./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1795433444
<...>
Warning: Permanently added '10.128.1.79' (ED25519) to the list of known hosts.
execve("./syz-executor1795433444", ["./syz-executor1795433444"], 0x7ffec7256bc0 /* 10 vars */) = 0
brk(NULL) = 0x5555564b6000
brk(0x5555564b6d00) = 0x5555564b6d00
arch_prctl(ARCH_SET_FS, 0x5555564b6380) = 0
set_tid_address(0x5555564b6650) = 5056
set_robust_list(0x5555564b6660, 24) = 0
rseq(0x5555564b6ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1795433444", 4096) = 28
getrandom("\x27\x54\xe3\x7f\x36\xf8\x4e\x4e", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555564b6d00
brk(0x5555564d7d00) = 0x5555564d7d00
brk(0x5555564d8000) = 0x5555564d8000
mprotect(0x7ffb9c9b8000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffb94508000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7ffb94508000, 138412032) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
mount("/dev/loop0", "./file0", "hfsplus", MS_NODIRATIME|MS_SILENT, "\x74\x79\x70\x65\x3d\xfa\x35\x4a\x6d\x2c\x6e\x6c\x73\x3d\x69\x73\x6f\x38\x38\x35\x39\x2d\x31\x2c") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 57.310468][ T5056] loop0: detected capacity change from 0 to 1024
[ 57.375810][ T5056] ==================================================================
[ 57.383894][ T5056] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x57a/0x11f0
[ 57.391617][ T5056] Read of size 2 at addr ffff88807e7a540c by task syz-executor179/5056
[ 57.399837][ T5056]
[ 57.402143][ T5056] CPU: 0 PID: 5056 Comm: syz-executor179 Not tainted 6.7.0-rc5-syzkaller-00134-g3f7168591ebf #0
[ 57.412536][ T5056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 57.422574][ T5056] Call Trace:
[ 57.425851][ T5056]
[ 57.428812][ T5056] dump_stack_lvl+0x1e7/0x2d0
[ 57.433537][ T5056] ? nf_tcp_handle_invalid+0x650/0x650
[ 57.439020][ T5056] ? panic+0x850/0x850
[ 57.443117][ T5056] ? _printk+0xd5/0x120
[ 57.447304][ T5056] print_report+0x163/0x540
[ 57.451821][ T5056] ? __virt_addr_valid+0x22f/0x2e0
[ 57.456925][ T5056] ? __phys_addr+0xba/0x170
[ 57.461413][ T5056] ? hfsplus_uni2asc+0x57a/0x11f0
[ 57.466422][ T5056] kasan_report+0x142/0x170
[ 57.471082][ T5056] ? hfsplus_uni2asc+0x57a/0x11f0
[ 57.476118][ T5056] hfsplus_uni2asc+0x57a/0x11f0
[ 57.480981][ T5056] ? __asan_memcpy+0x40/0x70
[ 57.485581][ T5056] hfsplus_readdir+0x92c/0x1310
[ 57.490432][ T5056] ? hfsplus_rename+0x1c0/0x1c0
[ 57.495293][ T5056] ? __mutex_lock+0x2ee/0xd60
[ 57.499960][ T5056] ? iterate_dir+0xd7/0x540
[ 57.504456][ T5056] ? down_read_interruptible+0xc50/0xc50
[ 57.510076][ T5056] ? __fdget_pos+0x2b0/0x340
[ 57.514661][ T5056] ? fsnotify_perm+0x43e/0x5a0
[ 57.519416][ T5056] iterate_dir+0x1cd/0x540
[ 57.523825][ T5056] __se_sys_getdents64+0x20d/0x4f0
[ 57.528955][ T5056] ? lockdep_hardirqs_on_prepare+0x43c/0x780
[ 57.534954][ T5056] ? __x64_sys_getdents64+0x80/0x80
[ 57.540150][ T5056] ? filldir+0x6a0/0x6a0
[ 57.544398][ T5056] ? syscall_enter_from_user_mode+0xa4/0x2d0
[ 57.550738][ T5056] ? syscall_enter_from_user_mode+0xf5/0x2d0
[ 57.556739][ T5056] do_syscall_64+0x45/0x110
[ 57.561247][ T5056] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 57.567141][ T5056] RIP: 0033:0x7ffb9c945649
[ 57.571550][ T5056] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 57.591149][ T5056] RSP: 002b:00007ffcba62a2f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 57.599552][ T5056] RAX: ffffffffffffffda RBX: 00007ffcba62a4c8 RCX: 00007ffb9c945649
[ 57.607603][ T5056] RDX: 0000000000000067 RSI: 0000000020000540 RDI: 0000000000000003
[ 57.615562][ T5056] RBP: 00007ffb9c9b8610 R08: 0000000000000651 R09: 00007ffcba62a4c8
[ 57.623520][ T5056] R10: 00007ffcba62a1b0 R11: 0000000000000246 R12: 0000000000000001
[ 57.631482][ T5056] R13: 00007ffcba62a4b8 R14: 0000000000000001 R15: 0000000000000001
[ 57.639449][ T5056]
[ 57.642456][ T5056]
[ 57.644763][ T5056] Allocated by task 5056:
[ 57.649077][ T5056] kasan_set_track+0x4f/0x70
[ 57.653660][ T5056] __kasan_kmalloc+0x98/0xb0
[ 57.658238][ T5056] __kmalloc+0xb3/0x1a0
[ 57.662401][ T5056] hfsplus_find_init+0x85/0x1c0
[ 57.667257][ T5056] hfsplus_readdir+0x20e/0x1310
[ 57.672109][ T5056] iterate_dir+0x1cd/0x540
[ 57.676532][ T5056] __se_sys_getdents64+0x20d/0x4f0
[ 57.681750][ T5056] do_syscall_64+0x45/0x110
[ 57.686256][ T5056] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 57.692146][ T5056]
[ 57.694459][ T5056] The buggy address belongs to the object at ffff88807e7a5000
[ 57.694459][ T5056] which belongs to the cache kmalloc-2k of size 2048
[ 57.708503][ T5056] The buggy address is located 0 bytes to the right of
[ 57.708503][ T5056] allocated 1036-byte region [ffff88807e7a5000, ffff88807e7a540c)
[ 57.723157][ T5056]
[ 57.725467][ T5056] The buggy address belongs to the physical page:
[ 57.731860][ T5056] page:ffffea0001f9e800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e7a0
[ 57.741994][ T5056] head:ffffea0001f9e800 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 57.750913][ T5056] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 57.758887][ T5056] page_type: 0xffffffff()
[ 57.763289][ T5056] raw: 00fff00000000840 ffff888012c42000 dead000000000122 0000000000000000
[ 57.771860][ T5056] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 57.780437][ T5056] page dumped because: kasan: bad access detected
[ 57.786833][ T5056] page_owner tracks the page as allocated
[ 57.792536][ T5056] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4500, tgid 4500 (klogd), ts 57324922215, free_ts 57234358654
[ 57.813275][ T5056] post_alloc_hook+0x1e6/0x210
[ 57.818030][ T5056] get_page_from_freelist+0x33ea/0x3570
[ 57.823564][ T5056] __alloc_pages+0x255/0x680
[ 57.828139][ T5056] alloc_pages_mpol+0x3de/0x640
[ 57.832974][ T5056] alloc_slab_page+0x6a/0x170
[ 57.837636][ T5056] new_slab+0x84/0x2f0
[ 57.841696][ T5056] ___slab_alloc+0xc8a/0x1330
[ 57.846363][ T5056] __kmem_cache_alloc_node+0x21d/0x300
[ 57.851815][ T5056] kmalloc_trace+0x2a/0x60
[ 57.856218][ T5056] syslog_print+0x121/0x9b0
[ 57.860712][ T5056] do_syslog+0x505/0x890
[ 57.864943][ T5056] __x64_sys_syslog+0x7c/0x90
[ 57.869608][ T5056] do_syscall_64+0x45/0x110
[ 57.874100][ T5056] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 57.879987][ T5056] page last free stack trace:
[ 57.884644][ T5056] free_unref_page_prepare+0x931/0xa60
[ 57.890091][ T5056] free_unref_page+0x37/0x3f0
[ 57.894758][ T5056] __unfreeze_partials+0x1e0/0x220
[ 57.899863][ T5056] put_cpu_partial+0x17b/0x250
[ 57.904612][ T5056] __slab_free+0x2b6/0x390
[ 57.909026][ T5056] qlist_free_all+0x75/0xe0
[ 57.913520][ T5056] kasan_quarantine_reduce+0x14b/0x160
[ 57.918975][ T5056] __kasan_slab_alloc+0x23/0x70
[ 57.923816][ T5056] slab_post_alloc_hook+0x6c/0x3c0
[ 57.928916][ T5056] __kmem_cache_alloc_node+0x1d0/0x300
[ 57.934365][ T5056] kmalloc_trace+0x2a/0x60
[ 57.938767][ T5056] tomoyo_init_log+0x11cd/0x2040
[ 57.943697][ T5056] tomoyo_supervisor+0x386/0x11f0
[ 57.948705][ T5056] tomoyo_env_perm+0x178/0x210
[ 57.953456][ T5056] tomoyo_find_next_domain+0x1383/0x1cf0
[ 57.959079][ T5056] tomoyo_bprm_check_security+0x114/0x170
[ 57.964788][ T5056]
[ 57.967107][ T5056] Memory state around the buggy address:
[ 57.972724][ T5056] ffff88807e7a5300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.980770][ T5056] ffff88807e7a5380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.988827][ T5056] >ffff88807e7a5400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 57.996878][ T5056] ^
[ 58.001190][ T5056] ffff88807e7a5480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 58.009322][ T5056] ffff88807e7a5500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 58.017456][ T5056] ==================================================================
[ 58.025725][ T5056] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 58.032921][ T5056] CPU: 1 PID: 5056 Comm: syz-executor179 Not tainted 6.7.0-rc5-syzkaller-00134-g3f7168591ebf #0
[ 58.043323][ T5056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 58.053369][ T5056] Call Trace:
[ 58.056640][ T5056]
[ 58.059581][ T5056] dump_stack_lvl+0x1e7/0x2d0
[ 58.064263][ T5056] ? nf_tcp_handle_invalid+0x650/0x650
[ 58.069717][ T5056] ? panic+0x850/0x850
[ 58.073774][ T5056] ? lockdep_hardirqs_on_prepare+0x43c/0x780
[ 58.079747][ T5056] ? vscnprintf+0x5d/0x80
[ 58.084066][ T5056] panic+0x349/0x850
[ 58.087952][ T5056] ? check_panic_on_warn+0x21/0xa0
[ 58.093058][ T5056] ? __memcpy_flushcache+0x2b0/0x2b0
[ 58.098347][ T5056] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 58.104320][ T5056] ? _raw_spin_unlock+0x40/0x40
[ 58.109160][ T5056] check_panic_on_warn+0x82/0xa0
[ 58.114098][ T5056] ? hfsplus_uni2asc+0x57a/0x11f0
[ 58.119116][ T5056] end_report+0x6e/0x140
[ 58.123352][ T5056] kasan_report+0x153/0x170
[ 58.127849][ T5056] ? hfsplus_uni2asc+0x57a/0x11f0
[ 58.132870][ T5056] hfsplus_uni2asc+0x57a/0x11f0
[ 58.137720][ T5056] ? __asan_memcpy+0x40/0x70
[ 58.142307][ T5056] hfsplus_readdir+0x92c/0x1310
[ 58.147160][ T5056] ? hfsplus_rename+0x1c0/0x1c0
[ 58.152018][ T5056] ? __mutex_lock+0x2ee/0xd60
[ 58.156689][ T5056] ? iterate_dir+0xd7/0x540
[ 58.161185][ T5056] ? down_read_interruptible+0xc50/0xc50
[ 58.166805][ T5056] ? __fdget_pos+0x2b0/0x340
[ 58.171395][ T5056] ? fsnotify_perm+0x43e/0x5a0
[ 58.176155][ T5056] iterate_dir+0x1cd/0x540
[ 58.180574][ T5056] __se_sys_getdents64+0x20d/0x4f0
[ 58.185680][ T5056] ? lockdep_hardirqs_on_prepare+0x43c/0x780
[ 58.191684][ T5056] ? __x64_sys_getdents64+0x80/0x80
[ 58.196878][ T5056] ? filldir+0x6a0/0x6a0
[ 58.201125][ T5056] ? syscall_enter_from_user_mode+0xa4/0x2d0
[ 58.207098][ T5056] ? syscall_enter_from_user_mode+0xf5/0x2d0
[ 58.213096][ T5056] do_syscall_64+0x45/0x110
[ 58.217616][ T5056] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 58.223515][ T5056] RIP: 0033:0x7ffb9c945649
[ 58.227917][ T5056] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 58.247517][ T5056] RSP: 002b:00007ffcba62a2f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 58.255937][ T5056] RAX: ffffffffffffffda RBX: 00007ffcba62a4c8 RCX: 00007ffb9c945649
[ 58.263946][ T5056] RDX: 0000000000000067 RSI: 0000000020000540 RDI: 0000000000000003
[ 58.271913][ T5056] RBP: 00007ffb9c9b8610 R08: 0000000000000651 R09: 00007ffcba62a4c8
[ 58.279878][ T5056] R10: 00007ffcba62a1b0 R11: 0000000000000246 R12: 0000000000000001
[ 58.287854][ T5056] R13: 00007ffcba62a4b8 R14: 0000000000000001 R15: 0000000000000001
[ 58.295838][ T5056]
[ 58.299052][ T5056] Kernel Offset: disabled
[ 58.303364][ T5056] Rebooting in 86400 seconds..