WARNING in reiserfs_readdir_inode (2)

Status: upstream: reported on 2026/10/17 15:24
Reported-by: syzbot+962525f0c0fb9a76da24@syzkaller.appspotmail.com
First crash: 9h17m, last: 9h17m
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in reiserfs_readdir_inode hfs -1 syz, C 128 1068d 1514d 0/29 auto-obsoleted due to no activity on 2024/04/14 04:44
linux-6.1 WARNING in reiserfs_readdir_inode -1 1 484d 484d 0/3 auto-obsoleted due to no activity on 2025/09/28 13:03

Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 0 PID: 5872 at kernel/locking/mutex.c:582 __mutex_lock_common+0x1468/0x1f3c kernel/locking/mutex.c:582
Modules linked in:
CPU: 0 PID: 5872 Comm: syz.2.326 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __mutex_lock_common+0x1468/0x1f3c kernel/locking/mutex.c:582
lr : __mutex_lock_common+0x1468/0x1f3c kernel/locking/mutex.c:582
sp : ffff800021b37680
x29: ffff800021b377d0 x28: ffff700004366ee4 x27: 0000000000000000
x26: 0000000000000000 x25: ffff800008cb7570 x24: 0000000000000000
x23: dfff800000000000 x22: ffff800008d193c0 x21: ffff800021b37740
x20: 0000000000000000 x19: ffff0000d96e6028 x18: 1fffe00033c1877e
x17: ffff80001641d000 x16: ffff800008043a58 x15: ffff00019e0c3bfc
x14: 0000000000000001 x13: 1fffe00019b05a90 x12: 0000000000000000
x11: 0000000000000000 x10: ffff600019b05a91 x9 : 9eb14b2da2113000
x8 : 9eb14b2da2113000 x7 : ffff800011d2c160 x6 : ffff80000825ab2c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082497f8
x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
 __mutex_lock_common+0x1468/0x1f3c kernel/locking/mutex.c:582
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
 reiserfs_readdir_inode+0x174/0xef4 fs/reiserfs/dir.c:79
 reiserfs_readdir+0x48/0x58 fs/reiserfs/dir.c:274
 iterate_dir+0x1f0/0x4d0 fs/readdir.c:-1
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x11c/0x314 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4263
hardirqs last  enabled at (4263): [<ffff80000805a54c>] local_daif_restore arch/arm64/include/asm/daifflags.h:75 [inline]
hardirqs last  enabled at (4263): [<ffff80000805a54c>] el0_svc_common+0xa0/0x258 arch/arm64/kernel/syscall.c:105
hardirqs last disabled at (4262): [<ffff800011bc78f8>] el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
softirqs last  enabled at (4254): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (4252): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9
index 15717 is out of range for type 'unsigned long[8]'
CPU: 1 PID: 5872 Comm: syz.2.326 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
 decode_tail kernel/locking/qspinlock.c:131 [inline]
 queued_spin_lock_slowpath+0x8a8/0xc14 kernel/locking/qspinlock.c:471
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x2f4/0x2f8 kernel/locking/spinlock_debug.c:115
 __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
 _raw_spin_lock+0x5c/0x6c kernel/locking/spinlock.c:154
 __mutex_lock_common+0x38c/0x1f3c kernel/locking/mutex.c:617
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
 reiserfs_readdir_inode+0x174/0xef4 fs/reiserfs/dir.c:79
 reiserfs_readdir+0x48/0x58 fs/reiserfs/dir.c:274
 iterate_dir+0x1f0/0x4d0 fs/readdir.c:-1
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x11c/0x314 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
================================================================================
Unable to handle kernel paging request at virtual address ffff80001638b1a0
KASAN: probably user-memory-access in range [0x00000000b1c58d00-0x00000000b1c58d07]
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047
  CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000020bbcc000
[ffff80001638b1a0] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000023fffa003, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5872 Comm: syz.2.326 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x598/0xc14 kernel/locking/qspinlock.c:474
lr : decode_tail kernel/locking/qspinlock.c:131 [inline]
lr : queued_spin_lock_slowpath+0x8a8/0xc14 kernel/locking/qspinlock.c:471
sp : ffff800021b37480
x29: ffff800021b37520 x28: 1fffe00033c1f230 x27: ffff80001638b1a0
x26: ffff00019e0f9188 x25: ffff800021b374a0 x24: 1fffe0001b2dcc06
x23: dfff800000000000 x22: ffff700004366e94 x21: ffff80001638b1a0
x20: ffff00019e0f9180 x19: ffff0000d96e6030 x18: 1fffe00033c1c97e
x17: 3d3d3d3d3d3d3d3d x16: ffff800008195558 x15: 3d3d3d3d3d3d3d3d
x14: ffff700003203abc x13: 1ffff00003203abc x12: 0000000000000004
x11: ff008000081955dc x10: ffff80001638b180 x9 : 0000000000000002
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021b36ed8 x4 : ffff800016504f40 x3 : ffff8000081955a4
x2 : 0000000000000001 x1 : 0000000000000004 x0 : ffff00019e0f9188
Call trace:
 queued_spin_lock_slowpath+0x598/0xc14 kernel/locking/qspinlock.c:477
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x2f4/0x2f8 kernel/locking/spinlock_debug.c:115
 __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
 _raw_spin_lock+0x5c/0x6c kernel/locking/spinlock.c:154
 __mutex_lock_common+0x38c/0x1f3c kernel/locking/mutex.c:617
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
 reiserfs_readdir_inode+0x174/0xef4 fs/reiserfs/dir.c:79
 reiserfs_readdir+0x48/0x58 fs/reiserfs/dir.c:274
 iterate_dir+0x1f0/0x4d0 fs/readdir.c:-1
 __do_sys_getdents64 fs/readdir.c:369 [inline]
 __se_sys_getdents64 fs/readdir.c:354 [inline]
 __arm64_sys_getdents64+0x11c/0x314 fs/readdir.c:354
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 978cfdf8 91002280 52800081 (f90002b4) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	aa1503e0 	mov	x0, x21
   4:	978cfdf8 	bl	0xfffffffffe33f7e4
   8:	91002280 	add	x0, x20, #0x8
   c:	52800081 	mov	w1, #0x4                   	// #4
* 10:	f90002b4 	str	x20, [x21] <-- trapping instruction

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/17 15:23 linux-6.1.y 79807e970724 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in reiserfs_readdir_inode
* Struck through repros no longer work on HEAD.