./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2660627919
<...>
DUID 00:04:4f:52:9e:ef:28:bc:79:ad:2a:9e:d1:97:f2:e1:e7:a4
forked to background, child pid 4665
[ 27.313760][ T4666] 8021q: adding VLAN 0 to HW filter on device bond0
[ 27.323305][ T4666] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.178' (ECDSA) to the list of known hosts.
execve("./syz-executor2660627919", ["./syz-executor2660627919"], 0x7ffeac120c10 /* 10 vars */) = 0
brk(NULL) = 0x55555651e000
brk(0x55555651ec40) = 0x55555651ec40
arch_prctl(ARCH_SET_FS, 0x55555651e300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2660627919", 4096) = 28
brk(0x55555653fc40) = 0x55555653fc40
brk(0x555556540000) = 0x555556540000
mprotect(0x7f8bfe7e2000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 4996
openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3
write(3, "10000000000", 11) = 11
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3
write(3, "20", 2) = 2
close(3) = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
write(3, "100", 3) = 3
close(3) = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3
write(3, "7 4 1 3", 7) = 7
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3
write(3, "4996", 4) = 4
close(3) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555651e5d0) = 4998
./strace-static-x86_64: Process 4998 attached
[pid 4998] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4998] setpgid(0, 0) = 0
[pid 4998] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4998] write(3, "1000", 4) = 4
[pid 4998] close(3) = 0
[pid 4998] memfd_create("syzkaller", 0) = 3
[pid 4998] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8bf6326000
[pid 4998] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
[pid 4998] munmap(0x7f8bf6326000, 4194304) = 0
[pid 4998] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
syzkaller login: [ 58.248149][ T4998] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4998 'syz-executor266'
[pid 4998] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4998] close(3) = 0
[pid 4998] mkdir("./file0", 0777) = 0
[ 58.299885][ T4998] loop0: detected capacity change from 0 to 8192
[ 58.322334][ T4998] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[ 58.335523][ T4998] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal
[ 58.345222][ T4998] REISERFS (device loop0): using ordered data mode
[ 58.352012][ T4998] reiserfs: using flush barriers
[ 58.358082][ T4998] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[ 58.375104][ T4998] REISERFS (device loop0): checking transaction log (loop0)
[ 58.384870][ T4998] REISERFS (device loop0): Using r5 hash to sort names
[ 58.392308][ T4998] ==================================================================
[ 58.400454][ T4998] BUG: KASAN: use-after-free in strlen+0x7d/0xa0
[ 58.406802][ T4998] Read of size 1 at addr ffff88807183c0c4 by task syz-executor266/4998
[ 58.415064][ T4998]
[ 58.417397][ T4998] CPU: 0 PID: 4998 Comm: syz-executor266 Not tainted 6.4.0-rc1-syzkaller-00177-gbb7c241fae62 #0
[ 58.427797][ T4998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 58.437839][ T4998] Call Trace:
[ 58.441105][ T4998]
[ 58.444023][ T4998] dump_stack_lvl+0xd9/0x150
[ 58.448617][ T4998] print_address_description.constprop.0+0x2c/0x3c0
[ 58.455203][ T4998] ? strlen+0x7d/0xa0
[ 58.459180][ T4998] kasan_report+0x11c/0x130
[ 58.463683][ T4998] ? strlen+0x7d/0xa0
[ 58.467655][ T4998] strlen+0x7d/0xa0
[ 58.471450][ T4998] set_de_name_and_namelen+0x4c4/0x6a0
[ 58.476901][ T4998] reiserfs_find_entry.part.0+0x3db/0xdf0
[ 58.482614][ T4998] ? search_by_entry_key+0x960/0x960
[ 58.487889][ T4998] ? find_held_lock+0x2d/0x110
[ 58.492649][ T4998] reiserfs_lookup+0x24e/0x610
[ 58.497403][ T4998] ? reiserfs_unlink+0x760/0x760
[ 58.502336][ T4998] __lookup_slow+0x24c/0x460
[ 58.506917][ T4998] ? lookup_one_qstr_excl+0x180/0x180
[ 58.512285][ T4998] ? lock_downgrade+0x690/0x690
[ 58.517134][ T4998] ? d_lookup+0x105/0x170
[ 58.521451][ T4998] lookup_one_len+0x16e/0x1a0
[ 58.526117][ T4998] ? try_lookup_one_len+0x190/0x190
[ 58.531303][ T4998] reiserfs_lookup_privroot+0x96/0x210
[ 58.536755][ T4998] reiserfs_fill_super+0x1a8d/0x2eb0
[ 58.542032][ T4998] ? reiserfs_remount+0x1650/0x1650
[ 58.547226][ T4998] ? snprintf+0xbf/0x100
[ 58.551462][ T4998] ? vsprintf+0x30/0x30
[ 58.555694][ T4998] ? wait_for_completion_io_timeout+0x20/0x20
[ 58.561785][ T4998] mount_bdev+0x357/0x420
[ 58.566116][ T4998] ? reiserfs_remount+0x1650/0x1650
[ 58.571305][ T4998] ? reiserfs_kill_sb+0x1e0/0x1e0
[ 58.576406][ T4998] legacy_get_tree+0x109/0x220
[ 58.581163][ T4998] vfs_get_tree+0x8d/0x350
[ 58.585568][ T4998] path_mount+0x134b/0x1e40
[ 58.590070][ T4998] ? kmem_cache_free+0xe9/0x480
[ 58.594915][ T4998] ? finish_automount+0x9b0/0x9b0
[ 58.599931][ T4998] ? putname+0x102/0x140
[ 58.604163][ T4998] __x64_sys_mount+0x283/0x300
[ 58.608947][ T4998] ? copy_mnt_ns+0xb30/0xb30
[ 58.613528][ T4998] ? lockdep_hardirqs_on+0x7d/0x100
[ 58.618719][ T4998] ? _raw_spin_unlock_irq+0x2e/0x50
[ 58.624090][ T4998] ? ptrace_notify+0xfe/0x140
[ 58.628758][ T4998] do_syscall_64+0x39/0xb0
[ 58.633171][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 58.639092][ T4998] RIP: 0033:0x7f8bfe77c25a
[ 58.643496][ T4998] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 98 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 58.663106][ T4998] RSP: 002b:00007ffca86059d8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 58.671550][ T4998] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8bfe77c25a
[ 58.679606][ T4998] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 00007ffca86059e0
[ 58.687593][ T4998] RBP: 00007ffca86059e0 R08: 00007ffca8605a20 R09: 0000000000000000
[ 58.695666][ T4998] R10: 0000000000008001 R11: 0000000000000286 R12: 0000000000000004
[ 58.703625][ T4998] R13: 000055555651e2c0 R14: 00007ffca8605a20 R15: 0000000000000000
[ 58.711590][ T4998]
[ 58.714592][ T4998]
[ 58.716900][ T4998] The buggy address belongs to the physical page:
[ 58.723292][ T4998] page:ffffea0001c60f00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x7183c
[ 58.733443][ T4998] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 58.740536][ T4998] page_type: 0xffffffff()
[ 58.744964][ T4998] raw: 00fff00000000000 ffffea0001c60f48 ffff8880b9843660 0000000000000000
[ 58.753535][ T4998] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 58.762101][ T4998] page dumped because: kasan: bad access detected
[ 58.768505][ T4998] page_owner tracks the page as freed
[ 58.773875][ T4998] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 11119347758, free_ts 11881422708
[ 58.788806][ T4998] post_alloc_hook+0x2db/0x350
[ 58.793570][ T4998] split_map_pages+0x1ef/0x520
[ 58.798321][ T4998] isolate_freepages_range+0x313/0x350
[ 58.803765][ T4998] alloc_contig_range+0x2fa/0x4a0
[ 58.808773][ T4998] alloc_contig_pages+0x361/0x4d0
[ 58.813779][ T4998] debug_vm_pgtable+0x91f/0x4210
[ 58.818707][ T4998] do_one_initcall+0x102/0x540
[ 58.823466][ T4998] kernel_init_freeable+0x64e/0xba0
[ 58.828653][ T4998] kernel_init+0x1e/0x2c0
[ 58.832972][ T4998] ret_from_fork+0x1f/0x30
[ 58.837378][ T4998] page last free stack trace:
[ 58.842035][ T4998] free_unref_page_prepare+0x62e/0xcb0
[ 58.847490][ T4998] free_unref_page+0x33/0x370
[ 58.852156][ T4998] free_contig_range+0xb5/0x180
[ 58.856999][ T4998] destroy_args+0x6c4/0x920
[ 58.861524][ T4998] debug_vm_pgtable+0x2412/0x4210
[ 58.866555][ T4998] do_one_initcall+0x102/0x540
[ 58.871399][ T4998] kernel_init_freeable+0x64e/0xba0
[ 58.876584][ T4998] kernel_init+0x1e/0x2c0
[ 58.880904][ T4998] ret_from_fork+0x1f/0x30
[ 58.885312][ T4998]
[ 58.887618][ T4998] Memory state around the buggy address:
[ 58.893226][ T4998] ffff88807183bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 58.901286][ T4998] ffff88807183c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.909446][ T4998] >ffff88807183c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.917490][ T4998] ^
[ 58.923624][ T4998] ffff88807183c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.931755][ T4998] ffff88807183c180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.939805][ T4998] ==================================================================
[ 58.952902][ T4998] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 58.960288][ T4998] CPU: 0 PID: 4998 Comm: syz-executor266 Not tainted 6.4.0-rc1-syzkaller-00177-gbb7c241fae62 #0
[ 58.970689][ T4998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 58.980739][ T4998] Call Trace:
[ 58.984015][ T4998]
[ 58.986962][ T4998] dump_stack_lvl+0xd9/0x150
[ 58.991575][ T4998] panic+0x686/0x730
[ 58.995484][ T4998] ? panic_smp_self_stop+0xa0/0xa0
[ 59.000598][ T4998] ? preempt_schedule_thunk+0x1a/0x20
[ 59.005989][ T4998] ? preempt_schedule_common+0x45/0xb0
[ 59.011613][ T4998] check_panic_on_warn+0xb1/0xc0
[ 59.016544][ T4998] end_report+0xe9/0x120
[ 59.020778][ T4998] ? strlen+0x7d/0xa0
[ 59.024745][ T4998] kasan_report+0xf9/0x130
[ 59.029157][ T4998] ? strlen+0x7d/0xa0
[ 59.033127][ T4998] strlen+0x7d/0xa0
[ 59.036958][ T4998] set_de_name_and_namelen+0x4c4/0x6a0
[ 59.042451][ T4998] reiserfs_find_entry.part.0+0x3db/0xdf0
[ 59.048191][ T4998] ? search_by_entry_key+0x960/0x960
[ 59.053469][ T4998] ? find_held_lock+0x2d/0x110
[ 59.058251][ T4998] reiserfs_lookup+0x24e/0x610
[ 59.063001][ T4998] ? reiserfs_unlink+0x760/0x760
[ 59.067935][ T4998] __lookup_slow+0x24c/0x460
[ 59.072550][ T4998] ? lookup_one_qstr_excl+0x180/0x180
[ 59.077918][ T4998] ? lock_downgrade+0x690/0x690
[ 59.082775][ T4998] ? d_lookup+0x105/0x170
[ 59.087099][ T4998] lookup_one_len+0x16e/0x1a0
[ 59.091768][ T4998] ? try_lookup_one_len+0x190/0x190
[ 59.096958][ T4998] reiserfs_lookup_privroot+0x96/0x210
[ 59.102413][ T4998] reiserfs_fill_super+0x1a8d/0x2eb0
[ 59.107696][ T4998] ? reiserfs_remount+0x1650/0x1650
[ 59.112886][ T4998] ? snprintf+0xbf/0x100
[ 59.117120][ T4998] ? vsprintf+0x30/0x30
[ 59.121268][ T4998] ? wait_for_completion_io_timeout+0x20/0x20
[ 59.127330][ T4998] mount_bdev+0x357/0x420
[ 59.131736][ T4998] ? reiserfs_remount+0x1650/0x1650
[ 59.137013][ T4998] ? reiserfs_kill_sb+0x1e0/0x1e0
[ 59.142030][ T4998] legacy_get_tree+0x109/0x220
[ 59.146792][ T4998] vfs_get_tree+0x8d/0x350
[ 59.151220][ T4998] path_mount+0x134b/0x1e40
[ 59.155718][ T4998] ? kmem_cache_free+0xe9/0x480
[ 59.160564][ T4998] ? finish_automount+0x9b0/0x9b0
[ 59.165582][ T4998] ? putname+0x102/0x140
[ 59.169815][ T4998] __x64_sys_mount+0x283/0x300
[ 59.174575][ T4998] ? copy_mnt_ns+0xb30/0xb30
[ 59.179161][ T4998] ? lockdep_hardirqs_on+0x7d/0x100
[ 59.184355][ T4998] ? _raw_spin_unlock_irq+0x2e/0x50
[ 59.189551][ T4998] ? ptrace_notify+0xfe/0x140
[ 59.194230][ T4998] do_syscall_64+0x39/0xb0
[ 59.198685][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 59.204662][ T4998] RIP: 0033:0x7f8bfe77c25a
[ 59.209063][ T4998] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 98 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 59.228683][ T4998] RSP: 002b:00007ffca86059d8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 59.237092][ T4998] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8bfe77c25a
[ 59.245053][ T4998] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 00007ffca86059e0
[ 59.253020][ T4998] RBP: 00007ffca86059e0 R08: 00007ffca8605a20 R09: 0000000000000000
[ 59.261070][ T4998] R10: 0000000000008001 R11: 0000000000000286 R12: 0000000000000004
[ 59.269029][ T4998] R13: 000055555651e2c0 R14: 00007ffca8605a20 R15: 0000000000000000
[ 59.276994][ T4998]
[ 59.280823][ T4998] Kernel Offset: disabled
[ 59.285136][ T4998] Rebooting in 86400 seconds..