./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3236574357
<...>
Warning: Permanently added '10.128.0.241' (ED25519) to the list of known hosts.
execve("./syz-executor3236574357", ["./syz-executor3236574357"], 0x7ffeec131750 /* 10 vars */) = 0
brk(NULL) = 0x5555574b1000
brk(0x5555574b1d00) = 0x5555574b1d00
arch_prctl(ARCH_SET_FS, 0x5555574b1380) = 0
set_tid_address(0x5555574b1650) = 5063
set_robust_list(0x5555574b1660, 24) = 0
rseq(0x5555574b1ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3236574357", 4096) = 28
getrandom("\x3d\xba\xcf\x94\x8c\xc2\xd1\x97", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555574b1d00
brk(0x5555574d2d00) = 0x5555574d2d00
brk(0x5555574d3000) = 0x5555574d3000
mprotect(0x7fb1d7833000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574b1650) = 5064
./strace-static-x86_64: Process 5064 attached
[pid 5064] set_robust_list(0x5555574b1660, 24) = 0
[ 69.895358][ T27] audit: type=1400 audit(1704576513.284:83): avc: denied { execmem } for pid=5063 comm="syz-executor323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 69.915300][ T27] audit: type=1400 audit(1704576513.294:84): avc: denied { read write } for pid=5063 comm="syz-executor323" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5064] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5064] setpgid(0, 0) = 0
[pid 5064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5064] write(3, "1000", 4) = 4
[pid 5064] close(3) = 0
[pid 5064] memfd_create("syzkaller", 0) = 3
[pid 5064] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb1cf200000
[pid 5064] write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x20\x00\x00\x00\xf7\x9a\x81\x47\x2b\x73\xcf\x43\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[ 69.939965][ T27] audit: type=1400 audit(1704576513.294:85): avc: denied { open } for pid=5063 comm="syz-executor323" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 69.966235][ T27] audit: type=1400 audit(1704576513.304:86): avc: denied { ioctl } for pid=5063 comm="syz-executor323" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5064] munmap(0x7fb1cf200000, 138412032) = 0
[pid 5064] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5064] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5064] close(3) = 0
[pid 5064] mkdir("./file0", 0777) = 0
[ 70.043604][ T5064] loop0: detected capacity change from 0 to 4096
[ 70.065504][ T27] audit: type=1400 audit(1704576513.454:87): avc: denied { mounton } for pid=5064 comm="syz-executor323" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 70.090697][ T5064] ntfs: (device loop0): ntfs_is_extended_system_file(): Corrupt file name attribute. You should run chkdsk.
[ 70.102207][ T5064] ntfs: (device loop0): ntfs_read_locked_inode(): $DATA attribute is missing.
[ 70.111060][ T5064] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -2. Marking corrupt inode 0x1 as bad. Run chkdsk.
[ 70.124129][ T5064] ntfs: (device loop0): load_system_files(): Failed to load $MFTMirr. Mounting read-only. Run ntfsfix and/or chkdsk.
[pid 5064] mount("/dev/loop0", "./file0", "ntfs", MS_NOSUID, "") = 0
[pid 5064] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5064] chdir("./file0") = 0
[pid 5064] ioctl(4, LOOP_CLR_FD) = 0
[pid 5064] close(4) = 0
[pid 5064] openat(AT_FDCWD, ".", O_RDONLY) = 4
[ 70.145044][ T5064] ntfs: volume version 3.1.
[ 70.151882][ T5064] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Corrupt directory. Aborting lookup.
[ 70.198761][ T5064] ==================================================================
[ 70.206873][ T5064] BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0x15a0/0x2e40
[ 70.214460][ T5064] Read of size 1 at addr ffff88801c2b2bf1 by task syz-executor323/5064
[ 70.222692][ T5064]
[ 70.225000][ T5064] CPU: 0 PID: 5064 Comm: syz-executor323 Not tainted 6.7.0-rc8-syzkaller-00174-g95c8a35f1c01 #0
[ 70.235394][ T5064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 70.245436][ T5064] Call Trace:
[ 70.248705][ T5064]
[ 70.251621][ T5064] dump_stack_lvl+0xd9/0x1b0
[ 70.256213][ T5064] print_report+0xc4/0x620
[ 70.260617][ T5064] ? __virt_addr_valid+0x5e/0x2d0
[ 70.265629][ T5064] ? __phys_addr+0xc6/0x140
[ 70.270128][ T5064] kasan_report+0xda/0x110
[ 70.274535][ T5064] ? ntfs_readdir+0x15a0/0x2e40
[ 70.279385][ T5064] ? ntfs_readdir+0x15a0/0x2e40
[ 70.284245][ T5064] ntfs_readdir+0x15a0/0x2e40
[ 70.288914][ T5064] ? lock_sync+0x190/0x190
[ 70.293324][ T5064] ? folio_flags.constprop.0+0x150/0x150
[ 70.298943][ T5064] ? down_read_killable+0xcc/0x380
[ 70.304132][ T5064] ? folio_flags.constprop.0+0x150/0x150
[ 70.309749][ T5064] wrap_directory_iterator+0xa5/0xe0
[ 70.315025][ T5064] iterate_dir+0x1e5/0x5b0
[ 70.319433][ T5064] __x64_sys_getdents64+0x14f/0x2e0
[ 70.324643][ T5064] ? __ia32_sys_getdents+0x2d0/0x2d0
[ 70.329917][ T5064] ? fillonedir+0x400/0x400
[ 70.334413][ T5064] ? _raw_spin_unlock_irq+0x2e/0x50
[ 70.339644][ T5064] ? ptrace_notify+0xf4/0x130
[ 70.344345][ T5064] ? syscall_trace_enter.constprop.0+0xaf/0x1e0
[ 70.350594][ T5064] do_syscall_64+0x40/0x110
[ 70.355185][ T5064] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 70.361171][ T5064] RIP: 0033:0x7fb1d77a1a59
[ 70.365571][ T5064] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 70.385170][ T5064] RSP: 002b:00007ffd20c87708 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 70.393570][ T5064] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb1d77a1a59
[ 70.401538][ T5064] RDX: 00000000000000ab RSI: 0000000020000080 RDI: 0000000000000004
[ 70.409498][ T5064] RBP: 00007fb1d78335f0 R08: 00005555574b24c0 R09: 00005555574b24c0
[ 70.417468][ T5064] R10: 000000000001f1b8 R11: 0000000000000246 R12: 00007ffd20c87730
[ 70.425465][ T5064] R13: 00007ffd20c87958 R14: 431bde82d7b634db R15: 00007fb1d77ea03b
[ 70.433428][ T5064]
[ 70.436429][ T5064]
[ 70.438732][ T5064] Allocated by task 5064:
[ 70.443042][ T5064] kasan_save_stack+0x33/0x50
[ 70.447711][ T5064] kasan_set_track+0x25/0x30
[ 70.452292][ T5064] __kasan_kmalloc+0xa3/0xb0
[ 70.456870][ T5064] __kmalloc+0x59/0x90
[ 70.460922][ T5064] ntfs_readdir+0x12ef/0x2e40
[ 70.465593][ T5064] wrap_directory_iterator+0xa5/0xe0
[ 70.470873][ T5064] iterate_dir+0x1e5/0x5b0
[ 70.475284][ T5064] __x64_sys_getdents64+0x14f/0x2e0
[ 70.480477][ T5064] do_syscall_64+0x40/0x110
[ 70.484980][ T5064] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 70.490900][ T5064]
[ 70.493210][ T5064] The buggy address belongs to the object at ffff88801c2b2b80
[ 70.493210][ T5064] which belongs to the cache kmalloc-64 of size 64
[ 70.507077][ T5064] The buggy address is located 57 bytes to the right of
[ 70.507077][ T5064] allocated 56-byte region [ffff88801c2b2b80, ffff88801c2b2bb8)
[ 70.521571][ T5064]
[ 70.523879][ T5064] The buggy address belongs to the physical page:
[ 70.530357][ T5064] page:ffffea000070ac80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c2b2
[ 70.540517][ T5064] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 70.548056][ T5064] page_type: 0x20()
[ 70.551866][ T5064] raw: 00fff00000000800 ffff888013040200 ffffea00007b68d0 ffffea000080a510
[ 70.560440][ T5064] raw: 0000000000000000 ffff88801c2b2000 0000000100000020 0000000000000000
[ 70.569017][ T5064] page dumped because: kasan: bad access detected
[ 70.575416][ T5064] page_owner tracks the page as allocated
[ 70.581137][ T5064] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x242040(__GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 4513, tgid 4513 (udevadm), ts 27200744791, free_ts 27200621730
[ 70.599966][ T5064] post_alloc_hook+0x2d0/0x350
[ 70.604726][ T5064] get_page_from_freelist+0xa25/0x36d0
[ 70.610175][ T5064] __alloc_pages+0x22e/0x2420
[ 70.614847][ T5064] cache_grow_begin+0x99/0x3a0
[ 70.619622][ T5064] cache_alloc_refill+0x295/0x3b0
[ 70.624634][ T5064] __kmem_cache_alloc_node+0x3ba/0x460
[ 70.630106][ T5064] __kmalloc+0x49/0x90
[ 70.634165][ T5064] tomoyo_encode2+0x100/0x3d0
[ 70.638847][ T5064] tomoyo_encode+0x29/0x50
[ 70.643246][ T5064] tomoyo_realpath_from_path+0x196/0x710
[ 70.648865][ T5064] tomoyo_check_open_permission+0x2a3/0x3b0
[ 70.654754][ T5064] tomoyo_file_open+0xa8/0xd0
[ 70.659421][ T5064] security_file_open+0x6a/0xe0
[ 70.664280][ T5064] do_dentry_open+0x583/0x18c0
[ 70.669050][ T5064] path_openat+0x1e5a/0x2c50
[ 70.673647][ T5064] do_filp_open+0x1de/0x430
[ 70.678137][ T5064] page last free stack trace:
[ 70.682790][ T5064] free_unref_page_prepare+0x4fa/0xaa0
[ 70.688290][ T5064] free_unref_page+0x33/0x3b0
[ 70.692973][ T5064] inode_doinit_with_dentry+0xac0/0x12c0
[ 70.698698][ T5064] selinux_d_instantiate+0x26/0x30
[ 70.703839][ T5064] security_d_instantiate+0x54/0xe0
[ 70.709036][ T5064] d_splice_alias+0x94/0xdf0
[ 70.713651][ T5064] kernfs_iop_lookup+0x283/0x330
[ 70.718593][ T5064] lookup_open.isra.0+0x926/0x13b0
[ 70.723724][ T5064] path_openat+0x922/0x2c50
[ 70.728231][ T5064] do_filp_open+0x1de/0x430
[ 70.732728][ T5064] do_sys_openat2+0x176/0x1e0
[ 70.737392][ T5064] __x64_sys_openat+0x175/0x210
[ 70.742232][ T5064] do_syscall_64+0x40/0x110
[ 70.746725][ T5064] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 70.752617][ T5064]
[ 70.754925][ T5064] Memory state around the buggy address:
[ 70.760537][ T5064] ffff88801c2b2a80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 70.768585][ T5064] ffff88801c2b2b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 70.776631][ T5064] >ffff88801c2b2b80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 70.784672][ T5064] ^
[ 70.792370][ T5064] ffff88801c2b2c00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 70.800414][ T5064] ffff88801c2b2c80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 70.808465][ T5064] ==================================================================
[ 70.816803][ T5064] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 70.824019][ T5064] CPU: 1 PID: 5064 Comm: syz-executor323 Not tainted 6.7.0-rc8-syzkaller-00174-g95c8a35f1c01 #0
[ 70.834441][ T5064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 70.844494][ T5064] Call Trace:
[ 70.847772][ T5064]
[ 70.850696][ T5064] dump_stack_lvl+0xd9/0x1b0
[ 70.855292][ T5064] panic+0x6dc/0x790
[ 70.859189][ T5064] ? panic_smp_self_stop+0xa0/0xa0
[ 70.864300][ T5064] ? preempt_schedule_thunk+0x1a/0x30
[ 70.869677][ T5064] ? preempt_schedule_common+0x45/0xc0
[ 70.875144][ T5064] ? check_panic_on_warn+0x1f/0xb0
[ 70.880271][ T5064] check_panic_on_warn+0xab/0xb0
[ 70.885224][ T5064] end_report+0x108/0x150
[ 70.889567][ T5064] kasan_report+0xea/0x110
[ 70.893984][ T5064] ? ntfs_readdir+0x15a0/0x2e40
[ 70.898839][ T5064] ? ntfs_readdir+0x15a0/0x2e40
[ 70.903690][ T5064] ntfs_readdir+0x15a0/0x2e40
[ 70.908370][ T5064] ? lock_sync+0x190/0x190
[ 70.912790][ T5064] ? folio_flags.constprop.0+0x150/0x150
[ 70.918418][ T5064] ? down_read_killable+0xcc/0x380
[ 70.923527][ T5064] ? folio_flags.constprop.0+0x150/0x150
[ 70.929171][ T5064] wrap_directory_iterator+0xa5/0xe0
[ 70.934478][ T5064] iterate_dir+0x1e5/0x5b0
[ 70.938901][ T5064] __x64_sys_getdents64+0x14f/0x2e0
[ 70.944104][ T5064] ? __ia32_sys_getdents+0x2d0/0x2d0
[ 70.949390][ T5064] ? fillonedir+0x400/0x400
[ 70.953892][ T5064] ? _raw_spin_unlock_irq+0x2e/0x50
[ 70.959094][ T5064] ? ptrace_notify+0xf4/0x130
[ 70.963779][ T5064] ? syscall_trace_enter.constprop.0+0xaf/0x1e0
[ 70.970021][ T5064] do_syscall_64+0x40/0x110
[ 70.974523][ T5064] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 70.980422][ T5064] RIP: 0033:0x7fb1d77a1a59
[ 70.984834][ T5064] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 71.004433][ T5064] RSP: 002b:00007ffd20c87708 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 71.012858][ T5064] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb1d77a1a59
[ 71.020822][ T5064] RDX: 00000000000000ab RSI: 0000000020000080 RDI: 0000000000000004
[ 71.028785][ T5064] RBP: 00007fb1d78335f0 R08: 00005555574b24c0 R09: 00005555574b24c0
[ 71.036749][ T5064] R10: 000000000001f1b8 R11: 0000000000000246 R12: 00007ffd20c87730
[ 71.044713][ T5064] R13: 00007ffd20c87958 R14: 431bde82d7b634db R15: 00007fb1d77ea03b
[ 71.052683][ T5064]
[ 71.055882][ T5064] Kernel Offset: disabled
[ 71.060191][ T5064] Rebooting in 86400 seconds..