BUG: spinlock bad magic on CPU#0, syz-executor301/4020 lock: 0xffff0000dd6a4aa8, .magic: ffff8000, .owner: €RjÝ/0, .owner_cpu: 512 CPU: 0 PID: 4020 Comm: syz-executor301 Not tainted 5.15.178-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 spin_dump kernel/locking/spinlock_debug.c:69 [inline] spin_bug+0x124/0x240 kernel/locking/spinlock_debug.c:77 debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline] do_raw_spin_lock+0x200/0x35c kernel/locking/spinlock_debug.c:114 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x918 fs/jfs/jfs_metapage.c:737 xtTruncate+0xc90/0x2b10 jfs_free_zero_link+0x374/0x598 fs/jfs/namei.c:758 jfs_evict_inode+0x308/0x408 fs/jfs/inode.c:153 evict+0x418/0x894 fs/inode.c:622 iput_final fs/inode.c:1744 [inline] iput+0x744/0x824 fs/inode.c:1770 dentry_unlink_inode+0x37c/0x4bc fs/dcache.c:380 __dentry_kill+0x324/0x5e4 fs/dcache.c:586 shrink_dentry_list+0x41c/0x850 fs/dcache.c:1181 shrink_dcache_parent+0xbc/0x434 do_one_tree+0x30/0xfc fs/dcache.c:1662 shrink_dcache_for_umount+0x80/0x12c fs/dcache.c:1679 generic_shutdown_super+0x68/0x2f0 fs/super.c:447 kill_block_super+0x70/0xdc fs/super.c:1427 deactivate_locked_super+0xb8/0x13c fs/super.c:335 deactivate_super+0x108/0x128 fs/super.c:366 cleanup_mnt+0x3c0/0x474 fs/namespace.c:1143 __cleanup_mnt+0x20/0x30 fs/namespace.c:1150 task_work_run+0x130/0x1e4 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 ================================================================================ UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:130:9 index 1150 is out of range for type 'unsigned long[8]' CPU: 0 PID: 4020 Comm: syz-executor301 Not tainted 5.15.178-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0x108/0x15c lib/ubsan.c:282 decode_tail kernel/locking/qspinlock.c:130 [inline] queued_spin_lock_slowpath+0x854/0x938 kernel/locking/qspinlock.c:468 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x918 fs/jfs/jfs_metapage.c:737 xtTruncate+0xc90/0x2b10 jfs_free_zero_link+0x374/0x598 fs/jfs/namei.c:758 jfs_evict_inode+0x308/0x408 fs/jfs/inode.c:153 evict+0x418/0x894 fs/inode.c:622 iput_final fs/inode.c:1744 [inline] iput+0x744/0x824 fs/inode.c:1770 dentry_unlink_inode+0x37c/0x4bc fs/dcache.c:380 __dentry_kill+0x324/0x5e4 fs/dcache.c:586 shrink_dentry_list+0x41c/0x850 fs/dcache.c:1181 shrink_dcache_parent+0xbc/0x434 do_one_tree+0x30/0xfc fs/dcache.c:1662 shrink_dcache_for_umount+0x80/0x12c fs/dcache.c:1679 generic_shutdown_super+0x68/0x2f0 fs/super.c:447 kill_block_super+0x70/0xdc fs/super.c:1427 deactivate_locked_super+0xb8/0x13c fs/super.c:335 deactivate_super+0x108/0x128 fs/super.c:366 cleanup_mnt+0x3c0/0x474 fs/namespace.c:1143 __cleanup_mnt+0x20/0x30 fs/namespace.c:1150 task_work_run+0x130/0x1e4 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 ================================================================================ ================================================================== BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x364/0x938 kernel/locking/qspinlock.c:471 Write of size 8 at addr ffff000027884e90 by task syz-executor301/4020 CPU: 0 PID: 4020 Comm: syz-executor301 Not tainted 5.15.178-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x174/0x1e4 mm/kasan/report.c:451 __asan_report_store8_noabort+0x44/0x50 mm/kasan/report_generic.c:314 queued_spin_lock_slowpath+0x364/0x938 kernel/locking/qspinlock.c:471 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xe8/0x1a0 kernel/sched/wait.c:157 unlock_metapage fs/jfs/jfs_metapage.c:37 [inline] release_metapage+0x17c/0x918 fs/jfs/jfs_metapage.c:737 xtTruncate+0xc90/0x2b10 jfs_free_zero_link+0x374/0x598 fs/jfs/namei.c:758 jfs_evict_inode+0x308/0x408 fs/jfs/inode.c:153 evict+0x418/0x894 fs/inode.c:622 iput_final fs/inode.c:1744 [inline] iput+0x744/0x824 fs/inode.c:1770 dentry_unlink_inode+0x37c/0x4bc fs/dcache.c:380 __dentry_kill+0x324/0x5e4 fs/dcache.c:586 shrink_dentry_list+0x41c/0x850 fs/dcache.c:1181 shrink_dcache_parent+0xbc/0x434 do_one_tree+0x30/0xfc fs/dcache.c:1662 shrink_dcache_for_umount+0x80/0x12c fs/dcache.c:1679 generic_shutdown_super+0x68/0x2f0 fs/super.c:447 kill_block_super+0x70/0xdc fs/super.c:1427 deactivate_locked_super+0xb8/0x13c fs/super.c:335 deactivate_super+0x108/0x128 fs/super.c:366 cleanup_mnt+0x3c0/0x474 fs/namespace.c:1143 __cleanup_mnt+0x20/0x30 fs/namespace.c:1150 task_work_run+0x130/0x1e4 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 The buggy address belongs to the page: page:0000000029149eeb refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x67884 flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff) raw: 01ffc00000000000 fffffc00009e2108 fffffc00009e2108 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000027884d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000027884e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff000027884e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff000027884f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000027884f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================