./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1688609199

<...>
Warning: Permanently added '10.128.0.111' (ED25519) to the list of known hosts.
execve("./syz-executor1688609199", ["./syz-executor1688609199"], 0x7ffc624958c0 /* 10 vars */) = 0
brk(NULL)                               = 0x555569ffa000
brk(0x555569ffad00)                     = 0x555569ffad00
arch_prctl(ARCH_SET_FS, 0x555569ffa380) = 0
set_tid_address(0x555569ffa650)         = 5228
set_robust_list(0x555569ffa660, 24)     = 0
rseq(0x555569ffaca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1688609199", 4096) = 28
getrandom("\xf2\x97\xd6\x5e\x27\xbe\x57\x93", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555569ffad00
brk(0x55556a01bd00)                     = 0x55556a01bd00
brk(0x55556a01c000)                     = 0x55556a01c000
mprotect(0x7fc1628cd000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5229 attached
, child_tidptr=0x555569ffa650) = 5229
[pid  5229] set_robust_list(0x555569ffa660, 24) = 0
[pid  5229] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5229] setpgid(0, 0)               = 0
[pid  5229] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5229] write(3, "1000", 4)         = 4
[pid  5229] close(3)                    = 0
executing program
[pid  5229] write(1, "executing program\n", 18) = 18
[pid  5229] memfd_create("syzkaller", 0) = 3
[pid  5229] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc15a400000
[pid  5229] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768
[pid  5229] munmap(0x7fc15a400000, 138412032) = 0
[pid  5229] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5229] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5229] close(3)                    = 0
[pid  5229] close(4)                    = 0
[pid  5229] mkdir("./file1", 0777)      = 0
[pid  5229] mount("/dev/loop0", "./file1", "hfs", 0, "") = 0
[pid  5229] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5229] chdir("./file1")            = 0
[pid  5229] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid  5229] openat(AT_FDCWD, "blkio.bfq.io_service_bytes", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[   72.029506][ T5229] loop0: detected capacity change from 0 to 64
[   72.061453][ T5229] ==================================================================
[   72.069566][ T5229] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x314/0x450
[   72.077491][ T5229] Write of size 94 at addr ffff888146303480 by task syz-executor168/5229
[   72.085899][ T5229] 
[   72.088262][ T5229] CPU: 1 UID: 0 PID: 5229 Comm: syz-executor168 Not tainted 6.12.0-rc2-syzkaller-00260-g9e4c6c1ad9a1 #0
[   72.099377][ T5229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   72.109443][ T5229] Call Trace:
[   72.112722][ T5229]  <TASK>
[   72.115649][ T5229]  dump_stack_lvl+0x241/0x360
[   72.120339][ T5229]  ? __pfx_dump_stack_lvl+0x10/0x10
[   72.125570][ T5229]  ? __pfx__printk+0x10/0x10
[   72.130161][ T5229]  ? _printk+0xd5/0x120
[   72.134321][ T5229]  ? __virt_addr_valid+0x183/0x530
[   72.139473][ T5229]  ? __virt_addr_valid+0x183/0x530
[   72.144593][ T5229]  print_report+0x169/0x550
[   72.149113][ T5229]  ? __virt_addr_valid+0x183/0x530
[   72.154243][ T5229]  ? __virt_addr_valid+0x183/0x530
[   72.159360][ T5229]  ? __virt_addr_valid+0x45f/0x530
[   72.164478][ T5229]  ? __phys_addr+0xba/0x170
[   72.168997][ T5229]  ? hfs_bnode_read_key+0x314/0x450
[   72.174211][ T5229]  kasan_report+0x143/0x180
[   72.178817][ T5229]  ? hfs_bnode_read_key+0x314/0x450
[   72.184017][ T5229]  kasan_check_range+0x282/0x290
[   72.188978][ T5229]  ? hfs_bnode_read_key+0x314/0x450
[   72.194178][ T5229]  __asan_memcpy+0x40/0x70
[   72.198604][ T5229]  hfs_bnode_read_key+0x314/0x450
[   72.203637][ T5229]  hfs_brec_insert+0x7f3/0xbd0
[   72.208421][ T5229]  ? __pfx_hfs_brec_insert+0x10/0x10
[   72.213728][ T5229]  hfs_cat_create+0x41d/0xa50
[   72.218415][ T5229]  ? __pfx_hfs_cat_create+0x10/0x10
[   72.223627][ T5229]  ? _raw_spin_unlock+0x28/0x50
[   72.228490][ T5229]  ? hfs_new_inode+0x86e/0xaf0
[   72.233266][ T5229]  hfs_mkdir+0x6c/0xe0
[   72.237358][ T5229]  vfs_mkdir+0x2f9/0x4f0
[   72.241626][ T5229]  do_mkdirat+0x264/0x3a0
[   72.245966][ T5229]  ? __might_fault+0xaa/0x120
[   72.250675][ T5229]  ? __pfx_do_mkdirat+0x10/0x10
[   72.255550][ T5229]  ? strncpy_from_user+0x131/0x250
[   72.260678][ T5229]  ? getname_flags+0x1e3/0x540
[   72.265480][ T5229]  __x64_sys_mkdir+0x6c/0x80
[   72.270081][ T5229]  do_syscall_64+0xf3/0x230
[   72.274592][ T5229]  ? clear_bhb_loop+0x35/0x90
[   72.279295][ T5229]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   72.285213][ T5229] RIP: 0033:0x7fc162859a99
[   72.289634][ T5229] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   72.310120][ T5229] RSP: 002b:00007ffc9051b6e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
[   72.318541][ T5229] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc162859a99
[   72.326518][ T5229] RDX: 00007fc162859a99 RSI: 0000000000000000 RDI: 0000000020000300
[   72.334588][ T5229] RBP: 00007fc1628cd5f0 R08: 0000555569ffb4c0 R09: 0000555569ffb4c0
[   72.342568][ T5229] R10: 00000000000002b3 R11: 0000000000000246 R12: 00007ffc9051b710
[   72.350540][ T5229] R13: 00007ffc9051b938 R14: 431bde82d7b634db R15: 00007fc1628a203b
[   72.358525][ T5229]  </TASK>
[   72.361545][ T5229] 
[   72.363870][ T5229] Allocated by task 5229:
[   72.368195][ T5229]  kasan_save_track+0x3f/0x80
[   72.372883][ T5229]  __kasan_kmalloc+0x98/0xb0
[   72.377497][ T5229]  __kmalloc_noprof+0x1fc/0x400
[   72.382435][ T5229]  hfs_find_init+0x90/0x1f0
[   72.386945][ T5229]  hfs_cat_create+0x182/0xa50
[   72.391627][ T5229]  hfs_mkdir+0x6c/0xe0
[   72.395702][ T5229]  vfs_mkdir+0x2f9/0x4f0
[   72.399949][ T5229]  do_mkdirat+0x264/0x3a0
[   72.404282][ T5229]  __x64_sys_mkdir+0x6c/0x80
[   72.408907][ T5229]  do_syscall_64+0xf3/0x230
[   72.413415][ T5229]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   72.419318][ T5229] 
[   72.421640][ T5229] The buggy address belongs to the object at ffff888146303480
[   72.421640][ T5229]  which belongs to the cache kmalloc-96 of size 96
[   72.435517][ T5229] The buggy address is located 0 bytes inside of
[   72.435517][ T5229]  allocated 78-byte region [ffff888146303480, ffff8881463034ce)
[   72.449397][ T5229] 
[   72.451728][ T5229] The buggy address belongs to the physical page:
[   72.458148][ T5229] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x146303
[   72.467000][ T5229] anon flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
[   72.474638][ T5229] page_type: f5(slab)
[   72.478624][ T5229] raw: 057ff00000000000 ffff88801ac41280 ffffea00050dd700 dead000000000005
[   72.487217][ T5229] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[   72.495883][ T5229] page dumped because: kasan: bad access detected
[   72.502304][ T5229] page_owner tracks the page as allocated
[   72.508020][ T5229] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 12056148846, free_ts 0
[   72.525646][ T5229]  post_alloc_hook+0x1f3/0x230
[   72.530424][ T5229]  get_page_from_freelist+0x3039/0x3180
[   72.535993][ T5229]  __alloc_pages_noprof+0x292/0x710
[   72.541198][ T5229]  alloc_pages_mpol_noprof+0x3e8/0x680
[   72.546696][ T5229]  alloc_slab_page+0x6a/0x120
[   72.551384][ T5229]  allocate_slab+0x5a/0x2f0
[   72.555893][ T5229]  ___slab_alloc+0xcd1/0x14b0
[   72.560577][ T5229]  __slab_alloc+0x58/0xa0
[   72.565043][ T5229]  __kmalloc_cache_noprof+0x1d5/0x2c0
[   72.570420][ T5229]  usb_hub_create_port_device+0xc8/0xc10
[   72.576066][ T5229]  hub_probe+0x2503/0x3640
[   72.580492][ T5229]  usb_probe_interface+0x645/0xbb0
[   72.585606][ T5229]  really_probe+0x2b8/0xad0
[   72.590115][ T5229]  __driver_probe_device+0x1a2/0x390
[   72.595404][ T5229]  driver_probe_device+0x50/0x430
[   72.600432][ T5229]  __device_attach_driver+0x2d6/0x530
[   72.605813][ T5229] page_owner free stack trace missing
[   72.611189][ T5229] 
[   72.613513][ T5229] Memory state around the buggy address:
[   72.619143][ T5229]  ffff888146303380: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[   72.627232][ T5229]  ffff888146303400: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   72.635292][ T5229] >ffff888146303480: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc
[   72.643358][ T5229]                                               ^
[   72.649783][ T5229]  ffff888146303500: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   72.657851][ T5229]  ffff888146303580: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   72.665916][ T5229] ==================================================================
[   72.674468][ T5229] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   72.681688][ T5229] CPU: 1 UID: 0 PID: 5229 Comm: syz-executor168 Not tainted 6.12.0-rc2-syzkaller-00260-g9e4c6c1ad9a1 #0
[   72.692799][ T5229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   72.702857][ T5229] Call Trace:
[   72.706140][ T5229]  <TASK>
[   72.709077][ T5229]  dump_stack_lvl+0x241/0x360
[   72.713780][ T5229]  ? __pfx_dump_stack_lvl+0x10/0x10
[   72.718988][ T5229]  ? __pfx__printk+0x10/0x10
[   72.723582][ T5229]  ? preempt_schedule+0xe1/0xf0
[   72.728460][ T5229]  ? vscnprintf+0x5d/0x90
[   72.732799][ T5229]  panic+0x349/0x880
[   72.736701][ T5229]  ? check_panic_on_warn+0x21/0xb0
[   72.741817][ T5229]  ? __pfx_panic+0x10/0x10
[   72.746241][ T5229]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   72.752241][ T5229]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   72.758583][ T5229]  ? print_report+0x502/0x550
[   72.763304][ T5229]  check_panic_on_warn+0x86/0xb0
[   72.768255][ T5229]  ? hfs_bnode_read_key+0x314/0x450
[   72.773459][ T5229]  end_report+0x77/0x160
[   72.777716][ T5229]  kasan_report+0x154/0x180
[   72.782235][ T5229]  ? hfs_bnode_read_key+0x314/0x450
[   72.787444][ T5229]  kasan_check_range+0x282/0x290
[   72.792423][ T5229]  ? hfs_bnode_read_key+0x314/0x450
[   72.797626][ T5229]  __asan_memcpy+0x40/0x70
[   72.802052][ T5229]  hfs_bnode_read_key+0x314/0x450
[   72.807082][ T5229]  hfs_brec_insert+0x7f3/0xbd0
[   72.811861][ T5229]  ? __pfx_hfs_brec_insert+0x10/0x10
[   72.817158][ T5229]  hfs_cat_create+0x41d/0xa50
[   72.821846][ T5229]  ? __pfx_hfs_cat_create+0x10/0x10
[   72.827058][ T5229]  ? _raw_spin_unlock+0x28/0x50
[   72.831919][ T5229]  ? hfs_new_inode+0x86e/0xaf0
[   72.836712][ T5229]  hfs_mkdir+0x6c/0xe0
[   72.840817][ T5229]  vfs_mkdir+0x2f9/0x4f0
[   72.845078][ T5229]  do_mkdirat+0x264/0x3a0
[   72.849430][ T5229]  ? __might_fault+0xaa/0x120
[   72.854167][ T5229]  ? __pfx_do_mkdirat+0x10/0x10
[   72.859043][ T5229]  ? strncpy_from_user+0x131/0x250
[   72.864376][ T5229]  ? getname_flags+0x1e3/0x540
[   72.869929][ T5229]  __x64_sys_mkdir+0x6c/0x80
[   72.874533][ T5229]  do_syscall_64+0xf3/0x230
[   72.879043][ T5229]  ? clear_bhb_loop+0x35/0x90
[   72.883724][ T5229]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   72.889629][ T5229] RIP: 0033:0x7fc162859a99
[   72.894049][ T5229] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   72.913661][ T5229] RSP: 002b:00007ffc9051b6e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
[   72.922082][ T5229] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc162859a99
[   72.930054][ T5229] RDX: 00007fc162859a99 RSI: 0000000000000000 RDI: 0000000020000300
[   72.938025][ T5229] RBP: 00007fc1628cd5f0 R08: 0000555569ffb4c0 R09: 0000555569ffb4c0
[   72.946000][ T5229] R10: 00000000000002b3 R11: 0000000000000246 R12: 00007ffc9051b710
[   72.954058][ T5229] R13: 00007ffc9051b938 R14: 431bde82d7b634db R15: 00007fc1628a203b
[   72.962127][ T5229]  </TASK>
[   72.965473][ T5229] Kernel Offset: disabled
[   72.969826][ T5229] Rebooting in 86400 seconds..