./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor976328297 <...> forked to background, child pid 4661 [ 42.601451][ T4662] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.611577][ T4662] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: [ 43.103377][ T4743] sshd (4743) used greatest stack depth: 20160 bytes left OK syzkaller Warning: Permanently added '10.128.10.9' (ECDSA) to the list of known hosts. execve("./syz-executor976328297", ["./syz-executor976328297"], 0x7ffca93f4cc0 /* 10 vars */) = 0 brk(NULL) = 0x555555fcd000 brk(0x555555fcdd00) = 0x555555fcdd00 arch_prctl(ARCH_SET_FS, 0x555555fcd3c0) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor976328297", 4096) = 27 brk(0x555555feed00) = 0x555555feed00 brk(0x555555fef000) = 0x555555fef000 mprotect(0x7f4b17b7f000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f4b17aae130, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4b17ab0c90}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f4b17aae130, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4b17ab0c90}, NULL, 8) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555fcd690) = 4999 ./strace-static-x86_64: Process 4999 attached [pid 4999] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4999] setpgid(0, 0) = 0 [pid 4999] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 4999] write(3, "1000", 4) = 4 [pid 4999] close(3) = 0 [pid 4999] memfd_create("syzkaller", 0) = 3 [pid 4999] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4b0f6a4000 [pid 4999] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 4999] munmap(0x7f4b0f6a4000, 262144) = 0 [pid 4999] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 4999] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 4999] close(3) = 0 [pid 4999] mkdir("./file1", 0777) = 0 syzkaller login: [ 73.622734][ T4999] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4999 'syz-executor976' [ 73.647405][ T4999] loop0: detected capacity change from 0 to 512 [pid 4999] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "errors=remount-ro,sysvgroups,dioread_lock,grpquota,noauto_da_alloc,resgid=0x0000000000000000,barrier"...) = 0 [pid 4999] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 4999] chdir("./file1") = 0 [pid 4999] ioctl(4, LOOP_CLR_FD) = 0 [ 73.674355][ T4999] EXT4-fs (loop0): 1 orphan inode deleted [ 73.680789][ T4999] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 73.693844][ T4999] ext4 filesystem being mounted at /root/file1 supports timestamps until 2038-01-19 (0x7fffffff) [pid 4999] close(4) = 0 [pid 4999] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 4999] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1< [ 73.812597][ T4999] dump_stack_lvl+0x1e7/0x2d0 [ 73.817308][ T4999] ? nf_tcp_handle_invalid+0x650/0x650 [ 73.823557][ T4999] ? panic+0x770/0x770 [ 73.827640][ T4999] ? _printk+0xd5/0x120 [ 73.831818][ T4999] print_report+0x163/0x540 [ 73.836334][ T4999] ? __virt_addr_valid+0x22f/0x2e0 [ 73.841492][ T4999] ? __phys_addr+0xba/0x170 [ 73.846010][ T4999] ? ext4_find_extent+0xbc8/0xde0 [ 73.851058][ T4999] kasan_report+0x176/0x1b0 [ 73.855606][ T4999] ? ext4_find_extent+0xbc8/0xde0 [ 73.860745][ T4999] ext4_find_extent+0xbc8/0xde0 [ 73.865614][ T4999] ext4_ext_map_blocks+0x2d1/0x7210 [ 73.870824][ T4999] ? mark_lock+0x9a/0x340 [ 73.875191][ T4999] ? ext4_ext_release+0x10/0x10 [ 73.880327][ T4999] ? __down_write_common+0x161/0x200 [ 73.885624][ T4999] ? ext4_es_lookup_extent+0x629/0xa60 [ 73.891267][ T4999] ext4_map_blocks+0xa4c/0x1cf0 [ 73.896936][ T4999] ? ext4_issue_zeroout+0x260/0x260 [ 73.902162][ T4999] _ext4_get_block+0x238/0x6a0 [ 73.907208][ T4999] ? __lock_acquire+0x2070/0x2070 [ 73.912547][ T4999] ? ext4_get_block+0x40/0x40 [ 73.917268][ T4999] ? do_raw_spin_unlock+0x13b/0x8b0 [ 73.922567][ T4999] ? _raw_spin_unlock+0x28/0x40 [ 73.927514][ T4999] ? folio_create_buffers+0x132/0x250 [ 73.932900][ T4999] __block_write_begin_int+0x548/0x1a50 [ 73.938582][ T4999] ? ext4_es_is_delayed+0x40/0x40 [ 73.943638][ T4999] ? PageUptodate+0x290/0x290 [ 73.948339][ T4999] ? ext4_journal_check_start+0x179/0x240 [ 73.954176][ T4999] block_page_mkwrite+0x2fc/0x620 [ 73.959259][ T4999] ? ext4_es_is_delayed+0x40/0x40 [ 73.964313][ T4999] ext4_page_mkwrite+0x4ff/0x1290 [ 73.969533][ T4999] ? ext4_es_is_delayed+0x40/0x40 [ 73.974757][ T4999] ? ext4_change_inode_journal_flag+0x8d0/0x8d0 [ 73.981116][ T4999] do_page_mkwrite+0x1a4/0x600 [ 73.985985][ T4999] do_wp_page+0x501/0x3690 [ 73.990417][ T4999] ? folio_lock_or_retry+0x1c0/0x1c0 [ 73.995806][ T4999] ? do_raw_spin_lock+0x14d/0x3a0 [ 74.000854][ T4999] ? __rwlock_init+0x150/0x150 [ 74.005645][ T4999] handle_mm_fault+0x2371/0x5860 [ 74.010604][ T4999] ? numa_migrate_prep+0x380/0x380 [ 74.015758][ T4999] ? mtree_destroy+0x30/0x30 [ 74.020366][ T4999] ? exc_page_fault+0x110/0x910 [ 74.025258][ T4999] exc_page_fault+0x7d2/0x910 [ 74.029949][ T4999] asm_exc_page_fault+0x26/0x30 [ 74.034808][ T4999] RIP: 0033:0x7f4b17ab09d5 [ 74.039229][ T4999] Code: 73 00 e9 06 f8 ff ff 66 c7 04 25 00 01 00 20 2e 00 e9 28 f8 ff ff b8 00 36 00 20 48 8d 35 0b 4e 0a 00 b9 25 00 00 00 48 89 c7 48 a5 0f b6 06 88 07 e9 38 f8 ff ff 50 b9 00 36 00 20 ba ac 04 [ 74.059036][ T4999] RSP: 002b:00007ffcb22cf580 EFLAGS: 00010246 [ 74.065117][ T4999] RAX: 0000000020003600 RBX: 00007ffcb22cf5b8 RCX: 0000000000000025 [ 74.073184][ T4999] RDX: 40854a4c23aebd1f RSI: 00007f4b17b557d8 RDI: 0000000020003600 [ 74.081256][ T4999] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 74.090021][ T4999] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcb22cf5b0 [ 74.098082][ T4999] R13: 0000000000000000 R14: 431bde82d7b634db R15: 0000000000000000 [ 74.106069][ T4999] [ 74.109093][ T4999] [ 74.111503][ T4999] The buggy address belongs to the physical page: [ 74.117912][ T4999] page:ffffea0001cf2a80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73caa [ 74.128327][ T4999] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 74.135523][ T4999] page_type: 0xffffffff() [ 74.139854][ T4999] raw: 00fff00000000000 ffffea0001cf2ac8 ffffea0001cf2a48 0000000000000000 [ 74.148625][ T4999] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 74.157214][ T4999] page dumped because: kasan: bad access detected [ 74.163706][ T4999] page_owner tracks the page as freed [ 74.169196][ T4999] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 4990, tgid 4990 (sshd), ts 67865553810, free_ts 68052578311 [ 74.187651][ T4999] post_alloc_hook+0x1e6/0x210 [ 74.192510][ T4999] get_page_from_freelist+0x321c/0x33a0 [ 74.198411][ T4999] __alloc_pages+0x255/0x670 [ 74.203105][ T4999] __folio_alloc+0x13/0x30 [ 74.207577][ T4999] vma_alloc_folio+0x48a/0x9a0 [ 74.212349][ T4999] handle_mm_fault+0x2942/0x5860 [ 74.219382][ T4999] exc_page_fault+0x274/0x910 [ 74.224090][ T4999] asm_exc_page_fault+0x26/0x30 [ 74.228950][ T4999] page last free stack trace: [ 74.233624][ T4999] free_unref_page_prepare+0x903/0xa30 [ 74.239175][ T4999] free_unref_page_list+0x596/0x830 [ 74.244379][ T4999] release_pages+0x2193/0x2470 [ 74.249156][ T4999] tlb_flush_mmu+0x100/0x210 [ 74.253759][ T4999] tlb_finish_mmu+0xd4/0x1f0 [ 74.258369][ T4999] exit_mmap+0x3da/0xaf0 [ 74.262625][ T4999] __mmput+0x115/0x3c0 [ 74.266788][ T4999] exit_mm+0x227/0x310 [ 74.270878][ T4999] do_exit+0x612/0x2290 [ 74.275049][ T4999] do_group_exit+0x206/0x2c0 [ 74.279644][ T4999] __x64_sys_exit_group+0x3f/0x40 [ 74.284671][ T4999] do_syscall_64+0x41/0xc0 [ 74.289092][ T4999] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 74.294999][ T4999] [ 74.297418][ T4999] Memory state around the buggy address: [ 74.303047][ T4999] ffff888073caa700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.311110][ T4999] ffff888073caa780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.319173][ T4999] >ffff888073caa800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.327236][ T4999] ^ [ 74.333127][ T4999] ffff888073caa880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.341188][ T4999] ffff888073caa900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 74.349249][ T4999] ================================================================== [ 74.361106][ T4999] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 74.368338][ T4999] CPU: 0 PID: 4999 Comm: syz-executor976 Not tainted 6.4.0-rc7-syzkaller-00194-g8a28a0b6f1a1 #0 [ 74.379016][ T4999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 74.389081][ T4999] Call Trace: [ 74.392423][ T4999] [ 74.395357][ T4999] dump_stack_lvl+0x1e7/0x2d0 [ 74.400132][ T4999] ? nf_tcp_handle_invalid+0x650/0x650 [ 74.405696][ T4999] ? panic+0x770/0x770 [ 74.409792][ T4999] ? vscnprintf+0x5d/0x80 [ 74.414142][ T4999] panic+0x30f/0x770 [ 74.418151][ T4999] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 74.424323][ T4999] ? check_panic_on_warn+0x21/0xa0 [ 74.429457][ T4999] ? __memcpy_flushcache+0x2b0/0x2b0 [ 74.434770][ T4999] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 74.440781][ T4999] ? _raw_spin_unlock+0x40/0x40 [ 74.445643][ T4999] check_panic_on_warn+0x82/0xa0 [ 74.450685][ T4999] ? ext4_find_extent+0xbc8/0xde0 [ 74.455717][ T4999] end_report+0x63/0x110 [ 74.460149][ T4999] kasan_report+0x183/0x1b0 [ 74.464757][ T4999] ? ext4_find_extent+0xbc8/0xde0 [ 74.469809][ T4999] ext4_find_extent+0xbc8/0xde0 [ 74.474688][ T4999] ext4_ext_map_blocks+0x2d1/0x7210 [ 74.479911][ T4999] ? mark_lock+0x9a/0x340 [ 74.484266][ T4999] ? ext4_ext_release+0x10/0x10 [ 74.489314][ T4999] ? __down_write_common+0x161/0x200 [ 74.494641][ T4999] ? ext4_es_lookup_extent+0x629/0xa60 [ 74.500610][ T4999] ext4_map_blocks+0xa4c/0x1cf0 [ 74.505480][ T4999] ? ext4_issue_zeroout+0x260/0x260 [ 74.510708][ T4999] _ext4_get_block+0x238/0x6a0 [ 74.515493][ T4999] ? __lock_acquire+0x2070/0x2070 [ 74.520555][ T4999] ? ext4_get_block+0x40/0x40 [ 74.525357][ T4999] ? do_raw_spin_unlock+0x13b/0x8b0 [ 74.530587][ T4999] ? _raw_spin_unlock+0x28/0x40 [ 74.535454][ T4999] ? folio_create_buffers+0x132/0x250 [ 74.540851][ T4999] __block_write_begin_int+0x548/0x1a50 [ 74.547119][ T4999] ? ext4_es_is_delayed+0x40/0x40 [ 74.552233][ T4999] ? PageUptodate+0x290/0x290 [ 74.556936][ T4999] ? ext4_journal_check_start+0x179/0x240 [ 74.562698][ T4999] block_page_mkwrite+0x2fc/0x620 [ 74.567747][ T4999] ? ext4_es_is_delayed+0x40/0x40 [ 74.572818][ T4999] ext4_page_mkwrite+0x4ff/0x1290 [ 74.578160][ T4999] ? ext4_es_is_delayed+0x40/0x40 [ 74.583198][ T4999] ? ext4_change_inode_journal_flag+0x8d0/0x8d0 [ 74.589466][ T4999] do_page_mkwrite+0x1a4/0x600 [ 74.594250][ T4999] do_wp_page+0x501/0x3690 [ 74.599632][ T4999] ? folio_lock_or_retry+0x1c0/0x1c0 [ 74.604946][ T4999] ? do_raw_spin_lock+0x14d/0x3a0 [ 74.610505][ T4999] ? __rwlock_init+0x150/0x150 [ 74.615287][ T4999] handle_mm_fault+0x2371/0x5860 [ 74.620332][ T4999] ? numa_migrate_prep+0x380/0x380 [ 74.625803][ T4999] ? mtree_destroy+0x30/0x30 [ 74.630415][ T4999] ? exc_page_fault+0x110/0x910 [ 74.635301][ T4999] exc_page_fault+0x7d2/0x910 [ 74.639988][ T4999] asm_exc_page_fault+0x26/0x30 [ 74.644859][ T4999] RIP: 0033:0x7f4b17ab09d5 [ 74.649294][ T4999] Code: 73 00 e9 06 f8 ff ff 66 c7 04 25 00 01 00 20 2e 00 e9 28 f8 ff ff b8 00 36 00 20 48 8d 35 0b 4e 0a 00 b9 25 00 00 00 48 89 c7 48 a5 0f b6 06 88 07 e9 38 f8 ff ff 50 b9 00 36 00 20 ba ac 04 [ 74.669165][ T4999] RSP: 002b:00007ffcb22cf580 EFLAGS: 00010246 [ 74.675242][ T4999] RAX: 0000000020003600 RBX: 00007ffcb22cf5b8 RCX: 0000000000000025 [ 74.683441][ T4999] RDX: 40854a4c23aebd1f RSI: 00007f4b17b557d8 RDI: 0000000020003600 [ 74.691515][ T4999] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 74.699503][ T4999] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcb22cf5b0 [ 74.707501][ T4999] R13: 0000000000000000 R14: 431bde82d7b634db R15: 0000000000000000 [ 74.715594][ T4999] [ 74.718900][ T4999] Kernel Offset: disabled [ 74.723343][ T4999] Rebooting in 86400 seconds..