./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3258794579
<...>
DUID 00:04:7c:7c:42:18:3f:30:8d:b4:e2:57:c6:a5:0a:a4:65:8b
forked to background, child pid 4646
[ 29.742272][ T4647] 8021q: adding VLAN 0 to HW filter on device bond0
[ 29.751650][ T4647] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.119' (ECDSA) to the list of known hosts.
execve("./syz-executor3258794579", ["./syz-executor3258794579"], 0x7fffba177b30 /* 10 vars */) = 0
brk(NULL) = 0x555557545000
brk(0x555557545c40) = 0x555557545c40
arch_prctl(ARCH_SET_FS, 0x555557545300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3258794579", 4096) = 28
brk(0x555557566c40) = 0x555557566c40
brk(0x555557567000) = 0x555557567000
mprotect(0x7f58cd742000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555575455d0) = 5068
./strace-static-x86_64: Process 5068 attached
[pid 5068] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5068] setpgid(0, 0) = 0
[pid 5068] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5068] write(3, "1000", 4) = 4
[pid 5068] close(3) = 0
[pid 5068] memfd_create("syzkaller", 0) = 3
[pid 5068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f58c5267000
[pid 5068] write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x20\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x03\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\xf4\x00\x00\x00\xf4\x00\x00\x00\x92\x9d\x3e\x59\x8b\x7e\x69\x31\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 4194304) = 4194304
[pid 5068] munmap(0x7f58c5267000, 4194304) = 0
[pid 5068] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5068] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5068] close(3) = 0
[pid 5068] mkdir("./file0", 0777) = 0
syzkaller login: [ 55.619643][ T5068] loop0: detected capacity change from 0 to 8192
[ 55.632316][ T5068] ntfs3: loop0: Different NTFS' sector size (4096) and media sector size (512)
[ 55.643378][ T5068] ==================================================================
[ 55.651449][ T5068] BUG: KASAN: use-after-free in run_unpack+0x84f/0xd00
[ 55.658297][ T5068] Read of size 1 at addr ffff88807ab90062 by task syz-executor325/5068
[ 55.666509][ T5068]
[ 55.668814][ T5068] CPU: 0 PID: 5068 Comm: syz-executor325 Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0
[ 55.678850][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 55.688882][ T5068] Call Trace:
[ 55.692145][ T5068]
[ 55.695059][ T5068] dump_stack_lvl+0x1b1/0x290
[ 55.699727][ T5068] ? nf_tcp_handle_invalid+0x630/0x630
[ 55.705167][ T5068] ? __wake_up_klogd+0xcd/0x100
[ 55.710016][ T5068] ? panic+0x710/0x710
[ 55.714071][ T5068] ? _printk+0xc0/0x100
[ 55.718208][ T5068] ? _raw_spin_lock_irqsave+0x8e/0x100
[ 55.723648][ T5068] print_address_description+0x74/0x340
[ 55.729178][ T5068] print_report+0x107/0x1f0
[ 55.733672][ T5068] ? __virt_addr_valid+0x21b/0x2d0
[ 55.738773][ T5068] ? __phys_addr+0xb5/0x160
[ 55.743266][ T5068] ? run_unpack+0x84f/0xd00
[ 55.747759][ T5068] kasan_report+0xcd/0x100
[ 55.752165][ T5068] ? run_unpack+0x84f/0xd00
[ 55.756661][ T5068] run_unpack+0x84f/0xd00
[ 55.760983][ T5068] run_unpack_ex+0xcc/0x870
[ 55.765478][ T5068] ? ni_enum_attr_ex+0x2f6/0x6d0
[ 55.770399][ T5068] ? run_unpack+0xd00/0xd00
[ 55.774893][ T5068] ? ni_find_attr+0x8c0/0x8c0
[ 55.779554][ T5068] ? mi_read+0x260/0x510
[ 55.783784][ T5068] ntfs_iget5+0x1cfa/0x36f0
[ 55.788284][ T5068] ? check_index_root+0x680/0x680
[ 55.793298][ T5068] ntfs_loadlog_and_replay+0x1ac/0x5c0
[ 55.798760][ T5068] ? ntfs_extend_init+0x5a0/0x5a0
[ 55.803782][ T5068] ? evict+0x5d5/0x620
[ 55.807871][ T5068] ntfs_fill_super+0x23c3/0x4370
[ 55.812820][ T5068] ? put_ntfs+0x2a0/0x2a0
[ 55.817145][ T5068] ? vscnprintf+0x80/0x80
[ 55.821470][ T5068] ? set_blocksize+0x1ec/0x390
[ 55.826243][ T5068] ? sb_set_blocksize+0x95/0xf0
[ 55.831103][ T5068] get_tree_bdev+0x400/0x620
[ 55.835698][ T5068] ? put_ntfs+0x2a0/0x2a0
[ 55.840028][ T5068] vfs_get_tree+0x88/0x270
[ 55.844432][ T5068] do_new_mount+0x289/0xad0
[ 55.848924][ T5068] ? do_move_mount_old+0x150/0x150
[ 55.854021][ T5068] ? user_path_at_empty+0x149/0x1a0
[ 55.859211][ T5068] __se_sys_mount+0x2d3/0x3c0
[ 55.863881][ T5068] ? __x64_sys_mount+0xc0/0xc0
[ 55.868628][ T5068] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 55.874595][ T5068] ? __x64_sys_mount+0x1c/0xc0
[ 55.879353][ T5068] do_syscall_64+0x3d/0xb0
[ 55.883756][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.889637][ T5068] RIP: 0033:0x7f58cd6b55ca
[ 55.894043][ T5068] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.913630][ T5068] RSP: 002b:00007fff47deea88 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 55.922025][ T5068] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f58cd6b55ca
[ 55.929981][ T5068] RDX: 0000000020020bc0 RSI: 0000000020000000 RDI: 00007fff47deeaa0
[ 55.937937][ T5068] RBP: 00007fff47deeaa0 R08: 00007fff47deeae0 R09: 0000000000000000
[ 55.945891][ T5068] R10: 0000000000018402 R11: 0000000000000286 R12: 0000000000000004
[ 55.953847][ T5068] R13: 00005555575452c0 R14: 0000000000018402 R15: 00007fff47deeae0
[ 55.961830][ T5068]
[ 55.964833][ T5068]
[ 55.967142][ T5068] Allocated by task 4937:
[ 55.971450][ T5068] kasan_set_track+0x3d/0x60
[ 55.976039][ T5068] __kasan_slab_alloc+0x65/0x70
[ 55.980882][ T5068] kmem_cache_alloc+0x1b3/0x350
[ 55.985714][ T5068] getname_flags+0xb8/0x4e0
[ 55.990202][ T5068] do_sys_openat2+0xba/0x4e0
[ 55.994781][ T5068] __x64_sys_openat+0x243/0x290
[ 55.999612][ T5068] do_syscall_64+0x3d/0xb0
[ 56.004098][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.010149][ T5068]
[ 56.012456][ T5068] Freed by task 4937:
[ 56.016417][ T5068] kasan_set_track+0x3d/0x60
[ 56.020992][ T5068] kasan_save_free_info+0x27/0x40
[ 56.026000][ T5068] ____kasan_slab_free+0xd6/0x120
[ 56.031010][ T5068] slab_free_freelist_hook+0x12e/0x1a0
[ 56.036459][ T5068] kmem_cache_free+0x94/0x1d0
[ 56.041126][ T5068] do_sys_openat2+0x417/0x4e0
[ 56.045786][ T5068] __x64_sys_openat+0x243/0x290
[ 56.050619][ T5068] do_syscall_64+0x3d/0xb0
[ 56.055020][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.060894][ T5068]
[ 56.063203][ T5068] The buggy address belongs to the object at ffff88807ab90000
[ 56.063203][ T5068] which belongs to the cache names_cache of size 4096
[ 56.077320][ T5068] The buggy address is located 98 bytes inside of
[ 56.077320][ T5068] 4096-byte region [ffff88807ab90000, ffff88807ab91000)
[ 56.090575][ T5068]
[ 56.092905][ T5068] The buggy address belongs to the physical page:
[ 56.099302][ T5068] page:ffffea0001eae400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ab90
[ 56.109527][ T5068] head:ffffea0001eae400 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
[ 56.119573][ T5068] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 56.127556][ T5068] raw: 00fff00000010200 ffff8880129dd640 ffffea0000960200 dead000000000002
[ 56.136119][ T5068] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
[ 56.144680][ T5068] page dumped because: kasan: bad access detected
[ 56.151070][ T5068] page_owner tracks the page as allocated
[ 56.156761][ T5068] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4433, tgid 4433 (udevd), ts 15204400898, free_ts 12559744477
[ 56.177488][ T5068] get_page_from_freelist+0x742/0x7c0
[ 56.182849][ T5068] __alloc_pages+0x259/0x560
[ 56.187440][ T5068] alloc_slab_page+0xbd/0x190
[ 56.192114][ T5068] allocate_slab+0x5e/0x3c0
[ 56.196600][ T5068] ___slab_alloc+0x782/0xe20
[ 56.201185][ T5068] kmem_cache_alloc+0x268/0x350
[ 56.206019][ T5068] getname_flags+0xb8/0x4e0
[ 56.210506][ T5068] do_sys_openat2+0xba/0x4e0
[ 56.215079][ T5068] __x64_sys_openat+0x243/0x290
[ 56.219910][ T5068] do_syscall_64+0x3d/0xb0
[ 56.224307][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.230182][ T5068] page last free stack trace:
[ 56.234833][ T5068] free_pcp_prepare+0x751/0x780
[ 56.239672][ T5068] free_unref_page+0x19/0x4c0
[ 56.244332][ T5068] free_contig_range+0xa3/0x160
[ 56.249173][ T5068] destroy_args+0xfe/0x940
[ 56.253575][ T5068] debug_vm_pgtable+0x43d/0x4a0
[ 56.258412][ T5068] do_one_initcall+0x1d1/0x410
[ 56.263162][ T5068] do_initcall_level+0x168/0x220
[ 56.268083][ T5068] do_initcalls+0x43/0x90
[ 56.272396][ T5068] kernel_init_freeable+0x428/0x5e0
[ 56.277582][ T5068] kernel_init+0x19/0x2b0
[ 56.281895][ T5068] ret_from_fork+0x1f/0x30
[ 56.286295][ T5068]
[ 56.288601][ T5068] Memory state around the buggy address:
[ 56.294209][ T5068] ffff88807ab8ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 56.302252][ T5068] ffff88807ab8ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 56.310292][ T5068] >ffff88807ab90000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 56.318331][ T5068] ^
[ 56.325505][ T5068] ffff88807ab90080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 56.333658][ T5068] ffff88807ab90100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 56.341699][ T5068] ==================================================================
[ 56.350458][ T5068] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 56.357742][ T5068] CPU: 1 PID: 5068 Comm: syz-executor325 Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0
[ 56.367801][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 56.377848][ T5068] Call Trace:
[ 56.381123][ T5068]
[ 56.384056][ T5068] dump_stack_lvl+0x1b1/0x290
[ 56.388733][ T5068] ? nf_tcp_handle_invalid+0x630/0x630
[ 56.394184][ T5068] ? panic+0x710/0x710
[ 56.398266][ T5068] ? lock_release+0x81/0x820
[ 56.402863][ T5068] ? vscnprintf+0x59/0x80
[ 56.407179][ T5068] panic+0x2d6/0x710
[ 56.411066][ T5068] ? asm_sysvec_apic_timer_interrupt+0x16/0x20
[ 56.417219][ T5068] ? check_panic_on_warn+0x1d/0xa0
[ 56.422320][ T5068] ? memcpy_page_flushcache+0x100/0x100
[ 56.427879][ T5068] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 56.433872][ T5068] ? _raw_spin_unlock+0x40/0x40
[ 56.438713][ T5068] ? print_report+0x1b4/0x1f0
[ 56.443395][ T5068] check_panic_on_warn+0x80/0xa0
[ 56.448326][ T5068] ? run_unpack+0x84f/0xd00
[ 56.452831][ T5068] end_report+0x47/0x90
[ 56.456972][ T5068] kasan_report+0xda/0x100
[ 56.461375][ T5068] ? run_unpack+0x84f/0xd00
[ 56.465864][ T5068] run_unpack+0x84f/0xd00
[ 56.470181][ T5068] run_unpack_ex+0xcc/0x870
[ 56.474681][ T5068] ? ni_enum_attr_ex+0x2f6/0x6d0
[ 56.479785][ T5068] ? run_unpack+0xd00/0xd00
[ 56.484282][ T5068] ? ni_find_attr+0x8c0/0x8c0
[ 56.488955][ T5068] ? mi_read+0x260/0x510
[ 56.493183][ T5068] ntfs_iget5+0x1cfa/0x36f0
[ 56.497679][ T5068] ? check_index_root+0x680/0x680
[ 56.502690][ T5068] ntfs_loadlog_and_replay+0x1ac/0x5c0
[ 56.508148][ T5068] ? ntfs_extend_init+0x5a0/0x5a0
[ 56.513159][ T5068] ? evict+0x5d5/0x620
[ 56.517211][ T5068] ntfs_fill_super+0x23c3/0x4370
[ 56.522140][ T5068] ? put_ntfs+0x2a0/0x2a0
[ 56.526455][ T5068] ? vscnprintf+0x80/0x80
[ 56.530772][ T5068] ? set_blocksize+0x1ec/0x390
[ 56.535529][ T5068] ? sb_set_blocksize+0x95/0xf0
[ 56.540374][ T5068] get_tree_bdev+0x400/0x620
[ 56.544952][ T5068] ? put_ntfs+0x2a0/0x2a0
[ 56.549274][ T5068] vfs_get_tree+0x88/0x270
[ 56.553693][ T5068] do_new_mount+0x289/0xad0
[ 56.558196][ T5068] ? do_move_mount_old+0x150/0x150
[ 56.563297][ T5068] ? user_path_at_empty+0x149/0x1a0
[ 56.568497][ T5068] __se_sys_mount+0x2d3/0x3c0
[ 56.573168][ T5068] ? __x64_sys_mount+0xc0/0xc0
[ 56.578001][ T5068] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 56.583975][ T5068] ? __x64_sys_mount+0x1c/0xc0
[ 56.588732][ T5068] do_syscall_64+0x3d/0xb0
[ 56.593132][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.599012][ T5068] RIP: 0033:0x7f58cd6b55ca
[ 56.603426][ T5068] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 56.623465][ T5068] RSP: 002b:00007fff47deea88 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 56.631867][ T5068] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f58cd6b55ca
[ 56.639827][ T5068] RDX: 0000000020020bc0 RSI: 0000000020000000 RDI: 00007fff47deeaa0
[ 56.647811][ T5068] RBP: 00007fff47deeaa0 R08: 00007fff47deeae0 R09: 0000000000000000
[ 56.655780][ T5068] R10: 0000000000018402 R11: 0000000000000286 R12: 0000000000000004
[ 56.663749][ T5068] R13: 00005555575452c0 R14: 0000000000018402 R15: 00007fff47deeae0
[ 56.671709][ T5068]
[ 56.674874][ T5068] Kernel Offset: disabled
[ 56.679188][ T5068] Rebooting in 86400 seconds..