command_status=-1
floppy1: floppy_interrupt: timeout handler died. normal interrupt end
------------[ cut here ]------------
WARNING: CPU: 3 PID: 5176 at drivers/block/floppy.c:999 schedule_bh drivers/block/floppy.c:999 [inline]
WARNING: CPU: 3 PID: 5176 at drivers/block/floppy.c:999 floppy_interrupt+0x415/0x480 drivers/block/floppy.c:1765
Modules linked in:
CPU: 3 PID: 5176 Comm: syz-executor.2 Not tainted 6.6.0-rc3-syzkaller-00214-ge402b08634b3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:schedule_bh drivers/block/floppy.c:999 [inline]
RIP: 0010:floppy_interrupt+0x415/0x480 drivers/block/floppy.c:1765
Code: ff 89 de e8 5d 9a 49 fc 85 db 0f 85 75 ff ff ff 41 be 01 00 00 00 e9 64 fd ff ff e8 15 55 9f fc e9 1d fd ff ff e8 cb 9e 49 fc <0f> 0b e9 2d fe ff ff 48 c7 c7 00 f2 80 8c e8 b8 54 9f fc e9 11 fc
RSP: 0018:ffffc900005d0cc8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff88801a862400 RSI: ffffffff853e27f5 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff853dc040
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802c900000(0063) knlGS:000000005833c400
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000058344f4c CR3: 000000005c037000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
floppy_hardint+0x1aa/0x200 arch/x86/include/asm/floppy.h:66
__handle_irq_event_percpu+0x22a/0x740 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x261/0xcf0 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq arch/x86/kernel/irq.c:238 [inline]
__common_interrupt+0xdb/0x240 arch/x86/kernel/irq.c:257
common_interrupt+0x51/0xd0 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636
RIP: 0010:__do_softirq+0x1dd/0x965 kernel/softirq.c:539
Code: 89 64 24 28 48 89 6c 24 10 48 c7 c7 00 52 8b 8a e8 18 34 fc ff 65 66 c7 05 ee 3f c1 75 00 00 e8 99 ff 4b f7 fb bb ff ff ff ff <49> c7 c4 c0 a0 80 8c 41 0f bc dd 83 c3 01 0f 85 a2 00 00 00 e9 6d
RSP: 0018:ffffc900005d0f30 EFLAGS: 00000206
RAX: 00000000028cda7e RBX: 00000000ffffffff RCX: 1ffffffff23469f6
RDX: 0000000000000000 RSI: ffffffff8a8caaa0 RDI: ffffffff8ae93160
RBP: ffff88801a862400 R08: 0000000000000001 R09: fffffbfff233e1e4
R10: ffffffff919f0f27 R11: 0000000000000800 R12: 1ffff920000ba1ee
R13: 0000000000000280 R14: 000000000000000a R15: 0000000000000001
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu kernel/softirq.c:632 [inline]
irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1074
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x70 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 26 2e 26 f7 48 89 df e8 1e ad 26 f7 f7 c5 00 02 00 00 75 1f 9c 58 f6 c4 02 75 2f 01 00 00 00 e8 35 15 18 f7 65 8b 05 26 68 c1 75 85 c0 74 12 5b
RSP: 0018:ffffc9000417f3a8 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffffff92539ee0 RCX: 1ffffffff23469f6
RDX: 0000000000000000 RSI: ffffffff8a8caaa0 RDI: ffffffff8ae93160
RBP: 0000000000000286 R08: 0000000000000001 R09: fffffbfff233e1e4
R10: ffffffff919f0f27 R11: 00000000d5ca0c4b R12: dffffc0000000000
R13: 000000000001f4d8 R14: 0000000000000000 R15: 0000000000000000
__debug_check_no_obj_freed lib/debugobjects.c:1042 [inline]
debug_check_no_obj_freed+0x245/0x4c0 lib/debugobjects.c:1063
slab_free_hook mm/slub.c:1775 [inline]
slab_free_freelist_hook+0x18c/0x1e0 mm/slub.c:1826
slab_free mm/slub.c:3809 [inline]
kmem_cache_free+0xf0/0x480 mm/slub.c:3831
ext4_mb_new_blocks+0x3c11/0x4af0 fs/ext4/mballoc.c:6240
ext4_ext_map_blocks+0x1b30/0x5b10 fs/ext4/extents.c:4285
ext4_map_blocks+0x619/0x1770 fs/ext4/inode.c:621
ext4_getblk+0x17f/0x810 fs/ext4/inode.c:819
ext4_bread+0x2c/0x190 fs/ext4/inode.c:875
ext4_append+0x26d/0x560 fs/ext4/namei.c:83
ext4_init_new_dir+0x220/0x4c0 fs/ext4/namei.c:2981
ext4_mkdir+0x316/0xb70 fs/ext4/namei.c:3027
vfs_mkdir+0x532/0x7e0 fs/namei.c:4120
do_mkdirat+0x2a9/0x330 fs/namei.c:4143
__do_sys_mkdirat fs/namei.c:4158 [inline]
__se_sys_mkdirat fs/namei.c:4156 [inline]
__ia32_sys_mkdirat+0x84/0xa0 fs/namei.c:4156
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x61/0xe0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f20579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ffd8bf28 EFLAGS: 00000282 ORIG_RAX: 0000000000000128
RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000ffd8bfd4
RDX: 00000000000001ff RSI: 00000000ffd8bfd4 RDI: 00000000f7353ff4
RBP: 0000000000000bb8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 89 64 24 28 mov %esp,0x28(%rsp)
4: 48 89 6c 24 10 mov %rbp,0x10(%rsp)
9: 48 c7 c7 00 52 8b 8a mov $0xffffffff8a8b5200,%rdi
10: e8 18 34 fc ff call 0xfffc342d
15: 65 66 c7 05 ee 3f c1 movw $0x0,%gs:0x75c13fee(%rip) # 0x75c1400d
1c: 75 00 00
1f: e8 99 ff 4b f7 call 0xf74bffbd
24: fb sti
25: bb ff ff ff ff mov $0xffffffff,%ebx
* 2a: 49 c7 c4 c0 a0 80 8c mov $0xffffffff8c80a0c0,%r12 <-- trapping instruction
31: 41 0f bc dd bsf %r13d,%ebx
35: 83 c3 01 add $0x1,%ebx
38: 0f 85 a2 00 00 00 jne 0xe0
3e: e9 .byte 0xe9
3f: 6d insl (%dx),%es:(%rdi)