./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1163805745

<...>
Warning: Permanently added '10.128.0.173' (ECDSA) to the list of known hosts.
execve("./syz-executor1163805745", ["./syz-executor1163805745"], 0x7ffedc1c96e0 /* 10 vars */) = 0
brk(NULL)                               = 0x555555e9e000
brk(0x555555e9ec40)                     = 0x555555e9ec40
arch_prctl(ARCH_SET_FS, 0x555555e9e300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1163805745", 4096) = 28
brk(0x555555ebfc40)                     = 0x555555ebfc40
brk(0x555555ec0000)                     = 0x555555ec0000
mprotect(0x7f293f9ba000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0)            = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2937500000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7f2937500000, 524288)          = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 4
ioctl(4, LOOP_SET_FD, 3)                = 0
close(3)                                = 0
mkdir("./file0", 0777)                  = 0
mount("/dev/loop0", "./file0", "hfsplus", MS_SYNCHRONOUS|MS_RELATIME|MS_I_VERSION|MS_LAZYTIME, "force") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0")                        = 0
ioctl(4, LOOP_CLR_FD)                   = 0
close(4)                                = 0
syzkaller login: [   53.235284][ T3629] loop0: detected capacity change from 0 to 1024
[   53.256586][ T3629] hfsplus: request for non-existent node 393216 in B*Tree
[   53.264241][ T3629] hfsplus: request for non-existent node 393216 in B*Tree
[   53.272829][ T3629] ==================================================================
[   53.280890][ T3629] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x144/0x150
[   53.288884][ T3629] Read of size 8 at addr ffff888017b25ac0 by task syz-executor116/3629
[   53.297276][ T3629] 
[   53.299579][ T3629] CPU: 0 PID: 3629 Comm: syz-executor116 Not tainted 6.1.0-syzkaller #0
[   53.307892][ T3629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   53.317925][ T3629] Call Trace:
[   53.321185][ T3629]  <TASK>
[   53.324096][ T3629]  dump_stack_lvl+0xd1/0x138
[   53.328671][ T3629]  print_report+0x15e/0x45d
[   53.333161][ T3629]  ? __phys_addr+0xc8/0x140
[   53.337657][ T3629]  ? hfsplus_bnode_read+0x144/0x150
[   53.342851][ T3629]  kasan_report+0xbf/0x1f0
[   53.347260][ T3629]  ? hfsplus_bnode_read+0x144/0x150
[   53.352451][ T3629]  hfsplus_bnode_read+0x144/0x150
[   53.357471][ T3629]  hfsplus_bnode_dump+0x2c6/0x3a0
[   53.362487][ T3629]  ? hfsplus_bnode_read+0xb8/0x150
[   53.367589][ T3629]  ? hfsplus_bnode_move+0x900/0x900
[   53.372778][ T3629]  ? hfsplus_bnode_write_u16+0x84/0xb0
[   53.378228][ T3629]  ? hfsplus_bnode_move+0x2b/0x900
[   53.383330][ T3629]  ? __mark_inode_dirty+0x32c/0x11e0
[   53.388615][ T3629]  hfsplus_brec_remove+0x3db/0x4f0
[   53.393720][ T3629]  __hfsplus_delete_attr+0x217/0x380
[   53.398988][ T3629]  ? hfsplus_find_exit+0xc0/0xc0
[   53.403914][ T3629]  ? hfsplus_part_find+0xb70/0xb70
[   53.409008][ T3629]  ? rcu_read_lock_sched_held+0x3e/0x70
[   53.414545][ T3629]  ? memset+0x24/0x50
[   53.418521][ T3629]  hfsplus_delete_all_attrs+0x25d/0x2d0
[   53.424049][ T3629]  ? hfsplus_delete_attr+0x2c0/0x2c0
[   53.429319][ T3629]  ? rcu_read_lock_sched_held+0x3e/0x70
[   53.434947][ T3629]  ? __mark_inode_dirty+0x67a/0x11e0
[   53.440218][ T3629]  hfsplus_delete_cat+0x86a/0xe40
[   53.445348][ T3629]  ? hfsplus_create_cat+0x10d0/0x10d0
[   53.450716][ T3629]  ? mutex_lock_io_nested+0x11a0/0x11a0
[   53.456260][ T3629]  ? lock_release+0x810/0x810
[   53.461102][ T3629]  hfsplus_unlink+0x1e3/0x830
[   53.465774][ T3629]  ? hfsplus_symlink+0x2e0/0x2e0
[   53.470705][ T3629]  ? down_write+0x157/0x220
[   53.475194][ T3629]  ? down_write_killable_nested+0x250/0x250
[   53.481072][ T3629]  vfs_unlink+0x355/0x930
[   53.485412][ T3629]  ? bpf_lsm_path_unlink+0x9/0x10
[   53.490432][ T3629]  do_unlinkat+0x3d0/0x660
[   53.494835][ T3629]  ? __ia32_sys_rmdir+0x110/0x110
[   53.499845][ T3629]  ? __check_object_size+0x2e2/0x5a0
[   53.505315][ T3629]  ? getname_flags.part.0+0x1dd/0x4f0
[   53.510946][ T3629]  __x64_sys_unlink+0xca/0x110
[   53.515695][ T3629]  do_syscall_64+0x39/0xb0
[   53.520103][ T3629]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   53.525984][ T3629] RIP: 0033:0x7f293f94c809
[   53.530380][ T3629] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   53.550068][ T3629] RSP: 002b:00007fffa3254b78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[   53.558471][ T3629] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f293f94c809
[   53.566428][ T3629] RDX: 00007f293f90ae83 RSI: 0000000000000000 RDI: 0000000020000000
[   53.574387][ T3629] RBP: 00007f293f90c0a0 R08: 00000000000005f2 R09: 0000000000000000
[   53.582348][ T3629] R10: 00007fffa3254a40 R11: 0000000000000246 R12: 00007f293f90c130
[   53.590303][ T3629] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   53.598268][ T3629]  </TASK>
[   53.601271][ T3629] 
[   53.603577][ T3629] Allocated by task 3629:
[   53.607881][ T3629]  kasan_save_stack+0x22/0x40
[   53.612547][ T3629]  kasan_set_track+0x25/0x30
[   53.617124][ T3629]  __kasan_kmalloc+0xa5/0xb0
[   53.621699][ T3629]  __kmalloc+0x5a/0xd0
[   53.625751][ T3629]  __hfs_bnode_create+0x107/0x820
[   53.630765][ T3629]  hfsplus_bnode_find+0x408/0xc50
[   53.635778][ T3629]  hfsplus_brec_find+0x2b3/0x510
[   53.640706][ T3629]  hfsplus_delete_all_attrs+0x236/0x2d0
[   53.646232][ T3629]  hfsplus_delete_cat+0x86a/0xe40
[   53.651258][ T3629]  hfsplus_unlink+0x1e3/0x830
[   53.655924][ T3629]  vfs_unlink+0x355/0x930
[   53.660246][ T3629]  do_unlinkat+0x3d0/0x660
[   53.664645][ T3629]  __x64_sys_unlink+0xca/0x110
[   53.669408][ T3629]  do_syscall_64+0x39/0xb0
[   53.673813][ T3629]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   53.679693][ T3629] 
[   53.681999][ T3629] The buggy address belongs to the object at ffff888017b25a00
[   53.681999][ T3629]  which belongs to the cache kmalloc-192 of size 192
[   53.696031][ T3629] The buggy address is located 0 bytes to the right of
[   53.696031][ T3629]  192-byte region [ffff888017b25a00, ffff888017b25ac0)
[   53.709630][ T3629] 
[   53.711933][ T3629] The buggy address belongs to the physical page:
[   53.718321][ T3629] page:ffffea00005ec940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17b25
[   53.728663][ T3629] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[   53.736201][ T3629] raw: 00fff00000000200 ffffea00005e7480 dead000000000004 ffff888012041a00
[   53.744771][ T3629] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   53.753330][ T3629] page dumped because: kasan: bad access detected
[   53.759722][ T3629] page_owner tracks the page as allocated
[   53.765417][ T3629] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 1549796022, free_ts 0
[   53.782002][ T3629]  get_page_from_freelist+0x10b5/0x2d50
[   53.787541][ T3629]  __alloc_pages+0x1cb/0x5b0
[   53.792121][ T3629]  alloc_page_interleave+0x1e/0x200
[   53.797306][ T3629]  alloc_pages+0x233/0x270
[   53.801712][ T3629]  allocate_slab+0x25f/0x350
[   53.806286][ T3629]  ___slab_alloc+0xa91/0x1400
[   53.811118][ T3629]  __slab_alloc.constprop.0+0x56/0xa0
[   53.816473][ T3629]  __kmem_cache_alloc_node+0x199/0x3e0
[   53.821921][ T3629]  kmalloc_trace+0x26/0x60
[   53.826332][ T3629]  call_usermodehelper_setup+0x9b/0x340
[   53.831875][ T3629]  kobject_uevent_env+0xed3/0x1620
[   53.836977][ T3629]  param_sysfs_init+0x36b/0x43f
[   53.841897][ T3629]  do_one_initcall+0x141/0x780
[   53.846911][ T3629]  kernel_init_freeable+0x6ff/0x788
[   53.852096][ T3629]  kernel_init+0x1e/0x1d0
[   53.856408][ T3629]  ret_from_fork+0x1f/0x30
[   53.860811][ T3629] page_owner free stack trace missing
[   53.866156][ T3629] 
[   53.868459][ T3629] Memory state around the buggy address:
[   53.874067][ T3629]  ffff888017b25980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   53.882196][ T3629]  ffff888017b25a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   53.890233][ T3629] >ffff888017b25a80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[   53.898268][ T3629]                                            ^
[   53.904397][ T3629]  ffff888017b25b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   53.912438][ T3629]  ffff888017b25b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   53.920474][ T3629] ==================================================================
[   53.928927][ T3629] Kernel panic - not syncing: panic_on_warn set ...
[   53.935517][ T3629] CPU: 1 PID: 3629 Comm: syz-executor116 Not tainted 6.1.0-syzkaller #0
[   53.943847][ T3629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   53.953878][ T3629] Call Trace:
[   53.957133][ T3629]  <TASK>
[   53.960043][ T3629]  dump_stack_lvl+0xd1/0x138
[   53.964621][ T3629]  panic+0x2cc/0x626
[   53.968500][ T3629]  ? panic_print_sys_info.part.0+0x110/0x110
[   53.974584][ T3629]  ? preempt_schedule_common+0x59/0xc0
[   53.980114][ T3629]  ? preempt_schedule_thunk+0x1a/0x1c
[   53.985471][ T3629]  end_report.part.0+0x3f/0x7c
[   53.990211][ T3629]  ? hfsplus_bnode_read+0x144/0x150
[   53.995392][ T3629]  kasan_report.cold+0xa/0xf
[   53.999961][ T3629]  ? hfsplus_bnode_read+0x144/0x150
[   54.005144][ T3629]  hfsplus_bnode_read+0x144/0x150
[   54.010325][ T3629]  hfsplus_bnode_dump+0x2c6/0x3a0
[   54.015332][ T3629]  ? hfsplus_bnode_read+0xb8/0x150
[   54.020447][ T3629]  ? hfsplus_bnode_move+0x900/0x900
[   54.025803][ T3629]  ? hfsplus_bnode_write_u16+0x84/0xb0
[   54.031249][ T3629]  ? hfsplus_bnode_move+0x2b/0x900
[   54.036357][ T3629]  ? __mark_inode_dirty+0x32c/0x11e0
[   54.041624][ T3629]  hfsplus_brec_remove+0x3db/0x4f0
[   54.046724][ T3629]  __hfsplus_delete_attr+0x217/0x380
[   54.051989][ T3629]  ? hfsplus_find_exit+0xc0/0xc0
[   54.056925][ T3629]  ? hfsplus_part_find+0xb70/0xb70
[   54.062017][ T3629]  ? rcu_read_lock_sched_held+0x3e/0x70
[   54.067570][ T3629]  ? memset+0x24/0x50
[   54.071558][ T3629]  hfsplus_delete_all_attrs+0x25d/0x2d0
[   54.077172][ T3629]  ? hfsplus_delete_attr+0x2c0/0x2c0
[   54.082883][ T3629]  ? rcu_read_lock_sched_held+0x3e/0x70
[   54.088414][ T3629]  ? __mark_inode_dirty+0x67a/0x11e0
[   54.093681][ T3629]  hfsplus_delete_cat+0x86a/0xe40
[   54.098686][ T3629]  ? hfsplus_create_cat+0x10d0/0x10d0
[   54.104042][ T3629]  ? mutex_lock_io_nested+0x11a0/0x11a0
[   54.109576][ T3629]  ? lock_release+0x810/0x810
[   54.114236][ T3629]  hfsplus_unlink+0x1e3/0x830
[   54.118893][ T3629]  ? hfsplus_symlink+0x2e0/0x2e0
[   54.123814][ T3629]  ? down_write+0x157/0x220
[   54.128300][ T3629]  ? down_write_killable_nested+0x250/0x250
[   54.134174][ T3629]  vfs_unlink+0x355/0x930
[   54.138504][ T3629]  ? bpf_lsm_path_unlink+0x9/0x10
[   54.143535][ T3629]  do_unlinkat+0x3d0/0x660
[   54.147931][ T3629]  ? __ia32_sys_rmdir+0x110/0x110
[   54.153023][ T3629]  ? __check_object_size+0x2e2/0x5a0
[   54.158290][ T3629]  ? getname_flags.part.0+0x1dd/0x4f0
[   54.163648][ T3629]  __x64_sys_unlink+0xca/0x110
[   54.168390][ T3629]  do_syscall_64+0x39/0xb0
[   54.172791][ T3629]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   54.178666][ T3629] RIP: 0033:0x7f293f94c809
[   54.183058][ T3629] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   54.202651][ T3629] RSP: 002b:00007fffa3254b78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[   54.211045][ T3629] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f293f94c809
[   54.219265][ T3629] RDX: 00007f293f90ae83 RSI: 0000000000000000 RDI: 0000000020000000
[   54.227391][ T3629] RBP: 00007f293f90c0a0 R08: 00000000000005f2 R09: 0000000000000000
[   54.235345][ T3629] R10: 00007fffa3254a40 R11: 0000000000000246 R12: 00007f293f90c130
[   54.243299][ T3629] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   54.251436][ T3629]  </TASK>
[   54.255441][ T3629] Kernel Offset: disabled
[   54.259784][ T3629] Rebooting in 86400 seconds..