./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2318287999 <...> Warning: Permanently added '10.128.1.9' (ECDSA) to the list of known hosts. execve("./syz-executor2318287999", ["./syz-executor2318287999"], 0x7ffe7d3b5dd0 /* 10 vars */) = 0 brk(NULL) = 0x555556d61000 brk(0x555556d61c40) = 0x555556d61c40 arch_prctl(ARCH_SET_FS, 0x555556d61300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2318287999", 4096) = 28 brk(0x555556d82c40) = 0x555556d82c40 brk(0x555556d83000) = 0x555556d83000 mprotect(0x7f880363e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87fb173000 [ 53.022235][ T4991] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4991 'syz-executor231' write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 munmap(0x7f87fb173000, 16777216) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 53.192733][ T4991] loop0: detected capacity change from 0 to 32768 [ 53.205824][ T4991] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 53.214204][ T4991] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 53.226484][ T4991] gfs2: fsid=syz:syz.0: journal 0 mapped with 3 extents in 0ms [ 53.235523][ T4991] general protection fault, probably for non-canonical address 0xdffffc0000000097: 0000 [#1] PREEMPT SMP KASAN [ 53.247226][ T4991] KASAN: null-ptr-deref in range [0x00000000000004b8-0x00000000000004bf] [ 53.255616][ T4991] CPU: 0 PID: 4991 Comm: syz-executor231 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 [ 53.266000][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 53.276028][ T4991] RIP: 0010:gfs2_rindex_update+0xbc/0x3c0 [ 53.281744][ T4991] Code: e8 39 24 28 fe 4c 8d 74 24 60 48 8b 03 48 89 44 24 38 48 8d 98 b8 04 00 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 06 24 28 fe 48 8b 03 48 89 44 24 20 [ 53.301331][ T4991] RSP: 0018:ffffc9000399f1e0 EFLAGS: 00010202 [ 53.307378][ T4991] RAX: 0000000000000097 RBX: 00000000000004b8 RCX: dffffc0000000000 [ 53.315332][ T4991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807cd28000 [ 53.323281][ T4991] RBP: ffffc9000399f2f0 R08: ffffffff83b1dee4 R09: ffffed100e94a001 [ 53.331229][ T4991] R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92000733e44 [ 53.339186][ T4991] R13: ffff88807cd28000 R14: ffffc9000399f240 R15: 1ffff92000733ea0 [ 53.347146][ T4991] FS: 0000555556d61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 53.356064][ T4991] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.362632][ T4991] CR2: 0000000001ade398 CR3: 0000000027634000 CR4: 00000000003506f0 [ 53.370593][ T4991] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.378546][ T4991] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.386501][ T4991] Call Trace: [ 53.389765][ T4991] [ 53.392681][ T4991] ? __die_body+0x5e/0xa0 [ 53.396997][ T4991] ? die_addr+0x99/0xc0 [ 53.401138][ T4991] ? exc_general_protection+0x3c2/0x5b0 [ 53.406676][ T4991] ? asm_exc_general_protection+0x26/0x30 [ 53.412380][ T4991] ? punch_hole+0xe64/0x3a60 [ 53.416956][ T4991] ? gfs2_rindex_update+0xbc/0x3c0 [ 53.422055][ T4991] ? gfs2_ri_total+0x2a0/0x2a0 [ 53.426806][ T4991] ? gfs2_journal_wipe+0x9e0/0x9e0 [ 53.431903][ T4991] ? io_schedule+0x8c/0x100 [ 53.436398][ T4991] ? __fillup_metapath+0x262/0x2d0 [ 53.441502][ T4991] punch_hole+0xe78/0x3a60 [ 53.445905][ T4991] ? bit_wait+0xc0/0xc0 [ 53.450048][ T4991] ? __wait_on_bit+0x170/0x170 [ 53.454801][ T4991] ? bit_waitqueue+0x30/0x30 [ 53.459384][ T4991] ? gfs2_meta_read+0x76e/0x920 [ 53.464225][ T4991] ? __lock_acquire+0x1316/0x2070 [ 53.469236][ T4991] ? gfs2_meta_new+0x160/0x160 [ 53.473987][ T4991] ? gfs2_truncatei_resume+0x70/0x70 [ 53.479256][ T4991] ? gfs2_meta_buffer+0x278/0x410 [ 53.484270][ T4991] ? read_lock_is_recursive+0x20/0x20 [ 53.489637][ T4991] ? _raw_spin_unlock+0x28/0x40 [ 53.494478][ T4991] ? gfs2_glock_nq+0xcbf/0x16c0 [ 53.499336][ T4991] gfs2_truncatei_resume+0x3c/0x70 [ 53.504447][ T4991] gfs2_glock_wait+0x1df/0x2b0 [ 53.509205][ T4991] init_journal+0x167c/0x23e0 [ 53.513876][ T4991] ? init_inodes+0xdc/0x310 [ 53.518370][ T4991] ? _compound_head+0x130/0x130 [ 53.523214][ T4991] ? init_sb+0xc37/0x1330 [ 53.527541][ T4991] ? snprintf+0xda/0x120 [ 53.531783][ T4991] ? init_inodes+0xdc/0x310 [ 53.536279][ T4991] ? vscnprintf+0x80/0x80 [ 53.540603][ T4991] init_inodes+0xdc/0x310 [ 53.544927][ T4991] gfs2_fill_super+0x1d02/0x2840 [ 53.549869][ T4991] ? gfs2_reconfigure+0xd00/0xd00 [ 53.554883][ T4991] ? ptr_to_hashval+0x80/0x80 [ 53.559549][ T4991] ? init_locking+0xbd/0x210 [ 53.564138][ T4991] ? sb_set_blocksize+0x99/0x100 [ 53.569064][ T4991] get_tree_bdev+0x405/0x620 [ 53.573639][ T4991] ? gfs2_reconfigure+0xd00/0xd00 [ 53.578659][ T4991] gfs2_get_tree+0x54/0x210 [ 53.583150][ T4991] ? bpf_lsm_capable+0x9/0x10 [ 53.587810][ T4991] vfs_get_tree+0x8c/0x270 [ 53.592214][ T4991] do_new_mount+0x28f/0xae0 [ 53.596707][ T4991] ? path_mount+0x5f2/0xf80 [ 53.602062][ T4991] ? do_move_mount_old+0x170/0x170 [ 53.607162][ T4991] ? user_path_at_empty+0x12f/0x180 [ 53.612344][ T4991] __se_sys_mount+0x2d9/0x3c0 [ 53.617007][ T4991] ? __x64_sys_mount+0xc0/0xc0 [ 53.621756][ T4991] ? syscall_enter_from_user_mode+0x32/0x230 [ 53.627724][ T4991] ? __x64_sys_mount+0x20/0xc0 [ 53.632475][ T4991] do_syscall_64+0x41/0xc0 [ 53.636875][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.642755][ T4991] RIP: 0033:0x7f88035c0b1a [ 53.647155][ T4991] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 53.666744][ T4991] RSP: 002b:00007ffd93026fa8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 [ 53.675147][ T4991] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f88035c0b1a [ 53.683102][ T4991] RDX: 00000000200124c0 RSI: 0000000020000040 RDI: 00007ffd93026fc0 [ 53.691059][ T4991] RBP: 00007ffd93026fc0 R08: 00007ffd93027000 R09: 000000000001254b [ 53.699014][ T4991] R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000004 [ 53.706967][ T4991] R13: 0000555556d612c0 R14: 0000000000000000 R15: 00007ffd93027000 [ 53.714929][ T4991] [ 53.717950][ T4991] Modules linked in: [ 53.721971][ T4991] ---[ end trace 0000000000000000 ]--- [ 53.727459][ T4991] RIP: 0010:gfs2_rindex_update+0xbc/0x3c0 [ 53.733187][ T4991] Code: e8 39 24 28 fe 4c 8d 74 24 60 48 8b 03 48 89 44 24 38 48 8d 98 b8 04 00 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 06 24 28 fe 48 8b 03 48 89 44 24 20 [ 53.752983][ T4991] RSP: 0018:ffffc9000399f1e0 EFLAGS: 00010202 [ 53.759157][ T4991] RAX: 0000000000000097 RBX: 00000000000004b8 RCX: dffffc0000000000 [ 53.767169][ T4991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807cd28000 [ 53.775152][ T4991] RBP: ffffc9000399f2f0 R08: ffffffff83b1dee4 R09: ffffed100e94a001 [ 53.783099][ T4991] R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92000733e44 [ 53.791125][ T4991] R13: ffff88807cd28000 R14: ffffc9000399f240 R15: 1ffff92000733ea0 [ 53.799173][ T4991] FS: 0000555556d61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 53.808141][ T4991] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.814731][ T4991] CR2: 0000000001ade398 CR3: 0000000027634000 CR4: 00000000003506f0 [ 53.822730][ T4991] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.830745][ T4991] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.838746][ T4991] Kernel panic - not syncing: Fatal exception [ 53.844873][ T4991] Kernel Offset: disabled [ 53.849187][ T4991] Rebooting in 86400 seconds..