./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2207080759

<...>
Warning: Permanently added '10.128.1.117' (ED25519) to the list of known hosts.
execve("./syz-executor2207080759", ["./syz-executor2207080759"], 0x7ffc7c45bb10 /* 10 vars */) = 0
brk(NULL)                               = 0x555578020000
brk(0x555578020d40)                     = 0x555578020d40
arch_prctl(ARCH_SET_FS, 0x5555780203c0) = 0
set_tid_address(0x555578020690)         = 5841
set_robust_list(0x5555780206a0, 24)     = 0
rseq(0x555578020ce0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2207080759", 4096) = 28
getrandom("\xbe\xa7\x9c\xfd\xea\x19\x84\xe3", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555578020d40
brk(0x555578041d40)                     = 0x555578041d40
brk(0x555578042000)                     = 0x555578042000
mprotect(0x7fdace192000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 3
close(3)                                = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_WRONLY) = 3
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555578020690) = 5842
./strace-static-x86_64: Process 5842 attached
[pid  5842] set_robust_list(0x5555780206a0, 24) = 0
[pid  5842] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5842] setpgid(0, 0)               = 0
[pid  5842] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5842] write(3, "1000", 4)         = 4
[pid  5842] close(3)                    = 0
executing program
[pid  5842] write(1, "executing program\n", 18) = 18
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  5842] rt_sigaction(SIGRT_1, {sa_handler=0x7fdace138fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fdace12adb0}, NULL, 8) = 0
[pid  5842] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid  5842] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fdace0a6000
[pid  5842] mprotect(0x7fdace0a7000, 131072, PROT_READ|PROT_WRITE) = 0
[pid  5842] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5842] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fdace0c6990, parent_tid=0x7fdace0c6990, exit_signal=0, stack=0x7fdace0a6000, stack_size=0x20300, tls=0x7fdace0c66c0}./strace-static-x86_64: Process 5843 attached
 <unfinished ...>
[pid  5843] rseq(0x7fdace0c6fe0, 0x20, 0, 0x53053053 <unfinished ...>
[pid  5842] <... clone3 resumed> => {parent_tid=[5843]}, 88) = 5843
[pid  5843] <... rseq resumed>)         = 0
[pid  5842] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5843] set_robust_list(0x7fdace0c69a0, 24 <unfinished ...>
[pid  5842] futex(0x7fdace1983e8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5843] <... set_robust_list resumed>) = 0
[pid  5842] <... futex resumed>)        = 0
[pid  5843] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  5843] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid  5843] mknod("./file0", 000)       = 0
[pid  5843] futex(0x7fdace1983ec, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  5842] <... futex resumed>)        = 0
[pid  5843] futex(0x7fdace1983e8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  5842] futex(0x7fdace1983e8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5843] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  5842] <... futex resumed>)        = 0
[pid  5843] openat(AT_FDCWD, "/dev/fuse", O_RDWR|O_CREAT, 000 <unfinished ...>
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  5843] <... openat resumed>)       = 3
[pid  5843] futex(0x7fdace1983ec, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  5842] <... futex resumed>)        = 0
[pid  5843] futex(0x7fdace1983e8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  5842] futex(0x7fdace1983e8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5843] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  5842] <... futex resumed>)        = 0
[pid  5843] mount(NULL, "./file0", "fuse", 0, "fd=0x0000000000000003,rootmode=00000000000000000100000,user_id=00000000000000000000,group_id=0000000"... <unfinished ...>
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  5843] <... mount resumed>)        = 0
[pid  5843] futex(0x7fdace1983ec, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  5842] <... futex resumed>)        = 0
[pid  5843] futex(0x7fdace1983e8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  5842] futex(0x7fdace1983e8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5843] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  5842] <... futex resumed>)        = 0
[pid  5843] read(3, "\x68\x00\x00\x00\x1a\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x29\x00\x00\x00\x00\x00\x02\x00\xfb\xff\xff\x73\xdf\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 8224) = 104
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  5843] futex(0x7fdace1983ec, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  5843] futex(0x7fdace1983e8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  5842] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  5842] futex(0x7fdace1983e8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5843] <... futex resumed>)        = 0
[pid  5842] <... futex resumed>)        = 1
[pid  5843] write(3, "\x50\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 80) = 80
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  5843] futex(0x7fdace1983ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5842] <... futex resumed>)        = 0
[pid  5843] <... futex resumed>)        = 1
[pid  5842] futex(0x7fdace1983e8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5843] read(3,  <unfinished ...>
[pid  5842] <... futex resumed>)        = 0
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out)
[pid  5842] futex(0x7fdace1983fc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  5842] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fdace085000
[pid  5842] mprotect(0x7fdace086000, 131072, PROT_READ|PROT_WRITE) = 0
[pid  5842] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5842] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fdace0a5990, parent_tid=0x7fdace0a5990, exit_signal=0, stack=0x7fdace085000, stack_size=0x20300, tls=0x7fdace0a56c0}./strace-static-x86_64: Process 5845 attached
 <unfinished ...>
[pid  5845] rseq(0x7fdace0a5fe0, 0x20, 0, 0x53053053) = 0
[pid  5845] set_robust_list(0x7fdace0a59a0, 24) = 0
[pid  5842] <... clone3 resumed> => {parent_tid=[5845]}, 88) = 5845
[pid  5845] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid  5842] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid  5845] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid  5842] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid  5845] futex(0x7fdace1983f8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  5842] futex(0x7fdace1983f8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5845] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  5845] openat(AT_FDCWD, "./file0", O_WRONLY|O_APPEND|O_NONBLOCK|O_DIRECT|O_NOFOLLOW <unfinished ...>
[pid  5842] <... futex resumed>)        = 0
[pid  5842] futex(0x7fdace1983fc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  5843] <... read resumed>"\x30\x00\x00\x00\x0e\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd5\x16\x00\x00\x00\x00\x00\x00\x01\xcc\x02\x00\x00\x00\x00\x00", 8192) = 48
[pid  5843] write(3, "\x20\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00", 32) = 32
[pid  5845] <... openat resumed>)       = 4
[pid  5843] futex(0x7fdace1983ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  5845] futex(0x7fdace1983fc, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  5843] <... futex resumed>)        = 0
[pid  5842] <... futex resumed>)        = 0
[pid  5845] futex(0x7fdace1983f8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  5843] futex(0x7fdace1983e8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  5842] futex(0x7fdace1983e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  5842] futex(0x7fdace1983ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  5843] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  5843] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5
[pid  5843] write(5, "3", 1)            = 1
[   66.786821][ T5843] FAULT_INJECTION: forcing a failure.
[   66.786821][ T5843] name failslab, interval 1, probability 0, space 0, times 1
[   66.799698][ T5843] CPU: 0 UID: 0 PID: 5843 Comm: syz-executor220 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0
[   66.810493][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   66.820649][ T5843] Call Trace:
[   66.823944][ T5843]  <TASK>
[   66.826876][ T5843]  dump_stack_lvl+0x241/0x360
[   66.831617][ T5843]  ? __pfx_dump_stack_lvl+0x10/0x10
[   66.836838][ T5843]  ? __pfx__printk+0x10/0x10
[   66.841435][ T5843]  ? __kmalloc_noprof+0xb5/0x4c0
[   66.846374][ T5843]  ? __pfx___might_resched+0x10/0x10
[   66.851666][ T5843]  should_fail_ex+0x3b0/0x4e0
[   66.856362][ T5843]  should_failslab+0xac/0x100
[   66.861054][ T5843]  __kmalloc_noprof+0xdd/0x4c0
[   66.865997][ T5843]  ? fuse_direct_io+0xb05/0x31f0
[   66.871031][ T5843]  fuse_direct_io+0xb05/0x31f0
[   66.875981][ T5843]  ? __pfx___might_resched+0x10/0x10
[   66.881509][ T5843]  ? generic_write_checks+0x160/0x1c0
[   66.887020][ T5843]  ? __pfx_fuse_direct_io+0x10/0x10
[   66.892324][ T5843]  ? __pfx_generic_write_checks+0x10/0x10
[   66.898054][ T5843]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   66.904046][ T5843]  fuse_file_write_iter+0xae2/0xf70
[   66.909263][ T5843]  ? irqentry_exit+0x63/0x90
[   66.913860][ T5843]  ? __pfx_fuse_file_write_iter+0x10/0x10
[   66.919627][ T5843]  ? lock_acquire+0x264/0x550
[   66.924330][ T5843]  do_iter_readv_writev+0x600/0x880
[   66.929566][ T5843]  ? __pfx_do_iter_readv_writev+0x10/0x10
[   66.935303][ T5843]  ? rcu_read_lock_any_held+0xb7/0x160
[   66.940799][ T5843]  vfs_writev+0x376/0xba0
[   66.945163][ T5843]  ? trace_contention_end+0x3c/0x120
[   66.950457][ T5843]  ? __mutex_lock+0x37f/0xee0
[   66.955134][ T5843]  ? __pfx_lock_acquire+0x10/0x10
[   66.960184][ T5843]  ? __pfx_vfs_writev+0x10/0x10
[   66.965076][ T5843]  ? __fget_files+0x2a/0x410
[   66.969684][ T5843]  ? __fget_files+0x395/0x410
[   66.974377][ T5843]  ? __fget_files+0x2a/0x410
[   66.978984][ T5843]  do_writev+0x1b6/0x360
[   66.983235][ T5843]  ? __pfx_do_writev+0x10/0x10
[   66.988029][ T5843]  ? do_syscall_64+0x100/0x230
[   66.992929][ T5843]  do_syscall_64+0xf3/0x230
[   66.997518][ T5843]  ? clear_bhb_loop+0x35/0x90
[   67.002242][ T5843]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   67.008160][ T5843] RIP: 0033:0x7fdace113519
[   67.012884][ T5843] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[pid  5843] writev(4, [{iov_base="\xa1", iov_len=1}, {iov_base=NULL, iov_len=0}], 2 <unfinished ...>
[pid  5842] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[   67.032780][ T5843] RSP: 002b:00007fdace0c6208 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
[   67.041223][ T5843] RAX: ffffffffffffffda RBX: 00007fdace1983e8 RCX: 00007fdace113519
[   67.049306][ T5843] RDX: 0000000000000002 RSI: 0000000020000180 RDI: 0000000000000004
[   67.057301][ T5843] RBP: 00007fdace1983e0 R08: 00007fdace0c5fa7 R09: 0000000000000033
[   67.065477][ T5843] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdace16529c
[   67.073814][ T5843] R13: 00007fdace0c6210 R14: 0000000000000001 R15: 0030656c69662f2e
[   67.082262][ T5843]  </TASK>
[pid  5842] exit_group(0)               = ?
[pid  5845] <... futex resumed>)        = ?
[pid  5845] +++ exited with 0 +++
[   67.230758][ T5843] ==================================================================
[   67.238881][ T5843] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x47f/0x590
[   67.246645][ T5843] Read of size 8 at addr ffffc90003effc98 by task syz-executor220/5843
[   67.254896][ T5843] 
[   67.257235][ T5843] CPU: 1 UID: 0 PID: 5843 Comm: syz-executor220 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0
[   67.267999][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   67.278411][ T5843] Call Trace:
[   67.281715][ T5843]  <TASK>
[   67.284661][ T5843]  dump_stack_lvl+0x241/0x360
[   67.289605][ T5843]  ? __pfx_dump_stack_lvl+0x10/0x10
[   67.294807][ T5843]  ? __pfx__printk+0x10/0x10
[   67.299488][ T5843]  ? _printk+0xd5/0x120
[   67.303748][ T5843]  print_report+0x169/0x550
[   67.308267][ T5843]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   67.314256][ T5843]  ? __virt_addr_valid+0xbd/0x530
[   67.319302][ T5843]  ? iov_iter_revert+0x47f/0x590
[   67.324295][ T5843]  kasan_report+0x143/0x180
[   67.328781][ T5843]  ? iov_iter_revert+0x47f/0x590
[   67.333717][ T5843]  iov_iter_revert+0x47f/0x590
[   67.338504][ T5843]  fuse_direct_io+0x30b3/0x31f0
[   67.344258][ T5843]  ? __pfx___might_resched+0x10/0x10
[   67.349560][ T5843]  ? generic_write_checks+0x160/0x1c0
[   67.355020][ T5843]  ? __pfx_fuse_direct_io+0x10/0x10
[   67.360214][ T5843]  ? __pfx_generic_write_checks+0x10/0x10
[   67.366126][ T5843]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   67.372103][ T5843]  fuse_file_write_iter+0xae2/0xf70
[   67.377305][ T5843]  ? irqentry_exit+0x63/0x90
[   67.381891][ T5843]  ? __pfx_fuse_file_write_iter+0x10/0x10
[   67.387698][ T5843]  ? lock_acquire+0x264/0x550
[   67.392372][ T5843]  do_iter_readv_writev+0x600/0x880
[   67.397570][ T5843]  ? __pfx_do_iter_readv_writev+0x10/0x10
[   67.403412][ T5843]  ? rcu_read_lock_any_held+0xb7/0x160
[   67.408898][ T5843]  vfs_writev+0x376/0xba0
[   67.413338][ T5843]  ? trace_contention_end+0x3c/0x120
[   67.418708][ T5843]  ? __mutex_lock+0x37f/0xee0
[   67.423387][ T5843]  ? __pfx_lock_acquire+0x10/0x10
[   67.428409][ T5843]  ? __pfx_vfs_writev+0x10/0x10
[   67.433261][ T5843]  ? __fget_files+0x2a/0x410
[   67.437848][ T5843]  ? __fget_files+0x395/0x410
[   67.442607][ T5843]  ? __fget_files+0x2a/0x410
[   67.447302][ T5843]  do_writev+0x1b6/0x360
[   67.451543][ T5843]  ? __pfx_do_writev+0x10/0x10
[   67.456396][ T5843]  ? do_syscall_64+0x100/0x230
[   67.461182][ T5843]  do_syscall_64+0xf3/0x230
[   67.465766][ T5843]  ? clear_bhb_loop+0x35/0x90
[   67.470466][ T5843]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   67.476450][ T5843] RIP: 0033:0x7fdace113519
[   67.480913][ T5843] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   67.500545][ T5843] RSP: 002b:00007fdace0c6208 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
[   67.508997][ T5843] RAX: ffffffffffffffda RBX: 00007fdace1983e8 RCX: 00007fdace113519
[   67.517109][ T5843] RDX: 0000000000000002 RSI: 0000000020000180 RDI: 0000000000000004
[   67.525129][ T5843] RBP: 00007fdace1983e0 R08: 00007fdace0c5fa7 R09: 0000000000000033
[   67.533143][ T5843] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdace16529c
[   67.541116][ T5843] R13: 00007fdace0c6210 R14: 0000000000000001 R15: 0030656c69662f2e
[   67.549262][ T5843]  </TASK>
[   67.552283][ T5843] 
[   67.554610][ T5843] The buggy address belongs to stack of task syz-executor220/5843
[   67.562397][ T5843]  and is located at offset 24 in frame:
[   67.568064][ T5843]  vfs_writev+0x0/0xba0
[   67.572227][ T5843] 
[   67.574619][ T5843] This frame has 3 objects:
[   67.579135][ T5843]  [32, 160) 'iovstack'
[   67.579150][ T5843]  [192, 200) 'iov'
[   67.583313][ T5843]  [224, 264) 'iter'
[   67.587123][ T5843] 
[   67.593326][ T5843] The buggy address belongs to the virtual mapping at
[   67.593326][ T5843]  [ffffc90003ef8000, ffffc90003f01000) created by:
[   67.593326][ T5843]  copy_process+0x5d1/0x3d50
[   67.611077][ T5843] 
[   67.613398][ T5843] The buggy address belongs to the physical page:
[   67.620298][ T5843] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a65f
[   67.629354][ T5843] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   67.636474][ T5843] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
[   67.645070][ T5843] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   67.653857][ T5843] page dumped because: kasan: bad access detected
[   67.660373][ T5843] page_owner tracks the page as allocated
[   67.666094][ T5843] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5842, tgid 5842 (syz-executor220), ts 66583539533, free_ts 59534252530
[   67.686344][ T5843]  post_alloc_hook+0x1f3/0x230
[   67.691141][ T5843]  get_page_from_freelist+0x363e/0x3790
[   67.696683][ T5843]  __alloc_pages_noprof+0x292/0x710
[   67.702114][ T5843]  alloc_pages_mpol_noprof+0x3e8/0x680
[   67.707577][ T5843]  __vmalloc_node_range_noprof+0x9c9/0x1380
[   67.713490][ T5843]  dup_task_struct+0x444/0x8c0
[   67.718261][ T5843]  copy_process+0x5d1/0x3d50
[   67.722888][ T5843]  kernel_clone+0x223/0x880
[   67.727509][ T5843]  __se_sys_clone3+0x2d8/0x360
[   67.732385][ T5843]  do_syscall_64+0xf3/0x230
[   67.736892][ T5843]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   67.742795][ T5843] page last free pid 5832 tgid 5832 stack trace:
[   67.749921][ T5843]  free_unref_page+0xded/0x1130
[   67.754802][ T5843]  __folio_put+0x2c7/0x440
[   67.759241][ T5843]  pipe_read+0x6ed/0x13e0
[   67.763588][ T5843]  vfs_read+0x991/0xb70
[   67.767748][ T5843]  ksys_read+0x18f/0x2b0
[   67.772007][ T5843]  do_syscall_64+0xf3/0x230
[   67.776516][ T5843]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   67.782422][ T5843] 
[   67.784749][ T5843] Memory state around the buggy address:
[   67.790382][ T5843]  ffffc90003effb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   67.798437][ T5843]  ffffc90003effc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   67.806490][ T5843] >ffffc90003effc80: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
[   67.814627][ T5843]                             ^
[   67.819468][ T5843]  ffffc90003effd00: 00 00 00 00 f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00
[   67.827605][ T5843]  ffffc90003effd80: 00 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
[   67.835763][ T5843] ==================================================================
[   67.844870][ T5843] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   67.852292][ T5843] CPU: 0 UID: 0 PID: 5843 Comm: syz-executor220 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0
[   67.863100][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   67.873234][ T5843] Call Trace:
[   67.876939][ T5843]  <TASK>
[   67.879863][ T5843]  dump_stack_lvl+0x241/0x360
[   67.884530][ T5843]  ? __pfx_dump_stack_lvl+0x10/0x10
[   67.889990][ T5843]  ? __pfx__printk+0x10/0x10
[   67.894674][ T5843]  ? preempt_schedule+0xe1/0xf0
[   67.899543][ T5843]  ? vscnprintf+0x5d/0x90
[   67.903873][ T5843]  panic+0x349/0x880
[   67.907768][ T5843]  ? check_panic_on_warn+0x21/0xb0
[   67.912971][ T5843]  ? __pfx_panic+0x10/0x10
[   67.917484][ T5843]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   67.923483][ T5843]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   67.929830][ T5843]  ? print_report+0x502/0x550
[   67.934538][ T5843]  check_panic_on_warn+0x86/0xb0
[   67.939491][ T5843]  ? iov_iter_revert+0x47f/0x590
[   67.944453][ T5843]  end_report+0x77/0x160
[   67.948701][ T5843]  kasan_report+0x154/0x180
[   67.953205][ T5843]  ? iov_iter_revert+0x47f/0x590
[   67.958169][ T5843]  iov_iter_revert+0x47f/0x590
[   67.962948][ T5843]  fuse_direct_io+0x30b3/0x31f0
[   67.967799][ T5843]  ? __pfx___might_resched+0x10/0x10
[   67.973111][ T5843]  ? generic_write_checks+0x160/0x1c0
[   67.978479][ T5843]  ? __pfx_fuse_direct_io+0x10/0x10
[   67.983684][ T5843]  ? __pfx_generic_write_checks+0x10/0x10
[   67.989402][ T5843]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   67.995461][ T5843]  fuse_file_write_iter+0xae2/0xf70
[   68.000682][ T5843]  ? irqentry_exit+0x63/0x90
[   68.005739][ T5843]  ? __pfx_fuse_file_write_iter+0x10/0x10
[   68.011675][ T5843]  ? lock_acquire+0x264/0x550
[   68.016448][ T5843]  do_iter_readv_writev+0x600/0x880
[   68.021677][ T5843]  ? __pfx_do_iter_readv_writev+0x10/0x10
[   68.027422][ T5843]  ? rcu_read_lock_any_held+0xb7/0x160
[   68.032899][ T5843]  vfs_writev+0x376/0xba0
[   68.037359][ T5843]  ? trace_contention_end+0x3c/0x120
[   68.042668][ T5843]  ? __mutex_lock+0x37f/0xee0
[   68.047583][ T5843]  ? __pfx_lock_acquire+0x10/0x10
[   68.052696][ T5843]  ? __pfx_vfs_writev+0x10/0x10
[   68.057552][ T5843]  ? __fget_files+0x2a/0x410
[   68.062173][ T5843]  ? __fget_files+0x395/0x410
[   68.067029][ T5843]  ? __fget_files+0x2a/0x410
[   68.071721][ T5843]  do_writev+0x1b6/0x360
[   68.075976][ T5843]  ? __pfx_do_writev+0x10/0x10
[   68.080744][ T5843]  ? do_syscall_64+0x100/0x230
[   68.085567][ T5843]  do_syscall_64+0xf3/0x230
[   68.090140][ T5843]  ? clear_bhb_loop+0x35/0x90
[   68.094917][ T5843]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   68.100850][ T5843] RIP: 0033:0x7fdace113519
[   68.105270][ T5843] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   68.124978][ T5843] RSP: 002b:00007fdace0c6208 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
[   68.133586][ T5843] RAX: ffffffffffffffda RBX: 00007fdace1983e8 RCX: 00007fdace113519
[   68.141597][ T5843] RDX: 0000000000000002 RSI: 0000000020000180 RDI: 0000000000000004
[   68.149600][ T5843] RBP: 00007fdace1983e0 R08: 00007fdace0c5fa7 R09: 0000000000000033
[   68.157572][ T5843] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdace16529c
[   68.165558][ T5843] R13: 00007fdace0c6210 R14: 0000000000000001 R15: 0030656c69662f2e
[   68.173564][ T5843]  </TASK>
[   68.176956][ T5843] Kernel Offset: disabled
[   68.181270][ T5843] Rebooting in 86400 seconds..