loop0: detected capacity change from 0 to 8192
ntfs3: loop0: Different NTFS sector size (4096) and media sector size (512).
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 4091 Comm: syz.0.15 Not tainted 6.9.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x3e/0xe0 lib/dump_stack.c:114
assign_lock_key+0x12f/0x140 kernel/locking/lockdep.c:976
register_lock_class+0xaa/0x280 kernel/locking/lockdep.c:1289
__lock_acquire+0x4d/0x4c0 kernel/locking/lockdep.c:5014
lock_acquire+0xd9/0x1f0 kernel/locking/lockdep.c:5754
down_write_nested+0x2c/0x90 kernel/locking/rwsem.c:1695
mark_as_free_ex+0x37/0x190 fs/ntfs3/fsntfs.c:2484
run_unpack+0x511/0x5a0 fs/ntfs3/run.c:1019
run_unpack_ex+0x49/0x2d0 fs/ntfs3/run.c:1060
ni_delete_all+0x7c/0x210 fs/ntfs3/frecord.c:1608
ni_clear+0x142/0x190 fs/ntfs3/frecord.c:106
evict+0xd3/0x2a0 fs/inode.c:667
ntfs_loadlog_and_replay+0xf5/0x190 fs/ntfs3/fsntfs.c:326
ntfs_fill_super+0xc85/0x15d0 fs/ntfs3/super.c:1278
get_tree_bdev+0x134/0x1b0 fs/super.c:1614
vfs_get_tree+0x26/0xb0 fs/super.c:1779
do_new_mount+0x15a/0x3a0 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x14b/0x1c0 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x8f/0x1a0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f05b9d7b65a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f05b97fee68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f05b97feef0 RCX: 00007f05b9d7b65a
RDX: 0000000020020b80 RSI: 0000000020020bc0 RDI: 00007f05b97feeb0
RBP: 0000000020020b80 R08: 00007f05b97feef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020020bc0
R13: 00007f05b97feeb0 R14: 0000000000020b89 R15: 0000000020020c00
BUG: kernel NULL pointer dereference, address: 0000000000000014
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 10faee067 P4D 10faee067 PUD 11081b067 PMD 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 4091 Comm: syz.0.15 Not tainted 6.9.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:wnd_is_used+0x26/0x230 fs/ntfs3/bitmap.c:928
Code: 90 90 90 90 66 0f 1f 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fc 65 48 8b 04 25 28 00 00 00 48 89 44 24 30 48 8b 07 <0f> b6 48 14 80 c1 03 48 89 f3 48 d3 eb 48 89 d5 44 8b 48 18 48 8b
RSP: 0018:ffffc9000264fa08 EFLAGS: 00010292
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff88810b3ce1f8
RBP: 0000000000000002 R08: 0000000000000000 R09: ffffffff840d8d90
R10: ffffc9000264f6e8 R11: 0000000000000000 R12: ffff88810b3ce1f8
R13: ffff88810b3ce1f8 R14: 0000000000000000 R15: ffff88810b3ce000
FS: 00007f05b97ff6c0(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000014 CR3: 000000010c76c000 CR4: 0000000000350ef0
Call Trace:
mark_as_free_ex+0x47/0x190 fs/ntfs3/fsntfs.c:2485
run_unpack+0x511/0x5a0 fs/ntfs3/run.c:1019
run_unpack_ex+0x49/0x2d0 fs/ntfs3/run.c:1060
ni_delete_all+0x7c/0x210 fs/ntfs3/frecord.c:1608
ni_clear+0x142/0x190 fs/ntfs3/frecord.c:106
evict+0xd3/0x2a0 fs/inode.c:667
ntfs_loadlog_and_replay+0xf5/0x190 fs/ntfs3/fsntfs.c:326
ntfs_fill_super+0xc85/0x15d0 fs/ntfs3/super.c:1278
get_tree_bdev+0x134/0x1b0 fs/super.c:1614
vfs_get_tree+0x26/0xb0 fs/super.c:1779
do_new_mount+0x15a/0x3a0 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x14b/0x1c0 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x8f/0x1a0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f05b9d7b65a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f05b97fee68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f05b97feef0 RCX: 00007f05b9d7b65a
RDX: 0000000020020b80 RSI: 0000000020020bc0 RDI: 00007f05b97feeb0
RBP: 0000000020020b80 R08: 00007f05b97feef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020020bc0
R13: 00007f05b97feeb0 R14: 0000000000020b89 R15: 0000000020020c00
Modules linked in:
CR2: 0000000000000014
---[ end trace 0000000000000000 ]---
RIP: 0010:wnd_is_used+0x26/0x230 fs/ntfs3/bitmap.c:928
Code: 90 90 90 90 66 0f 1f 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fc 65 48 8b 04 25 28 00 00 00 48 89 44 24 30 48 8b 07 <0f> b6 48 14 80 c1 03 48 89 f3 48 d3 eb 48 89 d5 44 8b 48 18 48 8b
RSP: 0018:ffffc9000264fa08 EFLAGS: 00010292
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff88810b3ce1f8
RBP: 0000000000000002 R08: 0000000000000000 R09: ffffffff840d8d90
R10: ffffc9000264f6e8 R11: 0000000000000000 R12: ffff88810b3ce1f8
R13: ffff88810b3ce1f8 R14: 0000000000000000 R15: ffff88810b3ce000
FS: 00007f05b97ff6c0(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000014 CR3: 000000010c76c000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 66 0f 1f 00 nopw (%rax)
8: 55 push %rbp
9: 41 57 push %r15
b: 41 56 push %r14
d: 41 55 push %r13
f: 41 54 push %r12
11: 53 push %rbx
12: 48 83 ec 38 sub $0x38,%rsp
16: 49 89 fc mov %rdi,%r12
19: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax
20: 00 00
22: 48 89 44 24 30 mov %rax,0x30(%rsp)
27: 48 8b 07 mov (%rdi),%rax
* 2a: 0f b6 48 14 movzbl 0x14(%rax),%ecx <-- trapping instruction
2e: 80 c1 03 add $0x3,%cl
31: 48 89 f3 mov %rsi,%rbx
34: 48 d3 eb shr %cl,%rbx
37: 48 89 d5 mov %rdx,%rbp
3a: 44 8b 48 18 mov 0x18(%rax),%r9d
3e: 48 rex.W
3f: 8b .byte 0x8b