./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor922722467
<...>
DUID 00:04:f8:32:f0:25:6b:f7:7b:d6:d2:5e:34:7f:1d:07:e3:4e
forked to background, child pid 4659
[ 30.109578][ T4660] 8021q: adding VLAN 0 to HW filter on device bond0
[ 30.121477][ T4660] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.207' (ECDSA) to the list of known hosts.
execve("./syz-executor922722467", ["./syz-executor922722467"], 0x7ffcc2a39a20 /* 10 vars */) = 0
brk(NULL) = 0x5555563e0000
brk(0x5555563e0c40) = 0x5555563e0c40
arch_prctl(ARCH_SET_FS, 0x5555563e0300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor922722467", 4096) = 27
brk(0x555556401c40) = 0x555556401c40
brk(0x555556402000) = 0x555556402000
mprotect(0x7f1549887000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 4991
mkdir("./syzkaller.narbmA", 0700) = 0
chmod("./syzkaller.narbmA", 0777) = 0
chdir("./syzkaller.narbmA") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555563e05d0) = 4992
./strace-static-x86_64: Process 4992 attached
[pid 4992] chdir("./0") = 0
[pid 4992] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4992] setpgid(0, 0) = 0
[pid 4992] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4992] write(3, "1000", 4) = 4
[pid 4992] close(3) = 0
[pid 4992] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4992] memfd_create("syzkaller", 0) = 3
[pid 4992] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f15413ab000
[pid 4992] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 4992] munmap(0x7f15413ab000, 1048576) = 0
[pid 4992] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4992] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4992] close(3) = 0
[pid 4992] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0777) = 0
syzkaller login: [ 54.231036][ T4992] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4992 'syz-executor922'
[ 54.260487][ T4992] loop0: detected capacity change from 0 to 2048
[pid 4992] mount("/dev/loop0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "udf", MS_NODIRATIME, "") = 0
[pid 4992] openat(AT_FDCWD, "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY|O_DIRECTORY) = 3
[pid 4992] chdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0
[pid 4992] ioctl(4, LOOP_CLR_FD) = 0
[pid 4992] close(4) = 0
[pid 4992] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = 4
[pid 4992] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 4992] memfd_create("syzkaller", 0) = 5
[pid 4992] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f15390ab000
[ 54.275209][ T4992] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 4992] write(5, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 4992] munmap(0x7f15390ab000, 2097152) = 0
[pid 4992] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6
[pid 4992] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 4992] ioctl(6, LOOP_CLR_FD) = 0
[pid 4992] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 4992] close(6) = 0
[pid 4992] close(5) = 0
[pid 4992] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5
[pid 4992] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 1048576
[pid 4992] exit_group(0) = ?
[pid 4992] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4992, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=12 /* 0.12 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555563e1620 /* 4 entries */, 32768) = 352
[ 54.508689][ T4991] ==================================================================
[ 54.516895][ T4991] BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2a0
[ 54.523683][ T4991] Read of size 1 at addr ffff8880743a3000 by task syz-executor922/4991
[ 54.531905][ T4991]
[ 54.534212][ T4991] CPU: 0 PID: 4991 Comm: syz-executor922 Not tainted 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0
[ 54.544604][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
[ 54.554639][ T4991] Call Trace:
[ 54.557903][ T4991]
[ 54.560817][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 54.565487][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 54.570934][ T4991] ? panic+0x770/0x770
[ 54.574980][ T4991] ? _printk+0xd5/0x120
[ 54.579118][ T4991] print_report+0x163/0x540
[ 54.583601][ T4991] ? ktime_get_real_ts64+0x460/0x460
[ 54.588871][ T4991] ? time64_to_tm+0x331/0x4d0
[ 54.593527][ T4991] ? __virt_addr_valid+0x22f/0x2e0
[ 54.598623][ T4991] ? __phys_addr+0xba/0x170
[ 54.603125][ T4991] ? crc_itu_t+0x1d5/0x2a0
[ 54.607549][ T4991] kasan_report+0x176/0x1b0
[ 54.612054][ T4991] ? crc_itu_t+0x1d5/0x2a0
[ 54.616462][ T4991] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 54.622726][ T4991] crc_itu_t+0x1d5/0x2a0
[ 54.626953][ T4991] udf_sync_fs+0x1d2/0x380
[ 54.631360][ T4991] ? udf_put_super+0x160/0x160
[ 54.636106][ T4991] sync_filesystem+0xec/0x220
[ 54.640784][ T4991] generic_shutdown_super+0x6f/0x340
[ 54.646413][ T4991] kill_block_super+0x84/0xf0
[ 54.651080][ T4991] deactivate_locked_super+0xa4/0x110
[ 54.656438][ T4991] cleanup_mnt+0x426/0x4c0
[ 54.660947][ T4991] ? _raw_spin_unlock_irq+0x23/0x50
[ 54.666150][ T4991] task_work_run+0x24a/0x300
[ 54.670828][ T4991] ? dput+0x3a1/0x420
[ 54.674841][ T4991] ? task_work_cancel+0x2b0/0x2b0
[ 54.679855][ T4991] ? __x64_sys_umount+0x126/0x170
[ 54.684958][ T4991] ptrace_notify+0x2cd/0x380
[ 54.689534][ T4991] ? do_notify_parent+0xf50/0xf50
[ 54.694582][ T4991] ? user_path_at_empty+0x12f/0x180
[ 54.699800][ T4991] ? __x64_sys_umount+0x126/0x170
[ 54.706121][ T4991] ? path_umount+0xea0/0xea0
[ 54.710704][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 54.716760][ T4991] syscall_exit_to_user_mode+0x157/0x280
[ 54.722379][ T4991] do_syscall_64+0x4d/0xc0
[ 54.726780][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.732656][ T4991] RIP: 0033:0x7f15497fa077
[ 54.737062][ T4991] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.756747][ T4991] RSP: 002b:00007ffd38bbc1e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 54.765235][ T4991] RAX: 0000000000000000 RBX: 000000000000d3ab RCX: 00007f15497fa077
[ 54.773286][ T4991] RDX: 00007ffd38bbc39c RSI: 000000000000000a RDI: 00007ffd38bbc2a0
[ 54.781328][ T4991] RBP: 00007ffd38bbc2a0 R08: 000000000000000c R09: 00007ffd38bbc080
[ 54.789283][ T4991] R10: 00005555563e1633 R11: 0000000000000206 R12: 00007ffd38bbd310
[ 54.797322][ T4991] R13: 00005555563e15f0 R14: 00007ffd38bbc210 R15: 0000000000000001
[ 54.805467][ T4991]
[ 54.808473][ T4991]
[ 54.810779][ T4991] The buggy address belongs to the physical page:
[ 54.817169][ T4991] page:ffffea0001d0e8c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x743a3
[ 54.827300][ T4991] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 54.834385][ T4991] page_type: 0xffffffff()
[ 54.838703][ T4991] raw: 00fff00000000000 ffffea0001d0e908 ffffea0001ffb9c8 0000000000000000
[ 54.847355][ T4991] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 54.856086][ T4991] page dumped because: kasan: bad access detected
[ 54.862565][ T4991] page_owner tracks the page as freed
[ 54.867910][ T4991] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 4954, tgid 4954 (sshd), ts 47175862591, free_ts 47253283703
[ 54.885943][ T4991] post_alloc_hook+0x1e6/0x210
[ 54.890693][ T4991] get_page_from_freelist+0x321c/0x33a0
[ 54.896221][ T4991] __alloc_pages+0x255/0x670
[ 54.900902][ T4991] __folio_alloc+0x13/0x30
[ 54.905296][ T4991] vma_alloc_folio+0x48a/0x9a0
[ 54.910056][ T4991] handle_mm_fault+0x2942/0x5860
[ 54.914991][ T4991] exc_page_fault+0x274/0x910
[ 54.919652][ T4991] asm_exc_page_fault+0x26/0x30
[ 54.924487][ T4991] page last free stack trace:
[ 54.929141][ T4991] free_unref_page_prepare+0x903/0xa30
[ 54.934670][ T4991] free_unref_page_list+0x596/0x830
[ 54.939935][ T4991] release_pages+0x2193/0x2470
[ 54.944787][ T4991] tlb_flush_mmu+0x100/0x210
[ 54.949410][ T4991] tlb_finish_mmu+0xd4/0x1f0
[ 54.953978][ T4991] unmap_region+0x258/0x2a0
[ 54.958471][ T4991] do_vmi_align_munmap+0x1123/0x1820
[ 54.963749][ T4991] do_vmi_munmap+0x24a/0x2b0
[ 54.968333][ T4991] __vm_munmap+0x226/0x470
[ 54.972857][ T4991] __x64_sys_munmap+0x69/0x80
[ 54.977717][ T4991] do_syscall_64+0x41/0xc0
[ 54.982316][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.988196][ T4991]
[ 54.990512][ T4991] Memory state around the buggy address:
[ 54.996120][ T4991] ffff8880743a2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 55.004178][ T4991] ffff8880743a2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 55.012241][ T4991] >ffff8880743a3000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 55.020289][ T4991] ^
[ 55.024353][ T4991] ffff8880743a3080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 55.032395][ T4991] ffff8880743a3100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 55.040430][ T4991] ==================================================================
[ 55.049175][ T4991] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 55.056378][ T4991] CPU: 0 PID: 4991 Comm: syz-executor922 Not tainted 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0
[ 55.066770][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
[ 55.076805][ T4991] Call Trace:
[ 55.080072][ T4991]
[ 55.082983][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 55.087650][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 55.093177][ T4991] ? panic+0x770/0x770
[ 55.097229][ T4991] ? preempt_schedule_common+0x83/0xc0
[ 55.102937][ T4991] ? vscnprintf+0x5d/0x80
[ 55.107248][ T4991] panic+0x30f/0x770
[ 55.111296][ T4991] ? check_panic_on_warn+0x21/0xa0
[ 55.116387][ T4991] ? __memcpy_flushcache+0x2b0/0x2b0
[ 55.121652][ T4991] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 55.127611][ T4991] ? _raw_spin_unlock+0x40/0x40
[ 55.132441][ T4991] check_panic_on_warn+0x82/0xa0
[ 55.137360][ T4991] ? crc_itu_t+0x1d5/0x2a0
[ 55.141756][ T4991] end_report+0x63/0x110
[ 55.145977][ T4991] kasan_report+0x183/0x1b0
[ 55.150479][ T4991] ? crc_itu_t+0x1d5/0x2a0
[ 55.154882][ T4991] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 55.161106][ T4991] crc_itu_t+0x1d5/0x2a0
[ 55.165331][ T4991] udf_sync_fs+0x1d2/0x380
[ 55.169745][ T4991] ? udf_put_super+0x160/0x160
[ 55.174492][ T4991] sync_filesystem+0xec/0x220
[ 55.179161][ T4991] generic_shutdown_super+0x6f/0x340
[ 55.184425][ T4991] kill_block_super+0x84/0xf0
[ 55.189085][ T4991] deactivate_locked_super+0xa4/0x110
[ 55.194444][ T4991] cleanup_mnt+0x426/0x4c0
[ 55.199012][ T4991] ? _raw_spin_unlock_irq+0x23/0x50
[ 55.204190][ T4991] task_work_run+0x24a/0x300
[ 55.208759][ T4991] ? dput+0x3a1/0x420
[ 55.212721][ T4991] ? task_work_cancel+0x2b0/0x2b0
[ 55.217725][ T4991] ? __x64_sys_umount+0x126/0x170
[ 55.222726][ T4991] ptrace_notify+0x2cd/0x380
[ 55.227295][ T4991] ? do_notify_parent+0xf50/0xf50
[ 55.232295][ T4991] ? user_path_at_empty+0x12f/0x180
[ 55.237473][ T4991] ? __x64_sys_umount+0x126/0x170
[ 55.242474][ T4991] ? path_umount+0xea0/0xea0
[ 55.247127][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 55.253085][ T4991] syscall_exit_to_user_mode+0x157/0x280
[ 55.258696][ T4991] do_syscall_64+0x4d/0xc0
[ 55.263099][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.268971][ T4991] RIP: 0033:0x7f15497fa077
[ 55.273372][ T4991] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.293484][ T4991] RSP: 002b:00007ffd38bbc1e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 55.301879][ T4991] RAX: 0000000000000000 RBX: 000000000000d3ab RCX: 00007f15497fa077
[ 55.309837][ T4991] RDX: 00007ffd38bbc39c RSI: 000000000000000a RDI: 00007ffd38bbc2a0
[ 55.317875][ T4991] RBP: 00007ffd38bbc2a0 R08: 000000000000000c R09: 00007ffd38bbc080
[ 55.325908][ T4991] R10: 00005555563e1633 R11: 0000000000000206 R12: 00007ffd38bbd310
[ 55.333876][ T4991] R13: 00005555563e15f0 R14: 00007ffd38bbc210 R15: 0000000000000001
[ 55.341844][ T4991]
[ 55.345023][ T4991] Kernel Offset: disabled
[ 55.349353][ T4991] Rebooting in 86400 seconds..