./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1146365123
<...>
Warning: Permanently added '10.128.0.65' (ECDSA) to the list of known hosts.
execve("./syz-executor1146365123", ["./syz-executor1146365123"], 0x7ffc1eeee050 /* 10 vars */) = 0
brk(NULL) = 0x555557529000
brk(0x555557529c40) = 0x555557529c40
arch_prctl(ARCH_SET_FS, 0x555557529300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1146365123", 4096) = 28
brk(0x55555754ac40) = 0x55555754ac40
brk(0x55555754b000) = 0x55555754b000
mprotect(0x7f1b32f7d000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1b2aac4000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7f1b2aac4000, 524288) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
mount("/dev/loop0", "./file0", "hfsplus", MS_NODIRATIME|MS_SILENT, "\x74\x79\x70\x65\x3d\xfa\x35\x4a\x6d\x2c\x6e\x6c\x73\x3d\x69\x73\x6f\x38\x38\x35\x39\x2d\x31\x2c") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 66.577236][ T5014] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5014 'syz-executor114'
[ 66.596325][ T5014] loop0: detected capacity change from 0 to 1024
[ 66.617836][ T5014] ==================================================================
[ 66.625962][ T5014] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x57a/0x11f0
[ 66.633745][ T5014] Read of size 2 at addr ffff888015e8d40c by task syz-executor114/5014
[ 66.642012][ T5014]
[ 66.644364][ T5014] CPU: 1 PID: 5014 Comm: syz-executor114 Not tainted 6.5.0-rc1-syzkaller-00006-g3f01e9fed845 #0
[ 66.654806][ T5014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[ 66.664889][ T5014] Call Trace:
[ 66.668178][ T5014]
[ 66.671199][ T5014] dump_stack_lvl+0x1e7/0x2d0
[ 66.675900][ T5014] ? nf_tcp_handle_invalid+0x650/0x650
[ 66.681374][ T5014] ? panic+0x770/0x770
[ 66.685450][ T5014] ? _printk+0xd5/0x120
[ 66.689617][ T5014] print_report+0x163/0x540
[ 66.694134][ T5014] ? __virt_addr_valid+0x22f/0x2e0
[ 66.699253][ T5014] ? __phys_addr+0xba/0x170
[ 66.703764][ T5014] ? hfsplus_uni2asc+0x57a/0x11f0
[ 66.708792][ T5014] kasan_report+0x175/0x1b0
[ 66.713305][ T5014] ? hfsplus_uni2asc+0x57a/0x11f0
[ 66.718356][ T5014] hfsplus_uni2asc+0x57a/0x11f0
[ 66.723216][ T5014] ? __asan_memcpy+0x40/0x70
[ 66.727825][ T5014] hfsplus_readdir+0x92c/0x1310
[ 66.732699][ T5014] ? hfsplus_rename+0x1c0/0x1c0
[ 66.737592][ T5014] ? __might_sleep+0xc0/0xc0
[ 66.742203][ T5014] ? iterate_dir+0x117/0x5a0
[ 66.746804][ T5014] ? iterate_dir+0x117/0x5a0
[ 66.751405][ T5014] ? fsnotify_perm+0x420/0x5a0
[ 66.756181][ T5014] iterate_dir+0x231/0x5a0
[ 66.760612][ T5014] ? hfsplus_rename+0x1c0/0x1c0
[ 66.765478][ T5014] __se_sys_getdents64+0x20d/0x4f0
[ 66.770607][ T5014] ? _raw_spin_unlock_irq+0x2e/0x50
[ 66.775820][ T5014] ? __x64_sys_getdents64+0x80/0x80
[ 66.781033][ T5014] ? filldir+0x6a0/0x6a0
[ 66.785288][ T5014] ? syscall_enter_from_user_mode+0x32/0x230
[ 66.791287][ T5014] ? syscall_enter_from_user_mode+0x8c/0x230
[ 66.797280][ T5014] do_syscall_64+0x41/0xc0
[ 66.801704][ T5014] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 66.807610][ T5014] RIP: 0033:0x7f1b32f107d9
[ 66.812029][ T5014] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 66.831641][ T5014] RSP: 002b:00007fffa4687868 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 66.840152][ T5014] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1b32f107d9
[ 66.848132][ T5014] RDX: 0000000000000067 RSI: 0000000020000540 RDI: 0000000000000003
[ 66.856112][ T5014] RBP: 00007f1b32ed00a0 R08: 0000000000000651 R09: 0000000000000000
[ 66.864086][ T5014] R10: 00007fffa4687720 R11: 0000000000000246 R12: 00007f1b32ed0130
[ 66.872061][ T5014] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 66.880043][ T5014]
[ 66.883251][ T5014]
[ 66.885576][ T5014] Allocated by task 5014:
[ 66.889901][ T5014] kasan_set_track+0x4f/0x70
[ 66.894503][ T5014] __kasan_kmalloc+0x98/0xb0
[ 66.899097][ T5014] __kmalloc+0xb9/0x230
[ 66.903252][ T5014] hfsplus_find_init+0x85/0x1c0
[ 66.908107][ T5014] hfsplus_readdir+0x20e/0x1310
[ 66.912968][ T5014] iterate_dir+0x231/0x5a0
[ 66.917394][ T5014] __se_sys_getdents64+0x20d/0x4f0
[ 66.922515][ T5014] do_syscall_64+0x41/0xc0
[ 66.926936][ T5014] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 66.932838][ T5014]
[ 66.935170][ T5014] Last potentially related work creation:
[ 66.940879][ T5014] kasan_save_stack+0x3f/0x60
[ 66.945565][ T5014] __kasan_record_aux_stack+0xad/0xc0
[ 66.950964][ T5014] call_rcu+0x167/0xa70
[ 66.955127][ T5014] netlink_release+0x146a/0x18f0
[ 66.960069][ T5014] sock_close+0xd1/0x230
[ 66.964318][ T5014] __fput+0x3f8/0x950
[ 66.968301][ T5014] task_work_run+0x24a/0x300
[ 66.972905][ T5014] exit_to_user_mode_loop+0xd9/0x100
[ 66.978195][ T5014] exit_to_user_mode_prepare+0xb1/0x140
[ 66.983740][ T5014] syscall_exit_to_user_mode+0x64/0x280
[ 66.989293][ T5014] do_syscall_64+0x4d/0xc0
[ 66.993714][ T5014] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 66.999614][ T5014]
[ 67.001938][ T5014] The buggy address belongs to the object at ffff888015e8d000
[ 67.001938][ T5014] which belongs to the cache kmalloc-2k of size 2048
[ 67.015995][ T5014] The buggy address is located 0 bytes to the right of
[ 67.015995][ T5014] allocated 1036-byte region [ffff888015e8d000, ffff888015e8d40c)
[ 67.030576][ T5014]
[ 67.033076][ T5014] The buggy address belongs to the physical page:
[ 67.039486][ T5014] page:ffffea000057a200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15e88
[ 67.049638][ T5014] head:ffffea000057a200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 67.058571][ T5014] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 67.066550][ T5014] page_type: 0xffffffff()
[ 67.070882][ T5014] raw: 00fff00000010200 ffff888012842000 ffffea000050e200 dead000000000002
[ 67.079470][ T5014] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 67.088055][ T5014] page dumped because: kasan: bad access detected
[ 67.094466][ T5014] page_owner tracks the page as allocated
[ 67.100176][ T5014] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3055971456, free_ts 0
[ 67.119806][ T5014] post_alloc_hook+0x1e6/0x210
[ 67.124662][ T5014] get_page_from_freelist+0x31e8/0x3370
[ 67.130215][ T5014] __alloc_pages+0x255/0x670
[ 67.134810][ T5014] alloc_page_interleave+0x22/0x1d0
[ 67.140011][ T5014] alloc_slab_page+0x6a/0x160
[ 67.144691][ T5014] new_slab+0x84/0x2f0
[ 67.148804][ T5014] ___slab_alloc+0xade/0x1100
[ 67.153506][ T5014] __kmem_cache_alloc_node+0x1af/0x270
[ 67.158994][ T5014] kmalloc_trace+0x2a/0xe0
[ 67.163411][ T5014] acpi_ds_create_walk_state+0x103/0x2a0
[ 67.169047][ T5014] acpi_ds_call_control_method+0x136/0x7b0
[ 67.174857][ T5014] acpi_ps_parse_aml+0x2df/0x960
[ 67.179804][ T5014] acpi_ps_execute_method+0x744/0x870
[ 67.185189][ T5014] acpi_ns_evaluate+0x5df/0xa40
[ 67.190046][ T5014] acpi_evaluate_object+0x59b/0xaf0
[ 67.195254][ T5014] acpi_evaluate_integer+0x11b/0x2f0
[ 67.200543][ T5014] page_owner free stack trace missing
[ 67.205910][ T5014]
[ 67.208231][ T5014] Memory state around the buggy address:
[ 67.213859][ T5014] ffff888015e8d300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.221947][ T5014] ffff888015e8d380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.230031][ T5014] >ffff888015e8d400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 67.238108][ T5014] ^
[ 67.242445][ T5014] ffff888015e8d480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 67.250511][ T5014] ffff888015e8d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 67.258572][ T5014] ==================================================================
[ 67.266996][ T5014] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 67.274213][ T5014] CPU: 1 PID: 5014 Comm: syz-executor114 Not tainted 6.5.0-rc1-syzkaller-00006-g3f01e9fed845 #0
[ 67.284638][ T5014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[ 67.294711][ T5014] Call Trace:
[ 67.298007][ T5014]
[ 67.300960][ T5014] dump_stack_lvl+0x1e7/0x2d0
[ 67.305681][ T5014] ? nf_tcp_handle_invalid+0x650/0x650
[ 67.311169][ T5014] ? panic+0x770/0x770
[ 67.315270][ T5014] ? vscnprintf+0x5d/0x80
[ 67.319636][ T5014] panic+0x30f/0x770
[ 67.323555][ T5014] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 67.329725][ T5014] ? check_panic_on_warn+0x21/0xa0
[ 67.334919][ T5014] ? __memcpy_flushcache+0x2b0/0x2b0
[ 67.340236][ T5014] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 67.346259][ T5014] ? _raw_spin_unlock+0x40/0x40
[ 67.351136][ T5014] check_panic_on_warn+0x82/0xa0
[ 67.356086][ T5014] ? hfsplus_uni2asc+0x57a/0x11f0
[ 67.361116][ T5014] end_report+0x6e/0x130
[ 67.365369][ T5014] kasan_report+0x186/0x1b0
[ 67.369887][ T5014] ? hfsplus_uni2asc+0x57a/0x11f0
[ 67.374922][ T5014] hfsplus_uni2asc+0x57a/0x11f0
[ 67.379782][ T5014] ? __asan_memcpy+0x40/0x70
[ 67.384388][ T5014] hfsplus_readdir+0x92c/0x1310
[ 67.389258][ T5014] ? hfsplus_rename+0x1c0/0x1c0
[ 67.394154][ T5014] ? __might_sleep+0xc0/0xc0
[ 67.398789][ T5014] ? iterate_dir+0x117/0x5a0
[ 67.403417][ T5014] ? iterate_dir+0x117/0x5a0
[ 67.408041][ T5014] ? fsnotify_perm+0x420/0x5a0
[ 67.412841][ T5014] iterate_dir+0x231/0x5a0
[ 67.417281][ T5014] ? hfsplus_rename+0x1c0/0x1c0
[ 67.422158][ T5014] __se_sys_getdents64+0x20d/0x4f0
[ 67.427306][ T5014] ? _raw_spin_unlock_irq+0x2e/0x50
[ 67.432531][ T5014] ? __x64_sys_getdents64+0x80/0x80
[ 67.437740][ T5014] ? filldir+0x6a0/0x6a0
[ 67.441996][ T5014] ? syscall_enter_from_user_mode+0x32/0x230
[ 67.447985][ T5014] ? syscall_enter_from_user_mode+0x8c/0x230
[ 67.453975][ T5014] do_syscall_64+0x41/0xc0
[ 67.458396][ T5014] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 67.464301][ T5014] RIP: 0033:0x7f1b32f107d9
[ 67.468743][ T5014] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 67.488355][ T5014] RSP: 002b:00007fffa4687868 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 67.496782][ T5014] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1b32f107d9
[ 67.504756][ T5014] RDX: 0000000000000067 RSI: 0000000020000540 RDI: 0000000000000003
[ 67.512731][ T5014] RBP: 00007f1b32ed00a0 R08: 0000000000000651 R09: 0000000000000000
[ 67.520737][ T5014] R10: 00007fffa4687720 R11: 0000000000000246 R12: 00007f1b32ed0130
[ 67.528713][ T5014] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 67.536694][ T5014]
[ 67.539919][ T5014] Kernel Offset: disabled
[ 67.544247][ T5014] Rebooting in 86400 seconds..