./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2901721098
<...>
Warning: Permanently added '10.128.10.34' (ED25519) to the list of known hosts.
execve("./syz-executor2901721098", ["./syz-executor2901721098"], 0x7ffca58b6b70 /* 10 vars */) = 0
brk(NULL) = 0x55556ca62000
brk(0x55556ca62d00) = 0x55556ca62d00
arch_prctl(ARCH_SET_FS, 0x55556ca62380) = 0
set_tid_address(0x55556ca62650) = 5817
set_robust_list(0x55556ca62660, 24) = 0
rseq(0x55556ca62ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2901721098", 4096) = 28
getrandom("\xfa\xd5\xbe\x57\x30\xe8\x54\x18", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55556ca62d00
brk(0x55556ca83d00) = 0x55556ca83d00
brk(0x55556ca84000) = 0x55556ca84000
mprotect(0x7fd17914e000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5819 attached
, child_tidptr=0x55556ca62650) = 5819
[pid 5819] set_robust_list(0x55556ca62660, 24) = 0
[pid 5819] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5819] setpgid(0, 0) = 0
[pid 5819] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5819] write(3, "1000", 4) = 4
[pid 5819] close(3) = 0
[pid 5819] write(1, "executing program\n", 18executing program
) = 18
[pid 5819] memfd_create("syzkaller", 0) = 3
[pid 5819] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd170c00000
[pid 5819] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 67108864) = 67108864
[pid 5819] munmap(0x7fd170c00000, 138412032) = 0
[pid 5819] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5819] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5819] close(3) = 0
[pid 5819] close(4) = 0
[pid 5819] mkdir("./file1", 0777) = 0
[ 70.017716][ T5819] loop0: detected capacity change from 0 to 131072
[ 70.057218][ T5819] F2FS-fs (loop0): inline encryption not supported
[ 70.064583][ T5819] F2FS-fs (loop0): heap/no_heap options were deprecated
[ 70.072544][ T5819] F2FS-fs (loop0): QUOTA feature is enabled, so ignore jquota_fmt
[ 70.088749][ T5819] F2FS-fs (loop0): invalid crc value
[ 70.100982][ T5819] F2FS-fs (loop0): Found nat_bits in checkpoint
[pid 5819] mount("/dev/loop0", "./file1", "f2fs", 0, "inlinecrypt,discard_unit=section,jqfmt=vfsold,heap,acl,nouser_xattr,background_gc=off,nouser_xattr,b"...) = 0
[pid 5819] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid 5819] chdir("./file1") = 0
[pid 5819] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 70.129442][ T5819] F2FS-fs (loop0): Mounted with checkpoint version = 1b41e954
[ 70.142952][ T5819] ==================================================================
[ 70.151037][ T5819] BUG: KASAN: slab-out-of-bounds in f2fs_getxattr+0x1334/0x13b0
[ 70.158887][ T5819] Read of size 4 at addr ffff88802f565078 by task syz-executor290/5819
[ 70.167303][ T5819]
[ 70.169661][ T5819] CPU: 0 UID: 0 PID: 5819 Comm: syz-executor290 Not tainted 6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0
[ 70.180860][ T5819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 70.190919][ T5819] Call Trace:
[ 70.194186][ T5819]
[ 70.197122][ T5819] dump_stack_lvl+0x241/0x360
[ 70.201830][ T5819] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.207055][ T5819] ? __pfx__printk+0x10/0x10
[ 70.211678][ T5819] ? _printk+0xd5/0x120
[ 70.215852][ T5819] ? __virt_addr_valid+0x183/0x530
[ 70.220987][ T5819] ? __virt_addr_valid+0x183/0x530
[ 70.226103][ T5819] print_report+0x169/0x550
[ 70.230664][ T5819] ? __virt_addr_valid+0x183/0x530
[ 70.235791][ T5819] ? __virt_addr_valid+0x183/0x530
[ 70.240925][ T5819] ? __virt_addr_valid+0x45f/0x530
[ 70.246044][ T5819] ? __phys_addr+0xba/0x170
[ 70.250563][ T5819] ? f2fs_getxattr+0x1334/0x13b0
[ 70.255595][ T5819] kasan_report+0x143/0x180
[ 70.260107][ T5819] ? f2fs_getxattr+0x1334/0x13b0
[ 70.265037][ T5819] f2fs_getxattr+0x1334/0x13b0
[ 70.269922][ T5819] ? f2fs_xattr_generic_get+0x76/0x190
[ 70.275397][ T5819] ? __pfx_f2fs_xattr_generic_get+0x10/0x10
[ 70.281289][ T5819] __vfs_getxattr+0x433/0x470
[ 70.285972][ T5819] smk_fetch+0xb1/0x140
[ 70.290124][ T5819] smack_d_instantiate+0x749/0xa50
[ 70.295320][ T5819] ? __pfx_smack_d_instantiate+0x10/0x10
[ 70.300949][ T5819] security_d_instantiate+0x107/0x1f0
[ 70.306317][ T5819] d_splice_alias+0x6f/0x330
[ 70.311033][ T5819] f2fs_lookup+0x4ff/0x820
[ 70.315466][ T5819] ? __pfx_f2fs_lookup+0x10/0x10
[ 70.321127][ T5819] ? generic_permission+0x2db/0x680
[ 70.326380][ T5819] ? bpf_lsm_inode_create+0x9/0x10
[ 70.331569][ T5819] ? security_inode_create+0xbe/0x340
[ 70.336950][ T5819] ? __pfx_f2fs_lookup+0x10/0x10
[ 70.341906][ T5819] path_openat+0x11a7/0x3590
[ 70.346515][ T5819] ? __pfx_path_openat+0x10/0x10
[ 70.351538][ T5819] do_filp_open+0x27f/0x4e0
[ 70.356381][ T5819] ? __pfx_do_filp_open+0x10/0x10
[ 70.361393][ T5819] ? do_raw_spin_lock+0x14f/0x370
[ 70.366418][ T5819] do_sys_openat2+0x13e/0x1d0
[ 70.371085][ T5819] ? __pfx_do_sys_openat2+0x10/0x10
[ 70.376279][ T5819] ? lockdep_hardirqs_on+0x99/0x150
[ 70.381498][ T5819] ? _raw_spin_unlock_irq+0x2e/0x50
[ 70.386866][ T5819] ? ptrace_notify+0x279/0x380
[ 70.391624][ T5819] __x64_sys_openat+0x247/0x2a0
[ 70.396469][ T5819] ? __pfx___x64_sys_openat+0x10/0x10
[ 70.401841][ T5819] ? do_syscall_64+0x100/0x230
[ 70.406600][ T5819] do_syscall_64+0xf3/0x230
[ 70.411097][ T5819] ? clear_bhb_loop+0x35/0x90
[ 70.415764][ T5819] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.421932][ T5819] RIP: 0033:0x7fd1790cab99
[ 70.426517][ T5819] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 70.446129][ T5819] RSP: 002b:00007ffe10d93778 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 70.454564][ T5819] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007fd1790cab99
[ 70.462537][ T5819] RDX: 0000000000101042 RSI: 0000000020000040 RDI: 00000000ffffff9c
[ 70.470511][ T5819] RBP: 00007fd17914e5f0 R08: 00000000000105b6 R09: 000055556ca634c0
[ 70.478606][ T5819] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe10d937a0
[ 70.486761][ T5819] R13: 00007ffe10d939c8 R14: 431bde82d7b634db R15: 00007fd17911303b
[ 70.494818][ T5819]
[ 70.497847][ T5819]
[ 70.500169][ T5819] Allocated by task 5819:
[ 70.504513][ T5819] kasan_save_track+0x3f/0x80
[ 70.509207][ T5819] __kasan_kmalloc+0x98/0xb0
[ 70.513988][ T5819] __kmalloc_noprof+0x285/0x4c0
[ 70.519021][ T5819] f2fs_getxattr+0x10f7/0x13b0
[ 70.523794][ T5819] __vfs_getxattr+0x433/0x470
[ 70.528465][ T5819] smk_fetch+0xb1/0x140
[ 70.532643][ T5819] smack_d_instantiate+0x749/0xa50
[ 70.537845][ T5819] security_d_instantiate+0x107/0x1f0
[ 70.543212][ T5819] d_splice_alias+0x6f/0x330
[ 70.547910][ T5819] f2fs_lookup+0x4ff/0x820
[ 70.552358][ T5819] path_openat+0x11a7/0x3590
[ 70.557136][ T5819] do_filp_open+0x27f/0x4e0
[ 70.561667][ T5819] do_sys_openat2+0x13e/0x1d0
[ 70.566383][ T5819] __x64_sys_openat+0x247/0x2a0
[ 70.571236][ T5819] do_syscall_64+0xf3/0x230
[ 70.575763][ T5819] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.581751][ T5819]
[ 70.584067][ T5819] The buggy address belongs to the object at ffff88802f565060
[ 70.584067][ T5819] which belongs to the cache kmalloc-16 of size 16
[ 70.598026][ T5819] The buggy address is located 12 bytes to the right of
[ 70.598026][ T5819] allocated 12-byte region [ffff88802f565060, ffff88802f56506c)
[ 70.612527][ T5819]
[ 70.614841][ T5819] The buggy address belongs to the physical page:
[ 70.621245][ T5819] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f565
[ 70.630046][ T5819] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 70.637149][ T5819] page_type: f5(slab)
[ 70.641401][ T5819] raw: 00fff00000000000 ffff88801ac41640 dead000000000100 dead000000000122
[ 70.650003][ T5819] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000
[ 70.658660][ T5819] page dumped because: kasan: bad access detected
[ 70.665111][ T5819] page_owner tracks the page as allocated
[ 70.671103][ T5819] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 15278427856, free_ts 15123069831
[ 70.689884][ T5819] post_alloc_hook+0x1f3/0x230
[ 70.694769][ T5819] get_page_from_freelist+0x3651/0x37a0
[ 70.700526][ T5819] __alloc_pages_noprof+0x292/0x710
[ 70.705926][ T5819] alloc_pages_mpol_noprof+0x3e8/0x680
[ 70.711711][ T5819] alloc_slab_page+0x6a/0x110
[ 70.716420][ T5819] allocate_slab+0x5a/0x2b0
[ 70.721146][ T5819] ___slab_alloc+0xc27/0x14a0
[ 70.726016][ T5819] __slab_alloc+0x58/0xa0
[ 70.730352][ T5819] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0
[ 70.736852][ T5819] kstrdup+0x39/0xb0
[ 70.740828][ T5819] snd_info_create_entry+0x78/0x350
[ 70.746038][ T5819] snd_pcm_new_stream+0xc87/0x1240
[ 70.751242][ T5819] _snd_pcm_new+0x1d1/0x410
[ 70.755743][ T5819] snd_pcm_new+0x3e/0x60
[ 70.760012][ T5819] snd_dummy_probe+0x5f2/0x18a0
[ 70.764938][ T5819] platform_probe+0x13a/0x1c0
[ 70.769739][ T5819] page last free pid 973 tgid 973 stack trace:
[ 70.775887][ T5819] free_unref_page+0xd2c/0x1000
[ 70.780740][ T5819] vfree+0x1c3/0x360
[ 70.784624][ T5819] delayed_vfree_work+0x56/0x80
[ 70.789478][ T5819] process_scheduled_works+0xa66/0x1840
[ 70.795044][ T5819] worker_thread+0x870/0xd30
[ 70.799661][ T5819] kthread+0x2f0/0x390
[ 70.803811][ T5819] ret_from_fork+0x4b/0x80
[ 70.808301][ T5819] ret_from_fork_asm+0x1a/0x30
[ 70.813055][ T5819]
[ 70.815370][ T5819] Memory state around the buggy address:
[ 70.821093][ T5819] ffff88802f564f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 70.829350][ T5819] ffff88802f564f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 70.837404][ T5819] >ffff88802f565000: 00 07 fc fc fa fb fc fc fa fb fc fc 00 04 fc fc
[ 70.845453][ T5819] ^
[ 70.853423][ T5819] ffff88802f565080: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
[ 70.861558][ T5819] ffff88802f565100: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
[ 70.869603][ T5819] ==================================================================
[ 70.878135][ T5819] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 70.885452][ T5819] CPU: 1 UID: 0 PID: 5819 Comm: syz-executor290 Not tainted 6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0
[ 70.896676][ T5819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 70.907038][ T5819] Call Trace:
[ 70.910447][ T5819]
[ 70.913398][ T5819] dump_stack_lvl+0x241/0x360
[ 70.919177][ T5819] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.926779][ T5819] ? __pfx__printk+0x10/0x10
[ 70.931721][ T5819] ? preempt_schedule+0xe1/0xf0
[ 70.936603][ T5819] ? vscnprintf+0x5d/0x90
[ 70.940938][ T5819] panic+0x349/0x880
[ 70.944839][ T5819] ? check_panic_on_warn+0x21/0xb0
[ 70.949953][ T5819] ? __pfx_panic+0x10/0x10
[ 70.954365][ T5819] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 70.960391][ T5819] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 70.966712][ T5819] ? print_report+0x502/0x550
[ 70.971473][ T5819] check_panic_on_warn+0x86/0xb0
[ 70.976411][ T5819] ? f2fs_getxattr+0x1334/0x13b0
[ 70.981342][ T5819] end_report+0x77/0x160
[ 70.985576][ T5819] kasan_report+0x154/0x180
[ 70.990161][ T5819] ? f2fs_getxattr+0x1334/0x13b0
[ 70.995091][ T5819] f2fs_getxattr+0x1334/0x13b0
[ 70.999848][ T5819] ? f2fs_xattr_generic_get+0x76/0x190
[ 71.005300][ T5819] ? __pfx_f2fs_xattr_generic_get+0x10/0x10
[ 71.011279][ T5819] __vfs_getxattr+0x433/0x470
[ 71.015953][ T5819] smk_fetch+0xb1/0x140
[ 71.020104][ T5819] smack_d_instantiate+0x749/0xa50
[ 71.025209][ T5819] ? __pfx_smack_d_instantiate+0x10/0x10
[ 71.030842][ T5819] security_d_instantiate+0x107/0x1f0
[ 71.036230][ T5819] d_splice_alias+0x6f/0x330
[ 71.040924][ T5819] f2fs_lookup+0x4ff/0x820
[ 71.045345][ T5819] ? __pfx_f2fs_lookup+0x10/0x10
[ 71.050305][ T5819] ? generic_permission+0x2db/0x680
[ 71.055603][ T5819] ? bpf_lsm_inode_create+0x9/0x10
[ 71.060800][ T5819] ? security_inode_create+0xbe/0x340
[ 71.066198][ T5819] ? __pfx_f2fs_lookup+0x10/0x10
[ 71.071131][ T5819] path_openat+0x11a7/0x3590
[ 71.075739][ T5819] ? __pfx_path_openat+0x10/0x10
[ 71.080692][ T5819] do_filp_open+0x27f/0x4e0
[ 71.085206][ T5819] ? __pfx_do_filp_open+0x10/0x10
[ 71.090229][ T5819] ? do_raw_spin_lock+0x14f/0x370
[ 71.095260][ T5819] do_sys_openat2+0x13e/0x1d0
[ 71.100015][ T5819] ? __pfx_do_sys_openat2+0x10/0x10
[ 71.105212][ T5819] ? lockdep_hardirqs_on+0x99/0x150
[ 71.110406][ T5819] ? _raw_spin_unlock_irq+0x2e/0x50
[ 71.115609][ T5819] ? ptrace_notify+0x279/0x380
[ 71.120383][ T5819] __x64_sys_openat+0x247/0x2a0
[ 71.125259][ T5819] ? __pfx___x64_sys_openat+0x10/0x10
[ 71.130636][ T5819] ? do_syscall_64+0x100/0x230
[ 71.135405][ T5819] do_syscall_64+0xf3/0x230
[ 71.140079][ T5819] ? clear_bhb_loop+0x35/0x90
[ 71.144754][ T5819] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.150662][ T5819] RIP: 0033:0x7fd1790cab99
[ 71.155080][ T5819] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 71.174802][ T5819] RSP: 002b:00007ffe10d93778 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 71.183498][ T5819] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007fd1790cab99
[ 71.191582][ T5819] RDX: 0000000000101042 RSI: 0000000020000040 RDI: 00000000ffffff9c
[ 71.199553][ T5819] RBP: 00007fd17914e5f0 R08: 00000000000105b6 R09: 000055556ca634c0
[ 71.207560][ T5819] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe10d937a0
[ 71.215520][ T5819] R13: 00007ffe10d939c8 R14: 431bde82d7b634db R15: 00007fd17911303b
[ 71.223490][ T5819]
[ 71.226879][ T5819] Kernel Offset: disabled
[ 71.231194][ T5819] Rebooting in 86400 seconds..