=============================
[ BUG: Invalid wait context ]
6.14.0-rc2-syzkaller-ga64dcfb451e2 #0 Not tainted
-----------------------------
udevd/4728 is trying to lock:
ffff888045b989a0 (register_mutex#3){+.+.}-{4:4}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888045b989a0 (register_mutex#3){+.+.}-{4:4}, at: lockref_get+0x15/0x60 lib/lockref.c:50
other info that might help us debug this:
context-{5:5}
2 locks held by udevd/4728:
#0: ffff88803f12ab98 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:887 [inline]
#0: ffff88803f12ab98 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: lookup_slow+0x45/0x70 fs/namei.c:1809
#1: ffff88803f12b4d0 (&sb->s_type->i_lock_key#23){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#1: ffff88803f12b4d0 (&sb->s_type->i_lock_key#23){+.+.}-{3:3}, at: d_splice_alias+0x7e/0x330 fs/dcache.c:3018
stack backtrace:
CPU: 0 UID: 0 PID: 4728 Comm: udevd Not tainted 6.14.0-rc2-syzkaller-ga64dcfb451e2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4828 [inline]
check_wait_context kernel/locking/lockdep.c:4900 [inline]
__lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5178
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
__d_find_any_alias fs/dcache.c:970 [inline]
d_splice_alias+0xdf/0x330 fs/dcache.c:3020
ext4_lookup+0x26d/0x750 fs/ext4/namei.c:1840
__lookup_slow+0x296/0x400 fs/namei.c:1793
lookup_slow+0x53/0x70 fs/namei.c:1810
walk_component+0x2e1/0x410 fs/namei.c:2114
lookup_last fs/namei.c:2612 [inline]
path_lookupat+0x16f/0x450 fs/namei.c:2636
filename_lookup+0x2a3/0x670 fs/namei.c:2665
vfs_statx+0x115/0x4f0 fs/stat.c:346
vfs_fstatat+0xe5/0x130 fs/stat.c:368
__do_sys_newfstatat fs/stat.c:532 [inline]
__se_sys_newfstatat fs/stat.c:526 [inline]
__x64_sys_newfstatat+0x11d/0x1a0 fs/stat.c:526
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8f855165f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007ffd71553698 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 0000564428b206c8 RCX: 00007f8f855165f4
RDX: 00007ffd715536a8 RSI: 0000564428b10897 RDI: 00000000ffffff9c
RBP: 000056442fe2ad38 R08: 000623062c2a2780 R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 000623062c2a2780 R15: 0000564428b14dca
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000077: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000003b8-0x00000000000003bf]
CPU: 0 UID: 0 PID: 4728 Comm: udevd Not tainted 6.14.0-rc2-syzkaller-ga64dcfb451e2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
RIP: 0010:do_raw_spin_lock+0x7f/0x370 kernel/locking/spinlock_debug.c:115
Code: 48 8d 74 24 40 48 c1 ee 03 48 b8 f1 f1 f1 f1 04 f3 f3 f3 48 89 f1 48 89 74 24 38 48 89 04 16 48 8d 5f 04 48 89 d8 48 c1 e8 03 <0f> b6 04 10 84 c0 0f 85 f6 01 00 00 8b 03 3d ad 4e ad de 0f 85 62
RSP: 0018:ffffc900021bf580 EFLAGS: 00010207
RAX: 0000000000000077 RBX: 00000000000003bc RCX: 1ffff92000437eb8
RDX: dffffc0000000000 RSI: 1ffff92000437eb8 RDI: 00000000000003b8
RBP: ffffc900021bf648 R08: ffffffff901b5c77 R09: 1ffffffff2036b8e
R10: dffffc0000000000 R11: fffffbfff2036b8f R12: 00000000000003b8
R13: ffff88803f196eb0 R14: ffff888042bcb1a0 R15: dffffc0000000000
FS: 00007f8f85895280(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056442fe1db00 CR3: 0000000036e8e000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
dget include/linux/dcache.h:352 [inline]
d_splice_alias+0x1bb/0x330 fs/dcache.c:3036
ext4_lookup+0x26d/0x750 fs/ext4/namei.c:1840
__lookup_slow+0x296/0x400 fs/namei.c:1793
lookup_slow+0x53/0x70 fs/namei.c:1810
walk_component+0x2e1/0x410 fs/namei.c:2114
lookup_last fs/namei.c:2612 [inline]
path_lookupat+0x16f/0x450 fs/namei.c:2636
filename_lookup+0x2a3/0x670 fs/namei.c:2665
vfs_statx+0x115/0x4f0 fs/stat.c:346
vfs_fstatat+0xe5/0x130 fs/stat.c:368
__do_sys_newfstatat fs/stat.c:532 [inline]
__se_sys_newfstatat fs/stat.c:526 [inline]
__x64_sys_newfstatat+0x11d/0x1a0 fs/stat.c:526
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8f855165f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007ffd71553698 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 0000564428b206c8 RCX: 00007f8f855165f4
RDX: 00007ffd715536a8 RSI: 0000564428b10897 RDI: 00000000ffffff9c
RBP: 000056442fe2ad38 R08: 000623062c2a2780 R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 000623062c2a2780 R15: 0000564428b14dca
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
RIP: 0010:do_raw_spin_lock+0x7f/0x370 kernel/locking/spinlock_debug.c:115
Code: 48 8d 74 24 40 48 c1 ee 03 48 b8 f1 f1 f1 f1 04 f3 f3 f3 48 89 f1 48 89 74 24 38 48 89 04 16 48 8d 5f 04 48 89 d8 48 c1 e8 03 <0f> b6 04 10 84 c0 0f 85 f6 01 00 00 8b 03 3d ad 4e ad de 0f 85 62
RSP: 0018:ffffc900021bf580 EFLAGS: 00010207
RAX: 0000000000000077 RBX: 00000000000003bc RCX: 1ffff92000437eb8
RDX: dffffc0000000000 RSI: 1ffff92000437eb8 RDI: 00000000000003b8
RBP: ffffc900021bf648 R08: ffffffff901b5c77 R09: 1ffffffff2036b8e
R10: dffffc0000000000 R11: fffffbfff2036b8f R12: 00000000000003b8
R13: ffff88803f196eb0 R14: ffff888042bcb1a0 R15: dffffc0000000000
FS: 00007f8f85895280(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056442fe1db00 CR3: 0000000036e8e000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 8d 74 24 40 lea 0x40(%rsp),%rsi
5: 48 c1 ee 03 shr $0x3,%rsi
9: 48 b8 f1 f1 f1 f1 04 movabs $0xf3f3f304f1f1f1f1,%rax
10: f3 f3 f3
13: 48 89 f1 mov %rsi,%rcx
16: 48 89 74 24 38 mov %rsi,0x38(%rsp)
1b: 48 89 04 16 mov %rax,(%rsi,%rdx,1)
1f: 48 8d 5f 04 lea 0x4(%rdi),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 0f b6 04 10 movzbl (%rax,%rdx,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 f6 01 00 00 jne 0x22c
36: 8b 03 mov (%rbx),%eax
38: 3d ad 4e ad de cmp $0xdead4ead,%eax
3d: 0f .byte 0xf
3e: 85 .byte 0x85
3f: 62 .byte 0x62