Warning: Permanently added '10.128.0.10' (ED25519) to the list of known hosts. executing program [ 58.094139][ T5051] loop0: detected capacity change from 0 to 4096 [ 58.117507][ T5053] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 58.136885][ T5051] ================================================================== [ 58.144993][ T5051] BUG: KASAN: out-of-bounds in nilfs_set_link+0x24d/0x2e0 [ 58.152138][ T5051] Read of size 2 at addr ffff888078f08008 by task syz-executor397/5051 [ 58.160376][ T5051] [ 58.162694][ T5051] CPU: 1 PID: 5051 Comm: syz-executor397 Not tainted 6.7.0-rc8-syzkaller-00177-g52b1853b080a #0 [ 58.173175][ T5051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 58.183243][ T5051] Call Trace: [ 58.186511][ T5051] [ 58.189435][ T5051] dump_stack_lvl+0x1e7/0x2d0 [ 58.194126][ T5051] ? seqcount_lockdep_reader_access+0x157/0x220 [ 58.200359][ T5051] ? nf_tcp_handle_invalid+0x650/0x650 [ 58.205996][ T5051] ? panic+0x850/0x850 [ 58.210055][ T5051] ? _printk+0xd5/0x120 [ 58.214195][ T5051] print_report+0x163/0x540 [ 58.218684][ T5051] ? __virt_addr_valid+0x22f/0x2e0 [ 58.223795][ T5051] ? __phys_addr+0xba/0x170 [ 58.228282][ T5051] ? nilfs_set_link+0x24d/0x2e0 [ 58.233465][ T5051] kasan_report+0x142/0x170 [ 58.237951][ T5051] ? nilfs_set_link+0x24d/0x2e0 [ 58.242783][ T5051] nilfs_set_link+0x24d/0x2e0 [ 58.247443][ T5051] nilfs_rename+0x5d8/0x6b0 [ 58.251973][ T5051] ? nilfs_mknod+0x290/0x290 [ 58.256559][ T5051] ? __down_write_common+0x161/0x200 [ 58.261826][ T5051] ? __lock_acquire+0x1fd0/0x1fd0 [ 58.266831][ T5051] ? clear_nonspinnable+0x60/0x60 [ 58.271845][ T5051] ? lock_two_inodes+0x13c/0x180 [ 58.276781][ T5051] ? nilfs_mknod+0x290/0x290 [ 58.281381][ T5051] vfs_rename+0xaba/0xde0 [ 58.285697][ T5051] ? __ia32_sys_link+0x90/0x90 [ 58.290470][ T5051] ? security_path_rename+0x183/0x210 [ 58.295828][ T5051] do_renameat2+0xd5a/0x1390 [ 58.300407][ T5051] ? fsnotify_move+0x4f0/0x4f0 [ 58.305153][ T5051] ? __check_object_size+0x4bb/0xa00 [ 58.310436][ T5051] ? getname_flags+0x1fd/0x4f0 [ 58.315197][ T5051] __x64_sys_rename+0x86/0x90 [ 58.319865][ T5051] do_syscall_64+0x45/0x110 [ 58.324361][ T5051] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 58.330243][ T5051] RIP: 0033:0x7fb7b8290669 [ 58.334649][ T5051] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 58.354329][ T5051] RSP: 002b:00007fffd4bb0238 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 58.362783][ T5051] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fb7b8290669 [ 58.370749][ T5051] RDX: 00007fb7b8290669 RSI: 0000000020000040 RDI: 0000000020000180 [ 58.378706][ T5051] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 58.386662][ T5051] R10: 0000000000000f69 R11: 0000000000000246 R12: 0000000000000000 [ 58.394621][ T5051] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007fffd4bb02a0 [ 58.402592][ T5051] [ 58.405607][ T5051] [ 58.407919][ T5051] The buggy address belongs to the physical page: [ 58.414312][ T5051] page:ffffea0001e3c200 refcount:1 mapcount:1 mapping:0000000000000000 index:0x55b79e908 pfn:0x78f08 [ 58.425140][ T5051] memcg:ffff888141652000 [ 58.429380][ T5051] anon flags: 0xfff000000a0028(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x7ff) [ 58.440223][ T5051] page_type: 0x0() [ 58.443937][ T5051] raw: 00fff000000a0028 ffffea0001391e88 ffffea00013f1b48 ffff888029cbb001 [ 58.452510][ T5051] raw: 000000055b79e908 0000000000000000 0000000100000000 ffff888141652000 [ 58.461080][ T5051] page dumped because: kasan: bad access detected [ 58.467494][ T5051] page_owner tracks the page as allocated [ 58.473206][ T5051] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5052, tgid 5052 (udevd), ts 58139256944, free_ts 52307690585 [ 58.490292][ T5051] post_alloc_hook+0x1e6/0x210 [ 58.495047][ T5051] get_page_from_freelist+0x33ea/0x3570 [ 58.500616][ T5051] __alloc_pages+0x255/0x680 [ 58.505197][ T5051] alloc_pages_mpol+0x3de/0x640 [ 58.510031][ T5051] vma_alloc_folio+0xf3/0x3f0 [ 58.514698][ T5051] do_wp_page+0x125e/0x4d40 [ 58.519194][ T5051] handle_mm_fault+0x1b1c/0x6680 [ 58.524143][ T5051] exc_page_fault+0x456/0x870 [ 58.528803][ T5051] asm_exc_page_fault+0x26/0x30 [ 58.533636][ T5051] page last free stack trace: [ 58.538306][ T5051] free_unref_page_prepare+0x931/0xa60 [ 58.543747][ T5051] free_unref_page_list+0x5a0/0x840 [ 58.548931][ T5051] release_pages+0x2117/0x2400 [ 58.553688][ T5051] tlb_flush_mmu+0x34c/0x4e0 [ 58.558259][ T5051] tlb_finish_mmu+0xd4/0x1f0 [ 58.562850][ T5051] exit_mmap+0x4d3/0xc60 [ 58.567089][ T5051] __mmput+0x115/0x3c0 [ 58.571148][ T5051] exit_mm+0x21f/0x300 [ 58.575209][ T5051] do_exit+0x9af/0x2740 [ 58.579350][ T5051] do_group_exit+0x206/0x2c0 [ 58.583923][ T5051] __x64_sys_exit_group+0x3f/0x40 [ 58.588935][ T5051] do_syscall_64+0x45/0x110 [ 58.593440][ T5051] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 58.599317][ T5051] [ 58.601623][ T5051] Memory state around the buggy address: [ 58.607236][ T5051] ffff888078f07f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.615301][ T5051] ffff888078f07f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.623341][ T5051] >ffff888078f08000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.631379][ T5051] ^ [ 58.635946][ T5051] ffff888078f08080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.643993][ T5051] ffff888078f08100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.652039][ T5051] ================================================================== [ 58.660481][ T5051] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 58.667722][ T5051] CPU: 1 PID: 5051 Comm: syz-executor397 Not tainted 6.7.0-rc8-syzkaller-00177-g52b1853b080a #0 [ 58.678119][ T5051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 58.688160][ T5051] Call Trace: [ 58.691426][ T5051] [ 58.694344][ T5051] dump_stack_lvl+0x1e7/0x2d0 [ 58.699017][ T5051] ? nf_tcp_handle_invalid+0x650/0x650 [ 58.704662][ T5051] ? panic+0x850/0x850 [ 58.708719][ T5051] ? vscnprintf+0x5d/0x80 [ 58.713039][ T5051] panic+0x349/0x850 [ 58.716922][ T5051] ? check_panic_on_warn+0x21/0xa0 [ 58.722020][ T5051] ? __memcpy_flushcache+0x2b0/0x2b0 [ 58.727294][ T5051] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 58.733269][ T5051] ? _raw_spin_unlock+0x40/0x40 [ 58.738105][ T5051] ? print_report+0x4fb/0x540 [ 58.742771][ T5051] check_panic_on_warn+0x82/0xa0 [ 58.747694][ T5051] ? nilfs_set_link+0x24d/0x2e0 [ 58.752527][ T5051] end_report+0x6e/0x140 [ 58.756755][ T5051] kasan_report+0x153/0x170 [ 58.761244][ T5051] ? nilfs_set_link+0x24d/0x2e0 [ 58.766169][ T5051] nilfs_set_link+0x24d/0x2e0 [ 58.770831][ T5051] nilfs_rename+0x5d8/0x6b0 [ 58.775320][ T5051] ? nilfs_mknod+0x290/0x290 [ 58.779898][ T5051] ? __down_write_common+0x161/0x200 [ 58.785167][ T5051] ? __lock_acquire+0x1fd0/0x1fd0 [ 58.790179][ T5051] ? clear_nonspinnable+0x60/0x60 [ 58.795199][ T5051] ? lock_two_inodes+0x13c/0x180 [ 58.800208][ T5051] ? nilfs_mknod+0x290/0x290 [ 58.804788][ T5051] vfs_rename+0xaba/0xde0 [ 58.809108][ T5051] ? __ia32_sys_link+0x90/0x90 [ 58.813857][ T5051] ? security_path_rename+0x183/0x210 [ 58.819219][ T5051] do_renameat2+0xd5a/0x1390 [ 58.823806][ T5051] ? fsnotify_move+0x4f0/0x4f0 [ 58.828561][ T5051] ? __check_object_size+0x4bb/0xa00 [ 58.833839][ T5051] ? getname_flags+0x1fd/0x4f0 [ 58.838594][ T5051] __x64_sys_rename+0x86/0x90 [ 58.843260][ T5051] do_syscall_64+0x45/0x110 [ 58.847754][ T5051] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 58.853633][ T5051] RIP: 0033:0x7fb7b8290669 [ 58.858037][ T5051] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 58.877625][ T5051] RSP: 002b:00007fffd4bb0238 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 58.886024][ T5051] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fb7b8290669 [ 58.893983][ T5051] RDX: 00007fb7b8290669 RSI: 0000000020000040 RDI: 0000000020000180 [ 58.902025][ T5051] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 58.909983][ T5051] R10: 0000000000000f69 R11: 0000000000000246 R12: 0000000000000000 [ 58.917938][ T5051] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007fffd4bb02a0 [ 58.925901][ T5051] [ 58.929088][ T5051] Kernel Offset: disabled [ 58.933392][ T5051] Rebooting in 86400 seconds..