BUG: spinlock bad magic on CPU#1, gfs2_quotad/5810
 lock: 0xffff0000d8d50b98, .magic: ffff0000, .owner: ÿÿÿÿ/400637872, .owner_cpu: -177266680
CPU: 1 PID: 5810 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 spin_dump+0x110/0x208 kernel/locking/spinlock_debug.c:69
 spin_bug kernel/locking/spinlock_debug.c:77 [inline]
 debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
 do_raw_spin_lock+0x1ec/0x2f8 kernel/locking/spinlock_debug.c:114
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
 _raw_spin_lock_irqsave+0x74/0xb0 kernel/locking/spinlock.c:162
 finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
 gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9
index 15706 is out of range for type 'unsigned long[8]'
CPU: 1 PID: 5810 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
 decode_tail kernel/locking/qspinlock.c:131 [inline]
 queued_spin_lock_slowpath+0x8a8/0xc18 kernel/locking/qspinlock.c:471
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x2f4/0x2f8 kernel/locking/spinlock_debug.c:115
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
 _raw_spin_lock_irqsave+0x74/0xb0 kernel/locking/spinlock.c:162
 finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
 gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
================================================================================
Unable to handle kernel paging request at virtual address ffff700102a313f7
KASAN: maybe wild-memory-access in range [0xffff800815189fb8-0xffff800815189fbf]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005
  CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000002229cd000
[ffff700102a313f7] pgd=000000023ea48003, p4d=000000023ea48003, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5810 Comm: gfs2_quotad Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x580/0xc18 kernel/locking/qspinlock.c:474
lr : decode_tail kernel/locking/qspinlock.c:131 [inline]
lr : queued_spin_lock_slowpath+0x8a8/0xc18 kernel/locking/qspinlock.c:471
sp : ffff8000210f7a80
x29: ffff8000210f7b20 x28: ffff800015189fb0 x27: 1fffe0001b1aa173
x26: ffff800015220f40 x25: 1fffe00033eacdf0 x24: dfff800000000000
x23: ffff70000421ef54 x22: ffff00019f566f88 x21: ffff800815189fb8
x20: ffff00019f566f80 x19: ffff0000d8d50b98 x18: ffff800011b9bf60
x17: 3d3d3d3d3d3d3d3d x16: ffff800008193848 x15: 0000000000000000
x14: ffff700002fc1cbc x13: 1ffff00002fc1cbc x12: 0000000000ff0100
x11: ff008000081938cc x10: ffff800015189f80 x9 : 0000000000000003
x8 : 1ffff00102a313f7 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000210f74d8 x4 : ffff800015304cc0 x3 : ffff800008193894
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 00000000ffffffff
Call trace:
 queued_spin_lock_slowpath+0x580/0xc18 kernel/locking/qspinlock.c:474
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x2f4/0x2f8 kernel/locking/spinlock_debug.c:115
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
 _raw_spin_lock_irqsave+0x74/0xb0 kernel/locking/spinlock.c:162
 finish_wait+0xc8/0x1ac kernel/sched/wait.c:410
 gfs2_quotad+0x390/0x500 fs/gfs2/quota.c:1579
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: 979340f1 f94002a8 8b1c0115 d343fea8 (38786908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	979340f1 	bl	0xfffffffffe4d03c4
   4:	f94002a8 	ldr	x8, [x21]
   8:	8b1c0115 	add	x21, x8, x28
   c:	d343fea8 	lsr	x8, x21, #3
* 10:	38786908 	ldrb	w8, [x8, x24] <-- trapping instruction