handle_mm_fault+0x36d/0xa20 mm/memory.c:6718 do_user_addr_fault+0x74c/0x12f0 arch/x86/mm/fault.c:1385 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 ------------[ cut here ]------------ kernel BUG at mm/filemap.c:859! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 8223 Comm: syz.6.664 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__filemap_add_folio+0xf81/0x1350 mm/filemap.c:859 Code: b5 9e c3 ff 48 8d 3d 7e e8 96 0e 67 48 0f b9 3a e9 07 fd ff ff e8 9f 9e c3 ff 48 c7 c6 60 56 bd 8b 4c 89 ef e8 90 bb 12 00 90 <0f> 0b 4c 8b 6c 24 60 e8 83 9e c3 ff 48 c7 84 24 a0 00 00 00 03 00 RSP: 0018:ffffc900229e7610 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802b582500 RSI: ffffffff8257c468 RDI: ffff88802b5829c4 RBP: 0000000000112cc0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000002 R13: ffffea0000b404c0 R14: 0000000000000000 R15: 1ffff9200453ceed FS: 00007f9052ecb6c0(0000) GS:ffff8880d6372000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 0000000037647000 CR4: 0000000000352ef0 Call Trace: filemap_add_folio+0x1d8/0x690 mm/filemap.c:967 ra_alloc_folio mm/readahead.c:456 [inline] page_cache_ra_order+0x614/0xf10 mm/readahead.c:515 do_sync_mmap_readahead mm/filemap.c:3406 [inline] filemap_fault+0x1900/0x2e90 mm/filemap.c:3555 __do_fault+0x10b/0x440 mm/memory.c:5458 do_read_fault mm/memory.c:5893 [inline] do_fault+0xa99/0x1750 mm/memory.c:6027 do_pte_missing mm/memory.c:4550 [inline] handle_pte_fault mm/memory.c:6411 [inline] __handle_mm_fault+0x187d/0x2a00 mm/memory.c:6549 handle_mm_fault+0x36d/0xa20 mm/memory.c:6718 do_user_addr_fault+0x74c/0x12f0 arch/x86/mm/fault.c:1385 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0010:do_strnlen_user lib/strnlen_user.c:37 [inline] RIP: 0010:strnlen_user+0x55/0x190 lib/strnlen_user.c:103 Code: fc 4d 85 ff 0f 8e 49 01 00 00 e8 56 54 da fc 48 b8 00 f0 ff ff ff 7f 00 00 48 39 c3 48 0f 47 d8 0f 01 cb 49 89 dd 49 83 e5 f8 <4d> 8b 75 00 e8 32 54 da fc 48 8b 4c 24 10 83 e3 07 b8 01 00 00 00 RSP: 0018:ffffc900229e7de8 EFLAGS: 00050206 RAX: 00007ffffffff000 RBX: 00002000000000c0 RCX: ffffffff852e527c RDX: ffff88802b582500 RSI: ffffffff852e528a RDI: ffff88802b582500 RBP: 0000000000001000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000001000 R11: 0000000000000000 R12: fffffffffffffff2 R13: 00002000000000c0 R14: 1ffff9200453cfce R15: 0000000000001000 strndup_user+0x27/0xe0 mm/util.c:272 copy_mount_string fs/namespace.c:4062 [inline] __do_sys_mount fs/namespace.c:4368 [inline] __se_sys_mount fs/namespace.c:4360 [inline] __x64_sys_mount+0x136/0x310 fs/namespace.c:4360 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9051f9cdd9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9052ecb028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f9052216090 RCX: 00007f9051f9cdd9 RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00002000000001c0 RBP: 00007f9052032d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004418 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9052216128 R14: 00007f9052216090 R15: 00007ffcd6293278 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__filemap_add_folio+0xf81/0x1350 mm/filemap.c:859 Code: b5 9e c3 ff 48 8d 3d 7e e8 96 0e 67 48 0f b9 3a e9 07 fd ff ff e8 9f 9e c3 ff 48 c7 c6 60 56 bd 8b 4c 89 ef e8 90 bb 12 00 90 <0f> 0b 4c 8b 6c 24 60 e8 83 9e c3 ff 48 c7 84 24 a0 00 00 00 03 00 RSP: 0018:ffffc900229e7610 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802b582500 RSI: ffffffff8257c468 RDI: ffff88802b5829c4 RBP: 0000000000112cc0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000002 R13: ffffea0000b404c0 R14: 0000000000000000 R15: 1ffff9200453ceed FS: 00007f9052ecb6c0(0000) GS:ffff8880d6572000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff11cf1bff8 CR3: 0000000037647000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: fc cld 1: 4d 85 ff test %r15,%r15 4: 0f 8e 49 01 00 00 jle 0x153 a: e8 56 54 da fc call 0xfcda5465 f: 48 b8 00 f0 ff ff ff movabs $0x7ffffffff000,%rax 16: 7f 00 00 19: 48 39 c3 cmp %rax,%rbx 1c: 48 0f 47 d8 cmova %rax,%rbx 20: 0f 01 cb stac 23: 49 89 dd mov %rbx,%r13 26: 49 83 e5 f8 and $0xfffffffffffffff8,%r13 * 2a: 4d 8b 75 00 mov 0x0(%r13),%r14 <-- trapping instruction 2e: e8 32 54 da fc call 0xfcda5465 33: 48 8b 4c 24 10 mov 0x10(%rsp),%rcx 38: 83 e3 07 and $0x7,%ebx 3b: b8 01 00 00 00 mov $0x1,%eax