From: syzbot <syzbot+3028e4abe404f87a385f@syzkaller.appspotmail.com>
To: adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tytso@mit.edu
Subject: [syzbot] [ext4?] INFO: trying to register non-static key in ext4_xattr_get
Date: Wed, 17 Sep 2025 05:40:29 -0700 [thread overview]
Message-ID: <68caac3d.050a0220.2ff435.055e.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 22f20375f5b7 Merge tag 'pci-v6.17-fixes-3' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10fd5934580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5b21423ca3f0a96
dashboard link: https://syzkaller.appspot.com/bug?extid=3028e4abe404f87a385f
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c68f77b43077/disk-22f20375.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8ef15b7a075a/vmlinux-22f20375.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c341517a203/bzImage-22f20375.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3028e4abe404f87a385f@syzkaller.appspotmail.com
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 13193 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984
register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299
__lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0xa2/0xf0 kernel/locking/spinlock.c:170
__rwbase_read_lock+0xa1/0x180 kernel/locking/rwbase_rt.c:76
rwbase_read_lock kernel/locking/rwbase_rt.c:147 [inline]
__down_read kernel/locking/rwsem.c:1466 [inline]
down_read+0x127/0x1f0 kernel/locking/rwsem.c:1539
ext4_xattr_get+0x10a/0x6a0 fs/ext4/xattr.c:704
__vfs_getxattr+0x3f1/0x430 fs/xattr.c:423
smk_fetch+0xb4/0x140 security/smack/smack_lsm.c:289
smack_d_instantiate+0x6f5/0x940 security/smack/smack_lsm.c:3606
security_d_instantiate+0x10a/0x200 security/security.c:4109
d_splice_alias_ops+0x71/0x370 fs/dcache.c:2998
ext4_lookup+0x2b9/0x6c0 fs/ext4/namei.c:1814
__lookup_slow+0x29d/0x3d0 fs/namei.c:1808
lookup_slow+0x53/0x70 fs/namei.c:1825
walk_component+0x2d2/0x400 fs/namei.c:2129
lookup_last fs/namei.c:2630 [inline]
path_lookupat+0x163/0x430 fs/namei.c:2654
filename_lookup+0x212/0x570 fs/namei.c:2683
user_path_at+0x3a/0x60 fs/namei.c:3127
ksys_umount fs/namespace.c:2112 [inline]
__do_sys_umount fs/namespace.c:2120 [inline]
__se_sys_umount fs/namespace.c:2118 [inline]
__x64_sys_umount+0xee/0x160 fs/namespace.c:2118
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa56aa0fed7
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffcf1d8f548 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa56aa0fed7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcf1d8f600
RBP: 00007ffcf1d8f600 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcf1d906f0
R13: 00007fa56aa91c05 R14: 000055558570a4a8 R15: 00007ffcf1d917c0
</TASK>
Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a000000b: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0xdead4ead00000058-0xdead4ead0000005f]
CPU: 1 UID: 0 PID: 13193 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:rt_mutex_top_waiter kernel/locking/rtmutex_common.h:138 [inline]
RIP: 0010:task_blocks_on_rt_mutex kernel/locking/rtmutex.c:1240 [inline]
RIP: 0010:__rt_mutex_slowlock kernel/locking/rtmutex.c:1719 [inline]
RIP: 0010:__rt_mutex_slowlock_locked+0xb61/0x25e0 kernel/locking/rtmutex.c:1760
Code: ff ff ff ff e8 70 30 5b 09 85 c0 0f 84 45 04 00 00 48 85 db 0f 84 49 04 00 00 48 89 5c 24 48 48 83 c3 58 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 10 f6 81 00 48 8b 44 24 10 48 39
RSP: 0018:ffffc9000413f2a0 EFLAGS: 00010802
RAX: 1bd5a9d5a000000b RBX: dead4ead00000058 RCX: 0000000000000078
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88802f9559ac
RBP: ffffc9000413f490 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000827e44 R12: ffff88802f957060
R13: ffff88802f955958 R14: 00000000fffffffe R15: dffffc0000000000
FS: 000055558570a500(0000) GS:ffff8881269bd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcf1d8dca8 CR3: 00000000537e4000 CR4: 00000000003526f0
Call Trace:
<TASK>
__rwbase_read_lock+0xbc/0x180 kernel/locking/rwbase_rt.c:114
rwbase_read_lock kernel/locking/rwbase_rt.c:147 [inline]
__down_read kernel/locking/rwsem.c:1466 [inline]
down_read+0x127/0x1f0 kernel/locking/rwsem.c:1539
ext4_xattr_get+0x10a/0x6a0 fs/ext4/xattr.c:704
__vfs_getxattr+0x3f1/0x430 fs/xattr.c:423
smk_fetch+0xb4/0x140 security/smack/smack_lsm.c:289
smack_d_instantiate+0x6f5/0x940 security/smack/smack_lsm.c:3606
security_d_instantiate+0x10a/0x200 security/security.c:4109
d_splice_alias_ops+0x71/0x370 fs/dcache.c:2998
ext4_lookup+0x2b9/0x6c0 fs/ext4/namei.c:1814
__lookup_slow+0x29d/0x3d0 fs/namei.c:1808
lookup_slow+0x53/0x70 fs/namei.c:1825
walk_component+0x2d2/0x400 fs/namei.c:2129
lookup_last fs/namei.c:2630 [inline]
path_lookupat+0x163/0x430 fs/namei.c:2654
filename_lookup+0x212/0x570 fs/namei.c:2683
user_path_at+0x3a/0x60 fs/namei.c:3127
ksys_umount fs/namespace.c:2112 [inline]
__do_sys_umount fs/namespace.c:2120 [inline]
__se_sys_umount fs/namespace.c:2118 [inline]
__x64_sys_umount+0xee/0x160 fs/namespace.c:2118
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa56aa0fed7
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffcf1d8f548 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa56aa0fed7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcf1d8f600
RBP: 00007ffcf1d8f600 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcf1d906f0
R13: 00007fa56aa91c05 R14: 000055558570a4a8 R15: 00007ffcf1d917c0
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rt_mutex_top_waiter kernel/locking/rtmutex_common.h:138 [inline]
RIP: 0010:task_blocks_on_rt_mutex kernel/locking/rtmutex.c:1240 [inline]
RIP: 0010:__rt_mutex_slowlock kernel/locking/rtmutex.c:1719 [inline]
RIP: 0010:__rt_mutex_slowlock_locked+0xb61/0x25e0 kernel/locking/rtmutex.c:1760
Code: ff ff ff ff e8 70 30 5b 09 85 c0 0f 84 45 04 00 00 48 85 db 0f 84 49 04 00 00 48 89 5c 24 48 48 83 c3 58 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 10 f6 81 00 48 8b 44 24 10 48 39
RSP: 0018:ffffc9000413f2a0 EFLAGS: 00010802
RAX: 1bd5a9d5a000000b RBX: dead4ead00000058 RCX: 0000000000000078
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88802f9559ac
RBP: ffffc9000413f490 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000827e44 R12: ffff88802f957060
R13: ffff88802f955958 R14: 00000000fffffffe R15: dffffc0000000000
FS: 000055558570a500(0000) GS:ffff8881269bd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcf1d8dca8 CR3: 00000000537e4000 CR4: 00000000003526f0
----------------
Code disassembly (best guess), 4 bytes skipped:
0: e8 70 30 5b 09 call 0x95b3075
5: 85 c0 test %eax,%eax
7: 0f 84 45 04 00 00 je 0x452
d: 48 85 db test %rbx,%rbx
10: 0f 84 49 04 00 00 je 0x45f
16: 48 89 5c 24 48 mov %rbx,0x48(%rsp)
1b: 48 83 c3 58 add $0x58,%rbx
1f: 48 89 d8 mov %rbx,%rax
22: 48 c1 e8 03 shr $0x3,%rax
* 26: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2b: 74 08 je 0x35
2d: 48 89 df mov %rbx,%rdi
30: e8 10 f6 81 00 call 0x81f645
35: 48 8b 44 24 10 mov 0x10(%rsp),%rax
3a: 48 rex.W
3b: 39 .byte 0x39
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2025-09-17 12:40 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68caac3d.050a0220.2ff435.055e.GAE@google.com \
--to=syzbot+3028e4abe404f87a385f@syzkaller.appspotmail.com \
--cc=adilger.kernel@dilger.ca \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.