program: syz_mount_image$hfs(&(0x7f0000000140), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000000)=ANY=[], 0x8b, 0x2b9, &(0x7f0000000700)="$eJzs3T9v00AYx/Hf2WmS0lIMLUJCDKhQwYTasiCWSqjiNbCAgCZIFVErSpGAhYgZ8QLYWXgBvAgmhMQMExMvoJvROZfm3Nhxk6p2K74fKY1j35/nHMe+J1JqAfhv3Vv/9fn2H/swUqhQ0l0psJuuqibpoi41X23tbu522q1RDYVSU8nDSElNM1RmY6udVdXWS2o4kX1V06y/DscjjuP4d9VBoEpN9xxmbQykhvt0hn7h02TqwOtuKHUriuWkMHva02vNVR0HAKBapnd9D9x1ftbN34NAWnKXff/6//NsxfEezQ3tVR1Cxbzrf5Jlxca+v+eSTYN8L0nh7PagnyWO24+dPNbVO7JSE0yTziqHk8UklmD62WanfWtju9MK9F5rjldsQdKaWi5ndVLRDje9mLEura681sYyk4xhyo5hNSf++axOJ++xmPlmvptHJtIntfbnf7XY+GN279T9qUH8y3nNbb94aJ+jXqmcUZ5POrmc3rEjRxnmZSRyeyoOlf6CIErHWc+sVdeBWr3RreT15NqZz6y1WlBrwdb64tUaHM35NY+b+WgemEX91Vete/P/wO7tJQ1/MrMbSUq6I6M/nszcsJaUjPxV3SuZbQaTjQdjGOzjD3qqO5p7+ebt8yedTnun7AUbQ+mdstBb6B8EJyWeyRbsOdZfo6i9Uyun9/qRd11TRWUafuH0SA8u9D/Wh+i9f5IujLDkMxMqMXjT88u8KzMglM2ePEwv//PyleUkRbJ/ohHz9Lho2ua1uJKRGzT2C57xWjLu+/n8DGgmM4Praoyc69pN6bq3siDninRBmh451tPErOuHHvP9PwAAAAAAAAAAAAAAAAAAwGlTxq81vO74jz4AAAAAAAAAAAAAAAAAAAAAAEwg//6/TR3j/X9TvwM49P1/G0cYKIAh/wIAAP//7nlzRQ==") unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) r0 = socket(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f00000009c0)={[{@abort}, {@grpjquota}, {@usrquota}], [{@mask={'mask', 0x3d, 'MAY_EXEC'}}, {@pcr={'pcr', 0x3d, 0x1e}}, {@appraise}]}, 0x1, 0x4c8, &(0x7f0000000f00)="$eJzs3c9rHNcdAPDv7kqyJMuV7ZZiu1AbXHB/YK1+UCy1vfTU9mAoNfTSgqtKa9XVSiu0K9cSPsjtzYceSksLTQ655y/IJT7FBELOyT3kEBwSR4EkJLBhZndt/diVN4msTTSfD4z1Zt5ov+95+T7NvpnZCSCzLiT/5CJGIuL1iBhtrO7c4ULjx9ajO3PJkot6/dp7uXS/ZL21a+v3jkfEZkQMRsTvfhXx59zeuNX1jcXZcrm02lwv1pZWitX1jcs3l2YXSgul5YnpKzMz0+NTkzMH1td7//zrvasv/WbgxY/+8fDBv155OWnWSLNuez8OUqPr/XFq27a+iPjFswjWA4Vmf4Z63RC+lOT9+3ZEXEzzfzQK6bsJZEG9Xq9/Vj/WqXqzvsdm87eAb7p8egycy49FRKOcz4+NNY7hvxPD+XKlWvvJjcra8nMn0gHhZPTnb9wsl8abnxVORn8uWZ9Iy0/WJ3etT0Wkx8D/Lgyl62NzlfL8YQ50wB7Hd+X/h4VG/gMZ8UU/8pvsgaPDlB9kVyP//VWHrOnz9x8yTf5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kEm/vXo1Weqt+9/nb62vLVZuXZ4vVRfHltbmxuYqqytjC5XKQnrPztLTXq9cqaxM/DTWbhdrpWqtWF3fuL5UWVuuXU/v679e6j+UXgHdOHX+/pu5iNj82VC6JAaadXIVjrZ6PedufsioQq8HIKBnTP1BdvmMD7T5it4dBjtVrBx8W4DDke91A4CeuXTW+T/IKvP/kF3m/yG7HOMD5v8he8z/Q3aNdHj+14ltz+4aj4hvRcQbhf5jrWd9AUdB/p1c8/j/0ugPRnbXDuQ+Tk8RDETE3/5/7b+3Z2u11Ylk+/uPt9f+19w+2Yv2A0/TOqffytNWHgMA2bX16M5caznMuO/+snERwt74fc25ycH0HOXwVm7HtQq5A7p2YfNuRJxpFz+Xzo2cbJ75GN4q7Il/uvkz13iJtL196XPTDyf+2W3xv78t/rmv/L8C2XA/GX/G2+VfPs3peJx/O8efkQO6diIZ/wptx9/84/Gv0GH8O99ljL88//e3O8a/G3Gu7fjbijeYxtodP2nbpS7jP/zj77/bqa7+QuN12sVvSUrF2tJKsbq+cTn9HrmF0vLE9JWZmenxqcmZYjpHXWzNVO/18zOvPdiv/8Md4u/X/2Tbj7rs/yffe/UPF/aJ/8OL7d//0/vEH4qIH3cZ/4PJt/7UqS6JP9+h//l94ifbprqMX/3Pr491uSsAcAiq6xuLs+VyaVWhfeHT+teiGQoKh1vo9cgEPGtPkr7XLQEAAAAAAAAAAAC6dZDXDI9G+6pe9xEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Cj4PAAA//+8oNN8") mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x200000, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r2, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) r3 = openat$uinput(0xffffff9c, &(0x7f0000000a40), 0x802, 0x0) r4 = getuid() ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000ac0)={0x1, 0x8b10, {0xffffffffffffffff}, {0xffffffffffffffff}, 0x2, 0xd0}) getgroups(0x1, &(0x7f0000000b00)=[0x0]) fsetxattr$system_posix_acl(r3, &(0x7f0000000a80)='system.posix_acl_default\x00', &(0x7f0000000b40)={{}, {0x1, 0x6}, [{0x2, 0x7, r4}, {0x2, 0x2, 0xee01}, {0x2, 0x0, r5}], {0x4, 0x7}, [{0x8, 0x2, r6}], {}, {0x20, 0x3}}, 0x44, 0x1) chdir(&(0x7f0000000140)='./bus\x00') link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') linkat(r1, &(0x7f0000000100)='./file1\x00', r2, &(0x7f0000000240)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0x1a4243c, &(0x7f00000013c0)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRES8, @ANYBLOB="f1bcde2281a84392f4e66ff7ef22aa9af727ceae8a8ec95fc1b73083de2de825a0cb2b0be774fdb33650d7dace27c16bc23b2f7c7fb72585548939698f280d138aa9255a8a924008f8477e82ba11cdb11efd5ca2f1ab049ce2ccc415d2daf8dac725533a558d561654faf5e0924f1376174f374d664fad4a6ab24ec0e822e7f9426e8e5de1fe58085a0ae86fd02a118b9365961834d46208b9fb4cb1a1fa962a8b0000dc2e319379ea1e5a07aeb3f9cd4e648df4dd18e6253e7b2310a78d63a232a2a40758027a472e7d263ef567a84166f26ee56e701c63a886378788a512f28edec086b1c0823c028840eeaf3f5d8769023c01218614f4fa40be9892e7a285ac63f7f97aaa5b8ecc86e28c6193bc21a2b833e5c9c703c4cfa063dd34c245706bde3d7ac373ab04b62b4111b59eabd436dd97e788a36ef25bad99be2aa924949558c800"/353, @ANYRESOCT=0x0, @ANYBLOB="defdd6f24cb9acb7fe0b0dc92a093135912ebef426731ffe88138f2b03791edb32e2ba3924188f2c07da77a1d75290af3db49e3aeedbaabdfc897ff5feb67e05cb1f923278506034c99285994c8d2a07e7732f9e4666bedc57efbc75eda531e10945eab9810dce4df5cb4468fee9df15bad908ce6d2cf900c4541ebe94681428ac2202f0132ddfd00bb4d24ace8c513914431814c2", @ANYRES32, @ANYRES32, @ANYRES8, @ANYRES64], 0x0, 0x0, &(0x7f0000000000)) rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000f00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r7 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents64(r7, &(0x7f0000000180)=""/105, 0x69) r8 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) ioctl$EXT4_IOC_SETFSUUID(r8, 0x4008662c, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0xfffffffc}, 0x9) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0xa}}, 0x26}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000740)={&(0x7f00000000c0)=@un=@file={0x1, './file0\x00'}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000140)="45c6d7b71fde07a3006b4d3ca8f2d03dd43f65dcd0dfb7ef24d8d0864f5f6be093812b40954af214de0cd7111987185cefa9eca3b9947f6398836cadc42619482b21d5f75a20ff1ea248536fdfa2d48d70e12927ac3a60c4985a5cd8871349a9d83d2f9656cbaeb24eaf86405831324ef22dec5e989662f7920286d67200ae99d3ed72eb", 0x84}, {&(0x7f00000002c0)="689cab064212cfdf32a11cecbea1487fc2dd01de56017065a2bc4f58fbb610824fb77437221aeee0af14f85fa731470ba7a62a57c42aa6d0a411afe6156f9653eb7e69df77de9c8286d15cd060825979e875f7e496c34672f55dc2aa9c2fa8c6929443d9a2cfb2e845f1298ba9e757648d756820a2ff0fa63be18a693259366310f751d9908736a0e072495b04020ce63b6bcbccc52f37a7a16fe3028fde6f0a53afb14db55ebd490fd6a6527b8b3b703bc5798188877080e4717a63aea1a42456fd3bb8", 0xc4}, {&(0x7f0000000200)}, {&(0x7f0000000240)="c4d2d107ff467f08b37ab1ab7c979e694c68fceda54f92fbb4e72e8d02a37297ca251a45a1c719392642ce9c66197b27a9059e48fc51446036", 0x39}, {&(0x7f00000003c0)="9f05ce2fed3eb7ca7feef6404f5322b21989539e5dddeb8b92b56e26d3e4ed8e9672de93dd8a56dddbf56aa6099df84c17942b139195e88df5cfe0090046555baf5200ff03f1911f12b60d5831869c66c6ae3796382edd0d1b04ede9c1ec7e", 0x5f}, {&(0x7f0000000440)="ccae0b5f3de936654f", 0x9}, {&(0x7f0000000480)="3b47791d64715a6c3391618673af7037a08f57628efa34a5a758013608c8e3ad074eb50ac0b79c116b5855f3b0e73b15cd90aaa369ab42ddc446b72da89ccc17e5efca53349ff145080093917e14854eb6879718c7baf00f234ccef240e7988f84228cd0fd7c117cf2af0ea346ea55f023a37bb96bddce2938dba494736bcb3a368ef9e236f4c20abb6438b6a52610375b56b5c30925134dbf32c75fe9c7cde316b479e831f004e598d8ca9d913f94bf33c487a6fa35c8848a26eb574ec983ab6c01d7404a1cc274e1228c8d43192d49f6297f65875900ef2d7fefed62e28fd7b956094826ed71ef", 0xe8}], 0x7, &(0x7f0000000600)=[{0x108, 0x10a, 0xfffffff4, "d0258ddde2efc717eeeffe75c61c0707154e6c851dc4f75a032a2728325dd1019e7a9c082d9d0634624760fc743de14a153eacecb472a75a8ba3d03cdc1d87fc93c5d23e68a8cbd1d81403a0002c55de0c6d0c4ac1ec766fe697d70f455d2a9b2d60652106e635274dc62ed3f9512322685ab0deea92c02817bbc36d4347d8157efe954a0f12b71b1f5a4b1c294ee05d07a8e5f74425b88199f3d808b9dd473e96f6d5747b1ea898bfccd79a348388c2ee64561e5d247fb2a0626c2e21f5c3d6ec981f49a644ba456baf5c260f479ec4722f757e5202b0b1396ea449d71542dcb983e9a5c7695bfbe65c43fa8c305e9e372ad0334d98"}], 0x108}, 0x40010) r9 = openat$vsock(0xffffff9c, &(0x7f0000000200), 0x200802, 0x0) ioctl$VIDIOC_SUBDEV_G_EDID(r9, 0xc0285628, &(0x7f00000007c0)={0x0, 0xfffff801, 0x5, '\x00', &(0x7f0000000780)=0xfb}) [ 73.017614][ T5090] Bluetooth: hci0: command tx timeout [ 73.131375][ T5109] loop0: detected capacity change from 0 to 64 [ 73.208953][ T5109] ================================================================== [ 73.212197][ T5109] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x314/0x450 [ 73.215540][ T5109] Write of size 94 at addr ffff888033a34980 by task syz.0.0/5109 [ 73.218682][ T5109] [ 73.219814][ T5109] CPU: 0 UID: 0 PID: 5109 Comm: syz.0.0 Not tainted 6.12.0-rc1-syzkaller-00306-g27cc6fdf7201 #0 [ 73.225340][ T5109] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 73.229293][ T5109] Call Trace: [ 73.230617][ T5109] [ 73.231823][ T5109] dump_stack_lvl+0x241/0x360 [ 73.233729][ T5109] ? __pfx_dump_stack_lvl+0x10/0x10 [ 73.235744][ T5109] ? __pfx__printk+0x10/0x10 [ 73.237681][ T5109] ? _printk+0xd5/0x120 [ 73.239716][ T5109] ? __virt_addr_valid+0x183/0x530 [ 73.242198][ T5109] ? __virt_addr_valid+0x183/0x530 [ 73.244189][ T5109] print_report+0x169/0x550 [ 73.246054][ T5109] ? __virt_addr_valid+0x183/0x530 [ 73.247968][ T5109] ? __virt_addr_valid+0x183/0x530 [ 73.249951][ T5109] ? __virt_addr_valid+0x45f/0x530 [ 73.252272][ T5109] ? __phys_addr+0xba/0x170 [ 73.254944][ T5109] ? hfs_bnode_read_key+0x314/0x450 [ 73.258781][ T5109] kasan_report+0x143/0x180 [ 73.260984][ T5109] ? hfs_bnode_read_key+0x314/0x450 [ 73.263048][ T5109] kasan_check_range+0x282/0x290 [ 73.265154][ T5109] ? hfs_bnode_read_key+0x314/0x450 [ 73.267481][ T5109] __asan_memcpy+0x40/0x70 [ 73.269273][ T5109] hfs_bnode_read_key+0x314/0x450 [ 73.270829][ T5109] hfs_brec_insert+0x7f3/0xbd0 [ 73.272567][ T5109] ? __pfx_hfs_brec_insert+0x10/0x10 [ 73.274640][ T5109] hfs_cat_create+0x41d/0xa50 [ 73.276910][ T5109] ? __pfx_hfs_cat_create+0x10/0x10 [ 73.280099][ T5109] ? _raw_spin_unlock+0x28/0x50 [ 73.282352][ T5109] ? hfs_new_inode+0x86e/0xaf0 [ 73.284318][ T5109] hfs_mkdir+0x6c/0xe0 [ 73.286040][ T5109] vfs_mkdir+0x2f9/0x4f0 [ 73.287590][ T5109] do_mkdirat+0x264/0x3a0 [ 73.288898][ T5109] ? __might_fault+0xaa/0x120 [ 73.290702][ T5109] ? __pfx_do_mkdirat+0x10/0x10 [ 73.292612][ T5109] ? strncpy_from_user+0x131/0x250 [ 73.294599][ T5109] ? getname_flags+0x1e3/0x540 [ 73.296611][ T5109] __x64_sys_mkdir+0x6c/0x80 [ 73.298594][ T5109] do_syscall_64+0xf3/0x230 [ 73.300688][ T5109] ? clear_bhb_loop+0x35/0x90 [ 73.302956][ T5109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.305483][ T5109] RIP: 0033:0x7f6f2277dff9 [ 73.307187][ T5109] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 73.314359][ T5109] RSP: 002b:00007f6f23555038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 73.317573][ T5109] RAX: ffffffffffffffda RBX: 00007f6f22935f80 RCX: 00007f6f2277dff9 [ 73.321196][ T5109] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200004c0 [ 73.325007][ T5109] RBP: 00007f6f227f0296 R08: 0000000000000000 R09: 0000000000000000 [ 73.328173][ T5109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.331232][ T5109] R13: 0000000000000000 R14: 00007f6f22935f80 R15: 00007ffe3e197718 [ 73.334443][ T5109] [ 73.335731][ T5109] [ 73.336615][ T5109] Allocated by task 5109: [ 73.338554][ T5109] kasan_save_track+0x3f/0x80 [ 73.340985][ T5109] __kasan_kmalloc+0x98/0xb0 [ 73.343689][ T5109] __kmalloc_noprof+0x1fc/0x400 [ 73.346087][ T5109] hfs_find_init+0x90/0x1f0 [ 73.347905][ T5109] hfs_cat_create+0x182/0xa50 [ 73.349818][ T5109] hfs_mkdir+0x6c/0xe0 [ 73.351517][ T5109] vfs_mkdir+0x2f9/0x4f0 [ 73.353284][ T5109] do_mkdirat+0x264/0x3a0 [ 73.355017][ T5109] __x64_sys_mkdir+0x6c/0x80 [ 73.356772][ T5109] do_syscall_64+0xf3/0x230 [ 73.358436][ T5109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.360995][ T5109] [ 73.362112][ T5109] The buggy address belongs to the object at ffff888033a34980 [ 73.362112][ T5109] which belongs to the cache kmalloc-96 of size 96 [ 73.367964][ T5109] The buggy address is located 0 bytes inside of [ 73.367964][ T5109] allocated 78-byte region [ffff888033a34980, ffff888033a349ce) [ 73.373598][ T5109] [ 73.374567][ T5109] The buggy address belongs to the physical page: [ 73.376901][ T5109] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33a34 [ 73.380182][ T5109] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 73.382958][ T5109] page_type: f5(slab) [ 73.384396][ T5109] raw: 04fff00000000000 ffff88801ac41280 dead000000000122 0000000000000000 [ 73.387637][ T5109] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 73.390749][ T5109] page dumped because: kasan: bad access detected [ 73.393105][ T5109] page_owner tracks the page as allocated [ 73.395265][ T5109] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5109, tgid 5108 (syz.0.0), ts 73130607630, free_ts 73125869483 [ 73.402221][ T5109] post_alloc_hook+0x1f3/0x230 [ 73.403893][ T5109] get_page_from_freelist+0x3045/0x3190 [ 73.405768][ T5109] __alloc_pages_noprof+0x256/0x6c0 [ 73.407562][ T5109] alloc_slab_page+0x59/0x120 [ 73.409159][ T5109] allocate_slab+0x5a/0x2f0 [ 73.410644][ T5109] ___slab_alloc+0xcd1/0x14b0 [ 73.412293][ T5109] __slab_alloc+0x58/0xa0 [ 73.414001][ T5109] __kmalloc_cache_node_noprof+0x20c/0x300 [ 73.416259][ T5109] __alloc_workqueue+0x709/0x1f20 [ 73.418056][ T5109] alloc_workqueue+0xd6/0x210 [ 73.419801][ T5109] loop_configure+0x519/0xeb0 [ 73.422130][ T5109] lo_ioctl+0x846/0x1f50 [ 73.424359][ T5109] blkdev_ioctl+0x57d/0x6a0 [ 73.426739][ T5109] __se_sys_ioctl+0xf9/0x170 [ 73.428635][ T5109] do_syscall_64+0xf3/0x230 [ 73.430435][ T5109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.432755][ T5109] page last free pid 16 tgid 16 stack trace: [ 73.434952][ T5109] free_unref_page+0xcfb/0xf20 [ 73.436850][ T5109] rcu_core+0xaaa/0x17a0 [ 73.438333][ T5109] handle_softirqs+0x2c5/0x980 [ 73.439908][ T5109] run_ksoftirqd+0xca/0x130 [ 73.441388][ T5109] smpboot_thread_fn+0x544/0xa30 [ 73.443120][ T5109] kthread+0x2f0/0x390 [ 73.445052][ T5109] ret_from_fork+0x4b/0x80 [ 73.447220][ T5109] ret_from_fork_asm+0x1a/0x30 [ 73.449511][ T5109] [ 73.450744][ T5109] Memory state around the buggy address: [ 73.452947][ T5109] ffff888033a34880: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 73.455817][ T5109] ffff888033a34900: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 73.459019][ T5109] >ffff888033a34980: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc [ 73.462142][ T5109] ^ [ 73.464655][ T5109] ffff888033a34a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.467838][ T5109] ffff888033a34a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.471579][ T5109] ================================================================== [ 73.645518][ T5109] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 73.648156][ T5109] CPU: 0 UID: 0 PID: 5109 Comm: syz.0.0 Not tainted 6.12.0-rc1-syzkaller-00306-g27cc6fdf7201 #0 [ 73.652828][ T5109] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 73.659092][ T5109] Call Trace: [ 73.660838][ T5109] [ 73.662433][ T5109] dump_stack_lvl+0x241/0x360 [ 73.664855][ T5109] ? __pfx_dump_stack_lvl+0x10/0x10 [ 73.667220][ T5109] ? __pfx__printk+0x10/0x10 [ 73.669363][ T5109] ? preempt_schedule+0xe1/0xf0 [ 73.671364][ T5109] ? vscnprintf+0x5d/0x90 [ 73.673396][ T5109] panic+0x349/0x880 [ 73.675284][ T5109] ? check_panic_on_warn+0x21/0xb0 [ 73.677583][ T5109] ? __pfx_panic+0x10/0x10 [ 73.679585][ T5109] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 73.682023][ T5109] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 73.684513][ T5109] ? print_report+0x502/0x550 [ 73.686391][ T5109] check_panic_on_warn+0x86/0xb0 [ 73.688272][ T5109] ? hfs_bnode_read_key+0x314/0x450 [ 73.690213][ T5109] end_report+0x77/0x160 [ 73.691558][ T5109] kasan_report+0x154/0x180 [ 73.693117][ T5109] ? hfs_bnode_read_key+0x314/0x450 [ 73.694989][ T5109] kasan_check_range+0x282/0x290 [ 73.696978][ T5109] ? hfs_bnode_read_key+0x314/0x450 [ 73.698920][ T5109] __asan_memcpy+0x40/0x70 [ 73.700562][ T5109] hfs_bnode_read_key+0x314/0x450 [ 73.702428][ T5109] hfs_brec_insert+0x7f3/0xbd0 [ 73.704208][ T5109] ? __pfx_hfs_brec_insert+0x10/0x10 [ 73.706155][ T5109] hfs_cat_create+0x41d/0xa50 [ 73.707857][ T5109] ? __pfx_hfs_cat_create+0x10/0x10 [ 73.709780][ T5109] ? _raw_spin_unlock+0x28/0x50 [ 73.711651][ T5109] ? hfs_new_inode+0x86e/0xaf0 [ 73.713451][ T5109] hfs_mkdir+0x6c/0xe0 [ 73.714987][ T5109] vfs_mkdir+0x2f9/0x4f0 [ 73.716572][ T5109] do_mkdirat+0x264/0x3a0 [ 73.718068][ T5109] ? __might_fault+0xaa/0x120 [ 73.719862][ T5109] ? __pfx_do_mkdirat+0x10/0x10 [ 73.721733][ T5109] ? strncpy_from_user+0x131/0x250 [ 73.723681][ T5109] ? getname_flags+0x1e3/0x540 [ 73.725569][ T5109] __x64_sys_mkdir+0x6c/0x80 [ 73.727595][ T5109] do_syscall_64+0xf3/0x230 [ 73.729370][ T5109] ? clear_bhb_loop+0x35/0x90 [ 73.731678][ T5109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.734841][ T5109] RIP: 0033:0x7f6f2277dff9 [ 73.736947][ T5109] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 73.744139][ T5109] RSP: 002b:00007f6f23555038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 73.747318][ T5109] RAX: ffffffffffffffda RBX: 00007f6f22935f80 RCX: 00007f6f2277dff9 [ 73.750383][ T5109] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200004c0 [ 73.753547][ T5109] RBP: 00007f6f227f0296 R08: 0000000000000000 R09: 0000000000000000 [ 73.757538][ T5109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.761368][ T5109] R13: 0000000000000000 R14: 00007f6f22935f80 R15: 00007ffe3e197718 [ 73.764254][ T5109] [ 73.765663][ T5109] Kernel Offset: disabled [ 73.767341][ T5109] Rebooting in 86400 seconds..