loop4: detected capacity change from 0 to 6
BUG: unable to handle page fault for address: ffff887f09663600
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 3975 Comm: syz-executor.4 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__queue_work+0x20d/0x1240
Code: 41 89 c5 89 c6 e8 93 f3 31 00 45 85 ed 0f 85 e1 05 00 00 e8 55 f8 31 00 48 89 e8 48 c1 e8 03 42 80 3c 20 00 0f 85 a0 0e 00 00 <4c> 8b 75 00 48 89 df 4c 89 34 24 e8 13 07 ff ff 49 89 c5 48 85 c0
RSP: 0018:ffff88804622f3f0 EFLAGS: 00010046
RAX: 1ffff10fe12cc6c0 RBX: ffff88801e456618 RCX: ffffc900042ab000
RDX: 0000000000040000 RSI: ffffffff8141ef2b RDI: 0000000000000005
RBP: ffff887f09663600 R08: 0000000000000001 R09: fffffbfff0f11ef4
R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000001 R14: 0000000000000001 R15: ffff8880440fc800
FS: 00007fd87cb53700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff887f09663600 CR3: 000000000e097000 CR4: 0000000000350ef0
Call Trace:
queue_work_on+0xd0/0xe0
loop_queue_rq+0x5c8/0x1180
__blk_mq_issue_directly+0xd5/0x260
blk_mq_request_issue_directly+0x11c/0x1e0
blk_mq_issue_direct+0x192/0x640
blk_mq_dispatch_queue_requests+0x4b0/0x7c0
blk_mq_flush_plug_list+0x1ec/0x5b0
__blk_flush_plug+0x25c/0x460
__submit_bio+0x480/0x5b0
submit_bio_noacct_nocheck+0x68e/0xcb0
submit_bio_noacct+0x359/0x1350
__bread_gfp+0x18b/0x3c0
fat_fill_super+0x5e1/0x3fd0
get_tree_bdev_flags+0x38a/0x620
vfs_get_tree+0x93/0x340
path_mount+0x132d/0x1dd0
__x64_sys_mount+0x27b/0x300
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd87f5df04a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd87cb52fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007fd87f5df04a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fd87cb53000
RBP: 00007fd87cb53040 R08: 00007fd87cb53040 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007fd87cb53000 R15: 0000000020010d00
Modules linked in:
CR2: ffff887f09663600
---[ end trace 0000000000000000 ]---
RIP: 0010:__queue_work+0x20d/0x1240
Code: 41 89 c5 89 c6 e8 93 f3 31 00 45 85 ed 0f 85 e1 05 00 00 e8 55 f8 31 00 48 89 e8 48 c1 e8 03 42 80 3c 20 00 0f 85 a0 0e 00 00 <4c> 8b 75 00 48 89 df 4c 89 34 24 e8 13 07 ff ff 49 89 c5 48 85 c0
RSP: 0018:ffff88804622f3f0 EFLAGS: 00010046
RAX: 1ffff10fe12cc6c0 RBX: ffff88801e456618 RCX: ffffc900042ab000
RDX: 0000000000040000 RSI: ffffffff8141ef2b RDI: 0000000000000005
RBP: ffff887f09663600 R08: 0000000000000001 R09: fffffbfff0f11ef4
R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000001 R14: 0000000000000001 R15: ffff8880440fc800
FS: 00007fd87cb53700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff887f09663600 CR3: 000000000e097000 CR4: 0000000000350ef0
note: syz-executor.4[3975] exited with irqs disabled
note: syz-executor.4[3975] exited with preempt_count 1
------------[ cut here ]------------
WARNING: kernel/exit.c:898 at do_exit+0x1c36/0x2970, CPU#1: syz-executor.4/3975
Modules linked in:
CPU: 1 UID: 0 PID: 3975 Comm: syz-executor.4 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:do_exit+0x1c36/0x2970
Code: 96 0a 00 00 c7 43 18 00 00 00 00 e9 21 e6 ff ff e8 bf a4 38 00 bf 02 24 00 00 e8 f5 ab 0b 00 e9 41 ff ff ff e8 ab a4 38 00 90 <0f> 0b 90 e9 87 e4 ff ff e8 9d a4 38 00 4c 89 e6 bf 05 06 00 00 e8
RSP: 0018:ffff88804622fe40 EFLAGS: 00010212
RAX: 000000000003c716 RBX: 0000000000000200 RCX: ffffc900042ab000
RDX: 0000000000040000 RSI: ffffffff813b42d5 RDI: ffff8880447048e8
RBP: ffff888044703700 R08: 0000000000000001 R09: fffffbfff0f11cd8
R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000009
R13: 0000000000002710 R14: ffff88804622f3d0 R15: 0000000000000000
FS: 00007fd87cb53700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff887f09663600 CR3: 000000000e097000 CR4: 0000000000350ef0
Call Trace:
make_task_dead+0x174/0x3b0
rewind_stack_and_make_dead+0x16/0x20
RIP: 0033:0x7fd87f5df04a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd87cb52fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007fd87f5df04a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fd87cb53000
RBP: 00007fd87cb53040 R08: 00007fd87cb53040 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007fd87cb53000 R15: 0000000020010d00
irq event stamp: 596
hardirqs last enabled at (595): [] _raw_spin_unlock_irqrestore+0x2c/0x50
hardirqs last disabled at (596): [] _raw_spin_lock_irq+0x42/0x50
softirqs last enabled at (548): [] handle_softirqs+0x50c/0x770
softirqs last disabled at (533): [] __irq_exit_rcu+0xc4/0x100
---[ end trace 0000000000000000 ]---
BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:51
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3975, name: syz-executor.4
preempt_count: 0, expected: 0
RCU nest depth: 2, expected: 0
INFO: lockdep is turned off.
CPU: 1 UID: 0 PID: 3975 Comm: syz-executor.4 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
__might_resched+0x2f3/0x510
exit_signals+0x25/0x940
do_exit+0x2db/0x2970
make_task_dead+0x174/0x3b0
rewind_stack_and_make_dead+0x16/0x20
RIP: 0033:0x7fd87f5df04a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd87cb52fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007fd87f5df04a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fd87cb53000
RBP: 00007fd87cb53040 R08: 00007fd87cb53040 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007fd87cb53000 R15: 0000000020010d00
kmemleak: Automatic memory scanning thread ended
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#2] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 23 Comm: kworker/1:0 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: events kmemleak_do_cleanup
RIP: 0010:dst_dev_put+0x21/0x250
Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 54 55 53 48 89 fb e8 40 c6 a8 fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 b5 01 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00
RSP: 0018:ffff88806cf08da0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 000000000000002a RCX: ffffffff84103977
RDX: 0000000000000005 RSI: ffffffff83cb2140 RDI: 000000000000002a
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 1ffff1100d9e6fc2 R12: fffffbfff0b0a4ac
R13: 0000607f1a639b70 R14: 0000607f1a639b70 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdf6ddfd018 CR3: 000000000d28c000 CR4: 0000000000350ef0
Call Trace:
rt_fibinfo_free_cpus.part.0+0xdb/0x1a0
fib_nh_common_release+0xa8/0x2c0
fib6_info_destroy_rcu+0x18b/0x1f0
rcu_core+0x7c8/0x1800
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:unwind_next_frame+0x51e/0x2540
Code: 00 41 80 fe 04 0f 84 7e 0e 00 00 41 80 fe 05 0f 85 fb 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 <0f> 85 25 19 00 00 48 89 c8 4d 8b 77 48 48 ba 00 00 00 00 00 fc ff
RSP: 0018:ffff88800974f840 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff8682a686
RDX: 1ffff110012e9f1f RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff88800974f908 R08: ffffffff8682a68a R09: 0000000000000000
R10: 000000000003be53 R11: 0000000000012bb3 R12: ffff88800974f910
R13: ffff88800974f8f8 R14: 0000000000000005 R15: ffff88800974f8b0
arch_stack_walk+0x86/0xf0
stack_trace_save+0x8e/0xc0
kasan_save_stack+0x24/0x50
kasan_record_aux_stack+0x89/0xa0
__call_rcu_common.constprop.0+0x70/0x960
__kmemleak_do_cleanup+0x4a/0x90
process_one_work+0x8e1/0x19c0
worker_thread+0x67e/0xe90
kthread+0x3c8/0x740
ret_from_fork+0x34b/0x430
ret_from_fork_asm+0x1a/0x30
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__queue_work+0x20d/0x1240
Code: 41 89 c5 89 c6 e8 93 f3 31 00 45 85 ed 0f 85 e1 05 00 00 e8 55 f8 31 00 48 89 e8 48 c1 e8 03 42 80 3c 20 00 0f 85 a0 0e 00 00 <4c> 8b 75 00 48 89 df 4c 89 34 24 e8 13 07 ff ff 49 89 c5 48 85 c0
RSP: 0018:ffff88804622f3f0 EFLAGS: 00010046
RAX: 1ffff10fe12cc6c0 RBX: ffff88801e456618 RCX: ffffc900042ab000
RDX: 0000000000040000 RSI: ffffffff8141ef2b RDI: 0000000000000005
RBP: ffff887f09663600 R08: 0000000000000001 R09: fffffbfff0f11ef4
R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000001 R14: 0000000000000001 R15: ffff8880440fc800
FS: 0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdf6ddfd018 CR3: 000000000d28c000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 41 89 c5 mov %eax,%r13d
3: 89 c6 mov %eax,%esi
5: e8 93 f3 31 00 callq 0x31f39d
a: 45 85 ed test %r13d,%r13d
d: 0f 85 e1 05 00 00 jne 0x5f4
13: e8 55 f8 31 00 callq 0x31f86d
18: 48 89 e8 mov %rbp,%rax
1b: 48 c1 e8 03 shr $0x3,%rax
1f: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
24: 0f 85 a0 0e 00 00 jne 0xeca
* 2a: 4c 8b 75 00 mov 0x0(%rbp),%r14 <-- trapping instruction
2e: 48 89 df mov %rbx,%rdi
31: 4c 89 34 24 mov %r14,(%rsp)
35: e8 13 07 ff ff callq 0xffff074d
3a: 49 89 c5 mov %rax,%r13
3d: 48 85 c0 test %rax,%rax