./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2991608482

<...>
Warning: Permanently added '10.128.0.48' (ED25519) to the list of known hosts.
execve("./syz-executor2991608482", ["./syz-executor2991608482"], 0x7ffe8101a5f0 /* 10 vars */) = 0
brk(NULL)                               = 0x555556281000
brk(0x555556281d00)                     = 0x555556281d00
arch_prctl(ARCH_SET_FS, 0x555556281380) = 0
set_tid_address(0x555556281650)         = 5027
set_robust_list(0x555556281660, 24)     = 0
rseq(0x555556281ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2991608482", 4096) = 28
getrandom("\xa5\x57\xc3\xc0\x1b\xce\x83\xd6", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555556281d00
brk(0x5555562a2d00)                     = 0x5555562a2d00
brk(0x5555562a3000)                     = 0x5555562a3000
mprotect(0x7f77aa63d000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0)            = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f77a218d000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768
munmap(0x7f77a218d000, 138412032)       = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 4
ioctl(4, LOOP_SET_FD, 3)                = 0
close(3)                                = 0
mkdir("./bus", 0777)                    = 0
mount("/dev/loop0", "./bus", "hfs", MS_DIRSYNC|MS_REC, "") = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
chdir("./bus")                          = 0
ioctl(4, LOOP_CLR_FD)                   = 0
close(4)                                = 0
[   76.502781][ T5027] syz-executor299[5027]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[   76.518660][ T5027] loop0: detected capacity change from 0 to 64
[   76.531827][ T5027] hfs: unable to locate alternate MDB
[   76.537850][ T5027] hfs: continuing without an alternate MDB
[   76.569454][ T5027] ==================================================================
[   76.577588][ T5027] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x314/0x440
[   76.585540][ T5027] Write of size 256 at addr ffff88801f1da780 by task syz-executor299/5027
[   76.594065][ T5027] 
[   76.596413][ T5027] CPU: 0 PID: 5027 Comm: syz-executor299 Not tainted 6.6.0-rc7-syzkaller-00018-gd88520ad73b7 #0
[   76.606850][ T5027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
[   76.616929][ T5027] Call Trace:
[   76.620207][ T5027]  <TASK>
[   76.623134][ T5027]  dump_stack_lvl+0x1e7/0x2d0
[   76.627833][ T5027]  ? folio_memcg_lock+0x89/0x390
[   76.632800][ T5027]  ? nf_tcp_handle_invalid+0x650/0x650
[   76.638317][ T5027]  ? panic+0x770/0x770
[   76.642384][ T5027]  ? _printk+0xd5/0x120
[   76.646539][ T5027]  print_report+0x163/0x540
[   76.651051][ T5027]  ? __virt_addr_valid+0x22f/0x2e0
[   76.656163][ T5027]  ? __phys_addr+0xba/0x170
[   76.660661][ T5027]  ? hfs_bnode_read_key+0x314/0x440
[   76.666032][ T5027]  kasan_report+0x175/0x1b0
[   76.670540][ T5027]  ? hfs_bnode_read_key+0x314/0x440
[   76.675743][ T5027]  kasan_check_range+0x27e/0x290
[   76.680732][ T5027]  ? hfs_bnode_read_key+0x314/0x440
[   76.685949][ T5027]  __asan_memcpy+0x40/0x70
[   76.690365][ T5027]  hfs_bnode_read_key+0x314/0x440
[   76.695389][ T5027]  hfs_brec_insert+0x6a1/0xbd0
[   76.700262][ T5027]  ? hfs_brec_keylen+0x360/0x360
[   76.705213][ T5027]  ? __asan_memset+0x23/0x40
[   76.709795][ T5027]  ? hfs_cat_build_record+0x242/0x800
[   76.715165][ T5027]  hfs_cat_create+0x5c0/0x970
[   76.719866][ T5027]  ? hfs_cat_build_key+0x170/0x170
[   76.724992][ T5027]  ? _raw_spin_unlock+0x28/0x40
[   76.729854][ T5027]  ? hfs_new_inode+0x88c/0xac0
[   76.734618][ T5027]  hfs_create+0x66/0xd0
[   76.738770][ T5027]  ? hfs_lookup+0x2f0/0x2f0
[   76.743285][ T5027]  path_openat+0x13e7/0x3180
[   76.747899][ T5027]  ? do_filp_open+0x490/0x490
[   76.752597][ T5027]  do_filp_open+0x234/0x490
[   76.757115][ T5027]  ? vfs_tmpfile+0x4b0/0x4b0
[   76.761710][ T5027]  ? _raw_spin_unlock+0x28/0x40
[   76.766558][ T5027]  ? alloc_fd+0x59c/0x640
[   76.770894][ T5027]  do_sys_openat2+0x13e/0x1d0
[   76.775577][ T5027]  ? do_sys_open+0x230/0x230
[   76.780191][ T5027]  ? lockdep_hardirqs_on+0x98/0x140
[   76.785393][ T5027]  ? _raw_spin_unlock_irq+0x2e/0x50
[   76.790587][ T5027]  ? ptrace_notify+0x278/0x380
[   76.795353][ T5027]  __x64_sys_openat+0x247/0x290
[   76.800209][ T5027]  ? __ia32_sys_open+0x270/0x270
[   76.805172][ T5027]  ? syscall_enter_from_user_mode+0x32/0x230
[   76.811158][ T5027]  ? syscall_enter_from_user_mode+0x8c/0x230
[   76.817182][ T5027]  do_syscall_64+0x41/0xc0
[   76.821598][ T5027]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   76.827500][ T5027] RIP: 0033:0x7f77aa5ca979
[   76.831909][ T5027] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   76.851510][ T5027] RSP: 002b:00007ffdc17aa058 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[   76.859917][ T5027] RAX: ffffffffffffffda RBX: 00007f77aa61304b RCX: 00007f77aa5ca979
[   76.867882][ T5027] RDX: 0000000000141842 RSI: 0000000020000380 RDI: 00000000ffffff9c
[   76.875850][ T5027] RBP: 00007f77aa613055 R08: 0000000000000260 R09: 0000000000000000
[   76.883837][ T5027] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[   76.891803][ T5027] R13: 00007ffdc17aa238 R14: 0000000000000001 R15: 0000000000000001
[   76.899776][ T5027]  </TASK>
[   76.902798][ T5027] 
[   76.905186][ T5027] Allocated by task 5027:
[   76.910579][ T5027]  kasan_set_track+0x4f/0x70
[   76.916989][ T5027]  __kasan_kmalloc+0x98/0xb0
[   76.921603][ T5027]  __kmalloc+0xb9/0x230
[   76.925791][ T5027]  hfs_find_init+0x90/0x1f0
[   76.930303][ T5027]  hfs_cat_create+0x17e/0x970
[   76.935138][ T5027]  hfs_create+0x66/0xd0
[   76.940394][ T5027]  path_openat+0x13e7/0x3180
[   76.945112][ T5027]  do_filp_open+0x234/0x490
[   76.949715][ T5027]  do_sys_openat2+0x13e/0x1d0
[   76.954395][ T5027]  __x64_sys_openat+0x247/0x290
[   76.959251][ T5027]  do_syscall_64+0x41/0xc0
[   76.967463][ T5027]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   76.976700][ T5027] 
[   76.979025][ T5027] The buggy address belongs to the object at ffff88801f1da780
[   76.979025][ T5027]  which belongs to the cache kmalloc-96 of size 96
[   76.993191][ T5027] The buggy address is located 0 bytes inside of
[   76.993191][ T5027]  allocated 78-byte region [ffff88801f1da780, ffff88801f1da7ce)
[   77.008897][ T5027] 
[   77.011215][ T5027] The buggy address belongs to the physical page:
[   77.017622][ T5027] page:ffffea00007c7680 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f1da
[   77.027767][ T5027] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[   77.037389][ T5027] page_type: 0xffffffff()
[   77.048407][ T5027] raw: 00fff00000000800 ffff888012841780 ffffea000050c440 dead000000000008
[   77.057688][ T5027] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[   77.066348][ T5027] page dumped because: kasan: bad access detected
[   77.072766][ T5027] page_owner tracks the page as allocated
[   77.078491][ T5027] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 48, tgid 48 (kworker/u4:3), ts 10501611575, free_ts 10495357702
[   77.099711][ T5027]  post_alloc_hook+0x1e6/0x210
[   77.104484][ T5027]  get_page_from_freelist+0x31db/0x3360
[   77.110063][ T5027]  __alloc_pages+0x255/0x670
[   77.114668][ T5027]  alloc_slab_page+0x6a/0x160
[   77.120143][ T5027]  new_slab+0x84/0x2f0
[   77.124228][ T5027]  ___slab_alloc+0xc85/0x1310
[   77.128908][ T5027]  __kmem_cache_alloc_node+0x1af/0x270
[   77.134363][ T5027]  __kmalloc+0xa8/0x230
[   77.138517][ T5027]  kobject_get_path+0xb8/0x230
[   77.143273][ T5027]  kobject_uevent_env+0x29f/0x8e0
[   77.148290][ T5027]  device_add+0x6b0/0xd30
[   77.152619][ T5027]  sd_probe+0x6ba/0x1130
[   77.156857][ T5027]  really_probe+0x294/0xc30
[   77.161384][ T5027]  __driver_probe_device+0x1a2/0x3d0
[   77.166680][ T5027]  driver_probe_device+0x50/0x420
[   77.171783][ T5027]  __device_attach_driver+0x2d3/0x520
[   77.177206][ T5027] page last free stack trace:
[   77.181876][ T5027]  free_unref_page_prepare+0x8c3/0x9f0
[   77.187350][ T5027]  free_unref_page_list+0x596/0x830
[   77.192547][ T5027]  release_pages+0x2113/0x23f0
[   77.197304][ T5027]  tlb_flush_mmu+0x34c/0x4e0
[   77.201889][ T5027]  tlb_finish_mmu+0xd4/0x1f0
[   77.206483][ T5027]  exit_mmap+0x4d3/0xc50
[   77.210721][ T5027]  __mmput+0x115/0x3c0
[   77.214803][ T5027]  free_bprm+0x144/0x330
[   77.219065][ T5027]  kernel_execve+0x8f5/0xa10
[   77.224759][ T5027]  call_usermodehelper_exec_async+0x233/0x370
[   77.232134][ T5027]  ret_from_fork+0x48/0x80
[   77.238132][ T5027]  ret_from_fork_asm+0x11/0x20
[   77.243033][ T5027] 
[   77.245733][ T5027] Memory state around the buggy address:
[   77.251370][ T5027]  ffff88801f1da680: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   77.259444][ T5027]  ffff88801f1da700: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[   77.267508][ T5027] >ffff88801f1da780: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc
[   77.275571][ T5027]                                               ^
[   77.281972][ T5027]  ffff88801f1da800: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   77.290025][ T5027]  ffff88801f1da880: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   77.298083][ T5027] ==================================================================
[   77.306565][ T5027] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   77.313785][ T5027] CPU: 0 PID: 5027 Comm: syz-executor299 Not tainted 6.6.0-rc7-syzkaller-00018-gd88520ad73b7 #0
[   77.324210][ T5027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
[   77.334264][ T5027] Call Trace:
[   77.337549][ T5027]  <TASK>
[   77.340487][ T5027]  dump_stack_lvl+0x1e7/0x2d0
[   77.345963][ T5027]  ? nf_tcp_handle_invalid+0x650/0x650
[   77.351433][ T5027]  ? panic+0x770/0x770
[   77.355504][ T5027]  ? preempt_schedule_common+0x83/0xc0
[   77.360973][ T5027]  ? vscnprintf+0x5d/0x80
[   77.365310][ T5027]  panic+0x30f/0x770
[   77.369211][ T5027]  ? check_panic_on_warn+0x21/0xa0
[   77.374351][ T5027]  ? __memcpy_flushcache+0x2b0/0x2b0
[   77.379654][ T5027]  ? _raw_spin_unlock_irqrestore+0x12c/0x140
[   77.385647][ T5027]  ? _raw_spin_unlock+0x40/0x40
[   77.390507][ T5027]  ? print_report+0x4fb/0x540
[   77.395195][ T5027]  check_panic_on_warn+0x82/0xa0
[   77.400143][ T5027]  ? hfs_bnode_read_key+0x314/0x440
[   77.405359][ T5027]  end_report+0x6e/0x130
[   77.409697][ T5027]  kasan_report+0x186/0x1b0
[   77.414233][ T5027]  ? hfs_bnode_read_key+0x314/0x440
[   77.419439][ T5027]  kasan_check_range+0x27e/0x290
[   77.424385][ T5027]  ? hfs_bnode_read_key+0x314/0x440
[   77.429592][ T5027]  __asan_memcpy+0x40/0x70
[   77.434010][ T5027]  hfs_bnode_read_key+0x314/0x440
[   77.439066][ T5027]  hfs_brec_insert+0x6a1/0xbd0
[   77.443846][ T5027]  ? hfs_brec_keylen+0x360/0x360
[   77.448872][ T5027]  ? __asan_memset+0x23/0x40
[   77.453772][ T5027]  ? hfs_cat_build_record+0x242/0x800
[   77.463687][ T5027]  hfs_cat_create+0x5c0/0x970
[   77.469024][ T5027]  ? hfs_cat_build_key+0x170/0x170
[   77.474602][ T5027]  ? _raw_spin_unlock+0x28/0x40
[   77.479591][ T5027]  ? hfs_new_inode+0x88c/0xac0
[   77.484397][ T5027]  hfs_create+0x66/0xd0
[   77.488564][ T5027]  ? hfs_lookup+0x2f0/0x2f0
[   77.493081][ T5027]  path_openat+0x13e7/0x3180
[   77.497697][ T5027]  ? do_filp_open+0x490/0x490
[   77.502390][ T5027]  do_filp_open+0x234/0x490
[   77.507079][ T5027]  ? vfs_tmpfile+0x4b0/0x4b0
[   77.511685][ T5027]  ? _raw_spin_unlock+0x28/0x40
[   77.516549][ T5027]  ? alloc_fd+0x59c/0x640
[   77.522533][ T5027]  do_sys_openat2+0x13e/0x1d0
[   77.527240][ T5027]  ? do_sys_open+0x230/0x230
[   77.531854][ T5027]  ? lockdep_hardirqs_on+0x98/0x140
[   77.537081][ T5027]  ? _raw_spin_unlock_irq+0x2e/0x50
[   77.542336][ T5027]  ? ptrace_notify+0x278/0x380
[   77.547136][ T5027]  __x64_sys_openat+0x247/0x290
[   77.552014][ T5027]  ? __ia32_sys_open+0x270/0x270
[   77.556988][ T5027]  ? syscall_enter_from_user_mode+0x32/0x230
[   77.562989][ T5027]  ? syscall_enter_from_user_mode+0x8c/0x230
[   77.568987][ T5027]  do_syscall_64+0x41/0xc0
[   77.573424][ T5027]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   77.579334][ T5027] RIP: 0033:0x7f77aa5ca979
[   77.583756][ T5027] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   77.603361][ T5027] RSP: 002b:00007ffdc17aa058 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[   77.612038][ T5027] RAX: ffffffffffffffda RBX: 00007f77aa61304b RCX: 00007f77aa5ca979
[   77.620015][ T5027] RDX: 0000000000141842 RSI: 0000000020000380 RDI: 00000000ffffff9c
[   77.627986][ T5027] RBP: 00007f77aa613055 R08: 0000000000000260 R09: 0000000000000000
[   77.635957][ T5027] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[   77.643930][ T5027] R13: 00007ffdc17aa238 R14: 0000000000000001 R15: 0000000000000001
[   77.651909][ T5027]  </TASK>
[   77.655171][ T5027] Kernel Offset: disabled
[   77.661770][ T5027] Rebooting in 86400 seconds..