Warning: Permanently added '[localhost]:59574' (ED25519) to the list of known hosts.
executing program
syzkaller login: [ 79.848270][ T5306] loop0: detected capacity change from 0 to 32768
[ 79.858865][ T5306] =======================================================
[ 79.858865][ T5306] WARNING: The mand mount option has been deprecated and
[ 79.858865][ T5306] and is ignored by this kernel. Remove the mand
[ 79.858865][ T5306] option from the mount to silence this warning.
[ 79.858865][ T5306] =======================================================
[ 79.933508][ T5306] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[ 79.945344][ T5306] ==================================================================
[ 79.948809][ T5306] BUG: KASAN: use-after-free in ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 79.952260][ T5306] Read of size 2 at addr ffff8880488de8c9 by task syz-executor146/5306
[ 79.956873][ T5306]
[ 79.957898][ T5306] CPU: 0 UID: 0 PID: 5306 Comm: syz-executor146 Not tainted 6.15.0-syzkaller-08297-ge0797d3b91de #0 PREEMPT(full)
[ 79.957914][ T5306] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 79.957922][ T5306] Call Trace:
[ 79.957929][ T5306]
[ 79.957936][ T5306] dump_stack_lvl+0x189/0x250
[ 79.957955][ T5306] ? __virt_addr_valid+0x1c8/0x5c0
[ 79.957972][ T5306] ? rcu_is_watching+0x15/0xb0
[ 79.957985][ T5306] ? __kasan_check_byte+0x12/0x40
[ 79.957999][ T5306] ? __pfx_dump_stack_lvl+0x10/0x10
[ 79.958014][ T5306] ? rcu_is_watching+0x15/0xb0
[ 79.958026][ T5306] ? lock_release+0x4b/0x3e0
[ 79.958035][ T5306] ? __virt_addr_valid+0x1c8/0x5c0
[ 79.958048][ T5306] ? __virt_addr_valid+0x4a5/0x5c0
[ 79.958062][ T5306] print_report+0xd2/0x2b0
[ 79.958076][ T5306] ? ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 79.958086][ T5306] kasan_report+0x118/0x150
[ 79.958097][ T5306] ? inode_query_iversion+0x11a/0x170
[ 79.958112][ T5306] ? ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 79.958124][ T5306] ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 79.958139][ T5306] ? __pfx_ocfs2_dir_foreach_blk+0x10/0x10
[ 79.958150][ T5306] ? ocfs2_inode_lock_atime+0x232/0x4e0
[ 79.958164][ T5306] ? __pfx_ocfs2_inode_lock_atime+0x10/0x10
[ 79.958179][ T5306] ? wrap_directory_iterator+0x5a/0xe0
[ 79.958198][ T5306] ocfs2_readdir+0x254/0x4c0
[ 79.958208][ T5306] ? __pfx_ocfs2_readdir+0x10/0x10
[ 79.958218][ T5306] ? down_write+0x162/0x1f0
[ 79.958288][ T5306] ? __pfx_down_write+0x10/0x10
[ 79.958302][ T5306] ? __pfx_ocfs2_readdir+0x10/0x10
[ 79.958312][ T5306] wrap_directory_iterator+0x96/0xe0
[ 79.958324][ T5306] iterate_dir+0x5af/0x770
[ 79.958336][ T5306] __se_sys_getdents+0xe4/0x250
[ 79.958348][ T5306] ? __pfx___se_sys_getdents+0x10/0x10
[ 79.958358][ T5306] ? exc_page_fault+0x76/0xf0
[ 79.958369][ T5306] ? __pfx_filldir+0x10/0x10
[ 79.958381][ T5306] ? do_syscall_64+0xbe/0x3b0
[ 79.958394][ T5306] do_syscall_64+0xfa/0x3b0
[ 79.958405][ T5306] ? lockdep_hardirqs_on+0x9c/0x150
[ 79.958415][ T5306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.958425][ T5306] ? clear_bhb_loop+0x60/0xb0
[ 79.958437][ T5306] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.958449][ T5306] RIP: 0033:0x7fae7968a2e9
[ 79.958461][ T5306] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 79.958471][ T5306] RSP: 002b:00007ffe13792098 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
[ 79.958484][ T5306] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fae7968a2e9
[ 79.958492][ T5306] RDX: 0000000000000058 RSI: 0000000000000000 RDI: 0000000000000004
[ 79.958498][ T5306] RBP: 0000000000000000 R08: 00007ffe137920d0 R09: 00007ffe137920d0
[ 79.958504][ T5306] R10: 00007ffe137920d0 R11: 0000000000000246 R12: 0000000000000001
[ 79.958510][ T5306] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffe137920f0
[ 79.958521][ T5306]
[ 79.958525][ T5306]
[ 80.079453][ T5306] The buggy address belongs to the physical page:
[ 80.081994][ T5306] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7fce425bb pfn:0x488de
[ 80.085764][ T5306] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 80.088849][ T5306] raw: 04fff00000000000 ffffea00012237c8 ffffea0001223708 0000000000000000
[ 80.092306][ T5306] raw: 00000007fce425bb 0000000000000000 00000000ffffffff 0000000000000000
[ 80.095604][ T5306] page dumped because: kasan: bad access detected
[ 80.098269][ T5306] page_owner tracks the page as freed
[ 80.100485][ T5306] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 5307, tgid 5307 (udevd), ts 79884353424, free_ts 79899200165
[ 80.107726][ T5306] post_alloc_hook+0x240/0x2a0
[ 80.109788][ T5306] get_page_from_freelist+0x21e0/0x22c0
[ 80.112269][ T5306] __alloc_frozen_pages_noprof+0x181/0x370
[ 80.114877][ T5306] alloc_pages_mpol+0x232/0x4a0
[ 80.117010][ T5306] vma_alloc_folio_noprof+0xe4/0x200
[ 80.119347][ T5306] folio_prealloc+0x30/0x180
[ 80.121317][ T5306] __handle_mm_fault+0x2c6a/0x55e0
[ 80.123516][ T5306] handle_mm_fault+0x40a/0x8e0
[ 80.125419][ T5306] do_user_addr_fault+0x764/0x1390
[ 80.127369][ T5306] exc_page_fault+0x76/0xf0
[ 80.129254][ T5306] asm_exc_page_fault+0x26/0x30
[ 80.131274][ T5306] page last free pid 5307 tgid 5307 stack trace:
[ 80.133812][ T5306] free_unref_folios+0xcc9/0x1550
[ 80.135664][ T5306] folios_put_refs+0x559/0x640
[ 80.137663][ T5306] free_pages_and_swap_cache+0x4be/0x520
[ 80.139896][ T5306] tlb_flush_mmu+0x3a0/0x680
[ 80.141789][ T5306] tlb_finish_mmu+0xc3/0x1d0
[ 80.143712][ T5306] vms_clear_ptes+0x42c/0x540
[ 80.145877][ T5306] vms_complete_munmap_vmas+0x206/0x8a0
[ 80.148468][ T5306] do_vmi_align_munmap+0x358/0x420
[ 80.150663][ T5306] do_vmi_munmap+0x253/0x2e0
[ 80.152656][ T5306] __vm_munmap+0x23b/0x3d0
[ 80.154570][ T5306] __x64_sys_munmap+0x60/0x70
[ 80.156623][ T5306] do_syscall_64+0xfa/0x3b0
[ 80.158554][ T5306] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.161218][ T5306]
[ 80.162162][ T5306] Memory state around the buggy address:
[ 80.164461][ T5306] ffff8880488de780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.167628][ T5306] ffff8880488de800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.171032][ T5306] >ffff8880488de880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.174379][ T5306] ^
[ 80.177250][ T5306] ffff8880488de900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.181504][ T5306] ffff8880488de980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.185860][ T5306] ==================================================================
[ 80.197820][ T5306] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 80.201094][ T5306] CPU: 0 UID: 0 PID: 5306 Comm: syz-executor146 Not tainted 6.15.0-syzkaller-08297-ge0797d3b91de #0 PREEMPT(full)
[ 80.206148][ T5306] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 80.210780][ T5306] Call Trace:
[ 80.212270][ T5306]
[ 80.213713][ T5306] dump_stack_lvl+0x99/0x250
[ 80.215739][ T5306] ? __asan_memcpy+0x40/0x70
[ 80.217800][ T5306] ? __pfx_dump_stack_lvl+0x10/0x10
[ 80.219981][ T5306] ? __pfx__printk+0x10/0x10
[ 80.222066][ T5306] panic+0x2db/0x790
[ 80.223760][ T5306] ? __pfx_panic+0x10/0x10
[ 80.225740][ T5306] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 80.228150][ T5306] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 80.230837][ T5306] ? print_memory_metadata+0x314/0x400
[ 80.233063][ T5306] ? ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 80.235393][ T5306] check_panic_on_warn+0x89/0xb0
[ 80.237450][ T5306] ? ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 80.239828][ T5306] end_report+0x78/0x160
[ 80.241678][ T5306] kasan_report+0x129/0x150
[ 80.243597][ T5306] ? inode_query_iversion+0x11a/0x170
[ 80.245796][ T5306] ? ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 80.248098][ T5306] ocfs2_dir_foreach_blk+0x1501/0x18a0
[ 80.250341][ T5306] ? __pfx_ocfs2_dir_foreach_blk+0x10/0x10
[ 80.252719][ T5306] ? ocfs2_inode_lock_atime+0x232/0x4e0
[ 80.255078][ T5306] ? __pfx_ocfs2_inode_lock_atime+0x10/0x10
[ 80.257519][ T5306] ? wrap_directory_iterator+0x5a/0xe0
[ 80.259805][ T5306] ocfs2_readdir+0x254/0x4c0
[ 80.261843][ T5306] ? __pfx_ocfs2_readdir+0x10/0x10
[ 80.263977][ T5306] ? down_write+0x162/0x1f0
[ 80.265855][ T5306] ? __pfx_down_write+0x10/0x10
[ 80.267897][ T5306] ? __pfx_ocfs2_readdir+0x10/0x10
[ 80.269940][ T5306] wrap_directory_iterator+0x96/0xe0
[ 80.272225][ T5306] iterate_dir+0x5af/0x770
[ 80.274018][ T5306] __se_sys_getdents+0xe4/0x250
[ 80.275941][ T5306] ? __pfx___se_sys_getdents+0x10/0x10
[ 80.278046][ T5306] ? exc_page_fault+0x76/0xf0
[ 80.280055][ T5306] ? __pfx_filldir+0x10/0x10
[ 80.282174][ T5306] ? do_syscall_64+0xbe/0x3b0
[ 80.284211][ T5306] do_syscall_64+0xfa/0x3b0
[ 80.286153][ T5306] ? lockdep_hardirqs_on+0x9c/0x150
[ 80.288302][ T5306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.290858][ T5306] ? clear_bhb_loop+0x60/0xb0
[ 80.292930][ T5306] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.295517][ T5306] RIP: 0033:0x7fae7968a2e9
[ 80.297482][ T5306] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 80.305489][ T5306] RSP: 002b:00007ffe13792098 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
[ 80.308995][ T5306] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fae7968a2e9
[ 80.312202][ T5306] RDX: 0000000000000058 RSI: 0000000000000000 RDI: 0000000000000004
[ 80.315538][ T5306] RBP: 0000000000000000 R08: 00007ffe137920d0 R09: 00007ffe137920d0
[ 80.318848][ T5306] R10: 00007ffe137920d0 R11: 0000000000000246 R12: 0000000000000001
[ 80.322184][ T5306] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffe137920f0
[ 80.325510][ T5306]
[ 80.327125][ T5306] Kernel Offset: disabled
[ 80.328988][ T5306] Rebooting in 86400 seconds..
VM DIAGNOSIS:
23:07:52 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000d1e7350
R8 =ffff888032240237 R9 =1ffff11006448046 R10=dffffc0000000000 R11=ffffffff8545c330
R12=dffffc0000000000 R13=ffffffff99ab1929 R14=ffffffff99db6d20 R15=0000000000000000
RIP=ffffffff8545c3ac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555583477380 ffffffff 00c00000
GS =0000 ffff88808d264000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fce427909c0 CR3=0000000043013000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fefeffd0 Opmask01=0000000000004211 Opmask02=000000007ffeffff Opmask03=0000000008000000
Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 44455a494c414954 494e495f43455355
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 44455a494c414954 494e495f43455355
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffff0f0e0d0c0b
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0072736d00313d63 696e61705f6f7400
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffff00 ffffffffffff00ff
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff0000ff000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fce42752c80
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3965336265396261 613434322d623333 622d383864342d63 6666352d63333536
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3965336265396261 613434322d623333 622d383864342d63 6666352d63333536
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 656431622f646975 752d79622f6b7369 642f7665642f2031 342f7165736b7369
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 66666f3d73657469 72775f776f6c6c61 0072736d00313d63 696e61705f6f7400
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 322e392d3533712d 63707276703a2939 3030322c39484349 2b35335128435064
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7261646e6174536e 703a554d45516e76 733a302e3072623a 343130322f31302f
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343064623a312b32 316f70627e322d33 2e36312e312d6e61 696265642d332e36
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 313731302c453631 302c353631302c34 3631302c33343130 2c323431302c3134
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4f42490054544149 00240059535f4449 00655f61635f2400 4c24004c4544004d
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000