program: r0 = syz_mount_image$hfs(&(0x7f0000000140), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000000)=ANY=[], 0x8e, 0x2b9, &(0x7f0000000700)="$eJzs3T9v00AYx/Hf2WmS0lIMLUJCDKhQwYTasiCWSqjiNbCAgCZIFVErSpGAhYgZ8QLYWXgBvAgmhMQMExMvoJvROZfm3Nhxk6p2K74fKY1j35/nHMe+J1JqAfhv3Vv/9fn2H/swUqhQ0l0psJuuqibpoi41X23tbu522q1RDYVSU8nDSElNM1RmY6udVdXWS2o4kX1V06y/DscjjuP4d9VBoEpN9xxmbQykhvt0hn7h02TqwOtuKHUriuWkMHva02vNVR0HAKBapnd9D9x1ftbN34NAWnKXff/6//NsxfEezQ3tVR1Cxbzrf5Jlxca+v+eSTYN8L0nh7PagnyWO24+dPNbVO7JSE0yTziqHk8UklmD62WanfWtju9MK9F5rjldsQdKaWi5ndVLRDje9mLEura681sYyk4xhyo5hNSf++axOJ++xmPlmvptHJtIntfbnf7XY+GN279T9qUH8y3nNbb94aJ+jXqmcUZ5POrmc3rEjRxnmZSRyeyoOlf6CIErHWc+sVdeBWr3RreT15NqZz6y1WlBrwdb64tUaHM35NY+b+WgemEX91Vete/P/wO7tJQ1/MrMbSUq6I6M/nszcsJaUjPxV3SuZbQaTjQdjGOzjD3qqO5p7+ebt8yedTnun7AUbQ+mdstBb6B8EJyWeyRbsOdZfo6i9Uyun9/qRd11TRWUafuH0SA8u9D/Wh+i9f5IujLDkMxMqMXjT88u8KzMglM2ePEwv//PyleUkRbJ/ohHz9Lho2ua1uJKRGzT2C57xWjLu+/n8DGgmM4Praoyc69pN6bq3siDninRBmh451tPErOuHHvP9PwAAAAAAAAAAAAAAAAAAwGlTxq81vO74jz4AAAAAAAAAAAAAAAAAAAAAAEwg//6/TR3j/X9TvwM49P1/G0cYKIAh/wIAAP//7nlzRQ==") r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r1, 0x0, 0x0) syz_mount_image$cramfs(&(0x7f0000000440), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000600)=ANY=[@ANYRES8=0x0, @ANYRESHEX, @ANYRESHEX=0x0, @ANYRES32], 0xfc, 0x15e, &(0x7f0000000480)="$eJzs0U1rE0Ecx/Hv7E4ewIQoRggeTG5Gg5AH9CYhKwYDxgVFEE+BuKKQEDGgPTb02kOg1xz6cC19C0nbQ2lJLn0VveRW6HHL7CYs7Wv4f27zm+H3n519/3ZRVETeDfp//nrDofej8NltN79cTacNk8eB5J398PysAb/QzDQsR2Di0zT8/N3zrO6gZ9bLBiQA58Eqp59Zz3OympGGCr69zk4SwTlrNTLMnsA3el6NWLB+qsHJhH1lYL4Hz/FxHoVZBbgGbFDKXN5PhEWtUv6xgo1J6ejw4tP8vPXqZd3brjbHL1I5uwTs46jkmRU9yWLe/ui23UWtWn2TLFcsXl+aQjbH6A+pf/BdgTZ9FkFfnNwz/RW2FOwEs5bHKm0+YvfG7Yf3qJuC/3YBVH7S7eRiB53sQwu7qM2uzz3mFwU70YsIIYQQQgghhBBCCCGEEEIIIYQQkdsAAAD//7ILTbU=") (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000180)={"b7a0926538d6c5e723714bf619794457", 0x0, 0x0, {0x1, 0x75}, {0x0, 0x1ff}, 0x0, [0xaab, 0x4, 0xa, 0x1, 0x5, 0x4, 0x65f1, 0x8, 0x3, 0x0, 0x90000000, 0x5, 0x4e0288b8, 0x5cca, 0xfffffffffffffffe, 0x7]}) (async, rerun: 32) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.numa_stat\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r4, 0x81f8943c, &(0x7f0000000640)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0x40789440, &(0x7f00000001c0)={"00d0500000000009e51511194d2e45df", 0x0, r5, {}, {0x3}}) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000280)={"17ee03305f68ae800331181b5342830c", r2, r5, {0x5, 0x8001}, {0x5, 0x1ff}, 0xffffffffffffffff, [0x8fe, 0x7, 0xa3a, 0xfffffffffffffe00, 0x3, 0x6, 0x1ff, 0xfffffffffffff270, 0x4, 0x8, 0x0, 0x7fff, 0x9, 0xffffffffffffffff, 0x5, 0x5]}) (async) open(&(0x7f0000000080)='./file1/file0\x00', 0x200001, 0x0) (async, rerun: 32) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) (async, rerun: 32) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(r6, 0xc0106426, &(0x7f0000000100)={0x9, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) [ 69.186303][ T4672] Bluetooth: hci0: command tx timeout [ 69.225177][ T5322] loop0: detected capacity change from 0 to 64 [ 69.284027][ T5322] ================================================================== [ 69.287299][ T5322] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read+0x167/0x200 [ 69.290414][ T5322] Write of size 94 at addr ffff888040c63c00 by task syz.0.0/5322 [ 69.293551][ T5322] [ 69.294611][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-00624-g2f2d52945852 #0 [ 69.294625][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.294631][ T5322] Call Trace: [ 69.294637][ T5322] [ 69.294642][ T5322] dump_stack_lvl+0x241/0x360 [ 69.294659][ T5322] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.294670][ T5322] ? __pfx__printk+0x10/0x10 [ 69.294686][ T5322] ? _printk+0xd5/0x120 [ 69.294701][ T5322] ? __virt_addr_valid+0x183/0x530 [ 69.294717][ T5322] ? __virt_addr_valid+0x183/0x530 [ 69.294732][ T5322] print_report+0x16e/0x5b0 [ 69.294768][ T5322] ? __virt_addr_valid+0x183/0x530 [ 69.294783][ T5322] ? __virt_addr_valid+0x183/0x530 [ 69.294802][ T5322] ? __virt_addr_valid+0x45f/0x530 [ 69.294821][ T5322] ? __phys_addr+0xba/0x170 [ 69.294836][ T5322] ? hfs_bnode_read+0x167/0x200 [ 69.294850][ T5322] kasan_report+0x143/0x180 [ 69.294862][ T5322] ? hfs_bnode_read+0x167/0x200 [ 69.294876][ T5322] kasan_check_range+0x282/0x290 [ 69.294888][ T5322] ? hfs_bnode_read+0x167/0x200 [ 69.294900][ T5322] __asan_memcpy+0x40/0x70 [ 69.294910][ T5322] hfs_bnode_read+0x167/0x200 [ 69.294928][ T5322] hfs_bnode_read_key+0x172/0x240 [ 69.294941][ T5322] ? __pfx_hfs_bnode_read_key+0x10/0x10 [ 69.294953][ T5322] ? do_raw_spin_unlock+0x58/0x8b0 [ 69.294967][ T5322] ? hfs_bnode_put+0x1c4/0x380 [ 69.294981][ T5322] hfs_brec_insert+0x7f3/0xbd0 [ 69.294998][ T5322] ? __pfx_hfs_brec_insert+0x10/0x10 [ 69.295013][ T5322] hfs_cat_create+0x3dc/0x760 [ 69.295029][ T5322] ? __pfx_hfs_cat_create+0x10/0x10 [ 69.295046][ T5322] ? _raw_spin_unlock+0x28/0x50 [ 69.295105][ T5322] ? hfs_new_inode+0x8df/0xba0 [ 69.295117][ T5322] hfs_create+0x66/0xe0 [ 69.295131][ T5322] ? __pfx_hfs_create+0x10/0x10 [ 69.295145][ T5322] path_openat+0x1954/0x35b0 [ 69.295162][ T5322] ? __pfx_path_openat+0x10/0x10 [ 69.295176][ T5322] do_filp_open+0x282/0x4e0 [ 69.295187][ T5322] ? __pfx_do_filp_open+0x10/0x10 [ 69.295196][ T5322] ? do_raw_spin_lock+0x14f/0x370 [ 69.295216][ T5322] do_sys_openat2+0x122/0x1c0 [ 69.295230][ T5322] ? __might_fault+0xaa/0x120 [ 69.295246][ T5322] ? __pfx_do_sys_openat2+0x10/0x10 [ 69.295259][ T5322] ? rcu_is_watching+0x15/0xb0 [ 69.295271][ T5322] ? __rseq_handle_notify_resume+0x34d/0x14e0 [ 69.295289][ T5322] __x64_sys_openat+0x247/0x2a0 [ 69.295303][ T5322] ? __pfx___x64_sys_openat+0x10/0x10 [ 69.295317][ T5322] ? do_syscall_64+0x100/0x230 [ 69.295331][ T5322] ? do_syscall_64+0xb6/0x230 [ 69.295345][ T5322] do_syscall_64+0xf3/0x230 [ 69.295357][ T5322] ? clear_bhb_loop+0x35/0x90 [ 69.295373][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.295388][ T5322] RIP: 0033:0x7f84cc58d169 [ 69.295398][ T5322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.295414][ T5322] RSP: 002b:00007f84cd326038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 69.295427][ T5322] RAX: ffffffffffffffda RBX: 00007f84cc7a5fa0 RCX: 00007f84cc58d169 [ 69.295434][ T5322] RDX: 000000000000275a RSI: 0000200000000080 RDI: ffffffffffffff9c [ 69.295443][ T5322] RBP: 00007f84cc60e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 69.295449][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.295455][ T5322] R13: 0000000000000000 R14: 00007f84cc7a5fa0 R15: 00007ffdf2e96e68 [ 69.295465][ T5322] [ 69.295469][ T5322] [ 69.424754][ T5322] Allocated by task 5322: [ 69.426330][ T5322] kasan_save_track+0x3f/0x80 [ 69.428103][ T5322] __kasan_kmalloc+0x98/0xb0 [ 69.429845][ T5322] __kmalloc_noprof+0x285/0x4c0 [ 69.431674][ T5322] hfs_find_init+0x90/0x1f0 [ 69.433354][ T5322] hfs_cat_create+0x17f/0x760 [ 69.435145][ T5322] hfs_create+0x66/0xe0 [ 69.436688][ T5322] path_openat+0x1954/0x35b0 [ 69.438459][ T5322] do_filp_open+0x282/0x4e0 [ 69.440280][ T5322] do_sys_openat2+0x122/0x1c0 [ 69.442165][ T5322] __x64_sys_openat+0x247/0x2a0 [ 69.444085][ T5322] do_syscall_64+0xf3/0x230 [ 69.445993][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.448325][ T5322] [ 69.449265][ T5322] The buggy address belongs to the object at ffff888040c63c00 [ 69.449265][ T5322] which belongs to the cache kmalloc-96 of size 96 [ 69.454642][ T5322] The buggy address is located 0 bytes inside of [ 69.454642][ T5322] allocated 78-byte region [ffff888040c63c00, ffff888040c63c4e) [ 69.459891][ T5322] [ 69.460811][ T5322] The buggy address belongs to the physical page: [ 69.463227][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x40c63 [ 69.466730][ T5322] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 69.469604][ T5322] page_type: f5(slab) [ 69.471312][ T5322] raw: 04fff00000000000 ffff88801b041280 dead000000000122 0000000000000000 [ 69.474566][ T5322] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 69.478098][ T5322] page dumped because: kasan: bad access detected [ 69.480796][ T5322] page_owner tracks the page as allocated [ 69.483206][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 1038, tgid 1038 (kworker/u4:7), ts 69269135778, free_ts 69249541690 [ 69.491179][ T5322] post_alloc_hook+0x1f4/0x240 [ 69.493251][ T5322] get_page_from_freelist+0x365c/0x37a0 [ 69.495615][ T5322] __alloc_frozen_pages_noprof+0x292/0x710 [ 69.498001][ T5322] allocate_slab+0x66/0x3a0 [ 69.499918][ T5322] ___slab_alloc+0xc27/0x14a0 [ 69.501857][ T5322] __slab_alloc+0x58/0xa0 [ 69.503702][ T5322] __kmalloc_node_noprof+0x2ee/0x4d0 [ 69.505940][ T5322] allocate_slab+0x179/0x3a0 [ 69.507710][ T5322] ___slab_alloc+0xc27/0x14a0 [ 69.509620][ T5322] __slab_alloc+0x58/0xa0 [ 69.511291][ T5322] kmem_cache_alloc_noprof+0x268/0x380 [ 69.513459][ T5322] dst_alloc+0x12b/0x190 [ 69.515181][ T5322] icmp6_dst_alloc+0x77/0x420 [ 69.517031][ T5322] mld_sendpack+0x6a3/0xdb0 [ 69.518962][ T5322] ipv6_mc_dad_complete+0x88/0x490 [ 69.520999][ T5322] addrconf_dad_completed+0x712/0xcd0 [ 69.523182][ T5322] page last free pid 5322 tgid 5321 stack trace: [ 69.525741][ T5322] free_frozen_pages+0xe0d/0x10e0 [ 69.527757][ T5322] __slab_free+0x2c2/0x380 [ 69.529558][ T5322] qlist_free_all+0x9a/0x140 [ 69.531412][ T5322] kasan_quarantine_reduce+0x14f/0x170 [ 69.533638][ T5322] __kasan_slab_alloc+0x23/0x80 [ 69.535679][ T5322] __kmalloc_noprof+0x236/0x4c0 [ 69.537659][ T5322] tomoyo_encode+0x26f/0x540 [ 69.539606][ T5322] tomoyo_mount_permission+0x359/0xb80 [ 69.541816][ T5322] security_sb_mount+0xe0/0x2f0 [ 69.543866][ T5322] path_mount+0xb9/0xfa0 [ 69.545567][ T5322] __se_sys_mount+0x2d6/0x3c0 [ 69.547536][ T5322] do_syscall_64+0xf3/0x230 [ 69.549362][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.552429][ T5322] [ 69.553711][ T5322] Memory state around the buggy address: [ 69.556043][ T5322] ffff888040c63b00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 69.559232][ T5322] ffff888040c63b80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 69.562410][ T5322] >ffff888040c63c00: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc [ 69.565565][ T5322] ^ [ 69.568182][ T5322] ffff888040c63c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.571283][ T5322] ffff888040c63d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.574441][ T5322] ================================================================== [ 69.601726][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 69.604703][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-00624-g2f2d52945852 #0 [ 69.608580][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.612707][ T5322] Call Trace: [ 69.614028][ T5322] [ 69.615313][ T5322] dump_stack_lvl+0x241/0x360 [ 69.617294][ T5322] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.619512][ T5322] ? __pfx__printk+0x10/0x10 [ 69.621479][ T5322] ? preempt_schedule+0xe1/0xf0 [ 69.623551][ T5322] ? vscnprintf+0x5d/0x90 [ 69.625390][ T5322] panic+0x349/0x880 [ 69.627116][ T5322] ? check_panic_on_warn+0x21/0xb0 [ 69.629375][ T5322] ? __pfx_panic+0x10/0x10 [ 69.631308][ T5322] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 69.633828][ T5322] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 69.636534][ T5322] ? print_report+0x519/0x5b0 [ 69.638488][ T5322] check_panic_on_warn+0x86/0xb0 [ 69.640601][ T5322] ? hfs_bnode_read+0x167/0x200 [ 69.642660][ T5322] end_report+0x77/0x160 [ 69.644562][ T5322] kasan_report+0x154/0x180 [ 69.646473][ T5322] ? hfs_bnode_read+0x167/0x200 [ 69.648431][ T5322] kasan_check_range+0x282/0x290 [ 69.650415][ T5322] ? hfs_bnode_read+0x167/0x200 [ 69.652410][ T5322] __asan_memcpy+0x40/0x70 [ 69.654164][ T5322] hfs_bnode_read+0x167/0x200 [ 69.656116][ T5322] hfs_bnode_read_key+0x172/0x240 [ 69.658107][ T5322] ? __pfx_hfs_bnode_read_key+0x10/0x10 [ 69.660305][ T5322] ? do_raw_spin_unlock+0x58/0x8b0 [ 69.662354][ T5322] ? hfs_bnode_put+0x1c4/0x380 [ 69.664407][ T5322] hfs_brec_insert+0x7f3/0xbd0 [ 69.666421][ T5322] ? __pfx_hfs_brec_insert+0x10/0x10 [ 69.668634][ T5322] hfs_cat_create+0x3dc/0x760 [ 69.670520][ T5322] ? __pfx_hfs_cat_create+0x10/0x10 [ 69.672717][ T5322] ? _raw_spin_unlock+0x28/0x50 [ 69.674698][ T5322] ? hfs_new_inode+0x8df/0xba0 [ 69.676526][ T5322] hfs_create+0x66/0xe0 [ 69.678111][ T5322] ? __pfx_hfs_create+0x10/0x10 [ 69.679971][ T5322] path_openat+0x1954/0x35b0 [ 69.681747][ T5322] ? __pfx_path_openat+0x10/0x10 [ 69.683619][ T5322] do_filp_open+0x282/0x4e0 [ 69.685336][ T5322] ? __pfx_do_filp_open+0x10/0x10 [ 69.687233][ T5322] ? do_raw_spin_lock+0x14f/0x370 [ 69.689133][ T5322] do_sys_openat2+0x122/0x1c0 [ 69.690909][ T5322] ? __might_fault+0xaa/0x120 [ 69.692658][ T5322] ? __pfx_do_sys_openat2+0x10/0x10 [ 69.694679][ T5322] ? rcu_is_watching+0x15/0xb0 [ 69.696731][ T5322] ? __rseq_handle_notify_resume+0x34d/0x14e0 [ 69.699224][ T5322] __x64_sys_openat+0x247/0x2a0 [ 69.701224][ T5322] ? __pfx___x64_sys_openat+0x10/0x10 [ 69.703520][ T5322] ? do_syscall_64+0x100/0x230 [ 69.705929][ T5322] ? do_syscall_64+0xb6/0x230 [ 69.707967][ T5322] do_syscall_64+0xf3/0x230 [ 69.709821][ T5322] ? clear_bhb_loop+0x35/0x90 [ 69.711738][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.714169][ T5322] RIP: 0033:0x7f84cc58d169 [ 69.715894][ T5322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.723358][ T5322] RSP: 002b:00007f84cd326038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 69.726648][ T5322] RAX: ffffffffffffffda RBX: 00007f84cc7a5fa0 RCX: 00007f84cc58d169 [ 69.729641][ T5322] RDX: 000000000000275a RSI: 0000200000000080 RDI: ffffffffffffff9c [ 69.732684][ T5322] RBP: 00007f84cc60e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 69.735799][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.738895][ T5322] R13: 0000000000000000 R14: 00007f84cc7a5fa0 R15: 00007ffdf2e96e68 [ 69.741931][ T5322] [ 69.743484][ T5322] Kernel Offset: disabled [ 69.745262][ T5322] Rebooting in 86400 seconds..