------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 1 PID: 7539 at kernel/locking/mutex.c:575 __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575 Modules linked in: CPU: 1 PID: 7539 Comm: syz.5.657 Not tainted 5.15.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575 lr : __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575 sp : ffff8000208572c0 x29: ffff800020857450 x28: dfff800000000000 x27: 1ffff000036fd1a4 x26: ffff80001b7e8000 x25: ffff70000410ae74 x24: 0000000000000000 x23: 0000000000000000 x22: ffff800008d150d0 x21: 0000000000000000 x20: 0000000000000000 x19: ffff0000d1b36028 x18: 0000000000000001 x17: 0000000000000002 x16: ffff800011b4efd4 x15: 00000000ffffffff x14: ffff0000d0f61b40 x13: 0000000000000001 x12: 0000000000080000 x11: 0000000000005d7f x10: ffff80002a374000 x9 : 1636ea4d08c67c00 x8 : 1636ea4d08c67c00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800020856a38 x4 : ffff800014c50660 x3 : ffff8000085568c0 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000028 Call trace: __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 reiserfs_lookup+0x130/0x3c4 fs/reiserfs/namei.c:364 lookup_open fs/namei.c:3440 [inline] open_last_lookups fs/namei.c:3532 [inline] path_openat+0xd9c/0x26cc fs/namei.c:3739 do_filp_open+0x1a8/0x3b4 fs/namei.c:3769 do_sys_openat2+0x128/0x3e0 fs/open.c:1253 do_sys_open fs/open.c:1269 [inline] __do_sys_openat fs/open.c:1285 [inline] __se_sys_openat fs/open.c:1280 [inline] __arm64_sys_openat+0x1f0/0x240 fs/open.c:1280 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 110371 hardirqs last enabled at (110371): [] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231 hardirqs last disabled at (110370): [] kasan_quarantine_put+0x9c/0x204 mm/kasan/quarantine.c:204 softirqs last enabled at (110344): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (110344): [] handle_softirqs+0xb88/0xdbc kernel/softirq.c:586 softirqs last disabled at (110303): [] __do_softirq kernel/softirq.c:592 [inline] softirqs last disabled at (110303): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (110303): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (110303): [] __irq_exit_rcu+0x268/0x4d8 kernel/softirq.c:641 ---[ end trace 99760d12d5c574e9 ]--- Unable to handle kernel NULL pointer dereference at virtual address 0000000000000005 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000130e17000 [0000000000000005] pgd=080000012eafe003, p4d=080000012eafe003, pud=080000011719f003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 7539 Comm: syz.5.657 Tainted: G W 5.15.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mutex_can_spin_on_owner kernel/locking/mutex.c:401 [inline] pc : mutex_optimistic_spin+0x11c/0x2bc kernel/locking/mutex.c:445 lr : instrument_atomic_read include/linux/instrumented.h:71 [inline] lr : atomic_long_read include/linux/atomic/atomic-instrumented.h:1183 [inline] lr : __mutex_owner kernel/locking/mutex.c:78 [inline] lr : mutex_can_spin_on_owner kernel/locking/mutex.c:394 [inline] lr : mutex_optimistic_spin+0xf4/0x2bc kernel/locking/mutex.c:445 sp : ffff800020857280 x29: ffff800020857280 x28: dfff800000000000 x27: 1ffff000036fd1a4 x26: ffff80001b7e8000 x25: ffff70000410ae74 x24: 0000000000000000 x23: dfff800000000000 x22: 000400000000002c x21: 0000000000000000 x20: 0000000000000000 x19: ffff0000d1b36028 x18: 0000000000000001 x17: 0000000000000002 x16: ffff800011b4e648 x15: 00000000ffffffff x14: ffff0000d0f61b40 x13: 0000000000000001 x12: 0000000000000001 x11: 1fffe0001a366c05 x10: 0000000000000000 x9 : 0000800000000005 x8 : 0004000000000000 x7 : 0000000000000001 x6 : ffff8000082e1a68 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000082e11ec x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000001 Call trace: mutex_can_spin_on_owner kernel/locking/mutex.c:401 [inline] mutex_optimistic_spin+0x11c/0x2bc kernel/locking/mutex.c:445 __mutex_lock_common+0x1b4/0x2154 kernel/locking/mutex.c:599 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 reiserfs_lookup+0x130/0x3c4 fs/reiserfs/namei.c:364 lookup_open fs/namei.c:3440 [inline] open_last_lookups fs/namei.c:3532 [inline] path_openat+0xd9c/0x26cc fs/namei.c:3739 do_filp_open+0x1a8/0x3b4 fs/namei.c:3769 do_sys_openat2+0x128/0x3e0 fs/open.c:1253 do_sys_open fs/open.c:1269 [inline] __do_sys_openat fs/open.c:1285 [inline] __se_sys_openat fs/open.c:1280 [inline] __arm64_sys_openat+0x1f0/0x240 fs/open.c:1280 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: f27df108 54000320 9100b116 d343fec9 (38f76929) ---[ end trace 99760d12d5c574ea ]--- ---------------- Code disassembly (best guess): 0: f27df108 ands x8, x8, #0xfffffffffffffff8 4: 54000320 b.eq 0x68 // b.none 8: 9100b116 add x22, x8, #0x2c c: d343fec9 lsr x9, x22, #3 * 10: 38f76929 ldrsb w9, [x9, x23] <-- trapping instruction