overlayfs: upper fs does not support tmpfile.
overlayfs: upper fs does not support RENAME_WHITEOUT.
overlayfs: failed to set xattr on upper
overlayfs: ...falling back to index=off,metacopy=off.
BUG: unable to handle page fault for address: ffffff91f3a90101
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD c572067 P4D c572067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 13125 Comm: syz-executor.5 Not tainted 6.2.0-syzkaller-13563-gf915322fe014 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:ovl_copy_xattr+0x10f/0xc90 fs/overlayfs/copy_up.c:85
Code: 00 00 00 fc ff df 48 8d 7b 02 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 fc 06 00 00 <0f> b7 5b 02 31 ff 83 e3 08 89 de e8 31 8e a1 fe 66 85 db 75 1a 45
RSP: 0018:ffffc90014e67710 EFLAGS: 00010246
RAX: 0000000000000002 RBX: ffffff91f3a900ff RCX: ffffc90006149000
RDX: 0000000000000000 RSI: ffffffff82e368d6 RDI: ffffff91f3a90101
RBP: ffffc90014e67b08 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000205 R12: ffff88807aefe180
R13: ffff8880369485e0 R14: ffff888073b69d58 R15: ffffc90014e67b08
FS: 00007fd5799b8700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffff91f3a90101 CR3: 000000003b324000 CR4: 0000000000350ef0
Call Trace:
<TASK>
ovl_copy_up_metadata+0x191/0x960 fs/overlayfs/copy_up.c:616
ovl_copy_up_workdir fs/overlayfs/copy_up.c:733 [inline]
ovl_do_copy_up fs/overlayfs/copy_up.c:879 [inline]
ovl_copy_up_one+0xa6d/0x2cc0 fs/overlayfs/copy_up.c:1049
ovl_copy_up_flags+0x150/0x1d0 fs/overlayfs/copy_up.c:1095
ovl_link fs/overlayfs/dir.c:708 [inline]
ovl_link+0x78/0x250 fs/overlayfs/dir.c:698
vfs_link+0x5c7/0xa90 fs/namei.c:4522
do_linkat+0x448/0x5e0 fs/namei.c:4593
__do_sys_link fs/namei.c:4627 [inline]
__se_sys_link fs/namei.c:4625 [inline]
__x64_sys_link+0x81/0xa0 fs/namei.c:4625
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd578c8c0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd5799b8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000056
RAX: ffffffffffffffda RBX: 00007fd578dabf80 RCX: 00007fd578c8c0f9
RDX: 0000000000000000 RSI: 00000000200004c0 RDI: 0000000020000400
RBP: 00007fd578ce7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdc794f92f R14: 00007fd5799b8300 R15: 0000000000022000
</TASK>
Modules linked in:
CR2: ffffff91f3a90101
---[ end trace 0000000000000000 ]---
RIP: 0010:ovl_copy_xattr+0x10f/0xc90 fs/overlayfs/copy_up.c:85
Code: 00 00 00 fc ff df 48 8d 7b 02 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 fc 06 00 00 <0f> b7 5b 02 31 ff 83 e3 08 89 de e8 31 8e a1 fe 66 85 db 75 1a 45
RSP: 0018:ffffc90014e67710 EFLAGS: 00010246
RAX: 0000000000000002 RBX: ffffff91f3a900ff RCX: ffffc90006149000
RDX: 0000000000000000 RSI: ffffffff82e368d6 RDI: ffffff91f3a90101
RBP: ffffc90014e67b08 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000205 R12: ffff88807aefe180
R13: ffff8880369485e0 R14: ffff888073b69d58 R15: ffffc90014e67b08
FS: 00007fd5799b8700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffff91f3a90101 CR3: 000000003b324000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess), 5 bytes skipped:
0: df 48 8d fisttps -0x73(%rax)
3: 7b 02 jnp 0x7
5: 48 89 fa mov %rdi,%rdx
8: 48 c1 ea 03 shr $0x3,%rdx
c: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
10: 48 89 f8 mov %rdi,%rax
13: 83 e0 07 and $0x7,%eax
16: 83 c0 01 add $0x1,%eax
19: 38 d0 cmp %dl,%al
1b: 7c 08 jl 0x25
1d: 84 d2 test %dl,%dl
1f: 0f 85 fc 06 00 00 jne 0x721
* 25: 0f b7 5b 02 movzwl 0x2(%rbx),%ebx <-- trapping instruction
29: 31 ff xor %edi,%edi
2b: 83 e3 08 and $0x8,%ebx
2e: 89 de mov %ebx,%esi
30: e8 31 8e a1 fe callq 0xfea18e66
35: 66 85 db test %bx,%bx
38: 75 1a jne 0x54
3a: 45 rex.RB