rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core+0x5f0/0x1220 kernel/rcu/tree.c:2919 handle_softirqs+0x216/0xa20 kernel/softirq.c:669 run_ksoftirqd kernel/softirq.c:1133 [inline] run_ksoftirqd+0x38/0x60 kernel/softirq.c:1125 smpboot_thread_fn+0x41f/0xb90 kernel/smpboot.c:162 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ------------[ cut here ]------------ kernel BUG at mm/filemap.c:857! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 10348 Comm: syz.1.1239 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 RIP: 0010:__filemap_add_folio+0xfe6/0x1290 mm/filemap.c:857 Code: b1 ba ff 48 c7 c6 c0 58 1f 8c 4c 89 ef e8 92 5a 13 00 90 0f 0b e8 3a b1 ba ff 48 c7 c6 20 59 1f 8c 4c 89 ef e8 7b 5a 13 00 90 <0f> 0b e8 23 b1 ba ff 90 0f 0b 90 e9 12 fc ff ff e8 15 b1 ba ff 48 RSP: 0018:ffffc900020cf4e8 EFLAGS: 00010287 RAX: 0000000000010236 RBX: 0000000000112cc0 RCX: ffffc9000eb73000 RDX: 0000000000080000 RSI: ffffffff826709d8 RDI: ffff88802bbc04c4 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff8fef8bab R11: 0000000000000001 R12: 0000000000000002 R13: ffffea0001d72d40 R14: 0000000000000000 R15: 1ffff92000419ec8 FS: 00007f9868a746c0(0000) GS:ffff888122470000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9868a53d58 CR3: 000000007d3aa000 CR4: 0000000000350ef0 Call Trace: filemap_add_folio+0x1d3/0x640 mm/filemap.c:970 ra_alloc_folio mm/readahead.c:470 [inline] page_cache_ra_order+0x602/0xed0 mm/readahead.c:535 do_sync_mmap_readahead mm/filemap.c:3460 [inline] filemap_fault+0x1ae2/0x3150 mm/filemap.c:3614 __do_fault+0x10b/0x440 mm/memory.c:5677 do_read_fault mm/memory.c:6112 [inline] do_fault+0xb3f/0x1890 mm/memory.c:6246 do_pte_missing mm/memory.c:4778 [inline] handle_pte_fault mm/memory.c:6665 [inline] __handle_mm_fault+0x1858/0x2f40 mm/memory.c:6817 handle_mm_fault+0x363/0xa30 mm/memory.c:6984 do_user_addr_fault+0x745/0x12f0 arch/x86/mm/fault.c:1394 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:do_strncpy_from_user lib/strncpy_from_user.c:41 [inline] RIP: 0010:strncpy_from_user+0xfd/0x2d0 lib/strncpy_from_user.c:130 Code: 00 4d 89 64 1d 00 48 83 ed 08 bf 07 00 00 00 48 83 c3 08 48 89 ee e8 d2 00 9e fc 48 83 fd 07 0f 86 bb 00 00 00 e8 23 06 9e fc <4d> 8b 24 1e e8 1a 06 9e fc 4c 89 e2 31 ff 4d 8d 7c 1d 00 48 b8 ff RSP: 0018:ffffc900020cfd08 EFLAGS: 00050283 RAX: 000000000000003d RBX: 0000000000000000 RCX: ffffc9000eb73000 RDX: 0000000000080000 RSI: ffffffff857059dd RDI: 0000000000000007 RBP: 00000000000000a8 R08: 0000000000000007 R09: 00000000000000a8 R10: ffff88804e6574bf R11: 0000000000000000 R12: 0000000000000000 R13: ffff88804e657418 R14: 0000200000000280 R15: 00000000000000a8 do_getname+0x78/0x390 fs/namei.c:198 class_filename_flags_constructor include/linux/fs.h:2598 [inline] do_sys_openat2+0xc3/0x1d0 fs/open.c:1442 do_sys_open fs/open.c:1449 [inline] __do_sys_openat fs/open.c:1465 [inline] __se_sys_openat fs/open.c:1460 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1460 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x7b0 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9867ba8f19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9868a74028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f9867e26090 RCX: 00007f9867ba8f19 RDX: 000400000000a882 RSI: 0000200000000280 RDI: ffffffffffffff9c RBP: 00007f9867c37f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9867e26128 R14: 00007f9867e26090 R15: 00007ffd0503e1b8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__filemap_add_folio+0xfe6/0x1290 mm/filemap.c:857 Code: b1 ba ff 48 c7 c6 c0 58 1f 8c 4c 89 ef e8 92 5a 13 00 90 0f 0b e8 3a b1 ba ff 48 c7 c6 20 59 1f 8c 4c 89 ef e8 7b 5a 13 00 90 <0f> 0b e8 23 b1 ba ff 90 0f 0b 90 e9 12 fc ff ff e8 15 b1 ba ff 48 RSP: 0018:ffffc900020cf4e8 EFLAGS: 00010287 RAX: 0000000000010236 RBX: 0000000000112cc0 RCX: ffffc9000eb73000 RDX: 0000000000080000 RSI: ffffffff826709d8 RDI: ffff88802bbc04c4 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff8fef8bab R11: 0000000000000001 R12: 0000000000000002 R13: ffffea0001d72d40 R14: 0000000000000000 R15: 1ffff92000419ec8 FS: 00007f9868a746c0(0000) GS:ffff888122470000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007efe05ee34e8 CR3: 000000007d3aa000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: 00 4d 89 add %cl,-0x77(%rbp) 3: 64 1d 00 48 83 ed fs sbb $0xed834800,%eax 9: 08 bf 07 00 00 00 or %bh,0x7(%rdi) f: 48 83 c3 08 add $0x8,%rbx 13: 48 89 ee mov %rbp,%rsi 16: e8 d2 00 9e fc call 0xfc9e00ed 1b: 48 83 fd 07 cmp $0x7,%rbp 1f: 0f 86 bb 00 00 00 jbe 0xe0 25: e8 23 06 9e fc call 0xfc9e064d * 2a: 4d 8b 24 1e mov (%r14,%rbx,1),%r12 <-- trapping instruction 2e: e8 1a 06 9e fc call 0xfc9e064d 33: 4c 89 e2 mov %r12,%rdx 36: 31 ff xor %edi,%edi 38: 4d 8d 7c 1d 00 lea 0x0(%r13,%rbx,1),%r15 3d: 48 rex.W 3e: b8 .byte 0xb8 3f: ff .byte 0xff