./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2331974186
<...>
Warning: Permanently added '10.128.0.242' (ED25519) to the list of known hosts.
execve("./syz-executor2331974186", ["./syz-executor2331974186"], 0x7ffdc658e4b0 /* 10 vars */) = 0
brk(NULL) = 0x555556825000
brk(0x555556825d00) = 0x555556825d00
arch_prctl(ARCH_SET_FS, 0x555556825380) = 0
set_tid_address(0x555556825650) = 5042
set_robust_list(0x555556825660, 24) = 0
rseq(0x555556825ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2331974186", 4096) = 28
getrandom("\xf2\x95\x06\x91\x11\xd4\x1a\xbb", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555556825d00
brk(0x555556846d00) = 0x555556846d00
brk(0x555556847000) = 0x555556847000
mprotect(0x7f003781e000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f002f200000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32394836) = 32394836
munmap(0x7f002f200000, 138412032) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
close(4) = 0
mkdir("./bus", 0777) = 0
[ 67.551533][ T5042] loop0: detected capacity change from 0 to 63271
[ 67.583005][ T5042] F2FS-fs (loop0): Mismatch start address, segment0(512) cp_blkaddr(605)
[ 67.591598][ T5042] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 67.600330][ T5042] F2FS-fs (loop0): Unrecognized mount option "18446744073709551615184467440737095516150177777777777777777777718446744073709551615”źû÷ǘ$H¦Qs¾G™" or missing value
[ 67.618972][ T5042] ==================================================================
[ 67.627063][ T5042] BUG: KASAN: slab-use-after-free in kill_f2fs_super+0x618/0x690
[ 67.634863][ T5042] Read of size 4 at addr ffff8880232cd77c by task syz-executor233/5042
[ 67.643096][ T5042]
[ 67.645445][ T5042] CPU: 1 PID: 5042 Comm: syz-executor233 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
[ 67.655527][ T5042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 67.665595][ T5042] Call Trace:
[ 67.668873][ T5042]
[ 67.671801][ T5042] dump_stack_lvl+0x1e7/0x2d0
[ 67.676493][ T5042] ? tcp_gro_dev_warn+0x260/0x260
[ 67.681542][ T5042] ? panic+0x850/0x850
[ 67.685625][ T5042] ? _printk+0xd5/0x120
[ 67.689788][ T5042] ? __virt_addr_valid+0x17e/0x480
[ 67.694928][ T5042] print_report+0x163/0x540
[ 67.699468][ T5042] ? __virt_addr_valid+0x17e/0x480
[ 67.704609][ T5042] ? __virt_addr_valid+0x3d1/0x480
[ 67.709736][ T5042] ? __phys_addr+0xba/0x170
[ 67.714248][ T5042] ? kill_f2fs_super+0x618/0x690
[ 67.719193][ T5042] kasan_report+0x142/0x170
[ 67.723713][ T5042] ? kill_f2fs_super+0x618/0x690
[ 67.728681][ T5042] kill_f2fs_super+0x618/0x690
[ 67.733477][ T5042] ? f2fs_mount+0x40/0x40
[ 67.737825][ T5042] ? radix_tree_delete_item+0x2e0/0x3f0
[ 67.743393][ T5042] ? shrinker_free+0x2c3/0x3d0
[ 67.748172][ T5042] deactivate_locked_super+0xc1/0x130
[ 67.753560][ T5042] mount_bdev+0x222/0x2d0
[ 67.757929][ T5042] ? kill_f2fs_super+0x690/0x690
[ 67.762905][ T5042] ? get_tree_bdev+0x560/0x560
[ 67.767690][ T5042] ? vfs_parse_fs_string+0x190/0x230
[ 67.772980][ T5042] ? vfs_parse_fs_param+0x410/0x410
[ 67.778182][ T5042] ? cap_capable+0x1b4/0x240
[ 67.782784][ T5042] legacy_get_tree+0xef/0x190
[ 67.787467][ T5042] ? trace_raw_output_f2fs__rw_end+0x110/0x110
[ 67.793626][ T5042] vfs_get_tree+0x8c/0x2a0
[ 67.798059][ T5042] do_new_mount+0x2be/0xb40
[ 67.802572][ T5042] ? ns_capable+0x89/0xe0
[ 67.806914][ T5042] ? do_move_mount_old+0x170/0x170
[ 67.812043][ T5042] __se_sys_mount+0x2d9/0x3c0
[ 67.816731][ T5042] ? __x64_sys_mount+0xc0/0xc0
[ 67.821544][ T5042] ? rcu_is_watching+0x15/0xb0
[ 67.826434][ T5042] ? __x64_sys_mount+0x20/0xc0
[ 67.831219][ T5042] do_syscall_64+0xf5/0x230
[ 67.835735][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 67.841662][ T5042] RIP: 0033:0x7f00377a4c7a
[ 67.846104][ T5042] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 67.865724][ T5042] RSP: 002b:00007ffea1faa708 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 67.874149][ T5042] RAX: ffffffffffffffda RBX: 00007ffea1faa720 RCX: 00007f00377a4c7a
[ 67.882133][ T5042] RDX: 00000000200000c0 RSI: 0000000020010280 RDI: 00007ffea1faa720
[ 67.890113][ T5042] RBP: 0000000000000010 R08: 00007ffea1faa760 R09: 0000000000007e5e
[ 67.898090][ T5042] R10: 0000000000000010 R11: 0000000000000286 R12: 0000000000000004
[ 67.906152][ T5042] R13: 00007ffea1faa760 R14: 0000000000000003 R15: 0000000001ee4e54
[ 67.914135][ T5042]
[ 67.917156][ T5042]
[ 67.919479][ T5042] Allocated by task 5042:
[ 67.923804][ T5042] kasan_save_track+0x3f/0x70
[ 67.928496][ T5042] __kasan_kmalloc+0x98/0xb0
[ 67.933098][ T5042] kmalloc_trace+0x1d6/0x360
[ 67.937700][ T5042] f2fs_fill_super+0xce/0x8170
[ 67.942465][ T5042] mount_bdev+0x206/0x2d0
[ 67.946814][ T5042] legacy_get_tree+0xef/0x190
[ 67.951497][ T5042] vfs_get_tree+0x8c/0x2a0
[ 67.955932][ T5042] do_new_mount+0x2be/0xb40
[ 67.960446][ T5042] __se_sys_mount+0x2d9/0x3c0
[ 67.965137][ T5042] do_syscall_64+0xf5/0x230
[ 67.969648][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 67.975555][ T5042]
[ 67.977884][ T5042] Freed by task 5042:
[ 67.981860][ T5042] kasan_save_track+0x3f/0x70
[ 67.986556][ T5042] kasan_save_free_info+0x4e/0x60
[ 67.991594][ T5042] poison_slab_object+0xa6/0xe0
[ 67.996454][ T5042] __kasan_slab_free+0x34/0x60
[ 68.001227][ T5042] kfree+0x14a/0x380
[ 68.005130][ T5042] f2fs_fill_super+0x6b04/0x8170
[ 68.010072][ T5042] mount_bdev+0x206/0x2d0
[ 68.014410][ T5042] legacy_get_tree+0xef/0x190
[ 68.019088][ T5042] vfs_get_tree+0x8c/0x2a0
[ 68.023514][ T5042] do_new_mount+0x2be/0xb40
[ 68.028028][ T5042] __se_sys_mount+0x2d9/0x3c0
[ 68.032723][ T5042] do_syscall_64+0xf5/0x230
[ 68.037228][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 68.043137][ T5042]
[ 68.045459][ T5042] The buggy address belongs to the object at ffff8880232cc000
[ 68.045459][ T5042] which belongs to the cache kmalloc-8k of size 8192
[ 68.059517][ T5042] The buggy address is located 6012 bytes inside of
[ 68.059517][ T5042] freed 8192-byte region [ffff8880232cc000, ffff8880232ce000)
[ 68.073493][ T5042]
[ 68.075817][ T5042] The buggy address belongs to the physical page:
[ 68.082227][ T5042] page:ffffea00008cb200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x232c8
[ 68.092379][ T5042] head:ffffea00008cb200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 68.101312][ T5042] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 68.109728][ T5042] page_type: 0xffffffff()
[ 68.114063][ T5042] raw: 00fff00000000840 ffff888012c42280 ffffea0000909c00 0000000000000005
[ 68.122648][ T5042] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000
[ 68.131228][ T5042] page dumped because: kasan: bad access detected
[ 68.137641][ T5042] page_owner tracks the page as allocated
[ 68.143351][ T5042] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4701, tgid 4701 (S40network), ts 40725830505, free_ts 40712614394
[ 68.163765][ T5042] post_alloc_hook+0x1e6/0x210
[ 68.168545][ T5042] get_page_from_freelist+0x33ea/0x3570
[ 68.174096][ T5042] __alloc_pages+0x255/0x680
[ 68.178690][ T5042] alloc_slab_page+0x5f/0x160
[ 68.183371][ T5042] new_slab+0x84/0x2f0
[ 68.187444][ T5042] ___slab_alloc+0xd17/0x13d0
[ 68.192122][ T5042] kmalloc_trace+0x25d/0x360
[ 68.196730][ T5042] tomoyo_init_log+0x11cd/0x2040
[ 68.201679][ T5042] tomoyo_supervisor+0x386/0x11f0
[ 68.206708][ T5042] tomoyo_env_perm+0x178/0x210
[ 68.211475][ T5042] tomoyo_find_next_domain+0x1383/0x1cf0
[ 68.217114][ T5042] tomoyo_bprm_check_security+0x114/0x170
[ 68.222860][ T5042] security_bprm_check+0x63/0xa0
[ 68.227806][ T5042] bprm_execve+0x95f/0x18a0
[ 68.232308][ T5042] do_execveat_common+0x580/0x720
[ 68.237336][ T5042] __x64_sys_execve+0x92/0xa0
[ 68.242020][ T5042] page last free pid 4700 tgid 4700 stack trace:
[ 68.248356][ T5042] free_unref_page_prepare+0x959/0xa80
[ 68.253823][ T5042] free_unref_page+0x37/0x3f0
[ 68.258503][ T5042] __put_partials+0xeb/0x130
[ 68.263099][ T5042] put_cpu_partial+0x17b/0x250
[ 68.267864][ T5042] __slab_free+0x2fe/0x410
[ 68.272283][ T5042] qlist_free_all+0x6d/0xd0
[ 68.276788][ T5042] kasan_quarantine_reduce+0x14b/0x160
[ 68.282252][ T5042] __kasan_slab_alloc+0x23/0x70
[ 68.287110][ T5042] kmem_cache_alloc+0x16f/0x340
[ 68.291967][ T5042] getname_flags+0xbc/0x4f0
[ 68.296476][ T5042] do_sys_openat2+0xd2/0x1d0
[ 68.301081][ T5042] __x64_sys_openat+0x247/0x290
[ 68.305948][ T5042] do_syscall_64+0xf5/0x230
[ 68.310456][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 68.316359][ T5042]
[ 68.318684][ T5042] Memory state around the buggy address:
[ 68.324311][ T5042] ffff8880232cd600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.332374][ T5042] ffff8880232cd680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.340462][ T5042] >ffff8880232cd700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.348527][ T5042] ^
[ 68.356539][ T5042] ffff8880232cd780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.364690][ T5042] ffff8880232cd800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.372749][ T5042] ==================================================================
[ 68.381088][ T5042] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 68.388332][ T5042] CPU: 0 PID: 5042 Comm: syz-executor233 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
[ 68.398400][ T5042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 68.408543][ T5042] Call Trace:
[ 68.411854][ T5042]
[ 68.414787][ T5042] dump_stack_lvl+0x1e7/0x2d0
[ 68.419476][ T5042] ? tcp_gro_dev_warn+0x260/0x260
[ 68.424504][ T5042] ? panic+0x850/0x850
[ 68.428579][ T5042] ? rcu_is_watching+0x15/0xb0
[ 68.433359][ T5042] ? vscnprintf+0x5d/0x80
[ 68.437703][ T5042] panic+0x349/0x850
[ 68.441616][ T5042] ? check_panic_on_warn+0x21/0xa0
[ 68.446734][ T5042] ? __memcpy_flushcache+0x2b0/0x2b0
[ 68.452035][ T5042] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 68.458033][ T5042] ? _raw_spin_unlock+0x40/0x40
[ 68.462922][ T5042] ? print_report+0x4fb/0x540
[ 68.467616][ T5042] check_panic_on_warn+0x82/0xa0
[ 68.472559][ T5042] ? kill_f2fs_super+0x618/0x690
[ 68.477527][ T5042] end_report+0x6e/0x140
[ 68.481780][ T5042] kasan_report+0x153/0x170
[ 68.486293][ T5042] ? kill_f2fs_super+0x618/0x690
[ 68.491237][ T5042] kill_f2fs_super+0x618/0x690
[ 68.496014][ T5042] ? f2fs_mount+0x40/0x40
[ 68.500353][ T5042] ? radix_tree_delete_item+0x2e0/0x3f0
[ 68.505914][ T5042] ? shrinker_free+0x2c3/0x3d0
[ 68.510689][ T5042] deactivate_locked_super+0xc1/0x130
[ 68.516075][ T5042] mount_bdev+0x222/0x2d0
[ 68.520417][ T5042] ? kill_f2fs_super+0x690/0x690
[ 68.525370][ T5042] ? get_tree_bdev+0x560/0x560
[ 68.530160][ T5042] ? vfs_parse_fs_string+0x190/0x230
[ 68.535474][ T5042] ? vfs_parse_fs_param+0x410/0x410
[ 68.540682][ T5042] ? cap_capable+0x1b4/0x240
[ 68.545277][ T5042] legacy_get_tree+0xef/0x190
[ 68.549967][ T5042] ? trace_raw_output_f2fs__rw_end+0x110/0x110
[ 68.556139][ T5042] vfs_get_tree+0x8c/0x2a0
[ 68.560569][ T5042] do_new_mount+0x2be/0xb40
[ 68.565080][ T5042] ? ns_capable+0x89/0xe0
[ 68.569419][ T5042] ? do_move_mount_old+0x170/0x170
[ 68.574544][ T5042] __se_sys_mount+0x2d9/0x3c0
[ 68.579237][ T5042] ? __x64_sys_mount+0xc0/0xc0
[ 68.584010][ T5042] ? rcu_is_watching+0x15/0xb0
[ 68.588793][ T5042] ? __x64_sys_mount+0x20/0xc0
[ 68.593601][ T5042] do_syscall_64+0xf5/0x230
[ 68.598127][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 68.604054][ T5042] RIP: 0033:0x7f00377a4c7a
[ 68.608498][ T5042] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 68.628118][ T5042] RSP: 002b:00007ffea1faa708 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 68.636542][ T5042] RAX: ffffffffffffffda RBX: 00007ffea1faa720 RCX: 00007f00377a4c7a
[ 68.644557][ T5042] RDX: 00000000200000c0 RSI: 0000000020010280 RDI: 00007ffea1faa720
[ 68.652546][ T5042] RBP: 0000000000000010 R08: 00007ffea1faa760 R09: 0000000000007e5e
[ 68.660521][ T5042] R10: 0000000000000010 R11: 0000000000000286 R12: 0000000000000004
[ 68.668503][ T5042] R13: 00007ffea1faa760 R14: 0000000000000003 R15: 0000000001ee4e54
[ 68.676490][ T5042]
[ 68.679713][ T5042] Kernel Offset: disabled
[ 68.684037][ T5042] Rebooting in 86400 seconds..