./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3244765682
<...>
forked to background, child pid 3182
no interfaces have a carrier
[ 23.556326][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0
[ 23.566117][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.152' (ECDSA) to the list of known hosts.
execve("./syz-executor3244765682", ["./syz-executor3244765682"], 0x7ffe3b6c2d40 /* 10 vars */) = 0
brk(NULL) = 0x555556bb2000
brk(0x555556bb2c40) = 0x555556bb2c40
arch_prctl(ARCH_SET_FS, 0x555556bb2300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3244765682", 4096) = 28
brk(0x555556bd3c40) = 0x555556bd3c40
brk(0x555556bd4000) = 0x555556bd4000
mprotect(0x7fc706db8000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
ftruncate(3, 4194338) = 0
pwrite64(3, "\x00\x04\x00\x00\xec\x01\x00\x00\x13\x02\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x61\x1c\xad\x49\xe1\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x10\xcc\x03\x02\x00\x01\x00\x52\x65\x49\x73\x45\x72\x33\x46\x73\x00\x00\x00\x02\x00\x00\x00\x02\x00\x01\x00\x02\x00\x01\x02\x00\x00\x00\x00\x01\x00\x00\x00\x12\x31\x23\x12\x12\x33\x12\x33\x12\x31\x12\x34\x13\x41\x24\x12"..., 128, 65536) = 128
pwrite64(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 32, 65728) = 32
pwrite64(3, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4096, 69632) = 4096
pwrite64(3, "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x61\x1c\xad\x49\xe1\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64, 2170880) = 64
pwrite64(3, "\x01\x00\x02\x00\x5c\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2c\x00\xd4\x0f\x01\x00\x01\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00\xf4\x01\x00\x00\x02\x00\x30\x00\xa4\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 96, 2174976) = 96
pwrite64(3, "\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x28\x00\x04\x00\x02\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x2e\x2e\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x00\x00\x00\x00\xed\x41\x00\x00\x03\x00\x00\x00\x30\x00\x00\x00\x00\x00\x00\x00\x5c\xf9\x01\x00\x53\x5f\x01\x00\x3a\xc1\x65\x5f\x3a\xc1\x65\x5f\x3a\xc1\x65\x5f\x01\x00\x00\x00\x00\x00\x00\x00", 96, 2178976) = 96
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
mkdir("./file0", 0777) = 0
syzkaller login: [ 41.654247][ T3604] loop0: detected capacity change from 0 to 8192
[ 41.665369][ T3604] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[ 41.678451][ T3604] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal
[ 41.687706][ T3604] REISERFS (device loop0): using ordered data mode
[ 41.694329][ T3604] reiserfs: using flush barriers
[ 41.700114][ T3604] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[ 41.716736][ T3604] REISERFS (device loop0): checking transaction log (loop0)
[ 41.725879][ T3604] REISERFS (device loop0): Using rupasov hash to sort names
[ 41.734191][ T3604] ==================================================================
[ 41.742238][ T3604] BUG: KASAN: out-of-bounds in leaf_paste_entries+0x449/0x910
[ 41.749725][ T3604] Read of size 18446744073709551585 at addr ffff888071117fa4 by task syz-executor324/3604
[ 41.759590][ T3604]
[ 41.761890][ T3604] CPU: 1 PID: 3604 Comm: syz-executor324 Not tainted 6.0.0-rc7-syzkaller-00162-g5a77386984b5 #0
[ 41.772291][ T3604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[ 41.782326][ T3604] Call Trace:
[ 41.785583][ T3604]
[ 41.788496][ T3604] dump_stack_lvl+0xcd/0x134
[ 41.793075][ T3604] print_report.cold+0x2ba/0x719
[ 41.797994][ T3604] ? leaf_paste_entries+0x449/0x910
[ 41.803170][ T3604] kasan_report+0xb1/0x1e0
[ 41.807566][ T3604] ? leaf_paste_entries+0x449/0x910
[ 41.812760][ T3604] kasan_check_range+0x13d/0x180
[ 41.817852][ T3604] memmove+0x20/0x60
[ 41.821729][ T3604] leaf_paste_entries+0x449/0x910
[ 41.826733][ T3604] balance_leaf+0x917d/0xde50
[ 41.831392][ T3604] ? reiserfs_prepare_for_journal+0x15e/0x2b0
[ 41.837439][ T3604] ? fix_nodes+0x14cb/0x8650
[ 41.842030][ T3604] ? replace_key+0x160/0x160
[ 41.846605][ T3604] do_balance+0x315/0x810
[ 41.850918][ T3604] ? get_right_neighbor_position+0x170/0x170
[ 41.856884][ T3604] ? wait_for_completion_io_timeout+0x20/0x20
[ 41.862933][ T3604] ? folio_flags.constprop.0+0x53/0x150
[ 41.868464][ T3604] reiserfs_paste_into_item+0x763/0x8e0
[ 41.873995][ T3604] ? reiserfs_delete_object+0x200/0x200
[ 41.879537][ T3604] ? search_by_entry_key+0x960/0x960
[ 41.884806][ T3604] ? yura_hash+0x1e3/0x2a0
[ 41.889208][ T3604] ? make_cpu_key+0x22/0x2a0
[ 41.893783][ T3604] reiserfs_add_entry+0x8cb/0xcf0
[ 41.898798][ T3604] ? reiserfs_lookup+0x490/0x490
[ 41.903714][ T3604] ? wait_for_completion_io_timeout+0x20/0x20
[ 41.909787][ T3604] ? dquot_get_next_dqblk+0x180/0x180
[ 41.915138][ T3604] ? rwlock_bug.part.0+0x90/0x90
[ 41.920058][ T3604] reiserfs_mkdir+0x675/0x980
[ 41.924712][ T3604] ? reiserfs_mknod+0x700/0x700
[ 41.929539][ T3604] ? down_write+0xdf/0x150
[ 41.934021][ T3604] ? down_write_killable_nested+0x180/0x180
[ 41.939914][ T3604] reiserfs_xattr_init+0x57a/0xc30
[ 41.945086][ T3604] reiserfs_fill_super+0x21d7/0x2f80
[ 41.950438][ T3604] ? reiserfs_remount+0x1530/0x1530
[ 41.955614][ T3604] ? sget+0x472/0x580
[ 41.959582][ T3604] ? snprintf+0xbb/0xf0
[ 41.963718][ T3604] ? set_blocksize+0x2e5/0x370
[ 41.968460][ T3604] mount_bdev+0x34d/0x410
[ 41.972768][ T3604] ? reiserfs_remount+0x1530/0x1530
[ 41.977943][ T3604] ? reiserfs_kill_sb+0x1e0/0x1e0
[ 41.982956][ T3604] legacy_get_tree+0x105/0x220
[ 41.987702][ T3604] vfs_get_tree+0x89/0x2f0
[ 41.992100][ T3604] path_mount+0x1326/0x1e20
[ 41.996596][ T3604] ? kmem_cache_free+0xeb/0x5b0
[ 42.001447][ T3604] ? finish_automount+0x960/0x960
[ 42.006452][ T3604] ? putname+0xfe/0x140
[ 42.010587][ T3604] __x64_sys_mount+0x27f/0x300
[ 42.015331][ T3604] ? copy_mnt_ns+0xae0/0xae0
[ 42.019899][ T3604] ? lockdep_hardirqs_on+0x79/0x100
[ 42.025076][ T3604] ? _raw_spin_unlock_irq+0x2a/0x40
[ 42.030250][ T3604] ? ptrace_notify+0xfa/0x140
[ 42.034925][ T3604] do_syscall_64+0x35/0xb0
[ 42.039318][ T3604] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 42.045187][ T3604] RIP: 0033:0x7fc706d4c2aa
[ 42.049580][ T3604] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 42.069165][ T3604] RSP: 002b:00007ffc851e8ee8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 42.077637][ T3604] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc706d4c2aa
[ 42.085584][ T3604] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc851e8f00
[ 42.093536][ T3604] RBP: 00007ffc851e8f00 R08: 00007ffc851e8f40 R09: 0000555556bb22c0
[ 42.101488][ T3604] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004
[ 42.109432][ T3604] R13: 00007ffc851e8f40 R14: 0000000000000006 R15: 0000000020000290
[ 42.117386][ T3604]
[ 42.120380][ T3604]
[ 42.122679][ T3604] The buggy address belongs to the physical page:
[ 42.129065][ T3604] page:ffffea0001c445c0 refcount:3 mapcount:0 mapping:ffff888140ceeaf8 index:0x213 pfn:0x71117
[ 42.139364][ T3604] memcg:ffff888140148000
[ 42.143600][ T3604] aops:def_blk_aops ino:700000
[ 42.148339][ T3604] flags: 0xfff00000002022(referenced|active|private|node=0|zone=1|lastcpupid=0x7ff)
[ 42.157861][ T3604] raw: 00fff00000002022 0000000000000000 dead000000000122 ffff888140ceeaf8
[ 42.166419][ T3604] raw: 0000000000000213 ffff888073f7cd98 00000003ffffffff ffff888140148000
[ 42.174977][ T3604] page dumped because: kasan: bad access detected
[ 42.181362][ T3604] page_owner tracks the page as allocated
[ 42.187047][ T3604] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 3604, tgid 3604 (syz-executor324), ts 41725581235, free_ts 37205417817
[ 42.207597][ T3604] get_page_from_freelist+0x109b/0x2ce0
[ 42.213122][ T3604] __alloc_pages+0x1c7/0x510
[ 42.217685][ T3604] alloc_pages+0x1a6/0x270
[ 42.222078][ T3604] folio_alloc+0x1c/0x70
[ 42.226316][ T3604] filemap_alloc_folio+0x306/0x3a0
[ 42.231406][ T3604] __filemap_get_folio+0x328/0xed0
[ 42.236493][ T3604] pagecache_get_page+0x2e/0x290
[ 42.241407][ T3604] __getblk_slow+0x1ed/0x1030
[ 42.246061][ T3604] __getblk_gfp+0x6e/0x80
[ 42.250366][ T3604] search_by_key+0x3a8/0x3bc0
[ 42.255029][ T3604] reiserfs_read_locked_inode+0x154/0x2160
[ 42.260830][ T3604] reiserfs_fill_super+0x1616/0x2f80
[ 42.266096][ T3604] mount_bdev+0x34d/0x410
[ 42.270401][ T3604] legacy_get_tree+0x105/0x220
[ 42.275148][ T3604] vfs_get_tree+0x89/0x2f0
[ 42.279539][ T3604] path_mount+0x1326/0x1e20
[ 42.284020][ T3604] page last free stack trace:
[ 42.288661][ T3604] free_pcp_prepare+0x5e4/0xd20
[ 42.293485][ T3604] free_unref_page_list+0x16f/0xb90
[ 42.298656][ T3604] release_pages+0xbd3/0x1400
[ 42.303307][ T3604] tlb_batch_pages_flush+0xa8/0x1a0
[ 42.308479][ T3604] tlb_finish_mmu+0x147/0x7e0
[ 42.313130][ T3604] exit_mmap+0x1d2/0x490
[ 42.317345][ T3604] __mmput+0x122/0x4b0
[ 42.321389][ T3604] mmput+0x56/0x60
[ 42.325086][ T3604] do_exit+0x9e2/0x29b0
[ 42.329216][ T3604] do_group_exit+0xd2/0x2f0
[ 42.333698][ T3604] __x64_sys_exit_group+0x3a/0x50
[ 42.338699][ T3604] do_syscall_64+0x35/0xb0
[ 42.343267][ T3604] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 42.349137][ T3604]
[ 42.351435][ T3604] Memory state around the buggy address:
[ 42.357037][ T3604] ffff888071117e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 42.365160][ T3604] ffff888071117f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 42.373194][ T3604] >ffff888071117f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 42.381227][ T3604] ^
[ 42.386310][ T3604] ffff888071118000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 42.394345][ T3604] ffff888071118080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 42.402380][ T3604] ==================================================================
[ 42.410816][ T3604] Kernel panic - not syncing: panic_on_warn set ...
[ 42.417484][ T3604] CPU: 1 PID: 3604 Comm: syz-executor324 Not tainted 6.0.0-rc7-syzkaller-00162-g5a77386984b5 #0
[ 42.427884][ T3604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[ 42.437927][ T3604] Call Trace:
[ 42.441196][ T3604]
[ 42.444114][ T3604] dump_stack_lvl+0xcd/0x134
[ 42.448702][ T3604] panic+0x2c8/0x627
[ 42.452587][ T3604] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 42.458559][ T3604] ? preempt_schedule_common+0x59/0xc0
[ 42.464012][ T3604] ? preempt_schedule_thunk+0x16/0x18
[ 42.469402][ T3604] ? leaf_paste_entries+0x449/0x910
[ 42.474609][ T3604] end_report.part.0+0x3f/0x7c
[ 42.479369][ T3604] kasan_report.cold+0xa/0xf
[ 42.483965][ T3604] ? leaf_paste_entries+0x449/0x910
[ 42.489164][ T3604] kasan_check_range+0x13d/0x180
[ 42.494094][ T3604] memmove+0x20/0x60
[ 42.497984][ T3604] leaf_paste_entries+0x449/0x910
[ 42.503005][ T3604] balance_leaf+0x917d/0xde50
[ 42.507676][ T3604] ? reiserfs_prepare_for_journal+0x15e/0x2b0
[ 42.513735][ T3604] ? fix_nodes+0x14cb/0x8650
[ 42.518317][ T3604] ? replace_key+0x160/0x160
[ 42.522910][ T3604] do_balance+0x315/0x810
[ 42.527236][ T3604] ? get_right_neighbor_position+0x170/0x170
[ 42.533208][ T3604] ? wait_for_completion_io_timeout+0x20/0x20
[ 42.539364][ T3604] ? folio_flags.constprop.0+0x53/0x150
[ 42.544929][ T3604] reiserfs_paste_into_item+0x763/0x8e0
[ 42.550472][ T3604] ? reiserfs_delete_object+0x200/0x200
[ 42.556039][ T3604] ? search_by_entry_key+0x960/0x960
[ 42.561312][ T3604] ? yura_hash+0x1e3/0x2a0
[ 42.565723][ T3604] ? make_cpu_key+0x22/0x2a0
[ 42.570302][ T3604] reiserfs_add_entry+0x8cb/0xcf0
[ 42.575320][ T3604] ? reiserfs_lookup+0x490/0x490
[ 42.580247][ T3604] ? wait_for_completion_io_timeout+0x20/0x20
[ 42.586315][ T3604] ? dquot_get_next_dqblk+0x180/0x180
[ 42.591680][ T3604] ? rwlock_bug.part.0+0x90/0x90
[ 42.596639][ T3604] reiserfs_mkdir+0x675/0x980
[ 42.601328][ T3604] ? reiserfs_mknod+0x700/0x700
[ 42.606351][ T3604] ? down_write+0xdf/0x150
[ 42.610763][ T3604] ? down_write_killable_nested+0x180/0x180
[ 42.616651][ T3604] reiserfs_xattr_init+0x57a/0xc30
[ 42.621754][ T3604] reiserfs_fill_super+0x21d7/0x2f80
[ 42.627030][ T3604] ? reiserfs_remount+0x1530/0x1530
[ 42.632219][ T3604] ? sget+0x472/0x580
[ 42.636193][ T3604] ? snprintf+0xbb/0xf0
[ 42.640339][ T3604] ? set_blocksize+0x2e5/0x370
[ 42.645096][ T3604] mount_bdev+0x34d/0x410
[ 42.649591][ T3604] ? reiserfs_remount+0x1530/0x1530
[ 42.654800][ T3604] ? reiserfs_kill_sb+0x1e0/0x1e0
[ 42.659815][ T3604] legacy_get_tree+0x105/0x220
[ 42.664591][ T3604] vfs_get_tree+0x89/0x2f0
[ 42.669002][ T3604] path_mount+0x1326/0x1e20
[ 42.673512][ T3604] ? kmem_cache_free+0xeb/0x5b0
[ 42.678362][ T3604] ? finish_automount+0x960/0x960
[ 42.683381][ T3604] ? putname+0xfe/0x140
[ 42.687528][ T3604] __x64_sys_mount+0x27f/0x300
[ 42.692283][ T3604] ? copy_mnt_ns+0xae0/0xae0
[ 42.696869][ T3604] ? lockdep_hardirqs_on+0x79/0x100
[ 42.702066][ T3604] ? _raw_spin_unlock_irq+0x2a/0x40
[ 42.707251][ T3604] ? ptrace_notify+0xfa/0x140
[ 42.711924][ T3604] do_syscall_64+0x35/0xb0
[ 42.716423][ T3604] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 42.722315][ T3604] RIP: 0033:0x7fc706d4c2aa
[ 42.726717][ T3604] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 42.746581][ T3604] RSP: 002b:00007ffc851e8ee8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 42.754984][ T3604] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc706d4c2aa
[ 42.762941][ T3604] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc851e8f00
[ 42.770902][ T3604] RBP: 00007ffc851e8f00 R08: 00007ffc851e8f40 R09: 0000555556bb22c0
[ 42.778951][ T3604] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004
[ 42.786913][ T3604] R13: 00007ffc851e8f40 R14: 0000000000000006 R15: 0000000020000290
[ 42.794884][ T3604]
[ 42.798566][ T3604] Kernel Offset: disabled
[ 42.802900][ T3604] Rebooting in 86400 seconds..