./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3781616626
<...>
forked to background, child pid 3207
no interfaces have a carrier
[ 27.318801][ T3208] 8021q: adding VLAN 0 to HW filter on device bond0
[ 27.331233][ T3208] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.172' (ECDSA) to the list of known hosts.
execve("./syz-executor3781616626", ["./syz-executor3781616626"], 0x7ffd2638bef0 /* 10 vars */) = 0
brk(NULL) = 0x555555a4d000
brk(0x555555a4dc40) = 0x555555a4dc40
arch_prctl(ARCH_SET_FS, 0x555555a4d300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3781616626", 4096) = 28
brk(0x555555a6ec40) = 0x555555a6ec40
brk(0x555555a6f000) = 0x555555a6f000
mprotect(0x7ffaa0faf000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffa98af6000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7ffa98af6000, 524288) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
mount("/dev/loop0", "./file0", "hfsplus", MS_POSIXACL, "") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
syzkaller login: [ 53.007681][ T3628] loop0: detected capacity change from 0 to 1024
[ 53.029406][ T3628] hfsplus: request for non-existent node 184549376 in B*Tree
[ 53.037064][ T3628] hfsplus: request for non-existent node 184549376 in B*Tree
[ 53.045576][ T3628] ==================================================================
[ 53.053827][ T3628] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x144/0x150
[ 53.061769][ T3628] Read of size 8 at addr ffff88801747a3c0 by task syz-executor378/3628
[ 53.069988][ T3628]
[ 53.072290][ T3628] CPU: 0 PID: 3628 Comm: syz-executor378 Not tainted 6.1.0-rc8-syzkaller-00154-g296a7b7eb792 #0
[ 53.082674][ T3628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 53.092711][ T3628] Call Trace:
[ 53.095971][ T3628]
[ 53.098881][ T3628] dump_stack_lvl+0xd1/0x138
[ 53.103486][ T3628] print_report+0x15e/0x45d
[ 53.107993][ T3628] ? __phys_addr+0xc8/0x140
[ 53.112502][ T3628] ? hfsplus_bnode_read+0x144/0x150
[ 53.117705][ T3628] kasan_report+0xbf/0x1f0
[ 53.122126][ T3628] ? hfsplus_bnode_read+0x144/0x150
[ 53.127326][ T3628] hfsplus_bnode_read+0x144/0x150
[ 53.132353][ T3628] hfsplus_bnode_dump+0x2c6/0x3a0
[ 53.137380][ T3628] ? hfsplus_bnode_read+0xb8/0x150
[ 53.142502][ T3628] ? hfsplus_bnode_move+0x900/0x900
[ 53.147702][ T3628] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 53.153168][ T3628] ? hfsplus_bnode_move+0x2b/0x900
[ 53.158288][ T3628] ? __mark_inode_dirty+0x32c/0x11e0
[ 53.163573][ T3628] hfsplus_brec_remove+0x3db/0x4f0
[ 53.168689][ T3628] __hfsplus_delete_attr+0x217/0x380
[ 53.173974][ T3628] ? hfsplus_find_exit+0xc0/0xc0
[ 53.178915][ T3628] ? hfsplus_part_find+0xb70/0xb70
[ 53.184025][ T3628] ? rcu_read_lock_sched_held+0x3e/0x70
[ 53.189571][ T3628] ? memset+0x24/0x50
[ 53.193547][ T3628] hfsplus_delete_all_attrs+0x25d/0x2d0
[ 53.199083][ T3628] ? hfsplus_delete_attr+0x2c0/0x2c0
[ 53.204355][ T3628] ? rcu_read_lock_sched_held+0x3e/0x70
[ 53.209895][ T3628] ? __mark_inode_dirty+0x67a/0x11e0
[ 53.215255][ T3628] hfsplus_delete_cat+0x86a/0xe40
[ 53.220274][ T3628] ? hfsplus_create_cat+0x10d0/0x10d0
[ 53.225726][ T3628] ? mutex_lock_io_nested+0x11a0/0x11a0
[ 53.231270][ T3628] ? lock_release+0x810/0x810
[ 53.235942][ T3628] hfsplus_unlink+0x1e3/0x830
[ 53.240614][ T3628] ? hfsplus_symlink+0x2e0/0x2e0
[ 53.245716][ T3628] ? down_write+0x157/0x220
[ 53.250556][ T3628] ? down_write_killable_nested+0x250/0x250
[ 53.256442][ T3628] vfs_unlink+0x355/0x930
[ 53.260772][ T3628] ? bpf_lsm_path_unlink+0x9/0x10
[ 53.265798][ T3628] do_unlinkat+0x3d0/0x660
[ 53.270290][ T3628] ? __ia32_sys_rmdir+0x110/0x110
[ 53.275321][ T3628] ? __check_object_size+0x2e2/0x5a0
[ 53.280610][ T3628] ? getname_flags.part.0+0x1dd/0x4f0
[ 53.285982][ T3628] __x64_sys_unlink+0xca/0x110
[ 53.290735][ T3628] do_syscall_64+0x39/0xb0
[ 53.295147][ T3628] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.301040][ T3628] RIP: 0033:0x7ffaa0f42769
[ 53.305444][ T3628] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 53.325051][ T3628] RSP: 002b:00007fff45e38798 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 53.333461][ T3628] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffaa0f42769
[ 53.341432][ T3628] RDX: 00007ffaa0f00de3 RSI: 0000000000000000 RDI: 0000000020000140
[ 53.349396][ T3628] RBP: 00007ffaa0f02000 R08: 00000000000005f0 R09: 0000000000000000
[ 53.357357][ T3628] R10: 00007fff45e38660 R11: 0000000000000246 R12: 00007ffaa0f02090
[ 53.365321][ T3628] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 53.373293][ T3628]
[ 53.376296][ T3628]
[ 53.378600][ T3628] Allocated by task 3628:
[ 53.382918][ T3628] kasan_save_stack+0x22/0x40
[ 53.387591][ T3628] kasan_set_track+0x25/0x30
[ 53.392174][ T3628] __kasan_kmalloc+0xa5/0xb0
[ 53.396757][ T3628] __kmalloc+0x5a/0xd0
[ 53.400816][ T3628] __hfs_bnode_create+0x107/0x820
[ 53.405836][ T3628] hfsplus_bnode_find+0x408/0xc50
[ 53.410857][ T3628] hfsplus_brec_find+0x2b3/0x510
[ 53.415794][ T3628] hfsplus_delete_all_attrs+0x236/0x2d0
[ 53.421337][ T3628] hfsplus_delete_cat+0x86a/0xe40
[ 53.426360][ T3628] hfsplus_unlink+0x1e3/0x830
[ 53.431033][ T3628] vfs_unlink+0x355/0x930
[ 53.435361][ T3628] do_unlinkat+0x3d0/0x660
[ 53.439765][ T3628] __x64_sys_unlink+0xca/0x110
[ 53.444522][ T3628] do_syscall_64+0x39/0xb0
[ 53.448933][ T3628] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.454825][ T3628]
[ 53.457133][ T3628] Last potentially related work creation:
[ 53.462834][ T3628] kasan_save_stack+0x22/0x40
[ 53.467507][ T3628] __kasan_record_aux_stack+0xbc/0xd0
[ 53.472881][ T3628] insert_work+0x48/0x350
[ 53.477206][ T3628] __queue_work+0x693/0x13b0
[ 53.481789][ T3628] queue_work_on+0xf2/0x110
[ 53.486297][ T3628] addr_event.part.0+0x33e/0x4f0
[ 53.491232][ T3628] inet6addr_event+0x142/0x1c0
[ 53.495986][ T3628] notifier_call_chain+0xb5/0x200
[ 53.501005][ T3628] atomic_notifier_call_chain+0x74/0x180
[ 53.506631][ T3628] ipv6_add_addr+0x1266/0x1de0
[ 53.511389][ T3628] inet6_addr_add+0x412/0xae0
[ 53.516059][ T3628] inet6_rtm_newaddr+0xfa8/0x1a60
[ 53.521078][ T3628] rtnetlink_rcv_msg+0x43e/0xca0
[ 53.526013][ T3628] netlink_rcv_skb+0x157/0x430
[ 53.530769][ T3628] netlink_unicast+0x547/0x7f0
[ 53.535530][ T3628] netlink_sendmsg+0x91b/0xe10
[ 53.540281][ T3628] sock_sendmsg+0xd3/0x120
[ 53.544688][ T3628] ____sys_sendmsg+0x712/0x8c0
[ 53.549444][ T3628] ___sys_sendmsg+0x110/0x1b0
[ 53.554108][ T3628] __sys_sendmsg+0xf7/0x1c0
[ 53.558597][ T3628] do_syscall_64+0x39/0xb0
[ 53.563015][ T3628] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.568904][ T3628]
[ 53.571215][ T3628] The buggy address belongs to the object at ffff88801747a300
[ 53.571215][ T3628] which belongs to the cache kmalloc-192 of size 192
[ 53.585354][ T3628] The buggy address is located 0 bytes to the right of
[ 53.585354][ T3628] 192-byte region [ffff88801747a300, ffff88801747a3c0)
[ 53.599140][ T3628]
[ 53.601445][ T3628] The buggy address belongs to the physical page:
[ 53.607834][ T3628] page:ffffea00005d1e80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1747a
[ 53.617968][ T3628] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 53.625506][ T3628] raw: 00fff00000000200 ffffea00005cb900 dead000000000004 ffff888012041a00
[ 53.634076][ T3628] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 53.642638][ T3628] page dumped because: kasan: bad access detected
[ 53.649031][ T3628] page_owner tracks the page as allocated
[ 53.654727][ T3628] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 1513916680, free_ts 0
[ 53.671302][ T3628] get_page_from_freelist+0x10b5/0x2d50
[ 53.676851][ T3628] __alloc_pages+0x1cb/0x5b0
[ 53.681434][ T3628] alloc_page_interleave+0x1e/0x200
[ 53.686618][ T3628] alloc_pages+0x233/0x270
[ 53.691022][ T3628] allocate_slab+0x25f/0x350
[ 53.695596][ T3628] ___slab_alloc+0xa91/0x1400
[ 53.700260][ T3628] __slab_alloc.constprop.0+0x56/0xa0
[ 53.705617][ T3628] __kmem_cache_alloc_node+0x199/0x3e0
[ 53.711065][ T3628] kmalloc_trace+0x26/0x60
[ 53.715474][ T3628] call_usermodehelper_setup+0x9b/0x340
[ 53.721015][ T3628] kobject_uevent_env+0xed3/0x1620
[ 53.726117][ T3628] param_sysfs_init+0x36b/0x43f
[ 53.730952][ T3628] do_one_initcall+0x141/0x780
[ 53.735702][ T3628] kernel_init_freeable+0x6ff/0x788
[ 53.740890][ T3628] kernel_init+0x1e/0x1d0
[ 53.745203][ T3628] ret_from_fork+0x1f/0x30
[ 53.749608][ T3628] page_owner free stack trace missing
[ 53.754955][ T3628]
[ 53.757258][ T3628] Memory state around the buggy address:
[ 53.762871][ T3628] ffff88801747a280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 53.770925][ T3628] ffff88801747a300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 53.778967][ T3628] >ffff88801747a380: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 53.787009][ T3628] ^
[ 53.793139][ T3628] ffff88801747a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 53.801181][ T3628] ffff88801747a480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 53.809226][ T3628] ==================================================================
[ 53.817791][ T3628] Kernel panic - not syncing: panic_on_warn set ...
[ 53.824391][ T3628] CPU: 1 PID: 3628 Comm: syz-executor378 Not tainted 6.1.0-rc8-syzkaller-00154-g296a7b7eb792 #0
[ 53.835145][ T3628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 53.845193][ T3628] Call Trace:
[ 53.848634][ T3628]
[ 53.851641][ T3628] dump_stack_lvl+0xd1/0x138
[ 53.856227][ T3628] panic+0x2cc/0x626
[ 53.860118][ T3628] ? panic_print_sys_info.part.0+0x110/0x110
[ 53.866351][ T3628] ? preempt_schedule_common+0x59/0xc0
[ 53.871804][ T3628] ? preempt_schedule_thunk+0x1a/0x1c
[ 53.877171][ T3628] end_report.part.0+0x3f/0x7c
[ 53.881953][ T3628] ? hfsplus_bnode_read+0x144/0x150
[ 53.887159][ T3628] kasan_report.cold+0xa/0xf
[ 53.891737][ T3628] ? hfsplus_bnode_read+0x144/0x150
[ 53.896928][ T3628] hfsplus_bnode_read+0x144/0x150
[ 53.901947][ T3628] hfsplus_bnode_dump+0x2c6/0x3a0
[ 53.906985][ T3628] ? hfsplus_bnode_read+0xb8/0x150
[ 53.912091][ T3628] ? hfsplus_bnode_move+0x900/0x900
[ 53.917281][ T3628] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 53.922735][ T3628] ? hfsplus_bnode_move+0x2b/0x900
[ 53.927838][ T3628] ? __mark_inode_dirty+0x32c/0x11e0
[ 53.933113][ T3628] hfsplus_brec_remove+0x3db/0x4f0
[ 53.938321][ T3628] __hfsplus_delete_attr+0x217/0x380
[ 53.943592][ T3628] ? hfsplus_find_exit+0xc0/0xc0
[ 53.948522][ T3628] ? hfsplus_part_find+0xb70/0xb70
[ 53.953632][ T3628] ? rcu_read_lock_sched_held+0x3e/0x70
[ 53.960674][ T3628] ? memset+0x24/0x50
[ 53.964679][ T3628] hfsplus_delete_all_attrs+0x25d/0x2d0
[ 53.970223][ T3628] ? hfsplus_delete_attr+0x2c0/0x2c0
[ 53.975503][ T3628] ? rcu_read_lock_sched_held+0x3e/0x70
[ 53.981049][ T3628] ? __mark_inode_dirty+0x67a/0x11e0
[ 53.986502][ T3628] hfsplus_delete_cat+0x86a/0xe40
[ 53.991536][ T3628] ? hfsplus_create_cat+0x10d0/0x10d0
[ 53.996914][ T3628] ? mutex_lock_io_nested+0x11a0/0x11a0
[ 54.002615][ T3628] ? lock_release+0x810/0x810
[ 54.007300][ T3628] hfsplus_unlink+0x1e3/0x830
[ 54.012071][ T3628] ? hfsplus_symlink+0x2e0/0x2e0
[ 54.017009][ T3628] ? down_write+0x157/0x220
[ 54.021504][ T3628] ? down_write_killable_nested+0x250/0x250
[ 54.027397][ T3628] vfs_unlink+0x355/0x930
[ 54.031745][ T3628] ? bpf_lsm_path_unlink+0x9/0x10
[ 54.036776][ T3628] do_unlinkat+0x3d0/0x660
[ 54.041193][ T3628] ? __ia32_sys_rmdir+0x110/0x110
[ 54.046209][ T3628] ? __check_object_size+0x2e2/0x5a0
[ 54.051498][ T3628] ? getname_flags.part.0+0x1dd/0x4f0
[ 54.056873][ T3628] __x64_sys_unlink+0xca/0x110
[ 54.061633][ T3628] do_syscall_64+0x39/0xb0
[ 54.066050][ T3628] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.071940][ T3628] RIP: 0033:0x7ffaa0f42769
[ 54.076345][ T3628] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.095948][ T3628] RSP: 002b:00007fff45e38798 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 54.104363][ T3628] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffaa0f42769
[ 54.112331][ T3628] RDX: 00007ffaa0f00de3 RSI: 0000000000000000 RDI: 0000000020000140
[ 54.120291][ T3628] RBP: 00007ffaa0f02000 R08: 00000000000005f0 R09: 0000000000000000
[ 54.128250][ T3628] R10: 00007fff45e38660 R11: 0000000000000246 R12: 00007ffaa0f02090
[ 54.136212][ T3628] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 54.144185][ T3628]
[ 54.148013][ T3628] Kernel Offset: disabled
[ 54.152337][ T3628] Rebooting in 86400 seconds..