./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor364090364
<...>
Warning: Permanently added '10.128.1.122' (ED25519) to the list of known hosts.
execve("./syz-executor364090364", ["./syz-executor364090364"], 0x7ffc3ab6d030 /* 10 vars */) = 0
brk(NULL) = 0x55558ec1c000
brk(0x55558ec1cd00) = 0x55558ec1cd00
arch_prctl(ARCH_SET_FS, 0x55558ec1c380) = 0
set_tid_address(0x55558ec1c650) = 5842
set_robust_list(0x55558ec1c660, 24) = 0
rseq(0x55558ec1cca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor364090364", 4096) = 27
getrandom("\x6a\x32\xaf\x16\xee\x9f\xdd\xbe", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55558ec1cd00
brk(0x55558ec3dd00) = 0x55558ec3dd00
brk(0x55558ec3e000) = 0x55558ec3e000
mprotect(0x7f818c668000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.AwqFME", 0700) = 0
chmod("./syzkaller.AwqFME", 0777) = 0
chdir("./syzkaller.AwqFME") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5844 attached
, child_tidptr=0x55558ec1c650) = 5844
[pid 5844] set_robust_list(0x55558ec1c660, 24) = 0
[pid 5844] chdir("./0") = 0
[pid 5844] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5844] setpgid(0, 0) = 0
[pid 5844] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5844] write(3, "1000", 4) = 4
[pid 5844] close(3) = 0
[pid 5844] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5844] write(1, "executing program\n", 18executing program
) = 18
[pid 5844] memfd_create("syzkaller", 0) = 3
[pid 5844] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8184000000
[pid 5844] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5844] munmap(0x7f8184000000, 138412032) = 0
[pid 5844] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5844] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5844] close(3) = 0
[pid 5844] close(4) = 0
[pid 5844] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[pid 5844] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5844] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5844] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5844] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 62.834412][ T5844] loop0: detected capacity change from 0 to 128
[ 62.856579][ T5844] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 62.909320][ T5844] syz-executor364: attempt to access beyond end of device
[ 62.909320][ T5844] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 62.923532][ T5844] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 62.933329][ T5844] unable to read i-node block
[ 62.938261][ T5844] syz-executor364: attempt to access beyond end of device
[ 62.938261][ T5844] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[pid 5844] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_SYNC|O_DIRECT, 060) = -1 EIO (Input/output error)
[pid 5844] exit_group(0) = ?
[pid 5844] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5844, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 62.952238][ T5844] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 62.960884][ T5844] sysv_free_inode: unable to read inode block on device loop0
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55558ec1d6f0 /* 4 entries */, 32768) = 176
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 63.081977][ T5842] sysv_free_block: flc_count > flc_size
[ 63.087805][ T5842] sysv_free_block: flc_count > flc_size
[ 63.093351][ T5842] sysv_free_block: flc_count > flc_size
[ 63.098950][ T5842] sysv_free_block: flc_count > flc_size
[ 63.104517][ T5842] sysv_free_block: flc_count > flc_size
[ 63.110142][ T5842] sysv_free_block: flc_count > flc_size
[ 63.115702][ T5842] sysv_free_block: flc_count > flc_size
[ 63.121433][ T5842] sysv_free_block: flc_count > flc_size
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
[ 63.126987][ T5842] sysv_free_block: flc_count > flc_size
[ 63.132657][ T5842] sysv_free_block: flc_count > flc_size
[ 63.138619][ T5842] sysv_free_inode: inode 0,1,2 or nonexistent inode
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x55558ec25730 /* 2 entries */, 32768) = 48
getdents64(4, 0x55558ec25730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
getdents64(3, 0x55558ec1d6f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5845 attached
, child_tidptr=0x55558ec1c650) = 5845
[pid 5845] set_robust_list(0x55558ec1c660, 24) = 0
[pid 5845] chdir("./1") = 0
[pid 5845] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5845] setpgid(0, 0) = 0
[pid 5845] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5845] write(3, "1000", 4) = 4
[pid 5845] close(3) = 0
[pid 5845] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5845] write(1, "executing program\n", 18executing program
) = 18
[pid 5845] memfd_create("syzkaller", 0) = 3
[pid 5845] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8184000000
[pid 5845] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5845] munmap(0x7f8184000000, 138412032) = 0
[pid 5845] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5845] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5845] close(3) = 0
[pid 5845] close(4) = 0
[pid 5845] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[ 63.423843][ T5845] loop0: detected capacity change from 0 to 128
[pid 5845] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5845] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5845] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5845] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 63.466284][ T5845] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 63.521190][ T5845] syz-executor364: attempt to access beyond end of device
[ 63.521190][ T5845] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 63.535204][ T5845] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 63.543732][ T5845] ==================================================================
[ 63.551813][ T5845] BUG: KASAN: use-after-free in sysv_new_inode+0xfc7/0x1160
[ 63.559115][ T5845] Read of size 2 at addr ffff88807a1521ce by task syz-executor364/5845
[ 63.567349][ T5845]
[ 63.569693][ T5845] CPU: 0 UID: 0 PID: 5845 Comm: syz-executor364 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0
[ 63.580700][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 63.590757][ T5845] Call Trace:
[ 63.594115][ T5845]
[ 63.597038][ T5845] dump_stack_lvl+0x241/0x360
[ 63.601717][ T5845] ? __pfx_dump_stack_lvl+0x10/0x10
[ 63.606910][ T5845] ? __pfx__printk+0x10/0x10
[ 63.611589][ T5845] ? _printk+0xd5/0x120
[ 63.615744][ T5845] ? __virt_addr_valid+0x183/0x530
[ 63.620844][ T5845] ? __virt_addr_valid+0x183/0x530
[ 63.625941][ T5845] print_report+0x169/0x550
[ 63.630432][ T5845] ? __virt_addr_valid+0x183/0x530
[ 63.635531][ T5845] ? __virt_addr_valid+0x183/0x530
[ 63.640626][ T5845] ? __virt_addr_valid+0x45f/0x530
[ 63.645727][ T5845] ? __phys_addr+0xba/0x170
[ 63.650223][ T5845] ? sysv_new_inode+0xfc7/0x1160
[ 63.655156][ T5845] kasan_report+0x143/0x180
[ 63.659661][ T5845] ? sysv_new_inode+0xfc7/0x1160
[ 63.664608][ T5845] sysv_new_inode+0xfc7/0x1160
[ 63.669382][ T5845] ? __pfx_sysv_new_inode+0x10/0x10
[ 63.674584][ T5845] ? _raw_spin_unlock+0x28/0x50
[ 63.679432][ T5845] ? __d_add+0x500/0x800
[ 63.683672][ T5845] sysv_mknod+0x4e/0xe0
[ 63.687813][ T5845] ? __pfx_sysv_create+0x10/0x10
[ 63.692740][ T5845] path_openat+0x1c03/0x3590
[ 63.697335][ T5845] ? __pfx_path_openat+0x10/0x10
[ 63.702286][ T5845] do_filp_open+0x27f/0x4e0
[ 63.706783][ T5845] ? __pfx_do_filp_open+0x10/0x10
[ 63.711798][ T5845] ? do_raw_spin_lock+0x14f/0x370
[ 63.716913][ T5845] do_sys_openat2+0x13e/0x1d0
[ 63.721601][ T5845] ? __pfx_do_sys_openat2+0x10/0x10
[ 63.726787][ T5845] ? lockdep_hardirqs_on+0x99/0x150
[ 63.732069][ T5845] ? _raw_spin_unlock_irq+0x2e/0x50
[ 63.737264][ T5845] ? ptrace_notify+0x279/0x380
[ 63.742025][ T5845] __x64_sys_openat+0x247/0x2a0
[ 63.746870][ T5845] ? __pfx___x64_sys_openat+0x10/0x10
[ 63.752236][ T5845] ? do_syscall_64+0x100/0x230
[ 63.756996][ T5845] do_syscall_64+0xf3/0x230
[ 63.761660][ T5845] ? clear_bhb_loop+0x35/0x90
[ 63.766332][ T5845] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.772215][ T5845] RIP: 0033:0x7f818c5ea0e9
[ 63.776716][ T5845] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 63.796319][ T5845] RSP: 002b:00007fff7edbecd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 63.804730][ T5845] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f818c5ea0e9
[ 63.812692][ T5845] RDX: 0000000000105042 RSI: 0000000020000080 RDI: 00000000ffffff9c
[ 63.820724][ T5845] RBP: 00000000ffffffff R08: 0000000000009e7f R09: 0000000000000000
[ 63.828689][ T5845] R10: 0000000000000030 R11: 0000000000000246 R12: 00007fff7edbed20
[ 63.836734][ T5845] R13: 00007fff7edbed60 R14: 0000000000010000 R15: 0000000000000003
[ 63.844701][ T5845]
[ 63.847717][ T5845]
[ 63.850031][ T5845] The buggy address belongs to the physical page:
[ 63.856451][ T5845] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7fd850132 pfn:0x7a152
[ 63.865898][ T5845] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 63.873025][ T5845] raw: 00fff00000000000 ffffea0001e854c8 ffffea0001e844c8 0000000000000000
[ 63.881613][ T5845] raw: 00000007fd850132 0000000000000000 00000000ffffffff 0000000000000000
[ 63.890181][ T5845] page dumped because: kasan: bad access detected
[ 63.896592][ T5845] page_owner tracks the page as freed
[ 63.901947][ T5845] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5834, tgid 5834 (sshd), ts 56973701838, free_ts 56993266862
[ 63.919910][ T5845] post_alloc_hook+0x1f3/0x230
[ 63.924668][ T5845] get_page_from_freelist+0x363e/0x3790
[ 63.930206][ T5845] __alloc_pages_noprof+0x292/0x710
[ 63.935412][ T5845] alloc_pages_mpol_noprof+0x3e8/0x680
[ 63.940867][ T5845] vma_alloc_folio_noprof+0x12e/0x230
[ 63.946228][ T5845] folio_prealloc+0x2e/0x170
[ 63.950809][ T5845] handle_pte_fault+0x2518/0x68a0
[ 63.955824][ T5845] handle_mm_fault+0x1053/0x1ad0
[ 63.961016][ T5845] exc_page_fault+0x459/0x8c0
[ 63.965690][ T5845] asm_exc_page_fault+0x26/0x30
[ 63.970530][ T5845] page last free pid 5834 tgid 5834 stack trace:
[ 63.976840][ T5845] free_unref_folios+0xf21/0x1a10
[ 63.981859][ T5845] folios_put_refs+0x76c/0x860
[ 63.986610][ T5845] free_pages_and_swap_cache+0x2ea/0x690
[ 63.992237][ T5845] tlb_flush_mmu+0x3a3/0x680
[ 63.996823][ T5845] tlb_finish_mmu+0xd4/0x200
[ 64.001497][ T5845] vms_clear_ptes+0x437/0x530
[ 64.006164][ T5845] vms_complete_munmap_vmas+0x210/0x8f0
[ 64.011872][ T5845] do_vmi_align_munmap+0x5ef/0x6f0
[ 64.016977][ T5845] do_vmi_munmap+0x24e/0x2d0
[ 64.021557][ T5845] __vm_munmap+0x24c/0x480
[ 64.025967][ T5845] __x64_sys_munmap+0x60/0x70
[ 64.030634][ T5845] do_syscall_64+0xf3/0x230
[ 64.035126][ T5845] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.041005][ T5845]
[ 64.043315][ T5845] Memory state around the buggy address:
[ 64.048934][ T5845] ffff88807a152080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.056983][ T5845] ffff88807a152100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.065051][ T5845] >ffff88807a152180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.073124][ T5845] ^
[ 64.079551][ T5845] ffff88807a152200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.087619][ T5845] ffff88807a152280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 64.095674][ T5845] ==================================================================
[ 64.104972][ T5845] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 64.112192][ T5845] CPU: 0 UID: 0 PID: 5845 Comm: syz-executor364 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0
[ 64.122951][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 64.133021][ T5845] Call Trace:
[ 64.136301][ T5845]
[ 64.139226][ T5845] dump_stack_lvl+0x241/0x360
[ 64.143905][ T5845] ? __pfx_dump_stack_lvl+0x10/0x10
[ 64.149097][ T5845] ? __pfx__printk+0x10/0x10
[ 64.153687][ T5845] ? preempt_schedule+0xe1/0xf0
[ 64.158539][ T5845] ? vscnprintf+0x5d/0x90
[ 64.162860][ T5845] panic+0x349/0x880
[ 64.166748][ T5845] ? check_panic_on_warn+0x21/0xb0
[ 64.171853][ T5845] ? __pfx_panic+0x10/0x10
[ 64.176262][ T5845] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 64.182237][ T5845] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 64.188569][ T5845] ? print_report+0x502/0x550
[ 64.193236][ T5845] check_panic_on_warn+0x86/0xb0
[ 64.198167][ T5845] ? sysv_new_inode+0xfc7/0x1160
[ 64.203099][ T5845] end_report+0x77/0x160
[ 64.207327][ T5845] kasan_report+0x154/0x180
[ 64.211816][ T5845] ? sysv_new_inode+0xfc7/0x1160
[ 64.216766][ T5845] sysv_new_inode+0xfc7/0x1160
[ 64.221671][ T5845] ? __pfx_sysv_new_inode+0x10/0x10
[ 64.226882][ T5845] ? _raw_spin_unlock+0x28/0x50
[ 64.231730][ T5845] ? __d_add+0x500/0x800
[ 64.235970][ T5845] sysv_mknod+0x4e/0xe0
[ 64.240114][ T5845] ? __pfx_sysv_create+0x10/0x10
[ 64.245041][ T5845] path_openat+0x1c03/0x3590
[ 64.249641][ T5845] ? __pfx_path_openat+0x10/0x10
[ 64.254581][ T5845] do_filp_open+0x27f/0x4e0
[ 64.259079][ T5845] ? __pfx_do_filp_open+0x10/0x10
[ 64.264098][ T5845] ? do_raw_spin_lock+0x14f/0x370
[ 64.269125][ T5845] do_sys_openat2+0x13e/0x1d0
[ 64.273798][ T5845] ? __pfx_do_sys_openat2+0x10/0x10
[ 64.279004][ T5845] ? lockdep_hardirqs_on+0x99/0x150
[ 64.284230][ T5845] ? _raw_spin_unlock_irq+0x2e/0x50
[ 64.289456][ T5845] ? ptrace_notify+0x279/0x380
[ 64.294229][ T5845] __x64_sys_openat+0x247/0x2a0
[ 64.299080][ T5845] ? __pfx___x64_sys_openat+0x10/0x10
[ 64.304448][ T5845] ? do_syscall_64+0x100/0x230
[ 64.309223][ T5845] do_syscall_64+0xf3/0x230
[ 64.313744][ T5845] ? clear_bhb_loop+0x35/0x90
[ 64.318431][ T5845] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.324332][ T5845] RIP: 0033:0x7f818c5ea0e9
[ 64.328743][ T5845] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 64.348340][ T5845] RSP: 002b:00007fff7edbecd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 64.356754][ T5845] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f818c5ea0e9
[ 64.364802][ T5845] RDX: 0000000000105042 RSI: 0000000020000080 RDI: 00000000ffffff9c
[ 64.372849][ T5845] RBP: 00000000ffffffff R08: 0000000000009e7f R09: 0000000000000000
[ 64.380809][ T5845] R10: 0000000000000030 R11: 0000000000000246 R12: 00007fff7edbed20
[ 64.388775][ T5845] R13: 00007fff7edbed60 R14: 0000000000010000 R15: 0000000000000003
[ 64.396742][ T5845]
[ 64.400016][ T5845] Kernel Offset: disabled
[ 64.404332][ T5845] Rebooting in 86400 seconds..