Warning: Permanently added '10.128.0.177' (ED25519) to the list of known hosts. executing program [ 65.902263][ T3544] loop0: detected capacity change from 0 to 1024 [ 65.924297][ T3544] ================================================================== [ 65.932417][ T3544] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x576/0x11f0 [ 65.940195][ T3544] Read of size 2 at addr ffff88807e1ab40c by task syz-executor238/3544 [ 65.948448][ T3544] [ 65.950773][ T3544] CPU: 1 PID: 3544 Comm: syz-executor238 Not tainted 6.1.69-syzkaller #0 [ 65.959191][ T3544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 65.969250][ T3544] Call Trace: [ 65.972704][ T3544] [ 65.975638][ T3544] dump_stack_lvl+0x1e3/0x2cb [ 65.980347][ T3544] ? nf_tcp_handle_invalid+0x642/0x642 [ 65.985818][ T3544] ? panic+0x75d/0x75d [ 65.989976][ T3544] ? _printk+0xd1/0x111 [ 65.994134][ T3544] ? _raw_spin_lock_irqsave+0xac/0x120 [ 65.999603][ T3544] print_report+0x15f/0x4f0 [ 66.004123][ T3544] ? hfsplus_bnode_read+0x1d0/0x1d0 [ 66.009330][ T3544] ? __virt_addr_valid+0x22b/0x2e0 [ 66.014453][ T3544] ? __phys_addr+0xb6/0x170 [ 66.018964][ T3544] ? hfsplus_uni2asc+0x576/0x11f0 [ 66.023997][ T3544] kasan_report+0x136/0x160 [ 66.028516][ T3544] ? hfsplus_uni2asc+0x576/0x11f0 [ 66.033554][ T3544] hfsplus_uni2asc+0x576/0x11f0 [ 66.038430][ T3544] ? memcpy+0x3c/0x60 [ 66.042417][ T3544] hfsplus_readdir+0x922/0x12c0 [ 66.047295][ T3544] ? hfsplus_rename+0x1b0/0x1b0 [ 66.052182][ T3544] ? __mutex_lock+0x2f7/0xd80 [ 66.056882][ T3544] ? iterate_dir+0x10a/0x560 [ 66.061582][ T3544] ? down_read_interruptible+0xc40/0xc40 [ 66.067229][ T3544] ? __fdget_pos+0x2ba/0x360 [ 66.071824][ T3544] ? __lock_acquire+0x1f80/0x1f80 [ 66.076864][ T3544] ? common_file_perm+0x17d/0x1d0 [ 66.081896][ T3544] ? fsnotify_perm+0x42f/0x590 [ 66.086665][ T3544] iterate_dir+0x224/0x560 [ 66.091097][ T3544] ? hfsplus_rename+0x1b0/0x1b0 [ 66.095957][ T3544] __se_sys_getdents64+0x209/0x4f0 [ 66.101084][ T3544] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 66.107086][ T3544] ? __x64_sys_getdents64+0x80/0x80 [ 66.112296][ T3544] ? filldir+0x6f0/0x6f0 [ 66.116553][ T3544] ? syscall_enter_from_user_mode+0x2e/0x220 [ 66.122543][ T3544] ? lockdep_hardirqs_on+0x94/0x130 [ 66.127902][ T3544] ? syscall_enter_from_user_mode+0x2e/0x220 [ 66.133888][ T3544] do_syscall_64+0x3d/0xb0 [ 66.138312][ T3544] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 66.144213][ T3544] RIP: 0033:0x7fdba861a649 [ 66.148630][ T3544] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 66.168280][ T3544] RSP: 002b:00007fff085acd08 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 66.176796][ T3544] RAX: ffffffffffffffda RBX: 00007fff085aced8 RCX: 00007fdba861a649 [ 66.184871][ T3544] RDX: 0000000000000067 RSI: 0000000020000540 RDI: 0000000000000003 [ 66.192864][ T3544] RBP: 00007fdba868d610 R08: 0000000000000651 R09: 00007fff085aced8 [ 66.200858][ T3544] R10: 00007fff085acbc0 R11: 0000000000000246 R12: 0000000000000001 [ 66.208849][ T3544] R13: 00007fff085acec8 R14: 0000000000000001 R15: 0000000000000001 [ 66.216922][ T3544] [ 66.219949][ T3544] [ 66.222284][ T3544] Allocated by task 3544: [ 66.226615][ T3544] kasan_set_track+0x4b/0x70 [ 66.231229][ T3544] __kasan_kmalloc+0x97/0xb0 [ 66.235834][ T3544] __kmalloc+0xb2/0x230 [ 66.240045][ T3544] hfsplus_find_init+0x81/0x1c0 [ 66.244905][ T3544] hfsplus_readdir+0x207/0x12c0 [ 66.249760][ T3544] iterate_dir+0x224/0x560 [ 66.254219][ T3544] __se_sys_getdents64+0x209/0x4f0 [ 66.259343][ T3544] do_syscall_64+0x3d/0xb0 [ 66.263768][ T3544] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 66.269678][ T3544] [ 66.271999][ T3544] The buggy address belongs to the object at ffff88807e1ab000 [ 66.271999][ T3544] which belongs to the cache kmalloc-2k of size 2048 [ 66.286051][ T3544] The buggy address is located 1036 bytes inside of [ 66.286051][ T3544] 2048-byte region [ffff88807e1ab000, ffff88807e1ab800) [ 66.299496][ T3544] [ 66.301822][ T3544] The buggy address belongs to the physical page: [ 66.309562][ T3544] page:ffffea0001f86a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e1a8 [ 66.319727][ T3544] head:ffffea0001f86a00 order:3 compound_mapcount:0 compound_pincount:0 [ 66.328056][ T3544] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 66.336075][ T3544] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888012442000 [ 66.344677][ T3544] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 66.353274][ T3544] page dumped because: kasan: bad access detected [ 66.359966][ T3544] page_owner tracks the page as allocated [ 66.365709][ T3544] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3216, tgid 3216 (dhcpcd), ts 54669778115, free_ts 54635492407 [ 66.386573][ T3544] post_alloc_hook+0x18d/0x1b0 [ 66.391366][ T3544] get_page_from_freelist+0x31a1/0x3320 [ 66.396915][ T3544] __alloc_pages+0x28d/0x770 [ 66.401505][ T3544] alloc_slab_page+0x6a/0x150 [ 66.406188][ T3544] new_slab+0x84/0x2d0 [ 66.410260][ T3544] ___slab_alloc+0xc20/0x1270 [ 66.414947][ T3544] __kmem_cache_alloc_node+0x19f/0x260 [ 66.420409][ T3544] __kmalloc+0xa1/0x230 [ 66.424619][ T3544] sk_prot_alloc+0xe0/0x200 [ 66.429137][ T3544] sk_alloc+0x36/0x350 [ 66.433224][ T3544] __netlink_create+0x6b/0x2c0 [ 66.438012][ T3544] netlink_create+0x3aa/0x540 [ 66.442714][ T3544] __sock_create+0x488/0x910 [ 66.447324][ T3544] __sys_socket+0x136/0x3a0 [ 66.451862][ T3544] __x64_sys_socket+0x76/0x80 [ 66.456564][ T3544] do_syscall_64+0x3d/0xb0 [ 66.461013][ T3544] page last free stack trace: [ 66.465689][ T3544] free_unref_page_prepare+0xf63/0x1120 [ 66.471256][ T3544] free_unref_page+0x33/0x3e0 [ 66.475946][ T3544] __unfreeze_partials+0x1b7/0x210 [ 66.481072][ T3544] put_cpu_partial+0x17b/0x250 [ 66.485845][ T3544] qlist_free_all+0x76/0xe0 [ 66.490354][ T3544] kasan_quarantine_reduce+0x156/0x170 [ 66.495818][ T3544] __kasan_slab_alloc+0x1f/0x70 [ 66.500678][ T3544] slab_post_alloc_hook+0x52/0x3a0 [ 66.505797][ T3544] kmem_cache_alloc+0x10c/0x2d0 [ 66.510739][ T3544] getname_flags+0xb8/0x4f0 [ 66.515244][ T3544] do_sys_openat2+0xd2/0x500 [ 66.519840][ T3544] __x64_sys_openat+0x243/0x290 [ 66.524704][ T3544] do_syscall_64+0x3d/0xb0 [ 66.529140][ T3544] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 66.535040][ T3544] [ 66.537361][ T3544] Memory state around the buggy address: [ 66.542985][ T3544] ffff88807e1ab300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 66.551054][ T3544] ffff88807e1ab380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 66.559118][ T3544] >ffff88807e1ab400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.567192][ T3544] ^ [ 66.571531][ T3544] ffff88807e1ab480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.579606][ T3544] ffff88807e1ab500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.587668][ T3544] ================================================================== [ 66.596355][ T3544] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 66.603595][ T3544] CPU: 0 PID: 3544 Comm: syz-executor238 Not tainted 6.1.69-syzkaller #0 [ 66.612042][ T3544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 66.622203][ T3544] Call Trace: [ 66.625563][ T3544] [ 66.628510][ T3544] dump_stack_lvl+0x1e3/0x2cb [ 66.633202][ T3544] ? nf_tcp_handle_invalid+0x642/0x642 [ 66.638683][ T3544] ? panic+0x75d/0x75d [ 66.642755][ T3544] ? preempt_schedule_common+0xa6/0xd0 [ 66.648246][ T3544] ? vscnprintf+0x59/0x80 [ 66.652582][ T3544] panic+0x318/0x75d [ 66.656479][ T3544] ? check_panic_on_warn+0x1d/0xa0 [ 66.661590][ T3544] ? memcpy_page_flushcache+0xfc/0xfc [ 66.666984][ T3544] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 66.672980][ T3544] ? _raw_spin_unlock+0x40/0x40 [ 66.677828][ T3544] ? print_report+0x4a3/0x4f0 [ 66.682510][ T3544] check_panic_on_warn+0x7e/0xa0 [ 66.687472][ T3544] ? hfsplus_uni2asc+0x576/0x11f0 [ 66.692496][ T3544] end_report+0x66/0x110 [ 66.696757][ T3544] kasan_report+0x143/0x160 [ 66.701282][ T3544] ? hfsplus_uni2asc+0x576/0x11f0 [ 66.706396][ T3544] hfsplus_uni2asc+0x576/0x11f0 [ 66.711264][ T3544] ? memcpy+0x3c/0x60 [ 66.715246][ T3544] hfsplus_readdir+0x922/0x12c0 [ 66.720103][ T3544] ? hfsplus_rename+0x1b0/0x1b0 [ 66.724975][ T3544] ? __mutex_lock+0x2f7/0xd80 [ 66.729657][ T3544] ? iterate_dir+0x10a/0x560 [ 66.734251][ T3544] ? down_read_interruptible+0xc40/0xc40 [ 66.739881][ T3544] ? __fdget_pos+0x2ba/0x360 [ 66.744468][ T3544] ? __lock_acquire+0x1f80/0x1f80 [ 66.749504][ T3544] ? common_file_perm+0x17d/0x1d0 [ 66.754682][ T3544] ? fsnotify_perm+0x42f/0x590 [ 66.759442][ T3544] iterate_dir+0x224/0x560 [ 66.763865][ T3544] ? hfsplus_rename+0x1b0/0x1b0 [ 66.768734][ T3544] __se_sys_getdents64+0x209/0x4f0 [ 66.773872][ T3544] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 66.779871][ T3544] ? __x64_sys_getdents64+0x80/0x80 [ 66.785079][ T3544] ? filldir+0x6f0/0x6f0 [ 66.789428][ T3544] ? syscall_enter_from_user_mode+0x2e/0x220 [ 66.795437][ T3544] ? lockdep_hardirqs_on+0x94/0x130 [ 66.800634][ T3544] ? syscall_enter_from_user_mode+0x2e/0x220 [ 66.806622][ T3544] do_syscall_64+0x3d/0xb0 [ 66.811067][ T3544] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 66.816985][ T3544] RIP: 0033:0x7fdba861a649 [ 66.821409][ T3544] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 66.841026][ T3544] RSP: 002b:00007fff085acd08 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 66.849458][ T3544] RAX: ffffffffffffffda RBX: 00007fff085aced8 RCX: 00007fdba861a649 [ 66.857425][ T3544] RDX: 0000000000000067 RSI: 0000000020000540 RDI: 0000000000000003 [ 66.865393][ T3544] RBP: 00007fdba868d610 R08: 0000000000000651 R09: 00007fff085aced8 [ 66.873361][ T3544] R10: 00007fff085acbc0 R11: 0000000000000246 R12: 0000000000000001 [ 66.881329][ T3544] R13: 00007fff085acec8 R14: 0000000000000001 R15: 0000000000000001 [ 66.889300][ T3544] [ 66.892557][ T3544] Kernel Offset: disabled [ 66.896914][ T3544] Rebooting in 86400 seconds..