+0xc4/0x208 fs/namei.c:2474
 filename_lookup+0xf8/0x264 fs/namei.c:2503
 user_path_at_empty+0x5c/0x114 fs/namei.c:2876
 user_path_at include/linux/namei.h:57 [inline]
 __do_sys_chdir fs/open.c:514 [inline]
 __se_sys_chdir fs/open.c:508 [inline]
 __arm64_sys_chdir+0x54/0x124 fs/open.c:508
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
irq event stamp: 706
hardirqs last  enabled at (705): [<ffff80000816c2e4>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1370 [inline]
hardirqs last  enabled at (705): [<ffff80000816c2e4>] finish_lock_switch+0x94/0xe8 kernel/sched/core.c:5003
hardirqs last disabled at (706): [<ffff80000c11365c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (698): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (619): [<ffff800008017c90>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
DEBUG_RWSEMS_WARN_ON(tmp < 0): count = 0xffffffffffffff00, magic = 0xffff0000cb1e1ed0, owner = 0x0, curr 0xffff0000c3a09a00, list empty
WARNING: CPU: 1 PID: 4407 at kernel/locking/rwsem.c:1340 __up_read+0x1f0/0x2ac kernel/locking/rwsem.c:1340
Modules linked in:
CPU: 1 PID: 4407 Comm: syz-executor242 Tainted: G        W          6.2.0-rc2-syzkaller-16046-gae87308093bc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __up_read+0x1f0/0x2ac kernel/locking/rwsem.c:1340
lr : __up_read+0x1f0/0x2ac kernel/locking/rwsem.c:1340
sp : ffff80000feabb40
x29: ffff80000feabb40 x28: ffff0000c3a09a00 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: ffff0000c3a09a00
x23: 00000000ffffff9c x22: ffffffffffffff00 x21: ffff80000d50c000
x20: ffff0000cb1e1ed8 x19: ffff0000cb1e1ed0 x18: 000000000000009e
x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000
x14: 000000000000000e x13: 205d373034345420 x12: 5b5d343430383832
x11: ff808000081cbbc8 x10: 0000000000000000 x9 : 1f1fd87e82259b00
x8 : 1f1fd87e82259b00 x7 : 205b5d3434303838 x6 : ffff80000c121738
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000087
Call trace:
 __up_read+0x1f0/0x2ac kernel/locking/rwsem.c:1340
 up_read+0x38/0x48 kernel/locking/rwsem.c:1605
 inode_unlock_shared include/linux/fs.h:771 [inline]
 lookup_slow+0x50/0x68 fs/namei.c:1703
 walk_component+0x178/0x1b0 fs/namei.c:1993
 lookup_last fs/namei.c:2450 [inline]
 path_lookupat+0xc4/0x208 fs/namei.c:2474
 filename_lookup+0xf8/0x264 fs/namei.c:2503
 user_path_at_empty+0x5c/0x114 fs/namei.c:2876
 user_path_at include/linux/namei.h:57 [inline]
 __do_sys_chdir fs/open.c:514 [inline]
 __se_sys_chdir fs/open.c:508 [inline]
 __arm64_sys_chdir+0x54/0x124 fs/open.c:508
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
irq event stamp: 791
hardirqs last  enabled at (791): [<ffff80000c115818>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (791): [<ffff80000c115818>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (790): [<ffff80000c11eec8>] preempt_schedule_irq+0x80/0x110 kernel/sched/core.c:6868
softirqs last  enabled at (786): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (709): [<ffff800008017c90>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---