loop2: detected capacity change from 0 to 256 exfat: Bad value for 'dmask' loop2: detected capacity change from 0 to 64 ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 1 PID: 9721 at kernel/locking/mutex.c:582 __mutex_lock_common+0x142c/0x1f38 kernel/locking/mutex.c:582 Modules linked in: CPU: 1 PID: 9721 Comm: syz.2.1839 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock_common+0x142c/0x1f38 kernel/locking/mutex.c:582 lr : __mutex_lock_common+0x142c/0x1f38 kernel/locking/mutex.c:582 sp : ffff8000209a7400 x29: ffff8000209a7550 x28: dfff800000000000 x27: ffff700004134e94 x26: 0000000000000000 x25: ffff800008cea660 x24: 0000000000000000 x23: 0000000000000000 x22: 0000000000000000 x21: ffff8000209a74c0 x20: 0000000000000000 x19: ffff0000cae55028 x18: 0000000000000000 x17: 0000000000000000 x16: ffff800008042d90 x15: 0000000000000002 x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000080000 x11: 0000000000003416 x10: ffff800029f8e000 x9 : efe27ad39847e700 x8 : efe27ad39847e700 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000209a6e98 x4 : ffff8000151a4920 x3 : ffff80000852e428 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: __mutex_lock_common+0x142c/0x1f38 kernel/locking/mutex.c:582 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 reiserfs_lookup+0x11c/0x378 fs/reiserfs/namei.c:364 __lookup_slow+0x24c/0x370 fs/namei.c:1698 lookup_slow+0x5c/0x80 fs/namei.c:1715 walk_component+0x270/0x364 fs/namei.c:2006 lookup_last fs/namei.c:2463 [inline] path_lookupat+0x13c/0x3d0 fs/namei.c:2487 filename_lookup+0x190/0x42c fs/namei.c:2516 user_path_at_empty+0x5c/0x84 fs/namei.c:2913 user_path_at include/linux/namei.h:57 [inline] path_setxattr+0xb8/0x25c fs/xattr.c:631 __do_sys_setxattr fs/xattr.c:652 [inline] __se_sys_setxattr fs/xattr.c:648 [inline] __arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 20343 hardirqs last enabled at (20343): [] seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline] hardirqs last enabled at (20343): [] read_seqbegin+0xe8/0x178 include/linux/seqlock.h:893 hardirqs last disabled at (20342): [] seqcount_lockdep_reader_access include/linux/seqlock.h:101 [inline] hardirqs last disabled at (20342): [] read_seqbegin+0x70/0x178 include/linux/seqlock.h:893 softirqs last enabled at (20314): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (20312): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- ================================================================================ UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9 index 13197 is out of range for type 'unsigned long[8]' CPU: 1 PID: 9721 Comm: syz.2.1839 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151 __ubsan_handle_out_of_bounds+0xd0/0xfc lib/ubsan.c:282 decode_tail kernel/locking/qspinlock.c:131 [inline] queued_spin_lock_slowpath+0xab0/0xc08 kernel/locking/qspinlock.c:471 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x2e8/0x2ec kernel/locking/spinlock_debug.c:115 __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline] _raw_spin_lock+0x5c/0x6c kernel/locking/spinlock.c:154 __mutex_lock_common+0x378/0x1f38 kernel/locking/mutex.c:617 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 reiserfs_lookup+0x11c/0x378 fs/reiserfs/namei.c:364 __lookup_slow+0x24c/0x370 fs/namei.c:1698 lookup_slow+0x5c/0x80 fs/namei.c:1715 walk_component+0x270/0x364 fs/namei.c:2006 lookup_last fs/namei.c:2463 [inline] path_lookupat+0x13c/0x3d0 fs/namei.c:2487 filename_lookup+0x190/0x42c fs/namei.c:2516 user_path_at_empty+0x5c/0x84 fs/namei.c:2913 user_path_at include/linux/namei.h:57 [inline] path_setxattr+0xb8/0x25c fs/xattr.c:631 __do_sys_setxattr fs/xattr.c:652 [inline] __se_sys_setxattr fs/xattr.c:648 [inline] __arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 ================================================================================ ================================================================== BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x90c/0xc08 kernel/locking/qspinlock.c:474 Write of size 8 at addr ffff000025921aec by task syz.2.1839/9721 CPU: 1 PID: 9721 Comm: syz.2.1839 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report+0xa8/0x100 mm/kasan/report.c:524 __asan_report_store8_noabort+0x2c/0x38 mm/kasan/report_generic.c:356 queued_spin_lock_slowpath+0x90c/0xc08 kernel/locking/qspinlock.c:474 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x2e8/0x2ec kernel/locking/spinlock_debug.c:115 __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline] _raw_spin_lock+0x5c/0x6c kernel/locking/spinlock.c:154 __mutex_lock_common+0x378/0x1f38 kernel/locking/mutex.c:617 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 reiserfs_lookup+0x11c/0x378 fs/reiserfs/namei.c:364 __lookup_slow+0x24c/0x370 fs/namei.c:1698 lookup_slow+0x5c/0x80 fs/namei.c:1715 walk_component+0x270/0x364 fs/namei.c:2006 lookup_last fs/namei.c:2463 [inline] path_lookupat+0x13c/0x3d0 fs/namei.c:2487 filename_lookup+0x190/0x42c fs/namei.c:2516 user_path_at_empty+0x5c/0x84 fs/namei.c:2913 user_path_at include/linux/namei.h:57 [inline] path_setxattr+0xb8/0x25c fs/xattr.c:631 __do_sys_setxattr fs/xattr.c:652 [inline] __se_sys_setxattr fs/xattr.c:648 [inline] __arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the physical page: page:000000007fb53418 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x65921 flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff) raw: 01ffc00000000000 fffffc0000964848 fffffc0000964848 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000025921980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000025921a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff000025921a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff000025921b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000025921b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================