./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2792019613 <...> Warning: Permanently added '10.128.0.175' (ED25519) to the list of known hosts. execve("./syz-executor2792019613", ["./syz-executor2792019613"], 0x7fffff12d580 /* 10 vars */) = 0 brk(NULL) = 0x55557c174000 brk(0x55557c174d00) = 0x55557c174d00 arch_prctl(ARCH_SET_FS, 0x55557c174380) = 0 set_tid_address(0x55557c174650) = 5827 set_robust_list(0x55557c174660, 24) = 0 rseq(0x55557c174ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2792019613", 4096) = 28 getrandom("\x8d\x61\x39\xd1\xe6\xb0\xed\xcf", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557c174d00 brk(0x55557c195d00) = 0x55557c195d00 brk(0x55557c196000) = 0x55557c196000 mprotect(0x7f988d0c5000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.XVHr0n", 0700) = 0 chmod("./syzkaller.XVHr0n", 0777) = 0 chdir("./syzkaller.XVHr0n") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5828 attached [pid 5828] set_robust_list(0x55557c174660, 24 [pid 5827] <... clone resumed>, child_tidptr=0x55557c174650) = 5828 [pid 5828] <... set_robust_list resumed>) = 0 [pid 5828] chdir("./0") = 0 [pid 5828] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5828] setpgid(0, 0) = 0 [pid 5828] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1000", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5828] write(1, "executing program\n", 18executing program ) = 18 [pid 5828] memfd_create("syzkaller", 0) = 3 [pid 5828] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9884c00000 [pid 5828] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5828] munmap(0x7f9884c00000, 138412032) = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5828] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5828] close(3) = 0 [pid 5828] close(4) = 0 [pid 5828] mkdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", 0777) = 0 [ 59.394748][ T5828] loop0: detected capacity change from 0 to 512 [ 59.417449][ T5828] EXT4-fs: Ignoring removed orlov option [pid 5828] mount("/dev/loop0", "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_I_VERSION|0x200, "journal_ioprio=0x0000000000000005,nogrpid,orlov,minixdf,resgid=0x0000000000000000,stripe=0x000000000"...) = 0 [pid 5828] openat(AT_FDCWD, "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", O_RDONLY|O_DIRECTORY) = 3 [pid 5828] chdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b") = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5828] chdir("./file0") = 0 [pid 5828] openat(AT_FDCWD, "net_prio.prioidx", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [ 59.434921][ T5828] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz-executor279: corrupted in-inode xattr: invalid ea_ino [ 59.450057][ T5828] EXT4-fs error (device loop0): ext4_orphan_get:1393: comm syz-executor279: couldn't read orphan inode 15 (err -117) [ 59.464443][ T5828] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [pid 5828] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 005) = 0 [pid 5828] creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 5 [pid 5828] mknod("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 0 [pid 5828] symlink("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [pid 5828] exit_group(0) = ? [pid 5828] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5828, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55557c1756f0 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 umount2("\x2e\x2f\x30\x2f\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("\x2e\x2f\x30\x2f\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "\x2e\x2f\x30\x2f\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("\x2e\x2f\x30\x2f\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "\x2e\x2f\x30\x2f\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x55557c17d730 /* 2 entries */, 32768) = 48 getdents64(4, 0x55557c17d730 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("\x2e\x2f\x30\x2f\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b") = 0 getdents64(3, 0x55557c1756f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5832 attached [pid 5832] set_robust_list(0x55557c174660, 24 [pid 5827] <... clone resumed>, child_tidptr=0x55557c174650) = 5832 [pid 5832] <... set_robust_list resumed>) = 0 [pid 5832] chdir("./1") = 0 [pid 5832] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5832] setpgid(0, 0) = 0 [pid 5832] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5832] write(3, "1000", 4) = 4 [pid 5832] close(3) = 0 [pid 5832] symlink("/dev/binderfs", "./binderfs") = 0 [ 59.558804][ T5827] EXT4-fs (loop0): unmounting filesystem 00000007-0000-0000-0000-000000000000. [pid 5832] write(1, "executing program\n", 18executing program ) = 18 [pid 5832] memfd_create("syzkaller", 0) = 3 [pid 5832] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9884c00000 [pid 5832] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5832] munmap(0x7f9884c00000, 138412032) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5832] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5832] close(3) = 0 [pid 5832] close(4) = 0 [pid 5832] mkdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", 0777) = 0 [ 59.664408][ T5832] loop0: detected capacity change from 0 to 512 [pid 5832] mount("/dev/loop0", "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_I_VERSION|0x200, "journal_ioprio=0x0000000000000005,nogrpid,orlov,minixdf,resgid=0x0000000000000000,stripe=0x000000000"...) = 0 [pid 5832] openat(AT_FDCWD, "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", O_RDONLY|O_DIRECTORY) = 3 [pid 5832] chdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b") = 0 [ 59.714141][ T5832] EXT4-fs: Ignoring removed orlov option [ 59.723218][ T5832] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz-executor279: corrupted in-inode xattr: invalid ea_ino [ 59.737711][ T5832] EXT4-fs error (device loop0): ext4_orphan_get:1393: comm syz-executor279: couldn't read orphan inode 15 (err -117) [ 59.751050][ T5832] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [pid 5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5832] chdir("./file0") = 0 [pid 5832] openat(AT_FDCWD, "net_prio.prioidx", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 5832] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 005) = 0 [pid 5832] creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 5 [pid 5832] mknod("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 0 [ 59.823822][ T5832] ================================================================== [ 59.831913][ T5832] BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 [ 59.839479][ T5832] Write of size 251 at addr ffff88807773ef14 by task syz-executor279/5832 [ 59.848009][ T5832] [ 59.850424][ T5832] CPU: 0 UID: 0 PID: 5832 Comm: syz-executor279 Not tainted 6.12.0-rc6-syzkaller-00279-gde2f378f2b77 #0 [ 59.861528][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 59.871600][ T5832] Call Trace: [ 59.874864][ T5832] [ 59.877782][ T5832] dump_stack_lvl+0x241/0x360 [ 59.882455][ T5832] ? __pfx_dump_stack_lvl+0x10/0x10 [ 59.887634][ T5832] ? __pfx__printk+0x10/0x10 [ 59.892210][ T5832] ? _printk+0xd5/0x120 [ 59.896373][ T5832] ? __virt_addr_valid+0x183/0x530 [ 59.901491][ T5832] ? __virt_addr_valid+0x183/0x530 [ 59.906584][ T5832] print_report+0x169/0x550 [ 59.911100][ T5832] ? __virt_addr_valid+0x183/0x530 [ 59.916191][ T5832] ? __virt_addr_valid+0x183/0x530 [ 59.921281][ T5832] ? __virt_addr_valid+0x45f/0x530 [ 59.926377][ T5832] ? __phys_addr+0xba/0x170 [ 59.930879][ T5832] ? ext4_insert_dentry+0x36a/0x6d0 [ 59.936059][ T5832] kasan_report+0x143/0x180 [ 59.940548][ T5832] ? ext4_insert_dentry+0x36a/0x6d0 [ 59.945732][ T5832] kasan_check_range+0x282/0x290 [ 59.950657][ T5832] ? ext4_insert_dentry+0x36a/0x6d0 [ 59.955838][ T5832] __asan_memcpy+0x40/0x70 [ 59.960239][ T5832] ext4_insert_dentry+0x36a/0x6d0 [ 59.965250][ T5832] add_dirent_to_buf+0x3d9/0x750 [ 59.970199][ T5832] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 59.975667][ T5832] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 59.981729][ T5832] make_indexed_dir+0xf98/0x1600 [ 59.986664][ T5832] ? __pfx_make_indexed_dir+0x10/0x10 [ 59.992055][ T5832] ? add_dirent_to_buf+0x398/0x750 [ 59.997167][ T5832] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 60.002629][ T5832] ? __ext4_read_dirblock+0x527/0x890 [ 60.008010][ T5832] ext4_add_entry+0x222a/0x25d0 [ 60.012861][ T5832] ? __pfx_ext4_initxattrs+0x10/0x10 [ 60.018145][ T5832] ? __pfx_security_inode_init_security+0x10/0x10 [ 60.024544][ T5832] ? rcu_is_watching+0x15/0xb0 [ 60.029296][ T5832] ? __brelse+0x59/0xa0 [ 60.033438][ T5832] ? __ext4_new_inode+0x380f/0x4380 [ 60.038623][ T5832] ? __pfx_ext4_add_entry+0x10/0x10 [ 60.043811][ T5832] ext4_add_nondir+0x8d/0x290 [ 60.048475][ T5832] ? ext4_symlink+0x6ce/0xb50 [ 60.053137][ T5832] ext4_symlink+0x920/0xb50 [ 60.057628][ T5832] ? __pfx_ext4_symlink+0x10/0x10 [ 60.062643][ T5832] ? generic_permission+0x1e0/0x550 [ 60.067826][ T5832] ? bpf_lsm_inode_symlink+0x9/0x10 [ 60.073015][ T5832] ? security_inode_symlink+0xbe/0x330 [ 60.078463][ T5832] vfs_symlink+0x137/0x2e0 [ 60.082870][ T5832] do_symlinkat+0x222/0x3a0 [ 60.087359][ T5832] ? __pfx_do_symlinkat+0x10/0x10 [ 60.092389][ T5832] ? strncpy_from_user+0x13a/0x260 [ 60.097485][ T5832] ? getname_flags+0x1e3/0x540 [ 60.102231][ T5832] __x64_sys_symlink+0x7a/0x90 [ 60.106993][ T5832] do_syscall_64+0xf3/0x230 [ 60.111657][ T5832] ? clear_bhb_loop+0x35/0x90 [ 60.116320][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.122211][ T5832] RIP: 0033:0x7f988d051369 [ 60.126616][ T5832] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 60.146665][ T5832] RSP: 002b:00007ffcd46e7488 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 60.155068][ T5832] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f988d051369 [ 60.163023][ T5832] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0 [ 60.171007][ T5832] RBP: 0000000000000000 R08: 00007ffcd46e74c0 R09: 00007ffcd46e74c0 [ 60.178962][ T5832] R10: 00007ffcd46e74c0 R11: 0000000000000246 R12: 00007ffcd46e74ac [ 60.186944][ T5832] R13: 0000000000000001 R14: 431bde82d7b634db R15: 00007ffcd46e74e0 [ 60.194917][ T5832] [ 60.197922][ T5832] [ 60.200257][ T5832] The buggy address belongs to the physical page: [ 60.206659][ T5832] page: refcount:3 mapcount:0 mapping:ffff8880234ccd78 index:0x3f pfn:0x7773e [ 60.215491][ T5832] memcg:ffff888140ad4000 [ 60.219718][ T5832] aops:def_blk_aops ino:700000 dentry name(?):"" [ 60.226037][ T5832] flags: 0xfff00000004114(referenced|dirty|active|private|node=0|zone=1|lastcpupid=0x7ff) [ 60.235947][ T5832] raw: 00fff00000004114 0000000000000000 dead000000000122 ffff8880234ccd78 [ 60.244545][ T5832] raw: 000000000000003f ffff88805a60fbc8 00000003ffffffff ffff888140ad4000 [ 60.253103][ T5832] page dumped because: kasan: bad access detected [ 60.259497][ T5832] page_owner tracks the page as allocated [ 60.265219][ T5832] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 5832, tgid 5832 (syz-executor279), ts 59823660135, free_ts 53743847408 [ 60.285774][ T5832] post_alloc_hook+0x1f3/0x230 [ 60.290524][ T5832] get_page_from_freelist+0x3033/0x3180 [ 60.296075][ T5832] __alloc_pages_noprof+0x292/0x710 [ 60.301259][ T5832] alloc_pages_mpol_noprof+0x3e8/0x680 [ 60.306728][ T5832] folio_alloc_noprof+0x128/0x180 [ 60.311733][ T5832] filemap_alloc_folio_noprof+0xdf/0x500 [ 60.317353][ T5832] __filemap_get_folio+0x446/0xbd0 [ 60.322448][ T5832] bdev_getblk+0x1d8/0x550 [ 60.326845][ T5832] ext4_getblk+0x303/0x800 [ 60.331247][ T5832] ext4_bread+0x2e/0x180 [ 60.335474][ T5832] ext4_append+0x327/0x5c0 [ 60.339893][ T5832] make_indexed_dir+0x523/0x1600 [ 60.344813][ T5832] ext4_add_entry+0x222a/0x25d0 [ 60.349646][ T5832] ext4_add_nondir+0x8d/0x290 [ 60.354307][ T5832] ext4_symlink+0x920/0xb50 [ 60.358794][ T5832] vfs_symlink+0x137/0x2e0 [ 60.363251][ T5832] page last free pid 5819 tgid 5819 stack trace: [ 60.369574][ T5832] free_unref_folios+0xee2/0x18a0 [ 60.374598][ T5832] folios_put_refs+0x76c/0x860 [ 60.379346][ T5832] free_pages_and_swap_cache+0x2ea/0x690 [ 60.384963][ T5832] tlb_flush_mmu+0x3a3/0x680 [ 60.389540][ T5832] tlb_finish_mmu+0xd4/0x200 [ 60.394116][ T5832] vms_clear_ptes+0x437/0x530 [ 60.398802][ T5832] vms_complete_munmap_vmas+0x208/0x910 [ 60.404334][ T5832] do_vmi_align_munmap+0x613/0x730 [ 60.409433][ T5832] do_vmi_munmap+0x24e/0x2d0 [ 60.414001][ T5832] __vm_munmap+0x24c/0x480 [ 60.418399][ T5832] __x64_sys_munmap+0x60/0x70 [ 60.423057][ T5832] do_syscall_64+0xf3/0x230 [ 60.427569][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.433445][ T5832] [ 60.435752][ T5832] Memory state around the buggy address: [ 60.441363][ T5832] ffff88807773ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.449417][ T5832] ffff88807773ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.457462][ T5832] >ffff88807773f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.466651][ T5832] ^ [ 60.470697][ T5832] ffff88807773f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.478735][ T5832] ffff88807773f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.486772][ T5832] ================================================================== [ 60.495870][ T5832] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 60.503096][ T5832] CPU: 1 UID: 0 PID: 5832 Comm: syz-executor279 Not tainted 6.12.0-rc6-syzkaller-00279-gde2f378f2b77 #0 [ 60.514223][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 60.524279][ T5832] Call Trace: [ 60.527545][ T5832] [ 60.530464][ T5832] dump_stack_lvl+0x241/0x360 [ 60.535135][ T5832] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.540333][ T5832] ? __pfx__printk+0x10/0x10 [ 60.544907][ T5832] ? preempt_schedule+0xe1/0xf0 [ 60.549741][ T5832] ? vscnprintf+0x5d/0x90 [ 60.554078][ T5832] panic+0x349/0x880 [ 60.557982][ T5832] ? check_panic_on_warn+0x21/0xb0 [ 60.563090][ T5832] ? __pfx_panic+0x10/0x10 [ 60.567498][ T5832] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 60.573469][ T5832] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 60.579782][ T5832] ? print_report+0x502/0x550 [ 60.584462][ T5832] check_panic_on_warn+0x86/0xb0 [ 60.589439][ T5832] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.594646][ T5832] end_report+0x77/0x160 [ 60.598889][ T5832] kasan_report+0x154/0x180 [ 60.603414][ T5832] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.608609][ T5832] kasan_check_range+0x282/0x290 [ 60.613535][ T5832] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.618718][ T5832] __asan_memcpy+0x40/0x70 [ 60.623128][ T5832] ext4_insert_dentry+0x36a/0x6d0 [ 60.628140][ T5832] add_dirent_to_buf+0x3d9/0x750 [ 60.633066][ T5832] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 60.638510][ T5832] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 60.644564][ T5832] make_indexed_dir+0xf98/0x1600 [ 60.649493][ T5832] ? __pfx_make_indexed_dir+0x10/0x10 [ 60.654856][ T5832] ? add_dirent_to_buf+0x398/0x750 [ 60.659959][ T5832] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 60.665407][ T5832] ? __ext4_read_dirblock+0x527/0x890 [ 60.670767][ T5832] ext4_add_entry+0x222a/0x25d0 [ 60.675608][ T5832] ? __pfx_ext4_initxattrs+0x10/0x10 [ 60.680881][ T5832] ? __pfx_security_inode_init_security+0x10/0x10 [ 60.687284][ T5832] ? rcu_is_watching+0x15/0xb0 [ 60.692036][ T5832] ? __brelse+0x59/0xa0 [ 60.696181][ T5832] ? __ext4_new_inode+0x380f/0x4380 [ 60.701367][ T5832] ? __pfx_ext4_add_entry+0x10/0x10 [ 60.706559][ T5832] ext4_add_nondir+0x8d/0x290 [ 60.711222][ T5832] ? ext4_symlink+0x6ce/0xb50 [ 60.716687][ T5832] ext4_symlink+0x920/0xb50 [ 60.721218][ T5832] ? __pfx_ext4_symlink+0x10/0x10 [ 60.726232][ T5832] ? generic_permission+0x1e0/0x550 [ 60.731421][ T5832] ? bpf_lsm_inode_symlink+0x9/0x10 [ 60.736610][ T5832] ? security_inode_symlink+0xbe/0x330 [ 60.742065][ T5832] vfs_symlink+0x137/0x2e0 [ 60.746473][ T5832] do_symlinkat+0x222/0x3a0 [ 60.750964][ T5832] ? __pfx_do_symlinkat+0x10/0x10 [ 60.755976][ T5832] ? strncpy_from_user+0x13a/0x260 [ 60.761091][ T5832] ? getname_flags+0x1e3/0x540 [ 60.765843][ T5832] __x64_sys_symlink+0x7a/0x90 [ 60.770620][ T5832] do_syscall_64+0xf3/0x230 [ 60.775202][ T5832] ? clear_bhb_loop+0x35/0x90 [ 60.779874][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.785763][ T5832] RIP: 0033:0x7f988d051369 [ 60.790166][ T5832] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 60.810239][ T5832] RSP: 002b:00007ffcd46e7488 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 60.818644][ T5832] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f988d051369 [ 60.826713][ T5832] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0 [ 60.834675][ T5832] RBP: 0000000000000000 R08: 00007ffcd46e74c0 R09: 00007ffcd46e74c0 [ 60.842634][ T5832] R10: 00007ffcd46e74c0 R11: 0000000000000246 R12: 00007ffcd46e74ac [ 60.850594][ T5832] R13: 0000000000000001 R14: 431bde82d7b634db R15: 00007ffcd46e74e0 [ 60.858558][ T5832] [ 60.861908][ T5832] Kernel Offset: disabled [ 60.866321][ T5832] Rebooting in 86400 seconds..