./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4183237166
<...>
Warning: Permanently added '10.128.1.47' (ED25519) to the list of known hosts.
execve("./syz-executor4183237166", ["./syz-executor4183237166"], 0x7ffd0bb62c20 /* 10 vars */) = 0
brk(NULL) = 0x55558bcfc000
brk(0x55558bcfcd00) = 0x55558bcfcd00
arch_prctl(ARCH_SET_FS, 0x55558bcfc380) = 0
set_tid_address(0x55558bcfc650) = 5071
set_robust_list(0x55558bcfc660, 24) = 0
rseq(0x55558bcfcca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor4183237166", 4096) = 28
getrandom("\x15\x9f\xcf\xb5\x98\x1a\x59\x54", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55558bcfcd00
brk(0x55558bd1dd00) = 0x55558bd1dd00
brk(0x55558bd1e000) = 0x55558bd1e000
mprotect(0x7f8233c5f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f822b600000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7f822b600000, 138412032) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
close(4) = 0
mkdir("./file1", 0777) = 0
[ 75.909499][ T5071] loop0: detected capacity change from 0 to 1024
[ 75.932886][ T5071] =======================================================
[ 75.932886][ T5071] WARNING: The mand mount option has been deprecated and
[ 75.932886][ T5071] and is ignored by this kernel. Remove the mand
mount("/dev/loop0", "./file1", "hfsplus", MS_SYNCHRONOUS|MS_MANDLOCK, "") = 0
openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
chdir("./file1") = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, ".", O_RDONLY) = 4
[ 75.932886][ T5071] option from the mount to silence this warning.
[ 75.932886][ T5071] =======================================================
[ 76.003091][ T5071] ==================================================================
[ 76.011173][ T5071] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x57f/0x1200
[ 76.018924][ T5071] Read of size 2 at addr ffff88802092e40c by task syz-executor418/5071
[ 76.027152][ T5071]
[ 76.029466][ T5071] CPU: 0 PID: 5071 Comm: syz-executor418 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
[ 76.039528][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[ 76.049591][ T5071] Call Trace:
[ 76.052863][ T5071]
[ 76.055790][ T5071] dump_stack_lvl+0x241/0x360
[ 76.060487][ T5071] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.065712][ T5071] ? __pfx__printk+0x10/0x10
[ 76.070306][ T5071] ? _printk+0xd5/0x120
[ 76.074464][ T5071] ? __virt_addr_valid+0x183/0x520
[ 76.079593][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.084457][ T5071] print_report+0x169/0x550
[ 76.088961][ T5071] ? __virt_addr_valid+0x183/0x520
[ 76.094077][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.098924][ T5071] ? __virt_addr_valid+0x44e/0x520
[ 76.104041][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.108901][ T5071] ? __phys_addr+0xba/0x170
[ 76.113408][ T5071] ? hfsplus_uni2asc+0x57f/0x1200
[ 76.118430][ T5071] kasan_report+0x143/0x180
[ 76.122935][ T5071] ? hfsplus_uni2asc+0x57f/0x1200
[ 76.127962][ T5071] hfsplus_uni2asc+0x57f/0x1200
[ 76.132816][ T5071] ? __asan_memcpy+0x40/0x70
[ 76.137404][ T5071] hfsplus_readdir+0x93b/0x1320
[ 76.142260][ T5071] ? __pfx_hfsplus_readdir+0x10/0x10
[ 76.147567][ T5071] ? __mutex_lock+0x2ef/0xd70
[ 76.152236][ T5071] ? iterate_dir+0x436/0x6f0
[ 76.156823][ T5071] ? __pfx_down_read_killable+0x10/0x10
[ 76.162363][ T5071] ? __fdget_pos+0x259/0x320
[ 76.166951][ T5071] ? common_file_perm+0x1a6/0x210
[ 76.171978][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.176823][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.181687][ T5071] iterate_dir+0x53b/0x6f0
[ 76.186101][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.190949][ T5071] __se_sys_getdents64+0x20d/0x4f0
[ 76.196063][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.200913][ T5071] ? _raw_spin_unlock_irq+0x2e/0x50
[ 76.206115][ T5071] ? __pfx___se_sys_getdents64+0x10/0x10
[ 76.211743][ T5071] ? __pfx_filldir64+0x10/0x10
[ 76.216510][ T5071] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 76.222849][ T5071] ? do_syscall_64+0x10a/0x240
[ 76.227607][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.232452][ T5071] ? syscall_trace_enter+0x5f/0x150
[ 76.237665][ T5071] do_syscall_64+0xfd/0x240
[ 76.242164][ T5071] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 76.248068][ T5071] RIP: 0033:0x7f8233beb8b9
[ 76.252490][ T5071] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 76.272100][ T5071] RSP: 002b:00007ffd8153ff88 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 76.280528][ T5071] RAX: ffffffffffffffda RBX: 00007ffd81540158 RCX: 00007f8233beb8b9
[ 76.288494][ T5071] RDX: 00000000000000a5 RSI: 00000000200002c0 RDI: 0000000000000004
[ 76.296479][ T5071] RBP: 00007f8233c5f610 R08: 0000000000000000 R09: 00007ffd81540158
[ 76.304460][ T5071] R10: 0000000000000632 R11: 0000000000000246 R12: 0000000000000001
[ 76.312420][ T5071] R13: 00007ffd81540148 R14: 0000000000000001 R15: 0000000000000001
[ 76.320390][ T5071]
[ 76.323399][ T5071]
[ 76.325709][ T5071] Allocated by task 5071:
[ 76.330021][ T5071] kasan_save_track+0x3f/0x80
[ 76.334693][ T5071] __kasan_kmalloc+0x98/0xb0
[ 76.339277][ T5071] __kmalloc+0x233/0x4a0
[ 76.343511][ T5071] hfsplus_find_init+0x85/0x1c0
[ 76.348387][ T5071] hfsplus_readdir+0x20e/0x1320
[ 76.353233][ T5071] iterate_dir+0x53b/0x6f0
[ 76.357643][ T5071] __se_sys_getdents64+0x20d/0x4f0
[ 76.362748][ T5071] do_syscall_64+0xfd/0x240
[ 76.367330][ T5071] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 76.373232][ T5071]
[ 76.375547][ T5071] The buggy address belongs to the object at ffff88802092e000
[ 76.375547][ T5071] which belongs to the cache kmalloc-2k of size 2048
[ 76.389735][ T5071] The buggy address is located 0 bytes to the right of
[ 76.389735][ T5071] allocated 1036-byte region [ffff88802092e000, ffff88802092e40c)
[ 76.404317][ T5071]
[ 76.406634][ T5071] The buggy address belongs to the physical page:
[ 76.413030][ T5071] page:ffffea0000824a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20928
[ 76.423189][ T5071] head:ffffea0000824a00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.432214][ T5071] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 76.440194][ T5071] page_type: 0xffffffff()
[ 76.444517][ T5071] raw: 00fff00000000840 ffff888014c42000 dead000000000122 0000000000000000
[ 76.453107][ T5071] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 76.461688][ T5071] page dumped because: kasan: bad access detected
[ 76.468086][ T5071] page_owner tracks the page as allocated
[ 76.473786][ T5071] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5061, tgid 5061 (sshd), ts 64567660065, free_ts 64521699826
[ 76.494448][ T5071] post_alloc_hook+0x1ea/0x210
[ 76.499216][ T5071] get_page_from_freelist+0x33ea/0x3580
[ 76.504757][ T5071] __alloc_pages+0x256/0x680
[ 76.509348][ T5071] alloc_slab_page+0x5f/0x160
[ 76.514031][ T5071] new_slab+0x84/0x2f0
[ 76.518096][ T5071] ___slab_alloc+0xc73/0x1260
[ 76.522764][ T5071] kmalloc_trace+0x269/0x360
[ 76.527368][ T5071] bpf_prog_alloc_no_stats+0xd8/0x4a0
[ 76.532739][ T5071] bpf_prog_alloc+0x3b/0x1b0
[ 76.537417][ T5071] bpf_prog_create_from_user+0xa4/0x3e0
[ 76.542977][ T5071] do_seccomp+0x90d/0xf90
[ 76.547300][ T5071] __se_sys_prctl+0xdad/0x3a20
[ 76.552067][ T5071] do_syscall_64+0xfd/0x240
[ 76.556563][ T5071] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 76.562453][ T5071] page last free pid 5060 tgid 5060 stack trace:
[ 76.568765][ T5071] free_unref_page_prepare+0x968/0xa90
[ 76.574226][ T5071] free_unref_page+0x37/0x3f0
[ 76.578906][ T5071] __put_partials+0xeb/0x130
[ 76.583494][ T5071] put_cpu_partial+0x17c/0x250
[ 76.588254][ T5071] __slab_free+0x2ea/0x3d0
[ 76.592667][ T5071] qlist_free_all+0x5e/0xc0
[ 76.597167][ T5071] kasan_quarantine_reduce+0x14f/0x170
[ 76.602636][ T5071] __kasan_slab_alloc+0x23/0x80
[ 76.607485][ T5071] kmem_cache_alloc+0x174/0x340
[ 76.612330][ T5071] vm_area_alloc+0x24/0x1d0
[ 76.616850][ T5071] mmap_region+0xbd9/0x1fa0
[ 76.621346][ T5071] do_mmap+0x7af/0xe60
[ 76.625420][ T5071] vm_mmap_pgoff+0x1e3/0x420
[ 76.630004][ T5071] ksys_mmap_pgoff+0x504/0x6e0
[ 76.634758][ T5071] do_syscall_64+0xfd/0x240
[ 76.639253][ T5071] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 76.645143][ T5071]
[ 76.647469][ T5071] Memory state around the buggy address:
[ 76.653083][ T5071] ffff88802092e300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 76.661133][ T5071] ffff88802092e380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 76.669196][ T5071] >ffff88802092e400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.677256][ T5071] ^
[ 76.681574][ T5071] ffff88802092e480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.689646][ T5071] ffff88802092e500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.697695][ T5071] ==================================================================
[ 76.706108][ T5071] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 76.713315][ T5071] CPU: 0 PID: 5071 Comm: syz-executor418 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
[ 76.723382][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[ 76.733468][ T5071] Call Trace:
[ 76.736752][ T5071]
[ 76.739716][ T5071] dump_stack_lvl+0x241/0x360
[ 76.744438][ T5071] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.749747][ T5071] ? __pfx__printk+0x10/0x10
[ 76.754361][ T5071] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 76.760436][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.765317][ T5071] ? vscnprintf+0x5d/0x90
[ 76.769661][ T5071] panic+0x349/0x860
[ 76.773580][ T5071] ? check_panic_on_warn+0x21/0xb0
[ 76.778712][ T5071] ? __pfx_panic+0x10/0x10
[ 76.783169][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.788052][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.792914][ T5071] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 76.798920][ T5071] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 76.805293][ T5071] check_panic_on_warn+0x86/0xb0
[ 76.810250][ T5071] ? hfsplus_uni2asc+0x57f/0x1200
[ 76.815289][ T5071] end_report+0x6e/0x140
[ 76.819548][ T5071] kasan_report+0x154/0x180
[ 76.824066][ T5071] ? hfsplus_uni2asc+0x57f/0x1200
[ 76.829108][ T5071] hfsplus_uni2asc+0x57f/0x1200
[ 76.833974][ T5071] ? __asan_memcpy+0x40/0x70
[ 76.838575][ T5071] hfsplus_readdir+0x93b/0x1320
[ 76.843446][ T5071] ? __pfx_hfsplus_readdir+0x10/0x10
[ 76.848771][ T5071] ? __mutex_lock+0x2ef/0xd70
[ 76.853459][ T5071] ? iterate_dir+0x436/0x6f0
[ 76.858059][ T5071] ? __pfx_down_read_killable+0x10/0x10
[ 76.863615][ T5071] ? __fdget_pos+0x259/0x320
[ 76.868222][ T5071] ? common_file_perm+0x1a6/0x210
[ 76.873264][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.878121][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.882982][ T5071] iterate_dir+0x53b/0x6f0
[ 76.887412][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.892274][ T5071] __se_sys_getdents64+0x20d/0x4f0
[ 76.897395][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.902252][ T5071] ? _raw_spin_unlock_irq+0x2e/0x50
[ 76.907468][ T5071] ? __pfx___se_sys_getdents64+0x10/0x10
[ 76.913199][ T5071] ? __pfx_filldir64+0x10/0x10
[ 76.917976][ T5071] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 76.924312][ T5071] ? do_syscall_64+0x10a/0x240
[ 76.929103][ T5071] ? srso_return_thunk+0x5/0x5f
[ 76.933969][ T5071] ? syscall_trace_enter+0x5f/0x150
[ 76.939179][ T5071] do_syscall_64+0xfd/0x240
[ 76.943691][ T5071] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 76.949598][ T5071] RIP: 0033:0x7f8233beb8b9
[ 76.954018][ T5071] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 76.973636][ T5071] RSP: 002b:00007ffd8153ff88 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 76.982062][ T5071] RAX: ffffffffffffffda RBX: 00007ffd81540158 RCX: 00007f8233beb8b9
[ 76.990037][ T5071] RDX: 00000000000000a5 RSI: 00000000200002c0 RDI: 0000000000000004
[ 76.998011][ T5071] RBP: 00007f8233c5f610 R08: 0000000000000000 R09: 00007ffd81540158
[ 77.005986][ T5071] R10: 0000000000000632 R11: 0000000000000246 R12: 0000000000000001
[ 77.013959][ T5071] R13: 00007ffd81540148 R14: 0000000000000001 R15: 0000000000000001
[ 77.021943][ T5071]
[ 77.025176][ T5071] Kernel Offset: disabled
[ 77.029495][ T5071] Rebooting in 86400 seconds..