./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3344117128 <...> [ 71.825595][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.832238][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.839471][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.850178][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.857745][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.877073][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.884436][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.891396][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.898515][ C0] eth0: bad gso: type: 1, size: 1408 [ 71.904886][ C0] eth0: bad gso: type: 1, size: 1408 Warning: Permanently added '10.128.0.228' (ED25519) to the list of known hosts. execve("./syz-executor3344117128", ["./syz-executor3344117128"], 0x7ffdaa287840 /* 10 vars */) = 0 brk(NULL) = 0x55556574c000 brk(0x55556574cd00) = 0x55556574cd00 arch_prctl(ARCH_SET_FS, 0x55556574c380) = 0 set_tid_address(0x55556574c650) = 5218 set_robust_list(0x55556574c660, 24) = 0 rseq(0x55556574cca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3344117128", 4096) = 28 getrandom("\x8e\xd3\x9e\x8e\x3b\x93\x65\x5b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556574cd00 brk(0x55556576dd00) = 0x55556576dd00 brk(0x55556576e000) = 0x55556576e000 mprotect(0x7fb1e3675000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getrandom("\xe0\xe6\xd2\x82\x8c\xc0\x1c\xf9", 8, GRND_NONBLOCK) = 8 getrandom("\x29\x82\x8e\xd4\x07\x56\xff\xfc", 8, GRND_NONBLOCK) = 8 getrandom("\xa4\xdf\x09\x5e\x72\xe8\x59\xdc", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.OCP62O", 0700) = 0 chmod("./syzkaller.OCP62O", 0777) = 0 chdir("./syzkaller.OCP62O") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5219 attached , child_tidptr=0x55556574c650) = 5219 [pid 5219] set_robust_list(0x55556574c660, 24) = 0 [pid 5219] chdir("./0") = 0 [pid 5219] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5219] setpgid(0, 0) = 0 [pid 5219] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5219] write(3, "1000", 4) = 4 [pid 5219] close(3) = 0 [pid 5219] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5219] write(1, "executing program\n", 18executing program ) = 18 [pid 5219] memfd_create("syzkaller", 0) = 3 [pid 5219] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb1db000000 [pid 5219] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5219] munmap(0x7fb1db000000, 138412032) = 0 [pid 5219] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5219] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5219] close(3) = 0 [pid 5219] close(4) = 0 [pid 5219] mkdir("./file0", 0777) = 0 [ 79.239384][ T5219] loop0: detected capacity change from 0 to 32768 [ 79.274598][ T5219] BTRFS: device fsid 92aec1fe-fee8-4e05-92dc-790b47b871d9 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor334 (5219) [ 79.315966][ T5219] BTRFS info (device loop0): first mount of filesystem 92aec1fe-fee8-4e05-92dc-790b47b871d9 [ 79.328255][ T5219] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm [ 79.338636][ T5219] BTRFS info (device loop0): using free-space-tree [pid 5219] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0 [pid 5219] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5219] chdir("./file0") = 0 [pid 5219] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5219] ioctl(4, LOOP_CLR_FD) = 0 [pid 5219] close(4) = 0 [pid 5219] openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 5219] openat(AT_FDCWD, "memory.events", O_WRONLY|O_TRUNC|O_NONBLOCK|O_DSYNC|O_DIRECT|FASYNC|0x4) = 5 [ 79.490758][ T5219] [ 79.493223][ T5219] ===================================== [ 79.498841][ T5219] WARNING: bad unlock balance detected! [ 79.504392][ T5219] 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 Not tainted [ 79.511489][ T5219] ------------------------------------- [ 79.517019][ T5219] syz-executor334/5219 is trying to release lock (&sb->s_type->i_mutex_key) at: [ 79.526076][ T5219] [] btrfs_direct_write+0x91f/0xb40 [ 79.532881][ T5219] but there are no more locks to release! [ 79.538590][ T5219] [ 79.538590][ T5219] other info that might help us debug this: [ 79.546660][ T5219] 1 lock held by syz-executor334/5219: [ 79.552133][ T5219] #0: ffff888026aee420 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x227/0xc90 [ 79.561043][ T5219] [ 79.561043][ T5219] stack backtrace: [ 79.567039][ T5219] CPU: 0 UID: 0 PID: 5219 Comm: syz-executor334 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 79.578188][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 79.588353][ T5219] Call Trace: [ 79.591658][ T5219] [ 79.594707][ T5219] dump_stack_lvl+0x241/0x360 [ 79.599447][ T5219] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.604677][ T5219] ? __pfx__printk+0x10/0x10 [ 79.609291][ T5219] ? btrfs_direct_write+0x91f/0xb40 [ 79.614501][ T5219] print_unlock_imbalance_bug+0x256/0x2c0 [ 79.620408][ T5219] ? __pfx_print_unlock_imbalance_bug+0x10/0x10 [ 79.626685][ T5219] lock_release+0x5cb/0xa30 [ 79.631226][ T5219] ? mark_lock+0x9a/0x350 [ 79.635568][ T5219] ? btrfs_direct_write+0x91f/0xb40 [ 79.640779][ T5219] ? __pfx_lock_release+0x10/0x10 [ 79.645816][ T5219] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 79.651837][ T5219] ? kasan_quarantine_put+0xdc/0x230 [ 79.657128][ T5219] up_write+0x79/0x590 [ 79.661206][ T5219] ? iomap_dio_complete+0x6a9/0x960 [ 79.666416][ T5219] ? kfree+0x149/0x360 [ 79.670501][ T5219] ? __pfx_up_write+0x10/0x10 [ 79.675204][ T5219] ? iomap_dio_complete+0x6a9/0x960 [ 79.680419][ T5219] btrfs_direct_write+0x91f/0xb40 [ 79.685463][ T5219] ? __pfx_btrfs_direct_write+0x10/0x10 [ 79.691024][ T5219] ? __pfx_lock_acquire+0x10/0x10 [ 79.696061][ T5219] btrfs_do_write_iter+0x2a1/0x760 [ 79.701190][ T5219] ? rcu_read_lock_any_held+0xb7/0x160 [ 79.706664][ T5219] ? __pfx_btrfs_do_write_iter+0x10/0x10 [ 79.712407][ T5219] vfs_write+0xa72/0xc90 [ 79.716655][ T5219] ? __pfx_btrfs_file_write_iter+0x10/0x10 [ 79.722476][ T5219] ? __pfx_vfs_write+0x10/0x10 [ 79.727246][ T5219] ? lockdep_hardirqs_on+0x99/0x150 [ 79.732456][ T5219] ksys_write+0x1a0/0x2c0 [ 79.736794][ T5219] ? __pfx_ksys_write+0x10/0x10 [ 79.741677][ T5219] ? exc_page_fault+0x590/0x8c0 [ 79.746540][ T5219] do_syscall_64+0xf3/0x230 [ 79.751057][ T5219] ? clear_bhb_loop+0x35/0x90 [ 79.755857][ T5219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.761772][ T5219] RIP: 0033:0x7fb1e35fc169 [ 79.766200][ T5219] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 79.785812][ T5219] RSP: 002b:00007ffcc8975c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 79.794321][ T5219] RAX: ffffffffffffffda RBX: 0073746e6576652e RCX: 00007fb1e35fc169 [ 79.802305][ T5219] RDX: 0000000000182000 RSI: 0000000020000000 RDI: 0000000000000005 [ 79.810393][ T5219] RBP: 652e79726f6d656d R08: 0000000000000000 R09: 0000000000000000 [ 79.818365][ T5219] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc8975ca0 [ 79.826351][ T5219] R13: 00007ffcc8975ce0 R14: 0000000001000000 R15: 0000000000000003 [ 79.834425][ T5219] [ 79.838146][ T5219] ------------[ cut here ]------------ [ 79.843690][ T5219] DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff888073c98d20, owner = 0x0, curr 0xffff88807dba1e00, list empty [ 79.862907][ T5219] WARNING: CPU: 1 PID: 5219 at kernel/locking/rwsem.c:1370 up_write+0x502/0x590 [ 79.872033][ T5219] Modules linked in: [ 79.875944][ T5219] CPU: 1 UID: 0 PID: 5219 Comm: syz-executor334 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 79.887213][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 79.897352][ T5219] RIP: 0010:up_write+0x502/0x590 [ 79.902327][ T5219] Code: c7 c7 a0 c8 ea 8b 48 c7 c6 20 cb ea 8b 48 8b 54 24 28 48 8b 4c 24 18 4d 89 e0 4c 8b 4c 24 30 53 e8 d3 9c e6 ff 48 83 c4 08 90 <0f> 0b 90 90 e9 6a fd ff ff 48 c7 c1 00 a9 f6 8f 80 e1 07 80 c1 03 [ 79.921980][ T5219] RSP: 0018:ffffc900033cf920 EFLAGS: 00010292 [ 79.928057][ T5219] RAX: b9b6859016ed5300 RBX: ffffffff8beac980 RCX: ffff88807dba1e00 [ 79.936082][ T5219] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 79.944131][ T5219] RBP: ffffc900033cf9f0 R08: ffffffff81559202 R09: 1ffff92000679ec4 [ 79.952155][ T5219] R10: dffffc0000000000 R11: fffff52000679ec5 R12: 0000000000000000 [ 79.960184][ T5219] R13: ffff888073c98d20 R14: 1ffff92000679f2c R15: dffffc0000000000 [ 79.968164][ T5219] FS: 000055556574c380(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 [ 79.977153][ T5219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 79.983800][ T5219] CR2: 0000559a77f63218 CR3: 0000000077ac4000 CR4: 00000000003506f0 [ 79.991870][ T5219] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 79.999867][ T5219] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 80.007913][ T5219] Call Trace: [ 80.011245][ T5219] [ 80.014175][ T5219] ? __warn+0x163/0x4e0 [ 80.018332][ T5219] ? up_write+0x502/0x590 [ 80.022700][ T5219] ? report_bug+0x2b3/0x500 [ 80.027230][ T5219] ? up_write+0x502/0x590 [ 80.031602][ T5219] ? handle_bug+0x3e/0x70 [ 80.035958][ T5219] ? exc_invalid_op+0x1a/0x50 [ 80.040699][ T5219] ? asm_exc_invalid_op+0x1a/0x20 [ 80.045843][ T5219] ? __warn_printk+0x292/0x360 [ 80.050653][ T5219] ? up_write+0x502/0x590 [ 80.055010][ T5219] ? __pfx_up_write+0x10/0x10 [ 80.059688][ T5219] ? iomap_dio_complete+0x6a9/0x960 [ 80.064938][ T5219] btrfs_direct_write+0x91f/0xb40 [ 80.070001][ T5219] ? __pfx_btrfs_direct_write+0x10/0x10 [ 80.075603][ T5219] ? __pfx_lock_acquire+0x10/0x10 [ 80.080680][ T5219] btrfs_do_write_iter+0x2a1/0x760 [ 80.085805][ T5219] ? rcu_read_lock_any_held+0xb7/0x160 [ 80.091313][ T5219] ? __pfx_btrfs_do_write_iter+0x10/0x10 [ 80.096981][ T5219] vfs_write+0xa72/0xc90 [ 80.101269][ T5219] ? __pfx_btrfs_file_write_iter+0x10/0x10 [ 80.107149][ T5219] ? __pfx_vfs_write+0x10/0x10 [ 80.111984][ T5219] ? lockdep_hardirqs_on+0x99/0x150 [ 80.117229][ T5219] ksys_write+0x1a0/0x2c0 [ 80.121614][ T5219] ? __pfx_ksys_write+0x10/0x10 [ 80.126496][ T5219] ? exc_page_fault+0x590/0x8c0 [ 80.131406][ T5219] do_syscall_64+0xf3/0x230 [ 80.135939][ T5219] ? clear_bhb_loop+0x35/0x90 [ 80.140662][ T5219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.146588][ T5219] RIP: 0033:0x7fb1e35fc169 [ 80.151042][ T5219] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 80.170766][ T5219] RSP: 002b:00007ffcc8975c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 80.179185][ T5219] RAX: ffffffffffffffda RBX: 0073746e6576652e RCX: 00007fb1e35fc169 [ 80.187223][ T5219] RDX: 0000000000182000 RSI: 0000000020000000 RDI: 0000000000000005 [ 80.195239][ T5219] RBP: 652e79726f6d656d R08: 0000000000000000 R09: 0000000000000000 [ 80.203275][ T5219] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc8975ca0 [ 80.211292][ T5219] R13: 00007ffcc8975ce0 R14: 0000000001000000 R15: 0000000000000003 [ 80.219275][ T5219] [ 80.222331][ T5219] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 80.229627][ T5219] CPU: 1 UID: 0 PID: 5219 Comm: syz-executor334 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 [ 80.240741][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 80.250805][ T5219] Call Trace: [ 80.254090][ T5219] [ 80.257030][ T5219] dump_stack_lvl+0x241/0x360 [ 80.261738][ T5219] ? __pfx_dump_stack_lvl+0x10/0x10 [ 80.266953][ T5219] ? __pfx__printk+0x10/0x10 [ 80.271553][ T5219] ? vscnprintf+0x5d/0x90 [ 80.275900][ T5219] panic+0x349/0x860 [ 80.279811][ T5219] ? __warn+0x172/0x4e0 [ 80.283984][ T5219] ? __pfx_panic+0x10/0x10 [ 80.288421][ T5219] __warn+0x346/0x4e0 [ 80.292416][ T5219] ? up_write+0x502/0x590 [ 80.296753][ T5219] report_bug+0x2b3/0x500 [ 80.301100][ T5219] ? up_write+0x502/0x590 [ 80.305559][ T5219] handle_bug+0x3e/0x70 [ 80.309755][ T5219] exc_invalid_op+0x1a/0x50 [ 80.314285][ T5219] asm_exc_invalid_op+0x1a/0x20 [ 80.319284][ T5219] RIP: 0010:up_write+0x502/0x590 [ 80.324252][ T5219] Code: c7 c7 a0 c8 ea 8b 48 c7 c6 20 cb ea 8b 48 8b 54 24 28 48 8b 4c 24 18 4d 89 e0 4c 8b 4c 24 30 53 e8 d3 9c e6 ff 48 83 c4 08 90 <0f> 0b 90 90 e9 6a fd ff ff 48 c7 c1 00 a9 f6 8f 80 e1 07 80 c1 03 [ 80.343872][ T5219] RSP: 0018:ffffc900033cf920 EFLAGS: 00010292 [ 80.349951][ T5219] RAX: b9b6859016ed5300 RBX: ffffffff8beac980 RCX: ffff88807dba1e00 [ 80.357973][ T5219] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 80.365961][ T5219] RBP: ffffc900033cf9f0 R08: ffffffff81559202 R09: 1ffff92000679ec4 [ 80.373947][ T5219] R10: dffffc0000000000 R11: fffff52000679ec5 R12: 0000000000000000 [ 80.381926][ T5219] R13: ffff888073c98d20 R14: 1ffff92000679f2c R15: dffffc0000000000 [ 80.389912][ T5219] ? __warn_printk+0x292/0x360 [ 80.394706][ T5219] ? __pfx_up_write+0x10/0x10 [ 80.399442][ T5219] ? iomap_dio_complete+0x6a9/0x960 [ 80.404654][ T5219] btrfs_direct_write+0x91f/0xb40 [ 80.409703][ T5219] ? __pfx_btrfs_direct_write+0x10/0x10 [ 80.415269][ T5219] ? __pfx_lock_acquire+0x10/0x10 [ 80.420349][ T5219] btrfs_do_write_iter+0x2a1/0x760 [ 80.425477][ T5219] ? rcu_read_lock_any_held+0xb7/0x160 [ 80.430951][ T5219] ? __pfx_btrfs_do_write_iter+0x10/0x10 [ 80.436607][ T5219] vfs_write+0xa72/0xc90 [ 80.440858][ T5219] ? __pfx_btrfs_file_write_iter+0x10/0x10 [ 80.446765][ T5219] ? __pfx_vfs_write+0x10/0x10 [ 80.451540][ T5219] ? lockdep_hardirqs_on+0x99/0x150 [ 80.456751][ T5219] ksys_write+0x1a0/0x2c0 [ 80.461089][ T5219] ? __pfx_ksys_write+0x10/0x10 [ 80.465942][ T5219] ? exc_page_fault+0x590/0x8c0 [ 80.470810][ T5219] do_syscall_64+0xf3/0x230 [ 80.475326][ T5219] ? clear_bhb_loop+0x35/0x90 [ 80.480045][ T5219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.485957][ T5219] RIP: 0033:0x7fb1e35fc169 [ 80.490382][ T5219] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 80.510013][ T5219] RSP: 002b:00007ffcc8975c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 80.518464][ T5219] RAX: ffffffffffffffda RBX: 0073746e6576652e RCX: 00007fb1e35fc169 [ 80.526442][ T5219] RDX: 0000000000182000 RSI: 0000000020000000 RDI: 0000000000000005 [ 80.534428][ T5219] RBP: 652e79726f6d656d R08: 0000000000000000 R09: 0000000000000000 [ 80.542432][ T5219] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc8975ca0 [ 80.550498][ T5219] R13: 00007ffcc8975ce0 R14: 0000000001000000 R15: 0000000000000003 [ 80.558487][ T5219] [ 80.561791][ T5219] Kernel Offset: disabled [ 80.566122][ T5219] Rebooting in 86400 seconds..