befs: (nullb0): cannot parse mount options BUG: spinlock recursion on CPU#1, syz.2.172/6109 ================================================================== lock: 0xffff8880b903ea40, .magic: dead4ead, .owner: syz.2.172/6109, .owner_cpu: 0 BUG: unable to handle page fault for address: ffffffff8c0d51e6 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation CPU: 1 UID: 0 PID: 6109 Comm: syz.2.172 Not tainted 6.11.0-rc4-next-20240821-syzkaller #0 PGD e73a067 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 P4D e73a067 PUD e73b063 Call Trace: PMD 800000000c0001a1 Oops: Oops: 0003 [#1] PREEMPT SMP KASAN PTI __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 CPU: 0 UID: 0 PID: 6109 Comm: syz.2.172 Not tainted 6.11.0-rc4-next-20240821-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:memcpy_orig+0x124/0x140 arch/x86/lib/memcpy_64.S:164 Code: 16 fc 89 0f 44 89 44 17 fc c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 83 ea 01 72 19 0f b6 0e 74 12 4c 0f b6 46 01 4c 0f b6 0c 16 <44> 88 47 01 44 88 0c 17 88 0f c3 cc cc cc cc 66 2e 0f 1f 84 00 00 debug_spin_lock_before kernel/locking/spinlock_debug.c:87 [inline] do_raw_spin_lock+0x227/0x370 kernel/locking/spinlock_debug.c:115 RSP: 0018:ffffc9000ccce7d8 EFLAGS: 00010002 RAX: ffffffff8c0d51e5 RBX: 0000000000000003 RCX: 000000000000002a RDX: 0000000000000002 RSI: ffffffff8c0b8a20 RDI: ffffffff8c0d51e5 RBP: ffffc9000ccce8d0 R08: 000000000000002a R09: 0000000000000020 R10: dffffc0000000000 R11: fffffbfff181aa3d R12: ffffffff8c0b8a23 raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:595 R13: dffffc0000000000 R14: ffffffff8c0d51e5 R15: ffffffff8c0b8a20 FS: 00007ff017b266c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 raw_spin_rq_lock kernel/sched/sched.h:1488 [inline] rq_lock kernel/sched/sched.h:1787 [inline] ttwu_queue kernel/sched/core.c:3938 [inline] try_to_wake_up+0x804/0x1480 kernel/sched/core.c:4266 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c0d51e6 CR3: 00000000589e4000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: wake_up_process kernel/sched/core.c:4398 [inline] wake_up_q+0xc8/0x120 kernel/sched/core.c:1056 futex_wake+0x523/0x5c0 kernel/futex/waitwake.c:199 do_futex+0x392/0x560 kernel/futex/syscalls.c:107 __do_sys_futex kernel/futex/syscalls.c:179 [inline] __se_sys_futex+0x3f9/0x480 kernel/futex/syscalls.c:160 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff016d79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff017b260e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 00007ff016f15f88 RCX: 00007ff016d79e79 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff016f15f8c RBP: 00007ff016f15f80 R08: 7fffffffffffffff R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff016f15f8c R13: 0000000000000000 R14: 00007ffde2beca60 R15: 00007ffde2becb48 Modules linked in: CR2: ffffffff8c0d51e6 ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy_orig+0x124/0x140 arch/x86/lib/memcpy_64.S:164 Code: 16 fc 89 0f 44 89 44 17 fc c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 83 ea 01 72 19 0f b6 0e 74 12 4c 0f b6 46 01 4c 0f b6 0c 16 <44> 88 47 01 44 88 0c 17 88 0f c3 cc cc cc cc 66 2e 0f 1f 84 00 00 RSP: 0018:ffffc9000ccce7d8 EFLAGS: 00010002 RAX: ffffffff8c0d51e5 RBX: 0000000000000003 RCX: 000000000000002a RDX: 0000000000000002 RSI: ffffffff8c0b8a20 RDI: ffffffff8c0d51e5 RBP: ffffc9000ccce8d0 R08: 000000000000002a R09: 0000000000000020 R10: dffffc0000000000 R11: fffffbfff181aa3d R12: ffffffff8c0b8a23 R13: dffffc0000000000 R14: ffffffff8c0d51e5 R15: ffffffff8c0b8a20 FS: 00007ff017b266c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c0d51e6 CR3: 00000000589e4000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: fc cld 1: 89 0f mov %ecx,(%rdi) 3: 44 89 44 17 fc mov %r8d,-0x4(%rdi,%rdx,1) 8: c3 ret 9: cc int3 a: cc int3 b: cc int3 c: cc int3 d: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 14: 00 15: 83 ea 01 sub $0x1,%edx 18: 72 19 jb 0x33 1a: 0f b6 0e movzbl (%rsi),%ecx 1d: 74 12 je 0x31 1f: 4c 0f b6 46 01 movzbq 0x1(%rsi),%r8 24: 4c 0f b6 0c 16 movzbq (%rsi,%rdx,1),%r9 * 29: 44 88 47 01 mov %r8b,0x1(%rdi) <-- trapping instruction 2d: 44 88 0c 17 mov %r9b,(%rdi,%rdx,1) 31: 88 0f mov %cl,(%rdi) 33: c3 ret 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: 66 data16 39: 2e cs 3a: 0f .byte 0xf 3b: 1f (bad) 3c: 84 00 test %al,(%rax)