Warning: Permanently added '10.128.0.239' (ED25519) to the list of known hosts. executing program [ 734.723889][ T6297] loop2: detected capacity change from 0 to 128 executing program executing program executing program [ 734.769324][ T6301] loop0: detected capacity change from 0 to 128 executing program [ 734.775248][ T6302] loop1: detected capacity change from 0 to 128 [ 734.781246][ T6297] syz-executor314: attempt to access beyond end of device [ 734.781246][ T6297] loop2: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 734.784840][ T6297] Buffer I/O error on dev loop2, logical block 3245768, async page read [ 734.788701][ T6305] loop4: detected capacity change from 0 to 128 [ 734.790023][ T6306] loop3: detected capacity change from 0 to 128 [ 734.793276][ T6302] syz-executor314: attempt to access beyond end of device [ 734.793276][ T6302] loop1: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 734.796717][ T6302] Buffer I/O error on dev loop1, logical block 3245768, async page read [ 734.800134][ T6297] syz-executor314: attempt to access beyond end of device [ 734.800134][ T6297] loop2: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 734.801844][ T6305] syz-executor314: attempt to access beyond end of device [ 734.801844][ T6305] loop4: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 734.803473][ T6297] Buffer I/O error on dev loop2, logical block 8833403, async page read [ 734.803505][ T6297] syz-executor314: attempt to access beyond end of device [ 734.803505][ T6297] loop2: rw=0, sector=26539618, nr_sectors = 2 limit=128 [ 734.813436][ T6301] syz-executor314: attempt to access beyond end of device [ 734.813436][ T6301] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 734.814309][ T6305] Buffer I/O error on dev loop4, logical block 3245768, async page read [ 734.820189][ T6301] Buffer I/O error on dev loop0, logical block 3245768, async page read [ 734.821559][ T6305] syz-executor314: attempt to access beyond end of device [ 734.821559][ T6305] loop4: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 734.822575][ T6306] syz-executor314: attempt to access beyond end of device [ 734.822575][ T6306] loop3: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 734.829710][ T6301] syz-executor314: attempt to access beyond end of device [ 734.829710][ T6301] loop0: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 734.833650][ T6305] Buffer I/O error on dev loop4, logical block 8833403, async page read [ 734.838595][ T6302] syz-executor314: attempt to access beyond end of device [ 734.838595][ T6302] loop1: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 734.839359][ T6305] Buffer I/O error on dev loop4, logical block 13269809, async page read [ 734.842150][ T6302] Buffer I/O error on dev loop1, logical block 8833403, async page read [ 734.842186][ T6302] Buffer I/O error on dev loop1, logical block 13269809, async page read [ 734.842208][ T6302] Buffer I/O error on dev loop1, logical block 8073606, async page read [ 846.200832][ T6301] bio_check_eod: 40 callbacks suppressed [ 846.200851][ T6301] syz-executor314: attempt to access beyond end of device [ 846.200851][ T6301] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 846.205717][ T6301] buffer_io_error: 40 callbacks suppressed [ 846.205727][ T6301] Buffer I/O error on dev loop0, logical block 3245768, async page read [ 846.209616][ T6301] syz-executor314: attempt to access beyond end of device [ 846.209616][ T6301] loop0: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 846.212956][ T6301] Buffer I/O error on dev loop0, logical block 8833403, async page read [ 846.215022][ T6301] syz-executor314: attempt to access beyond end of device [ 846.215022][ T6301] loop0: rw=0, sector=26539618, nr_sectors = 2 limit=128 [ 846.296809][ T6301] Buffer I/O error on dev loop0, logical block 13269809, async page read [ 846.298885][ T6301] syz-executor314: attempt to access beyond end of device [ 846.298885][ T6301] loop0: rw=0, sector=16147212, nr_sectors = 2 limit=128 [ 846.302220][ T6301] Buffer I/O error on dev loop0, logical block 8073606, async page read [ 846.521607][ T6305] syz-executor314: attempt to access beyond end of device [ 846.521607][ T6305] loop4: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 846.525058][ T6305] Buffer I/O error on dev loop4, logical block 3245768, async page read [ 846.534522][ T6305] syz-executor314: attempt to access beyond end of device [ 846.534522][ T6305] loop4: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 846.538220][ T6305] Buffer I/O error on dev loop4, logical block 8833403, async page read [ 846.540511][ T6305] syz-executor314: attempt to access beyond end of device [ 846.540511][ T6305] loop4: rw=0, sector=26539618, nr_sectors = 2 limit=128 [ 846.544018][ T6305] Buffer I/O error on dev loop4, logical block 13269809, async page read [ 846.546047][ T6305] syz-executor314: attempt to access beyond end of device [ 846.546047][ T6305] loop4: rw=0, sector=16147212, nr_sectors = 2 limit=128 [ 846.549779][ T6305] Buffer I/O error on dev loop4, logical block 8073606, async page read [ 846.939653][ T6302] syz-executor314: attempt to access beyond end of device [ 846.939653][ T6302] loop1: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 846.942845][ T6302] Buffer I/O error on dev loop1, logical block 3245768, async page read [ 846.944699][ T6302] syz-executor314: attempt to access beyond end of device [ 846.944699][ T6302] loop1: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 846.977663][ T6302] Buffer I/O error on dev loop1, logical block 8833403, async page read [ 849.322594][ T6306] ================================================================== [ 849.324522][ T6306] BUG: KASAN: use-after-free in sysv_new_inode+0xd24/0xe9c [ 849.326135][ T6306] Read of size 2 at addr ffff0000ddb431ce by task syz-executor314/6306 [ 849.327930][ T6306] [ 849.328435][ T6306] CPU: 1 PID: 6306 Comm: syz-executor314 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 [ 849.330755][ T6306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 849.333158][ T6306] Call trace: [ 849.333914][ T6306] dump_backtrace+0x1b8/0x1e4 [ 849.335205][ T6306] show_stack+0x2c/0x3c [ 849.336202][ T6306] dump_stack_lvl+0xe4/0x150 [ 849.337339][ T6306] print_report+0x198/0x538 [ 849.338436][ T6306] kasan_report+0xd8/0x138 [ 849.339427][ T6306] __asan_report_load2_noabort+0x20/0x2c [ 849.340740][ T6306] sysv_new_inode+0xd24/0xe9c [ 849.341821][ T6306] sysv_mknod+0x5c/0x100 [ 849.342915][ T6306] sysv_create+0x38/0x4c [ 849.343909][ T6306] path_openat+0xfb4/0x2830 [ 849.344973][ T6306] do_filp_open+0x1bc/0x3cc [ 849.346031][ T6306] do_sys_openat2+0x124/0x1b8 [ 849.347106][ T6306] __arm64_sys_openat+0x1f0/0x240 [ 849.348330][ T6306] invoke_syscall+0x98/0x2b8 [ 849.349463][ T6306] el0_svc_common+0x130/0x23c [ 849.350605][ T6306] do_el0_svc+0x48/0x58 [ 849.351685][ T6306] el0_svc+0x54/0x168 [ 849.352621][ T6306] el0t_64_sync_handler+0x84/0xfc [ 849.353746][ T6306] el0t_64_sync+0x190/0x194 [ 849.354878][ T6306] [ 849.355419][ T6306] The buggy address belongs to the physical page: [ 849.357022][ T6306] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x11db43 [ 849.359168][ T6306] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 849.360866][ T6306] page_type: 0xffffffff() [ 849.361818][ T6306] raw: 05ffc00000000000 dead000000000100 dead000000000122 0000000000000000 [ 849.363798][ T6306] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 849.365776][ T6306] page dumped because: kasan: bad access detected [ 849.367383][ T6306] [ 849.367892][ T6306] Memory state around the buggy address: [ 849.369281][ T6306] ffff0000ddb43080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 849.371225][ T6306] ffff0000ddb43100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 849.373125][ T6306] >ffff0000ddb43180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 849.375068][ T6306] ^ [ 849.376648][ T6306] ffff0000ddb43200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 849.378613][ T6306] ffff0000ddb43280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 849.380580][ T6306] ================================================================== [ 849.547108][ T6306] Disabling lock debugging due to kernel taint [ 855.855781][ T6290] sysv_free_block: flc_count > flc_size [ 855.866826][ T6290] sysv_free_block: flc_count > flc_size [ 855.868242][ T6290] sysv_free_block: flc_count > flc_size [ 855.869589][ T6290] sysv_free_block: flc_count > flc_size [ 855.870942][ T6290] sysv_free_block: flc_count > flc_size [ 855.872310][ T6290] sysv_free_block: flc_count > flc_size [ 855.873668][ T6290] sysv_free_block: flc_count > flc_size [ 855.875039][ T6290] sysv_free_block: flc_count > flc_size [ 855.876350][ T6290] sysv_free_block: flc_count > flc_size [ 855.926898][ T6290] sysv_free_block: flc_count > flc_size [ 855.928374][ T6290] sysv_free_inode: inode 0,1,2 or nonexistent inode [ 856.209009][ T6296] sysv_free_block: flc_count > flc_size [ 856.210458][ T6296] sysv_free_block: flc_count > flc_size [ 856.211858][ T6296] sysv_free_block: flc_count > flc_size [ 856.213162][ T6296] sysv_free_block: flc_count > flc_size [ 856.214602][ T6296] sysv_free_block: flc_count > flc_size [ 856.215980][ T6296] sysv_free_block: flc_count > flc_size [ 856.227002][ T6296] sysv_free_block: flc_count > flc_size [ 856.228437][ T6296] sysv_free_block: flc_count > flc_size [ 856.229771][ T6296] sysv_free_block: flc_count > flc_size [ 856.231108][ T6296] sysv_free_block: flc_count > flc_size [ 856.232495][ T6296] sysv_free_inode: inode 0,1,2 or nonexistent inode [ 856.262453][ T6291] sysv_free_block: flc_count > flc_size [ 856.276151][ T6291] sysv_free_block: flc_count > flc_size [ 856.277501][ T6291] sysv_free_block: flc_count > flc_size [ 856.278756][ T6291] sysv_free_block: flc_count > flc_size [ 856.279914][ T6291] sysv_free_block: flc_count > flc_size [ 856.297044][ T6291] sysv_free_block: flc_count > flc_size [ 856.298305][ T6291] sysv_free_block: flc_count > flc_size [ 856.299496][ T6291] sysv_free_block: flc_count > flc_size [ 856.305012][ T6291] sysv_free_block: flc_count > flc_size [ 856.306351][ T6291] sysv_free_block: flc_count > flc_size [ 856.312905][ T6291] sysv_free_inode: inode 0,1,2 or nonexistent inode [ 856.863962][ T6292] sysv_free_block: flc_count > flc_size [ 856.865368][ T6292] sysv_free_block: flc_count > flc_size [ 856.866732][ T6292] sysv_free_block: flc_count > flc_size [ 856.904036][ T6292] sysv_free_block: flc_count > flc_size [ 856.908739][ T6292] sysv_free_block: flc_count > flc_size [ 856.927169][ T6292] sysv_free_block: flc_count > flc_size [ 856.938498][ T6292] sysv_free_block: flc_count > flc_size [ 856.949062][ T6292] sysv_free_block: flc_count > flc_size [ 856.965474][ T6292] sysv_free_block: flc_count > flc_size [ 856.971336][ T6292] sysv_free_block: flc_count > flc_size [ 856.983444][ T6292] sysv_free_inode: inode 0,1,2 or nonexistent inode [ 857.100733][ T6324] loop4: detected capacity change from 0 to 128 executing program executing program executing program [ 857.104426][ T6325] loop1: detected capacity change from 0 to 128 [ 857.109355][ T6326] loop0: detected capacity change from 0 to 128 [ 857.111970][ T6324] bio_check_eod: 10 callbacks suppressed [ 857.111981][ T6324] syz-executor314: attempt to access beyond end of device [ 857.111981][ T6324] loop4: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 857.128770][ T6326] syz-executor314: attempt to access beyond end of device [ 857.128770][ T6326] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 857.132728][ T6325] syz-executor314: attempt to access beyond end of device [ 857.132728][ T6325] loop1: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 857.136119][ T6326] buffer_io_error: 10 callbacks suppressed [ 857.136129][ T6326] Buffer I/O error on dev loop0, logical block 3245768, async page read executing program [ 857.141277][ T6326] syz-executor314: attempt to access beyond end of device [ 857.141277][ T6326] loop0: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 857.144630][ T6324] Buffer I/O error on dev loop4, logical block 3245768, async page read [ 857.146697][ T6325] Buffer I/O error on dev loop1, logical block 3245768, async page read [ 857.151609][ T6324] syz-executor314: attempt to access beyond end of device [ 857.151609][ T6324] loop4: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 857.157151][ T6325] syz-executor314: attempt to access beyond end of device [ 857.157151][ T6325] loop1: rw=0, sector=17666806, nr_sectors = 2 limit=128 [ 857.160977][ T6330] loop2: detected capacity change from 0 to 128 [ 857.164776][ T6326] Buffer I/O error on dev loop0, logical block 8833403, async page read [ 857.168481][ T6324] Buffer I/O error on dev loop4, logical block 8833403, async page read [ 857.171659][ T6326] syz-executor314: attempt to access beyond end of device [ 857.171659][ T6326] loop0: rw=0, sector=26539618, nr_sectors = 2 limit=128 [ 857.176171][ T6325] Buffer I/O error on dev loop1, logical block 8833403, async page read [ 857.179008][ T6330] syz-executor314: attempt to access beyond end of device [ 857.179008][ T6330] loop2: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 857.185096][ T6324] syz-executor314: attempt to access beyond end of device [ 857.185096][ T6324] loop4: rw=0, sector=26539618, nr_sectors = 2 limit=128 [ 857.188901][ T6325] syz-executor314: attempt to access beyond end of device [ 857.188901][ T6325] loop1: rw=0, sector=26539618, nr_sectors = 2 limit=128 [ 857.194579][ T6326] Buffer I/O error on dev loop0, logical block 13269809, async page read [ 857.197168][ T6330] Buffer I/O error on dev loop2, logical block 3245768, async page read [ 857.199186][ T6324] Buffer I/O error on dev loop4, logical block 13269809, async page read [ 857.202352][ T6325] Buffer I/O error on dev loop1, logical block 13269809, async page read [ 858.482959][ T6293] sysv_free_block: flc_count > flc_size [ 858.486686][ T6293] sysv_free_block: flc_count > flc_size [ 858.489312][ T6293] sysv_free_block: flc_count > flc_size [ 858.491790][ T6293] sysv_free_block: flc_count > flc_size [ 858.495400][ T6293] sysv_free_block: flc_count > flc_size [ 858.498129][ T6293] sysv_free_block: flc_count > flc_size [ 858.500693][ T6293] sysv_free_block: flc_count > flc_size [ 858.504393][ T6293] sysv_free_block: flc_count > flc_size [ 858.506944][ T6293] sysv_free_block: flc_count > flc_size [ 858.509478][ T6293] sysv_free_block: flc_count > flc_size [ 858.513196][ T6293] sysv_free_inode: inode 0,1,2 or nonexistent inode executing program [ 858.594518][ T6337] loop3: detected capacity change from 0 to 128