BUG: Dentry ffff88811a0b3aa0{i=5,n=.incomplete} still in use (1) [unmount of tmpfs tmpfs] ------------[ cut here ]------------ WARNING: CPU: 1 PID: 380 at fs/dcache.c:1616 umount_check+0x18d/0x1d0 fs/dcache.c:1607 Modules linked in: CPU: 1 PID: 380 Comm: syz-executor.4 Not tainted 5.10.99-syzkaller-00837-gca562bf79c65 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:umount_check+0x18d/0x1d0 fs/dcache.c:1607 Code: 8b 0b 49 81 c6 f8 03 00 00 48 c7 c7 40 4e 2e 85 4c 89 e6 48 8b 55 d0 4c 89 e1 45 89 f8 31 c0 41 56 e8 de ab 9e ff 48 83 c4 08 <0f> 0b e9 f1 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c c9 fe ff RSP: 0018:ffffc90000c17c88 EFLAGS: 00010286 RAX: 000000000000005a RBX: ffffffff8660f860 RCX: 8423de7450931f00 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffc90000c17cb8 R08: ffffffff815454a8 R09: ffffed103ee2a5d8 R10: ffffed103ee2a5d8 R11: 0000000000000000 R12: ffff88811a0b3aa0 R13: dffffc0000000000 R14: ffff888116c813f8 R15: 0000000000000001 FS: 0000555556965400(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdf3f54ff8 CR3: 000000012aa8a000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_walk+0x309/0x540 fs/dcache.c:1326 do_one_tree fs/dcache.c:1623 [inline] shrink_dcache_for_umount+0x8e/0x1b0 fs/dcache.c:1639 generic_shutdown_super+0x66/0x2c0 fs/super.c:447 kill_anon_super fs/super.c:1108 [inline] kill_litter_super+0x75/0xa0 fs/super.c:1117 deactivate_locked_super+0xb0/0x100 fs/super.c:335 deactivate_super+0xa5/0xd0 fs/super.c:366 cleanup_mnt+0x45f/0x510 fs/namespace.c:1118 __cleanup_mnt+0x19/0x20 fs/namespace.c:1125 task_work_run+0x147/0x1b0 kernel/task_work.c:154 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0xc3/0xe0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x24/0x40 kernel/entry/common.c:266 do_syscall_64+0x3d/0x70 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f064d0354c7 Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf3f55268 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f064d0354c7 RDX: 00007ffdf3f55339 RSI: 000000000000000a RDI: 00007ffdf3f55330 RBP: 00007ffdf3f55330 R08: 00000000ffffffff R09: 00007ffdf3f55100 R10: 0000555556966bf3 R11: 0000000000000246 R12: 00007f064d08d1ea R13: 00007ffdf3f563f0 R14: 0000555556966b00 R15: 00007ffdf3f56430 ---[ end trace 71a33eea7d357b30 ]--- BUG: Dentry ffff8881534a9bb0{i=4,n=.index} still in use (1) [unmount of tmpfs tmpfs] ------------[ cut here ]------------ WARNING: CPU: 1 PID: 380 at fs/dcache.c:1616 umount_check+0x18d/0x1d0 fs/dcache.c:1607 Modules linked in: CPU: 1 PID: 380 Comm: syz-executor.4 Tainted: G W 5.10.99-syzkaller-00837-gca562bf79c65 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:umount_check+0x18d/0x1d0 fs/dcache.c:1607 Code: 8b 0b 49 81 c6 f8 03 00 00 48 c7 c7 40 4e 2e 85 4c 89 e6 48 8b 55 d0 4c 89 e1 45 89 f8 31 c0 41 56 e8 de ab 9e ff 48 83 c4 08 <0f> 0b e9 f1 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c c9 fe ff RSP: 0018:ffffc90000c17c88 EFLAGS: 00010286 RAX: 0000000000000055 RBX: ffffffff8660f860 RCX: 8423de7450931f00 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffc90000c17cb8 R08: ffffffff815454a8 R09: ffffed103ee2a5d8 R10: ffffed103ee2a5d8 R11: 0000000000000000 R12: ffff8881534a9bb0 R13: dffffc0000000000 R14: ffff888116c813f8 R15: 0000000000000001 FS: 0000555556965400(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdf3f54ff8 CR3: 000000012aa8a000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_walk+0x309/0x540 fs/dcache.c:1326 do_one_tree fs/dcache.c:1623 [inline] shrink_dcache_for_umount+0x8e/0x1b0 fs/dcache.c:1639 generic_shutdown_super+0x66/0x2c0 fs/super.c:447 kill_anon_super fs/super.c:1108 [inline] kill_litter_super+0x75/0xa0 fs/super.c:1117 deactivate_locked_super+0xb0/0x100 fs/super.c:335 deactivate_super+0xa5/0xd0 fs/super.c:366 cleanup_mnt+0x45f/0x510 fs/namespace.c:1118 __cleanup_mnt+0x19/0x20 fs/namespace.c:1125 task_work_run+0x147/0x1b0 kernel/task_work.c:154 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0xc3/0xe0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x24/0x40 kernel/entry/common.c:266 do_syscall_64+0x3d/0x70 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f064d0354c7 Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf3f55268 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f064d0354c7 RDX: 00007ffdf3f55339 RSI: 000000000000000a RDI: 00007ffdf3f55330 RBP: 00007ffdf3f55330 R08: 00000000ffffffff R09: 00007ffdf3f55100 R10: 0000555556966bf3 R11: 0000000000000246 R12: 00007f064d08d1ea R13: 00007ffdf3f563f0 R14: 0000555556966b00 R15: 00007ffdf3f56430 ---[ end trace 71a33eea7d357b31 ]--- VFS: Busy inodes after unmount of tmpfs. Self-destruct in 5 seconds. Have a nice day... VFS: Busy inodes after unmount of incremental-fs. Self-destruct in 5 seconds. Have a nice day... general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 1 PID: 380 Comm: syz-executor.4 Tainted: G W 5.10.99-syzkaller-00837-gca562bf79c65 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:shmem_free_inode mm/shmem.c:349 [inline] RIP: 0010:shmem_evict_inode+0x92c/0xa20 mm/shmem.c:1192 Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ec 0b 10 00 4c 8b 3b 49 8d 5f 30 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 c6 0b 10 00 48 8b 1b 31 ff 48 89 de RSP: 0018:ffffc90000c17a40 EFLAGS: 00010206 RAX: 0000000000000006 RBX: 0000000000000030 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000c17b70 R08: ffffffff8196e4d2 R09: 0000000000000003 R10: fffff52000182eb5 R11: 0000000000000004 R12: ffff88814eb85280 R13: ffff88814eb85260 R14: ffff88814eb85260 R15: 0000000000000000 FS: 0000555556965400(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020a80000 CR3: 000000012aa8a000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: evict+0x2a3/0x6c0 fs/inode.c:578 iput_final fs/inode.c:1656 [inline] iput+0x622/0x7e0 fs/inode.c:1682 dentry_unlink_inode+0x2df/0x3d0 fs/dcache.c:374 __dentry_kill+0x3db/0x5c0 fs/dcache.c:579 dentry_kill fs/dcache.c:692 [inline] dput+0x303/0x600 fs/dcache.c:878 incfs_free_mount_info+0x5e/0x210 fs/incfs/data_mgmt.c:167 incfs_kill_sb+0x53/0x80 fs/incfs/vfs.c:1909 deactivate_locked_super+0xb0/0x100 fs/super.c:335 deactivate_super+0xa5/0xd0 fs/super.c:366 cleanup_mnt+0x45f/0x510 fs/namespace.c:1118 __cleanup_mnt+0x19/0x20 fs/namespace.c:1125 task_work_run+0x147/0x1b0 kernel/task_work.c:154 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0xc3/0xe0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x24/0x40 kernel/entry/common.c:266 do_syscall_64+0x3d/0x70 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f064d0354c7 Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf3f55268 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f064d0354c7 RDX: 00007ffdf3f55339 RSI: 000000000000000a RDI: 00007ffdf3f55330 RBP: 00007ffdf3f55330 R08: 00000000ffffffff R09: 00007ffdf3f55100 R10: 0000555556966bf3 R11: 0000000000000246 R12: 00007f064d08d1ea R13: 00007ffdf3f563f0 R14: 0000555556966b00 R15: 00007ffdf3f56430 Modules linked in: ---[ end trace 71a33eea7d357b32 ]--- RIP: 0010:shmem_free_inode mm/shmem.c:349 [inline] RIP: 0010:shmem_evict_inode+0x92c/0xa20 mm/shmem.c:1192 Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ec 0b 10 00 4c 8b 3b 49 8d 5f 30 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 c6 0b 10 00 48 8b 1b 31 ff 48 89 de RSP: 0018:ffffc90000c17a40 EFLAGS: 00010206 RAX: 0000000000000006 RBX: 0000000000000030 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000c17b70 R08: ffffffff8196e4d2 R09: 0000000000000003 R10: fffff52000182eb5 R11: 0000000000000004 R12: ffff88814eb85280 R13: ffff88814eb85260 R14: ffff88814eb85260 R15: 0000000000000000 FS: 0000555556965400(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555567d2b38 CR3: 000000012aa8a000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 3 bytes skipped: 0: df 80 3c 08 00 74 filds 0x7400083c(%rax) 6: 08 48 89 or %cl,-0x77(%rax) 9: df e8 fucomip %st(0),%st b: ec in (%dx),%al c: 0b 10 or (%rax),%edx e: 00 4c 8b 3b add %cl,0x3b(%rbx,%rcx,4) 12: 49 8d 5f 30 lea 0x30(%r15),%rbx 16: 48 89 d8 mov %rbx,%rax 19: 48 c1 e8 03 shr $0x3,%rax 1d: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 24: fc ff df * 27: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2b: 74 08 je 0x35 2d: 48 89 df mov %rbx,%rdi 30: e8 c6 0b 10 00 callq 0x100bfb 35: 48 8b 1b mov (%rbx),%rbx 38: 31 ff xor %edi,%edi 3a: 48 89 de mov %rbx,%rsi