./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2026847902 <...> Warning: Permanently added '10.128.1.183' (ED25519) to the list of known hosts. execve("./syz-executor2026847902", ["./syz-executor2026847902"], 0x7fff738c05d0 /* 10 vars */) = 0 brk(NULL) = 0x555583d0f000 brk(0x555583d0fe00) = 0x555583d0fe00 arch_prctl(ARCH_SET_FS, 0x555583d0f480) = 0 set_tid_address(0x555583d0f750) = 5218 set_robust_list(0x555583d0f760, 24) = 0 rseq(0x555583d0fda0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2026847902", 4096) = 28 getrandom("\xff\xad\x15\x35\x61\xc1\xe5\xb0", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555583d0fe00 brk(0x555583d30e00) = 0x555583d30e00 brk(0x555583d31000) = 0x555583d31000 mprotect(0x7fc0e91b3000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5219 attached , child_tidptr=0x555583d0f750) = 5219 [pid 5218] openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC [pid 5219] set_robust_list(0x555583d0f760, 24) = 0 [pid 5218] <... openat resumed>) = 3 [pid 5218] write(3, "10000000000", 11) = 11 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "20", 2) = 2 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "1", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "0", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "0", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "1", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "100", 3) = 3 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "0", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "0", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "7 4 1 3", 7) = 7 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "1", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "1", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "0", 1) = 1 [pid 5218] close(3) = 0 [pid 5218] openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "5219", 4) = 4 [pid 5218] close(3) = 0 [pid 5218] kill(5219, SIGKILL) = 0 [pid 5219] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5219, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5218}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5218}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5218}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5218}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5218}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5218}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5218}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7fc0e9108c60, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fc0e9110e90}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7fc0e9108c60, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fc0e9110e90}, NULL, 8) = 0 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc0e0c00000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7fc0e0c00000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0777) = 0 [ 78.564116][ T5218] loop0: detected capacity change from 0 to 512 [ 78.587530][ T5218] EXT4-fs: Ignoring removed mblk_io_submit option [ 78.597097][ T5218] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 78.618883][ T5218] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=b042c118, mo2=0002] [ 78.626979][ T5218] System zones: 1-12 [ 78.633399][ T5218] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz-executor202: corrupted in-inode xattr: e_value size too large [ 78.649831][ T5218] EXT4-fs error (device loop0): ext4_orphan_get:1393: comm syz-executor202: couldn't read orphan inode 15 (err -117) mount("/dev/loop0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "ext3", MS_MGC_VAL|MS_NOSUID|MS_NODEV|MS_NOEXEC, "jqfmt=vfsold,data_err=abort,debug,noload,mblk_io_submit,commit=0x0000000000000005,init_itable=0x0000"...) = 0 openat(AT_FDCWD, "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 78.663448][ T5218] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. mkdir("./bus", 0777) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 4 open(".", O_RDONLY) = 5 mknod("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 0 symlink("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 6 lseek(5, 2047, SEEK_CUR) = 2047 [ 78.800514][ T5218] EXT4-fs warning (device loop0): dx_probe:833: inode #2: comm syz-executor202: Unrecognised inode hash code 4 [ 78.812721][ T5218] EXT4-fs warning (device loop0): dx_probe:966: inode #2: comm syz-executor202: Corrupt directory, running e2fsck is recommended [ 78.826201][ T5218] ================================================================== [ 78.834373][ T5218] BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x6fd/0x880 [ 78.842299][ T5218] Read of size 2 at addr ffff8880125f1003 by task syz-executor202/5218 [ 78.850546][ T5218] [ 78.852913][ T5218] CPU: 1 UID: 0 PID: 5218 Comm: syz-executor202 Not tainted 6.12.0-rc1-syzkaller-00031-ge32cde8d2bd7 #0 [ 78.864027][ T5218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 78.874103][ T5218] Call Trace: [ 78.877380][ T5218] [ 78.880309][ T5218] dump_stack_lvl+0x241/0x360 [ 78.885052][ T5218] ? __pfx_dump_stack_lvl+0x10/0x10 [ 78.890335][ T5218] ? __pfx__printk+0x10/0x10 [ 78.894922][ T5218] ? _printk+0xd5/0x120 [ 78.899090][ T5218] ? __virt_addr_valid+0x183/0x530 [ 78.904218][ T5218] ? __virt_addr_valid+0x183/0x530 [ 78.909333][ T5218] print_report+0x169/0x550 [ 78.913847][ T5218] ? __virt_addr_valid+0x183/0x530 [ 78.918955][ T5218] ? __virt_addr_valid+0x183/0x530 [ 78.924073][ T5218] ? __virt_addr_valid+0x45f/0x530 [ 78.929183][ T5218] ? __phys_addr+0xba/0x170 [ 78.933702][ T5218] ? __ext4_check_dir_entry+0x6fd/0x880 [ 78.939265][ T5218] kasan_report+0x143/0x180 [ 78.943781][ T5218] ? __ext4_check_dir_entry+0x6fd/0x880 [ 78.949341][ T5218] __ext4_check_dir_entry+0x6fd/0x880 [ 78.954726][ T5218] ? __pfx_ext4_dirblock_csum_verify+0x10/0x10 [ 78.960892][ T5218] ext4_readdir+0x1436/0x3a60 [ 78.965677][ T5218] ? __mutex_trylock_common+0x183/0x2e0 [ 78.971318][ T5218] ? __pfx_ext4_readdir+0x10/0x10 [ 78.976349][ T5218] ? trace_contention_end+0x3c/0x120 [ 78.981638][ T5218] ? iterate_dir+0x20c/0x800 [ 78.986229][ T5218] ? __pfx_down_read_killable+0x10/0x10 [ 78.991772][ T5218] ? fdget_pos+0x24e/0x320 [ 78.996205][ T5218] ? __pfx___mutex_lock+0x10/0x10 [ 79.001403][ T5218] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 79.007388][ T5218] iterate_dir+0x571/0x800 [ 79.011821][ T5218] __se_sys_getdents64+0x1d3/0x4a0 [ 79.016945][ T5218] ? _raw_spin_unlock_irq+0x2e/0x50 [ 79.022149][ T5218] ? __pfx___se_sys_getdents64+0x10/0x10 [ 79.027781][ T5218] ? __pfx_filldir64+0x10/0x10 [ 79.032545][ T5218] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 79.038875][ T5218] ? do_syscall_64+0x100/0x230 [ 79.043987][ T5218] do_syscall_64+0xf3/0x230 [ 79.048589][ T5218] ? clear_bhb_loop+0x35/0x90 [ 79.053261][ T5218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.059252][ T5218] RIP: 0033:0x7fc0e91457c9 [ 79.063678][ T5218] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 79.083293][ T5218] RSP: 002b:00007ffe4f6bc318 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 79.091702][ T5218] RAX: ffffffffffffffda RBX: 00007ffe4f6bc430 RCX: 00007fc0e91457c9 [ 79.099687][ T5218] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000005 [ 79.107737][ T5218] RBP: 00007ffe4f6bc438 R08: 00007fc0e9188258 R09: 00007fc0e9188258 [ 79.115708][ T5218] R10: 00007fc0e9188258 R11: 0000000000000246 R12: 0000000000000000 [ 79.123681][ T5218] R13: 0000000000000000 R14: 00007fc0e91b96c0 R15: 000000000000001d [ 79.131652][ T5218] [ 79.134663][ T5218] [ 79.136985][ T5218] The buggy address belongs to the physical page: [ 79.143395][ T5218] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f0e84a87 pfn:0x125f1 [ 79.152936][ T5218] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 79.160061][ T5218] raw: 00fff00000000000 ffffea0000476408 ffff8880b8644af0 0000000000000000 [ 79.168655][ T5218] raw: 00000007f0e84a87 0000000000000000 00000000ffffffff 0000000000000000 [ 79.177228][ T5218] page dumped because: kasan: bad access detected [ 79.183743][ T5218] page_owner tracks the page as freed [ 79.189101][ T5218] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5207, tgid 5207 (sshd), ts 71056529663, free_ts 71161620783 [ 79.207154][ T5218] post_alloc_hook+0x1f3/0x230 [ 79.211922][ T5218] get_page_from_freelist+0x3039/0x3180 [ 79.217485][ T5218] __alloc_pages_noprof+0x256/0x6c0 [ 79.222683][ T5218] alloc_pages_mpol_noprof+0x3e8/0x680 [ 79.228134][ T5218] vma_alloc_folio_noprof+0x12e/0x230 [ 79.233499][ T5218] folio_prealloc+0x31/0x170 [ 79.238088][ T5218] handle_pte_fault+0x24dd/0x6800 [ 79.243115][ T5218] handle_mm_fault+0x1053/0x1ad0 [ 79.248061][ T5218] exc_page_fault+0x459/0x8c0 [ 79.252742][ T5218] asm_exc_page_fault+0x26/0x30 [ 79.257597][ T5218] page last free pid 5207 tgid 5207 stack trace: [ 79.263933][ T5218] free_unref_folios+0xee2/0x18a0 [ 79.268982][ T5218] folios_put_refs+0x76c/0x860 [ 79.273756][ T5218] free_pages_and_swap_cache+0x2ea/0x690 [ 79.279390][ T5218] tlb_flush_mmu+0x3a3/0x680 [ 79.283995][ T5218] tlb_finish_mmu+0xd4/0x200 [ 79.288599][ T5218] vms_clear_ptes+0x437/0x530 [ 79.293268][ T5218] vms_complete_munmap_vmas+0x208/0x910 [ 79.298810][ T5218] do_vmi_align_munmap+0x613/0x730 [ 79.303923][ T5218] do_vmi_munmap+0x24e/0x2d0 [ 79.308507][ T5218] __vm_munmap+0x24c/0x480 [ 79.312935][ T5218] __x64_sys_munmap+0x68/0x80 [ 79.317612][ T5218] do_syscall_64+0xf3/0x230 [ 79.322123][ T5218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.328019][ T5218] [ 79.330343][ T5218] Memory state around the buggy address: [ 79.335975][ T5218] ffff8880125f0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 79.344031][ T5218] ffff8880125f0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 79.352088][ T5218] >ffff8880125f1000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 79.360137][ T5218] ^ [ 79.364208][ T5218] ffff8880125f1080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 79.372276][ T5218] ffff8880125f1100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 79.380357][ T5218] ================================================================== [ 79.388986][ T5218] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 79.396218][ T5218] CPU: 1 UID: 0 PID: 5218 Comm: syz-executor202 Not tainted 6.12.0-rc1-syzkaller-00031-ge32cde8d2bd7 #0 [ 79.407339][ T5218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 79.417402][ T5218] Call Trace: [ 79.420689][ T5218] [ 79.423630][ T5218] dump_stack_lvl+0x241/0x360 [ 79.428326][ T5218] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.433544][ T5218] ? __pfx__printk+0x10/0x10 [ 79.438140][ T5218] ? preempt_schedule+0xe1/0xf0 [ 79.443096][ T5218] ? vscnprintf+0x5d/0x90 [ 79.447455][ T5218] panic+0x349/0x880 [ 79.451386][ T5218] ? check_panic_on_warn+0x21/0xb0 [ 79.456623][ T5218] ? __pfx_panic+0x10/0x10 [ 79.461057][ T5218] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 79.467071][ T5218] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 79.473423][ T5218] ? print_report+0x502/0x550 [ 79.478122][ T5218] check_panic_on_warn+0x86/0xb0 [ 79.483073][ T5218] ? __ext4_check_dir_entry+0x6fd/0x880 [ 79.488635][ T5218] end_report+0x77/0x160 [ 79.492894][ T5218] kasan_report+0x154/0x180 [ 79.497415][ T5218] ? __ext4_check_dir_entry+0x6fd/0x880 [ 79.502979][ T5218] __ext4_check_dir_entry+0x6fd/0x880 [ 79.508394][ T5218] ? __pfx_ext4_dirblock_csum_verify+0x10/0x10 [ 79.514561][ T5218] ext4_readdir+0x1436/0x3a60 [ 79.519290][ T5218] ? __mutex_trylock_common+0x183/0x2e0 [ 79.524941][ T5218] ? __pfx_ext4_readdir+0x10/0x10 [ 79.529978][ T5218] ? trace_contention_end+0x3c/0x120 [ 79.535271][ T5218] ? iterate_dir+0x20c/0x800 [ 79.539872][ T5218] ? __pfx_down_read_killable+0x10/0x10 [ 79.545425][ T5218] ? fdget_pos+0x24e/0x320 [ 79.549855][ T5218] ? __pfx___mutex_lock+0x10/0x10 [ 79.554885][ T5218] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 79.560889][ T5218] iterate_dir+0x571/0x800 [ 79.565319][ T5218] __se_sys_getdents64+0x1d3/0x4a0 [ 79.570448][ T5218] ? _raw_spin_unlock_irq+0x2e/0x50 [ 79.575663][ T5218] ? __pfx___se_sys_getdents64+0x10/0x10 [ 79.581328][ T5218] ? __pfx_filldir64+0x10/0x10 [ 79.586117][ T5218] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 79.592478][ T5218] ? do_syscall_64+0x100/0x230 [ 79.597266][ T5218] do_syscall_64+0xf3/0x230 [ 79.601786][ T5218] ? clear_bhb_loop+0x35/0x90 [ 79.606472][ T5218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.612378][ T5218] RIP: 0033:0x7fc0e91457c9 [ 79.616885][ T5218] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 79.636501][ T5218] RSP: 002b:00007ffe4f6bc318 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 79.644949][ T5218] RAX: ffffffffffffffda RBX: 00007ffe4f6bc430 RCX: 00007fc0e91457c9 [ 79.652951][ T5218] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000005 [ 79.660936][ T5218] RBP: 00007ffe4f6bc438 R08: 00007fc0e9188258 R09: 00007fc0e9188258 [ 79.669040][ T5218] R10: 00007fc0e9188258 R11: 0000000000000246 R12: 0000000000000000 [ 79.677031][ T5218] R13: 0000000000000000 R14: 00007fc0e91b96c0 R15: 000000000000001d [ 79.685018][ T5218] [ 79.688352][ T5218] Kernel Offset: disabled [ 79.692685][ T5218] Rebooting in 86400 seconds..