__do_sys_fsmount+0x43e/0x950
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
journal_path: Non-blockdev passed as './file0'
------------[ cut here ]------------
WARNING: fs/namespace.c:1375 at cleanup_mnt+0x33f/0x430, CPU#1: syz-executor.6/4021
Modules linked in:
EXT4-fs: error: could not find journal device path
CPU: 1 UID: 0 PID: 4021 Comm: syz-executor.6 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:cleanup_mnt+0x33f/0x430
Code: c7 a0 45 d1 85 e8 01 7c fa 02 49 8d 7d 40 5b 48 c7 c6 10 e2 be 81 5d 41 5c 41 5d 41 5e 41 5f e9 57 b3 9c ff e8 82 46 b4 ff 90 <0f> 0b 90 e9 e6 fc ff ff e8 74 46 b4 ff 4c 89 ef e8 6c d7 06 00 e9
RSP: 0018:ffff88801546fe20 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff81bf9de5
RDX: ffff888018dd5280 RSI: ffffffff81bfa0fe RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000001 R12: ffff888018dd5b58
R13: ffff888044962000 R14: 0000000000000001 R15: ffff888044962040
FS: 0000555586ecd400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d422000 CR3: 000000000c792000 CR4: 0000000000350ef0
Call Trace:
task_work_run+0x172/0x280
exit_to_user_mode_loop+0xef/0x110
do_syscall_64+0x2f7/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdbec37072b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffc029db670 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007fdbec37072b
RDX: 00007fdbec4d52b8 RSI: 00007fdbec1355f0 RDI: 0000000000000004
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2d421e1c
R10: 0000000000000a85 R11: 0000000000000293 R12: 000000000001c0df
R13: 00000000000003e8 R14: 00007fdbec4d0f60 R15: 000000000001c0d5
irq event stamp: 3277
hardirqs last enabled at (3287): [] __up_console_sem+0x78/0x80
hardirqs last disabled at (3296): [] __up_console_sem+0x5d/0x80
softirqs last enabled at (2876): [] handle_softirqs+0x50c/0x770
softirqs last disabled at (2871): [] __irq_exit_rcu+0xc4/0x100
---[ end trace 0000000000000000 ]---
kmemleak: Found object by alias at 0x607f1a62ba88
CPU: 0 UID: 0 PID: 4035 Comm: syz-executor.1 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
__lookup_object+0x94/0xb0
delete_object_full+0x27/0x70
free_percpu+0x30/0x1160
futex_hash_free+0x38/0xc0
mmput+0x2d3/0x390
do_exit+0x79d/0x2970
do_group_exit+0xd3/0x2a0
get_signal+0x2315/0x2340
arch_do_signal_or_restart+0x80/0x790
exit_to_user_mode_loop+0x8b/0x110
do_syscall_64+0x2f7/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8a9a34fb19
Code: Unable to access opcode bytes at 0x7f8a9a34faef.
RSP: 002b:00007f8a978c5218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 00007f8a9a462f68 RCX: 00007f8a9a34fb19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a9a462f68
RBP: 00007f8a9a462f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8a9a462f6c
R13: 00007fff61bb24af R14: 00007f8a978c5300 R15: 0000000000022000
kmemleak: Object (percpu) 0x607f1a62ba84 (size 8):
kmemleak: comm "syz-executor.6", pid 4036, jiffies 4294782060
kmemleak: min_count = 1
kmemleak: count = 0
kmemleak: flags = 0x21
kmemleak: checksum = 0
kmemleak: backtrace:
pcpu_alloc_noprof+0x87a/0x1170
alloc_vfsmnt+0x135/0x6e0
vfs_create_mount.part.0+0x40/0x440
__do_sys_fsmount+0x43e/0x950
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
block device autoloading is deprecated and will be removed.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
CPU: 1 UID: 0 PID: 289 Comm: syz-executor.0 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff8880164f75c0 EFLAGS: 00010212
RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
RDX: ffff888019cc8000 RSI: ffffffff818995b7 RDI: 0000000000000191
RBP: ffff8880164f7830 R08: ffff88806cf31340 R09: ffffe8ffffd0e520
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 000000000000001c R14: ffff88806cf31340 R15: dffffc0000000000
FS: 0000555568523400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556852cc58 CR3: 0000000042f5f000 CR4: 0000000000350ef0
Call Trace:
perf_trace_run_bpf_submit+0xef/0x180
perf_trace_contention_begin+0x235/0x3e0
trace_contention_begin+0xae/0x110
__mutex_lock+0x14b/0x1020
lo_ioctl+0x289/0x1c70
blkdev_ioctl+0x27c/0x6c0
__x64_sys_ioctl+0x18f/0x210
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f22968a78d7
Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 a4 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff50e01048 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fff50e010d0 RCX: 00007f22968a78d7
RDX: 0000000000000000 RSI: 0000000000004c01 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fff50e00ee0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000032
R13: 0000000000000000 R14: 0000000000000003 R15: 00007fff50e01110
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff8880164f75c0 EFLAGS: 00010212
RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
RDX: ffff888019cc8000 RSI: ffffffff818995b7 RDI: 0000000000000191
RBP: ffff8880164f7830 R08: ffff88806cf31340 R09: ffffe8ffffd0e520
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 000000000000001c R14: ffff88806cf31340 R15: dffffc0000000000
FS: 0000555568523400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556852cc58 CR3: 0000000042f5f000 CR4: 0000000000350ef0
note: syz-executor.0[289] exited with preempt_count 2
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
CPU: 0 UID: 0 PID: 4113 Comm: syz-executor.1 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff88801705f940 EFLAGS: 00010012
RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc9000088e000
RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191
RBP: ffff88801705fbb0 R08: ffff88806ce31340 R09: ffffe8ffffc0e520
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
FS: 00007f8a978c5700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8a9a463018 CR3: 000000000c68d000 CR4: 0000000000350ef0
Call Trace:
perf_trace_run_bpf_submit+0xef/0x180
perf_trace_preemptirq_template+0x259/0x430
trace_irq_disable.constprop.0+0xa6/0x100
_raw_spin_lock_irqsave+0x53/0x60
pcpu_alloc_noprof+0x264/0x1170
packet_create+0x1f1/0x8d0
__sock_create+0x369/0x810
__sys_socket+0x145/0x260
__x64_sys_socket+0x73/0xb0
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8a9a34fb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8a978c5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007f8a9a462f60 RCX: 00007f8a9a34fb19
RDX: 0000000000000300 RSI: 0000000000000002 RDI: 0000000000000011
RBP: 00007f8a9a3a9f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff61bb24af R14: 00007f8a978c5300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff8880164f75c0 EFLAGS: 00010212
RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
RDX: ffff888019cc8000 RSI: ffffffff818995b7 RDI: 0000000000000191
RBP: ffff8880164f7830 R08: ffff88806cf31340 R09: ffffe8ffffd0e520
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 000000000000001c R14: ffff88806cf31340 R15: dffffc0000000000
FS: 00007f8a978c5700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8a9a463018 CR3: 000000000c68d000 CR4: 0000000000350ef0
note: syz-executor.1[4113] exited with irqs disabled
note: syz-executor.1[4113] exited with preempt_count 1
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#3] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 22 Comm: ksoftirqd/1 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:dst_dev_put+0x21/0x250
==================================================================
Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 54 55 53 48 89 fb e8 40 c6 a8 fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 b5 01 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00
BUG: KASAN: slab-use-after-free in __mutex_lock+0xc72/0x1020
RSP: 0018:ffff888009747bf0 EFLAGS: 00010256
Read of size 4 at addr ffff888018dd0034 by task syz-executor.3/4120
RAX: dffffc0000000000 RBX: 0000000000000002 RCX: ffffffff84103977
CPU: 0 UID: 0 PID: 4120 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
print_report+0xcb/0x610
kasan_report+0xca/0x100
__mutex_lock+0xc72/0x1020
pcpu_alloc_noprof+0xaa0/0x1170
packet_create+0x1f1/0x8d0
__sock_create+0x369/0x810
__sys_socket+0x145/0x260
__x64_sys_socket+0x73/0xb0
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe0d00d0b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe0cd625188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007fe0d01e4020 RCX: 00007fe0d00d0b19
RDX: 0000000000000300 RSI: 0000000000000003 RDI: 0000000000000011
RBP: 00007fe0d012af6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc2e59413f R14: 00007fe0cd625300 R15: 0000000000022000
RDX: 0000000000000000 RSI: ffffffff83cb2140 RDI: 0000000000000002
Allocated by task 4109:
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
kasan_save_stack+0x24/0x50
R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff0b0a4ac
kasan_save_track+0x14/0x30
R13: 0000607f1a631520 R14: 0000607f1a631520 R15: 0000000000000000
__kasan_slab_alloc+0x59/0x70
FS: 0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
kmem_cache_alloc_node_noprof+0x21a/0x690
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
copy_process+0x461/0x73c0
CR2: 00007fe0cd625718 CR3: 000000001ee1f000 CR4: 0000000000350ef0
kernel_clone+0xea/0x7f0
Call Trace:
__do_sys_clone+0xce/0x120
do_syscall_64+0xbf/0x360
rt_fibinfo_free_cpus.part.0+0xdb/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 275:
fib_nh_common_release+0xa8/0x2c0
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_save_free_info+0x3a/0x60
fib6_info_destroy_rcu+0x18b/0x1f0
__kasan_slab_free+0x3f/0x50
kmem_cache_free+0x2a1/0x540
rcu_core+0x7c8/0x1800
rcu_core+0x7c8/0x1800
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
handle_softirqs+0x1b1/0x770
sysvec_apic_timer_interrupt+0x39/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
Last potentially related work creation:
run_ksoftirqd+0x2e/0x60
kasan_save_stack+0x24/0x50
smpboot_thread_fn+0x41d/0x9d0
kasan_record_aux_stack+0x89/0xa0
__call_rcu_common.constprop.0+0x70/0x960
kthread+0x3c8/0x740
delayed_put_task_struct+0xde/0x260
rcu_core+0x7c8/0x1800
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
ret_from_fork+0x34b/0x430
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
ret_from_fork_asm+0x1a/0x30
Second to last potentially related work creation:
kasan_save_stack+0x24/0x50
Modules linked in:
kasan_record_aux_stack+0x89/0xa0
__call_rcu_common.constprop.0+0x70/0x960
---[ end trace 0000000000000000 ]---
put_task_struct_rcu_user+0x75/0xc0
__schedule+0xe86/0x3590
RIP: 0010:perf_tp_event+0x175/0xe70
__cond_resched+0x4c/0x80
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
scan_gray_list+0x22b/0x290
RSP: 0018:ffff8880164f75c0 EFLAGS: 00010212
kmemleak_scan+0x574/0xe00
kmemleak_scan_thread+0x78/0xc0
RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
kthread+0x3c8/0x740
RDX: ffff888019cc8000 RSI: ffffffff818995b7 RDI: 0000000000000191
ret_from_fork+0x34b/0x430
RBP: ffff8880164f7830 R08: ffff88806cf31340 R09: ffffe8ffffd0e520
ret_from_fork_asm+0x1a/0x30
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
The buggy address belongs to the object at ffff888018dd0000
which belongs to the cache task_struct of size 6784
The buggy address is located 52 bytes inside of
freed 6784-byte region [ffff888018dd0000, ffff888018dd1a80)
R13: 000000000000001c R14: ffff88806cf31340 R15: dffffc0000000000
The buggy address belongs to the physical page:
FS: 0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x18dd0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
CR2: 00007fe0cd625718 CR3: 000000001ee1f000 CR4: 0000000000350ef0
memcg:ffff88800e02b601
anon flags: 0x100000000000040(head|node=0|zone=1)
----------------
Code disassembly (best guess), 1 bytes skipped:
0: df 48 89 fisttps -0x77(%rax)
3: 85 a8 fd ff ff 48 test %ebp,0x48fffffd(%rax)
9: c1 e8 03 shr $0x3,%eax
c: 4c 01 e0 add %r12,%rax
f: 48 89 85 c8 fd ff ff mov %rax,-0x238(%rbp)
16: e8 c9 51 ea ff callq 0xffea51e4
1b: 48 8d bb f0 01 00 00 lea 0x1f0(%rbx),%rdi
22: 48 89 f8 mov %rdi,%rax
25: 48 c1 e8 03 shr $0x3,%rax
* 29: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e c5 0b 00 00 jle 0xbff
3a: 44 rex.R
3b: 8b .byte 0x8b
3c: ab stos %eax,%es:(%rdi)
3d: f0 lock
3e: 01 .byte 0x1