------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 1 PID: 7256 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4772 [inline] WARNING: CPU: 1 PID: 7256 at kernel/locking/lockdep.c:231 __lock_acquire+0x78c/0x779c kernel/locking/lockdep.c:5092 Modules linked in: CPU: 1 UID: 0 PID: 7256 Comm: syz.1.266 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_wait_context kernel/locking/lockdep.c:4772 [inline] pc : __lock_acquire+0x78c/0x779c kernel/locking/lockdep.c:5092 lr : hlock_class kernel/locking/lockdep.c:231 [inline] lr : check_wait_context kernel/locking/lockdep.c:4772 [inline] lr : __lock_acquire+0x780/0x779c kernel/locking/lockdep.c:5092 sp : ffff8000a2337340 x29: ffff8000a2337600 x28: ffff0000ca688000 x27: ffff0000ca688af0 x26: 1fffe000194d115e x25: ffff800092d35580 x24: 0000000000000001 x23: ffff0000ca688a78 x22: ffff0000ca688ad0 x21: ffff0000ca688af4 x20: 0000000000001bf0 x19: ffff800092d358f8 x18: 0000000000000008 x17: 0000000000000000 x16: ffff800083032784 x15: 0000000000000001 x14: 1fffe000366d7a5a x13: dfff800000000000 x12: 0000000000000000 x11: 0000000000040000 x10: 0000000000002345 x9 : 1d714c3adea6d100 x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a2336a98 x4 : ffff80008f65b620 x3 : ffff8000806051a0 x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000000 Call trace: check_wait_context kernel/locking/lockdep.c:4772 [inline] __lock_acquire+0x78c/0x779c kernel/locking/lockdep.c:5092 lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 local_lock_acquire+0x3c/0x98 include/linux/local_lock_internal.h:29 ___slab_alloc+0xcbc/0xf38 mm/slub.c:3776 __slab_alloc+0x74/0xd0 mm/slub.c:3817 __slab_alloc_node mm/slub.c:3870 [inline] slab_alloc_node mm/slub.c:4029 [inline] kmem_cache_alloc_noprof+0x26c/0x350 mm/slub.c:4048 f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2835 [inline] xattr_alloc fs/f2fs/xattr.c:30 [inline] lookup_all_xattrs fs/f2fs/xattr.c:333 [inline] f2fs_getxattr+0x3b4/0x111c fs/f2fs/xattr.c:533 f2fs_xattr_generic_get+0x130/0x174 fs/f2fs/xattr.c:63 __vfs_getxattr+0x394/0x3c0 fs/xattr.c:423 cap_inode_need_killpriv+0x50/0x78 security/commoncap.c:302 security_inode_need_killpriv+0x6c/0xa4 security/security.c:2530 dentry_needs_remove_privs+0x94/0x108 fs/inode.c:2112 do_truncate fs/open.c:57 [inline] do_ftruncate+0x364/0x4cc fs/open.c:181 do_sys_ftruncate fs/open.c:199 [inline] __do_sys_ftruncate fs/open.c:207 [inline] __se_sys_ftruncate fs/open.c:205 [inline] __arm64_sys_ftruncate+0x94/0xec fs/open.c:205 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 irq event stamp: 78800 hardirqs last enabled at (78799): [] seqcount_lockdep_reader_access+0x6c/0xd4 include/linux/seqlock.h:74 hardirqs last disabled at (78800): [] ___slab_alloc+0xc90/0xf38 mm/slub.c:3776 softirqs last enabled at (78794): [] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (78794): [] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582 softirqs last disabled at (78513): [] __do_softirq+0x14/0x20 kernel/softirq.c:588 ---[ end trace 0000000000000000 ]--- Unable to handle kernel paging request at virtual address dfff800000000018 KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000018] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 UID: 0 PID: 7256 Comm: syz.1.266 Tainted: G W 6.11.0-rc7-syzkaller-g5f5673607153 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_wait_context kernel/locking/lockdep.c:4772 [inline] pc : __lock_acquire+0x574/0x779c kernel/locking/lockdep.c:5092 lr : hlock_class kernel/locking/lockdep.c:231 [inline] lr : check_wait_context kernel/locking/lockdep.c:4772 [inline] lr : __lock_acquire+0x780/0x779c kernel/locking/lockdep.c:5092 sp : ffff8000a2337340 x29: ffff8000a2337600 x28: ffff0000ca688000 x27: ffff0000ca688af0 x26: 1fffe000194d115e x25: ffff800092d35580 x24: 0000000000000001 x23: ffff0000ca688a78 x22: ffff0000ca688ad0 x21: 00000000000000c4 x20: 0000000000001bf0 x19: ffff800092d358f8 x18: 0000000000000008 x17: 0000000000000000 x16: ffff800083032784 x15: 0000000000000001 x14: 1fffe000366d7a5a x13: dfff800000000000 x12: 0000000000000000 x11: 0000000000040000 x10: 0000000000002345 x9 : 1d714c3adea6d100 x8 : 0000000000000018 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a2336a98 x4 : ffff80008f65b620 x3 : ffff8000806051a0 x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000000 Call trace: check_wait_context kernel/locking/lockdep.c:4772 [inline] __lock_acquire+0x574/0x779c kernel/locking/lockdep.c:5092 lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 local_lock_acquire+0x3c/0x98 include/linux/local_lock_internal.h:29 ___slab_alloc+0xcbc/0xf38 mm/slub.c:3776 __slab_alloc+0x74/0xd0 mm/slub.c:3817 __slab_alloc_node mm/slub.c:3870 [inline] slab_alloc_node mm/slub.c:4029 [inline] kmem_cache_alloc_noprof+0x26c/0x350 mm/slub.c:4048 f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2835 [inline] xattr_alloc fs/f2fs/xattr.c:30 [inline] lookup_all_xattrs fs/f2fs/xattr.c:333 [inline] f2fs_getxattr+0x3b4/0x111c fs/f2fs/xattr.c:533 f2fs_xattr_generic_get+0x130/0x174 fs/f2fs/xattr.c:63 __vfs_getxattr+0x394/0x3c0 fs/xattr.c:423 cap_inode_need_killpriv+0x50/0x78 security/commoncap.c:302 security_inode_need_killpriv+0x6c/0xa4 security/security.c:2530 dentry_needs_remove_privs+0x94/0x108 fs/inode.c:2112 do_truncate fs/open.c:57 [inline] do_ftruncate+0x364/0x4cc fs/open.c:181 do_sys_ftruncate fs/open.c:199 [inline] __do_sys_ftruncate fs/open.c:207 [inline] __se_sys_ftruncate fs/open.c:205 [inline] __arm64_sys_ftruncate+0x94/0xec fs/open.c:205 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 34000e88 aa1f03e8 91031115 d343fea8 (38ed6908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 34000e88 cbz w8, 0x1d0 4: aa1f03e8 mov x8, xzr 8: 91031115 add x21, x8, #0xc4 c: d343fea8 lsr x8, x21, #3 * 10: 38ed6908 ldrsb w8, [x8, x13] <-- trapping instruction