./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1242478179
<...>
Warning: Permanently added '10.128.1.81' (ECDSA) to the list of known hosts.
execve("./syz-executor1242478179", ["./syz-executor1242478179"], 0x7ffca99e0330 /* 10 vars */) = 0
brk(NULL) = 0x555557245000
brk(0x555557245c40) = 0x555557245c40
arch_prctl(ARCH_SET_FS, 0x555557245300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1242478179", 4096) = 28
brk(0x555557266c40) = 0x555557266c40
brk(0x555557267000) = 0x555557267000
mprotect(0x7f731f0b3000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7316a00000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768
munmap(0x7f7316a00000, 32768) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
mount("/dev/loop0", "./file0", "hfs", MS_RDONLY|MS_NOSUID, "dir_umask=00000000000000000006752,iocharset=cp950,quiet,uid=0x0000000000000000,file_umask=0000000000"...) = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
syzkaller login: [ 64.748427][ T3630] loop0: detected capacity change from 0 to 64
[ 64.765864][ T3630] ==================================================================
[ 64.773961][ T3630] BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0
[ 64.781275][ T3630] Write of size 1 at addr ffff88807e301cce by task syz-executor124/3630
[ 64.789604][ T3630]
[ 64.791925][ T3630] CPU: 0 PID: 3630 Comm: syz-executor124 Not tainted 6.1.0-rc7-syzkaller #0
[ 64.800598][ T3630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 64.810646][ T3630] Call Trace:
[ 64.813920][ T3630]
[ 64.816833][ T3630] dump_stack_lvl+0x1b1/0x28e
[ 64.821503][ T3630] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 64.827112][ T3630] ? __wake_up_klogd+0xcd/0x100
[ 64.831945][ T3630] ? panic+0x710/0x710
[ 64.835996][ T3630] ? _printk+0xc0/0x100
[ 64.840135][ T3630] ? _raw_spin_lock_irqsave+0x8e/0x100
[ 64.845577][ T3630] print_address_description+0x74/0x340
[ 64.851113][ T3630] print_report+0x107/0x1f0
[ 64.855606][ T3630] ? __virt_addr_valid+0x21b/0x2d0
[ 64.860701][ T3630] ? __phys_addr+0xb5/0x160
[ 64.865190][ T3630] ? hfs_asc2mac+0x467/0x9a0
[ 64.869761][ T3630] kasan_report+0xcd/0x100
[ 64.874156][ T3630] ? hfs_asc2mac+0x467/0x9a0
[ 64.878725][ T3630] hfs_asc2mac+0x467/0x9a0
[ 64.883123][ T3630] ? mutex_lock_io_nested+0x60/0x60
[ 64.888304][ T3630] ? hfs_mac2asc+0x850/0x850
[ 64.892874][ T3630] ? hfs_find_init+0x8b/0x1e0
[ 64.897557][ T3630] ? trace_kmalloc+0x30/0xf0
[ 64.902130][ T3630] ? __kmalloc+0xcc/0x1a0
[ 64.906438][ T3630] hfs_cat_build_key+0x92/0x170
[ 64.911269][ T3630] hfs_lookup+0x1ab/0x2c0
[ 64.915582][ T3630] ? hfs_dir_release+0x140/0x140
[ 64.920533][ T3630] ? d_alloc_parallel+0x1144/0x1240
[ 64.925978][ T3630] ? memset+0x1f/0x40
[ 64.929945][ T3630] ? lockdep_init_map_type+0x9d/0x890
[ 64.935387][ T3630] ? d_hash_and_lookup+0x1c0/0x1c0
[ 64.940494][ T3630] ? __init_waitqueue_head+0xa6/0x140
[ 64.945848][ T3630] __lookup_slow+0x266/0x3a0
[ 64.950417][ T3630] ? lookup_one_len+0x690/0x690
[ 64.955249][ T3630] ? __down_read_common+0x156/0x2a0
[ 64.960448][ T3630] lookup_slow+0x53/0x70
[ 64.964677][ T3630] walk_component+0x2e1/0x410
[ 64.969333][ T3630] ? path_lookupat+0x16f/0x450
[ 64.974165][ T3630] path_lookupat+0x17d/0x450
[ 64.978741][ T3630] filename_lookup+0x274/0x650
[ 64.983488][ T3630] ? hashlen_string+0x120/0x120
[ 64.988323][ T3630] ? check_heap_object+0x244/0x810
[ 64.993764][ T3630] ? __phys_addr_symbol+0x2b/0x70
[ 64.998770][ T3630] ? 0xffffffff81000000
[ 65.002906][ T3630] ? __check_object_size+0x15a/0x210
[ 65.008175][ T3630] ? strncpy_from_user+0x1d6/0x330
[ 65.013440][ T3630] ? getname_flags+0x1ea/0x4e0
[ 65.018187][ T3630] user_path_at_empty+0x40/0x1a0
[ 65.023105][ T3630] __se_sys_open_tree+0x1fa/0x8c0
[ 65.028108][ T3630] ? __x64_sys_open_tree+0x80/0x80
[ 65.033196][ T3630] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 65.039327][ T3630] ? syscall_enter_from_user_mode+0x86/0x1d0
[ 65.045285][ T3630] do_syscall_64+0x3d/0xb0
[ 65.049684][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 65.055556][ T3630] RIP: 0033:0x7f731f046af9
[ 65.059947][ T3630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 65.079619][ T3630] RSP: 002b:00007ffe3060e688 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac
[ 65.088015][ T3630] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f731f046af9
[ 65.095966][ T3630] RDX: 0000000000000000 RSI: 00000000200003c0 RDI: 00000000ffffff9c
[ 65.103920][ T3630] RBP: 00007f731f006100 R08: 000000000000023c R09: 0000000000000000
[ 65.111867][ T3630] R10: 00007ffe3060e550 R11: 0000000000000246 R12: 00007f731f006190
[ 65.119817][ T3630] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 65.127772][ T3630]
[ 65.130769][ T3630]
[ 65.133070][ T3630] Allocated by task 3630:
[ 65.137372][ T3630] kasan_set_track+0x3d/0x60
[ 65.141945][ T3630] __kasan_kmalloc+0x97/0xb0
[ 65.146513][ T3630] __kmalloc+0xaf/0x1a0
[ 65.150732][ T3630] hfs_find_init+0x8b/0x1e0
[ 65.155220][ T3630] hfs_lookup+0x105/0x2c0
[ 65.159525][ T3630] __lookup_slow+0x266/0x3a0
[ 65.164088][ T3630] lookup_slow+0x53/0x70
[ 65.168304][ T3630] walk_component+0x2e1/0x410
[ 65.172958][ T3630] path_lookupat+0x17d/0x450
[ 65.177528][ T3630] filename_lookup+0x274/0x650
[ 65.182269][ T3630] user_path_at_empty+0x40/0x1a0
[ 65.187197][ T3630] __se_sys_open_tree+0x1fa/0x8c0
[ 65.192198][ T3630] do_syscall_64+0x3d/0xb0
[ 65.196592][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 65.202461][ T3630]
[ 65.204762][ T3630] The buggy address belongs to the object at ffff88807e301c80
[ 65.204762][ T3630] which belongs to the cache kmalloc-96 of size 96
[ 65.218616][ T3630] The buggy address is located 78 bytes inside of
[ 65.218616][ T3630] 96-byte region [ffff88807e301c80, ffff88807e301ce0)
[ 65.231779][ T3630]
[ 65.234080][ T3630] The buggy address belongs to the physical page:
[ 65.240464][ T3630] page:ffffea0001f8c040 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807e301100 pfn:0x7e301
[ 65.251890][ T3630] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 65.259413][ T3630] raw: 00fff00000000200 ffffea0000601580 dead000000000008 ffff888012841780
[ 65.267974][ T3630] raw: ffff88807e301100 000000008020001f 00000001ffffffff 0000000000000000
[ 65.276531][ T3630] page dumped because: kasan: bad access detected
[ 65.282930][ T3630] page_owner tracks the page as allocated
[ 65.288617][ T3630] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 3008, tgid 3008 (udevd), ts 25242392826, free_ts 25236191974
[ 65.306125][ T3630] get_page_from_freelist+0x742/0x7c0
[ 65.311507][ T3630] __alloc_pages+0x259/0x560
[ 65.316079][ T3630] alloc_slab_page+0x70/0xf0
[ 65.320649][ T3630] allocate_slab+0x5e/0x4b0
[ 65.325131][ T3630] ___slab_alloc+0x782/0xe20
[ 65.329697][ T3630] __kmem_cache_alloc_node+0x252/0x310
[ 65.335143][ T3630] __kmalloc+0x9e/0x1a0
[ 65.339276][ T3630] tomoyo_encode+0x26f/0x540
[ 65.343847][ T3630] tomoyo_realpath_from_path+0x5ae/0x5f0
[ 65.349460][ T3630] tomoyo_path_perm+0x227/0x670
[ 65.354288][ T3630] security_inode_getattr+0xc0/0x140
[ 65.359551][ T3630] vfs_statx+0x188/0x4a0
[ 65.363769][ T3630] __se_sys_newfstatat+0xed/0x7d0
[ 65.368772][ T3630] do_syscall_64+0x3d/0xb0
[ 65.373172][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 65.379040][ T3630] page last free stack trace:
[ 65.383687][ T3630] free_pcp_prepare+0x80c/0x8f0
[ 65.388512][ T3630] free_unref_page+0x7d/0x5f0
[ 65.393170][ T3630] qlist_free_all+0x2b/0x70
[ 65.397659][ T3630] kasan_quarantine_reduce+0x169/0x180
[ 65.403095][ T3630] __kasan_slab_alloc+0x1f/0x70
[ 65.407923][ T3630] kmem_cache_alloc+0x1cc/0x300
[ 65.412752][ T3630] getname_flags+0xb8/0x4e0
[ 65.417344][ T3630] __se_sys_newfstatat+0xcb/0x7d0
[ 65.422347][ T3630] do_syscall_64+0x3d/0xb0
[ 65.426747][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 65.432619][ T3630]
[ 65.434922][ T3630] Memory state around the buggy address:
[ 65.440526][ T3630] ffff88807e301b80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 65.448565][ T3630] ffff88807e301c00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 65.456600][ T3630] >ffff88807e301c80: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc
[ 65.464808][ T3630] ^
[ 65.471193][ T3630] ffff88807e301d00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
[ 65.479228][ T3630] ffff88807e301d80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 65.487261][ T3630] ==================================================================
[ 65.496171][ T3630] Kernel panic - not syncing: panic_on_warn set ...
[ 65.502777][ T3630] CPU: 1 PID: 3630 Comm: syz-executor124 Not tainted 6.1.0-rc7-syzkaller #0
[ 65.511451][ T3630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 65.521493][ T3630] Call Trace:
[ 65.524759][ T3630]
[ 65.527671][ T3630] dump_stack_lvl+0x1b1/0x28e
[ 65.532330][ T3630] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 65.537771][ T3630] ? panic+0x710/0x710
[ 65.541822][ T3630] ? preempt_schedule_common+0xb7/0xe0
[ 65.547265][ T3630] ? vscnprintf+0x59/0x80
[ 65.551578][ T3630] panic+0x2d6/0x710
[ 65.555465][ T3630] ? memcpy_page_flushcache+0xfc/0xfc
[ 65.560816][ T3630] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 65.566805][ T3630] ? rcu_read_lock_sched_held+0x5d/0x110
[ 65.572426][ T3630] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 65.578573][ T3630] ? hfs_asc2mac+0x467/0x9a0
[ 65.583148][ T3630] end_report+0x91/0xa0
[ 65.587383][ T3630] kasan_report+0xda/0x100
[ 65.591781][ T3630] ? hfs_asc2mac+0x467/0x9a0
[ 65.596363][ T3630] hfs_asc2mac+0x467/0x9a0
[ 65.600765][ T3630] ? mutex_lock_io_nested+0x60/0x60
[ 65.605966][ T3630] ? hfs_mac2asc+0x850/0x850
[ 65.610547][ T3630] ? hfs_find_init+0x8b/0x1e0
[ 65.615216][ T3630] ? trace_kmalloc+0x30/0xf0
[ 65.619797][ T3630] ? __kmalloc+0xcc/0x1a0
[ 65.624119][ T3630] hfs_cat_build_key+0x92/0x170
[ 65.628989][ T3630] hfs_lookup+0x1ab/0x2c0
[ 65.633310][ T3630] ? hfs_dir_release+0x140/0x140
[ 65.638231][ T3630] ? d_alloc_parallel+0x1144/0x1240
[ 65.643419][ T3630] ? memset+0x1f/0x40
[ 65.647391][ T3630] ? lockdep_init_map_type+0x9d/0x890
[ 65.652760][ T3630] ? d_hash_and_lookup+0x1c0/0x1c0
[ 65.657860][ T3630] ? __init_waitqueue_head+0xa6/0x140
[ 65.663221][ T3630] __lookup_slow+0x266/0x3a0
[ 65.667798][ T3630] ? lookup_one_len+0x690/0x690
[ 65.672645][ T3630] ? __down_read_common+0x156/0x2a0
[ 65.677829][ T3630] lookup_slow+0x53/0x70
[ 65.682061][ T3630] walk_component+0x2e1/0x410
[ 65.686729][ T3630] ? path_lookupat+0x16f/0x450
[ 65.691487][ T3630] path_lookupat+0x17d/0x450
[ 65.696071][ T3630] filename_lookup+0x274/0x650
[ 65.700829][ T3630] ? hashlen_string+0x120/0x120
[ 65.705687][ T3630] ? check_heap_object+0x244/0x810
[ 65.710791][ T3630] ? __phys_addr_symbol+0x2b/0x70
[ 65.715808][ T3630] ? 0xffffffff81000000
[ 65.719950][ T3630] ? __check_object_size+0x15a/0x210
[ 65.725230][ T3630] ? strncpy_from_user+0x1d6/0x330
[ 65.730331][ T3630] ? getname_flags+0x1ea/0x4e0
[ 65.735088][ T3630] user_path_at_empty+0x40/0x1a0
[ 65.740014][ T3630] __se_sys_open_tree+0x1fa/0x8c0
[ 65.745032][ T3630] ? __x64_sys_open_tree+0x80/0x80
[ 65.750132][ T3630] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 65.756108][ T3630] ? syscall_enter_from_user_mode+0x86/0x1d0
[ 65.762079][ T3630] do_syscall_64+0x3d/0xb0
[ 65.766491][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 65.772377][ T3630] RIP: 0033:0x7f731f046af9
[ 65.776781][ T3630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 65.796373][ T3630] RSP: 002b:00007ffe3060e688 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac
[ 65.804780][ T3630] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f731f046af9
[ 65.812742][ T3630] RDX: 0000000000000000 RSI: 00000000200003c0 RDI: 00000000ffffff9c
[ 65.820699][ T3630] RBP: 00007f731f006100 R08: 000000000000023c R09: 0000000000000000
[ 65.828654][ T3630] R10: 00007ffe3060e550 R11: 0000000000000246 R12: 00007f731f006190
[ 65.836623][ T3630] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 65.844587][ T3630]
[ 65.847741][ T3630] Kernel Offset: disabled
[ 65.852053][ T3630] Rebooting in 86400 seconds..