./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1711250282 <...> forked to background, child pid 4659 [ 33.037082][ T4660] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.046734][ T4660] eql: remember to turn off Van-Jacobson compression on your slave devices [ 33.243574][ T4732] ssh-keygen (4732) used greatest stack depth: 19320 bytes left Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.45' (ECDSA) to the list of known hosts. execve("./syz-executor1711250282", ["./syz-executor1711250282"], 0x7ffdddc16c10 /* 10 vars */) = 0 brk(NULL) = 0x555555756000 brk(0x555555756c40) = 0x555555756c40 arch_prctl(ARCH_SET_FS, 0x555555756300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1711250282", 4096) = 28 brk(0x555555777c40) = 0x555555777c40 brk(0x555555778000) = 0x555555778000 mprotect(0x7fd092f49000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 4992 attached , child_tidptr=0x5555557565d0) = 4992 [pid 4992] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 4992] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4992] setsid() = 1 [pid 4992] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 4992] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 4992] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 4992] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 4992] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 4992] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 4992] unshare(CLONE_NEWNS) = 0 [pid 4992] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 4992] unshare(CLONE_NEWIPC) = 0 [pid 4992] unshare(CLONE_NEWCGROUP) = 0 [pid 4992] unshare(CLONE_NEWUTS) = 0 [pid 4992] unshare(CLONE_SYSVSEM) = 0 [pid 4992] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 4992] write(3, "16777216", 8) = 8 [pid 4992] close(3) = 0 [pid 4992] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 4992] write(3, "536870912", 9) = 9 [pid 4992] close(3) = 0 [pid 4992] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 4992] write(3, "1024", 4) = 4 [pid 4992] close(3) = 0 [pid 4992] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 4992] write(3, "8192", 4) = 4 [pid 4992] close(3) = 0 [pid 4992] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 4992] write(3, "1024", 4) = 4 [pid 4992] close(3) = 0 [pid 4992] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 4992] write(3, "1024", 4) = 4 [pid 4992] close(3) = 0 [pid 4992] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 4992] write(3, "1024 1048576 500 1024", 21) = 21 [pid 4992] close(3) = 0 [pid 4992] getpid() = 1 [pid 4992] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 56.677073][ T4992] dump_stack_lvl+0x1e7/0x2d0 [ 56.681755][ T4992] ? irq_work_queue+0xca/0x150 [ 56.686512][ T4992] ? nf_tcp_handle_invalid+0x650/0x650 [ 56.691968][ T4992] ? panic+0x770/0x770 [ 56.696038][ T4992] ? _printk+0xd5/0x120 [ 56.700192][ T4992] print_report+0x163/0x540 [ 56.704690][ T4992] ? __virt_addr_valid+0x22f/0x2e0 [ 56.709801][ T4992] ? __phys_addr+0xba/0x170 [ 56.714307][ T4992] ? search_by_entry_key+0x579/0x1380 [ 56.719670][ T4992] kasan_report+0x176/0x1b0 [ 56.724167][ T4992] ? search_by_entry_key+0x579/0x1380 [ 56.729540][ T4992] search_by_entry_key+0x579/0x1380 [ 56.734744][ T4992] ? make_cpu_key+0x2f/0x230 [ 56.739338][ T4992] reiserfs_find_entry+0x2ce/0x19b0 [ 56.744541][ T4992] ? mark_lock+0x9a/0x340 [ 56.748878][ T4992] ? reiserfs_get_parent+0x2d0/0x2d0 [ 56.754166][ T4992] ? mutex_lock_nested+0x1b/0x20 [ 56.759111][ T4992] reiserfs_lookup+0x1e2/0x580 [ 56.763878][ T4992] ? reiserfs_init_priv_inode+0x150/0x150 [ 56.769609][ T4992] ? d_hash_and_lookup+0x1b0/0x1b0 [ 56.774725][ T4992] ? __init_waitqueue_head+0xae/0x150 [ 56.780104][ T4992] __lookup_slow+0x282/0x3e0 [ 56.784703][ T4992] ? lookup_one_len+0x2d0/0x2d0 [ 56.789558][ T4992] lookup_one_len+0x18b/0x2d0 [ 56.794232][ T4992] ? lookup_one_common+0x460/0x460 [ 56.799344][ T4992] reiserfs_lookup_privroot+0x89/0x180 [ 56.804804][ T4992] reiserfs_fill_super+0x21c1/0x2620 [ 56.810096][ T4992] ? reiserfs_kill_sb+0x150/0x150 [ 56.815125][ T4992] ? snprintf+0xda/0x120 [ 56.819378][ T4992] ? sb_set_blocksize+0x99/0x100 [ 56.824315][ T4992] mount_bdev+0x2d0/0x3f0 [ 56.828644][ T4992] ? reiserfs_kill_sb+0x150/0x150 [ 56.833674][ T4992] legacy_get_tree+0xef/0x190 [ 56.838357][ T4992] ? remove_save_link+0x540/0x540 [ 56.843376][ T4992] vfs_get_tree+0x8c/0x270 [ 56.847784][ T4992] do_new_mount+0x28f/0xae0 [ 56.852291][ T4992] ? path_mount+0x5f2/0xf80 [ 56.856785][ T4992] ? do_move_mount_old+0x170/0x170 [ 56.861897][ T4992] ? user_path_at_empty+0x12f/0x180 [ 56.867085][ T4992] __se_sys_mount+0x2d9/0x3c0 [ 56.871761][ T4992] ? __x64_sys_mount+0xc0/0xc0 [ 56.876520][ T4992] ? syscall_enter_from_user_mode+0x32/0x230 [ 56.882501][ T4992] ? __x64_sys_mount+0x20/0xc0 [ 56.887258][ T4992] do_syscall_64+0x41/0xc0 [ 56.891675][ T4992] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.897576][ T4992] RIP: 0033:0x7fd092edb5ba [ 56.901998][ T4992] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 d8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 56.921591][ T4992] RSP: 002b:00007ffdb6f96b08 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 56.929995][ T4992] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd092edb5ba [ 56.937956][ T4992] RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007ffdb6f96b20 [ 56.945916][ T4992] RBP: 00007ffdb6f96b20 R08: 00007ffdb6f96b60 R09: 0000000000001120 [ 56.953881][ T4992] R10: 0000000000208000 R11: 0000000000000286 R12: 0000000000000004 [ 56.961847][ T4992] R13: 00005555557562c0 R14: 0000000000208000 R15: 00007ffdb6f96b60 [ 56.969816][ T4992] [ 56.972903][ T4992] [ 56.975225][ T4992] The buggy address belongs to the physical page: [ 56.981624][ T4992] page:ffffea0001cee340 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73b8d [ 56.991771][ T4992] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 56.998871][ T4992] page_type: 0xffffffff() [ 57.003191][ T4992] raw: 00fff00000000000 ffff8880b9843260 ffff8880b9843260 0000000000000000 [ 57.011787][ T4992] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 57.020356][ T4992] page dumped because: kasan: bad access detected [ 57.026751][ T4992] page_owner tracks the page as freed [ 57.032107][ T4992] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 13340796304, free_ts 14622276876 [ 57.047025][ T4992] post_alloc_hook+0x1e6/0x210 [ 57.051800][ T4992] split_map_pages+0x24a/0x510 [ 57.056559][ T4992] isolate_freepages_range+0x480/0x4e0 [ 57.062013][ T4992] alloc_contig_range+0x62e/0x9a0 [ 57.067032][ T4992] alloc_contig_pages+0x3f4/0x4f0 [ 57.072049][ T4992] debug_vm_pgtable_alloc_huge_page+0xb9/0x110 [ 57.078197][ T4992] init_args+0x836/0xb10 [ 57.082431][ T4992] debug_vm_pgtable+0xa8/0x490 [ 57.087191][ T4992] do_one_initcall+0x23d/0x7d0 [ 57.091946][ T4992] do_initcall_level+0x157/0x210 [ 57.096875][ T4992] do_initcalls+0x3f/0x80 [ 57.101192][ T4992] kernel_init_freeable+0x43b/0x5d0 [ 57.106394][ T4992] kernel_init+0x1d/0x2a0 [ 57.110721][ T4992] ret_from_fork+0x1f/0x30 [ 57.115132][ T4992] page last free stack trace: [ 57.119791][ T4992] free_unref_page_prepare+0x903/0xa30 [ 57.125244][ T4992] free_unref_page+0x37/0x3f0 [ 57.129914][ T4992] free_contig_range+0x9e/0x150 [ 57.134782][ T4992] destroy_args+0x102/0x9a0 [ 57.139289][ T4992] debug_vm_pgtable+0x405/0x490 [ 57.144141][ T4992] do_one_initcall+0x23d/0x7d0 [ 57.148903][ T4992] do_initcall_level+0x157/0x210 [ 57.153836][ T4992] do_initcalls+0x3f/0x80 [ 57.158160][ T4992] kernel_init_freeable+0x43b/0x5d0 [ 57.163350][ T4992] kernel_init+0x1d/0x2a0 [ 57.167672][ T4992] ret_from_fork+0x1f/0x30 [ 57.172084][ T4992] [ 57.174434][ T4992] Memory state around the buggy address: [ 57.180056][ T4992] ffff888073b8cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 57.188107][ T4992] ffff888073b8cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 57.196157][ T4992] >ffff888073b8d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 57.204206][ T4992] ^ [ 57.208267][ T4992] ffff888073b8d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 57.216318][ T4992] ffff888073b8d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 57.224369][ T4992] ================================================================== [ 57.232646][ T4992] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 57.239857][ T4992] CPU: 1 PID: 4992 Comm: syz-executor171 Not tainted 6.4.0-rc5-syzkaller #0 [ 57.248534][ T4992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 57.258581][ T4992] Call Trace: [ 57.261849][ T4992] [ 57.264769][ T4992] dump_stack_lvl+0x1e7/0x2d0 [ 57.269449][ T4992] ? nf_tcp_handle_invalid+0x650/0x650 [ 57.274904][ T4992] ? panic+0x770/0x770 [ 57.278965][ T4992] ? preempt_schedule_common+0x83/0xc0 [ 57.284421][ T4992] ? vscnprintf+0x5d/0x80 [ 57.288747][ T4992] panic+0x30f/0x770 [ 57.292638][ T4992] ? check_panic_on_warn+0x21/0xa0 [ 57.297764][ T4992] ? __memcpy_flushcache+0x2b0/0x2b0 [ 57.303054][ T4992] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 57.309030][ T4992] ? _raw_spin_unlock+0x40/0x40 [ 57.313883][ T4992] ? print_report+0x4fb/0x540 [ 57.318573][ T4992] check_panic_on_warn+0x82/0xa0 [ 57.323524][ T4992] ? search_by_entry_key+0x579/0x1380 [ 57.328902][ T4992] end_report+0x63/0x110 [ 57.333155][ T4992] kasan_report+0x183/0x1b0 [ 57.337682][ T4992] ? search_by_entry_key+0x579/0x1380 [ 57.343056][ T4992] search_by_entry_key+0x579/0x1380 [ 57.348261][ T4992] ? make_cpu_key+0x2f/0x230 [ 57.352854][ T4992] reiserfs_find_entry+0x2ce/0x19b0 [ 57.358058][ T4992] ? mark_lock+0x9a/0x340 [ 57.362391][ T4992] ? reiserfs_get_parent+0x2d0/0x2d0 [ 57.367677][ T4992] ? mutex_lock_nested+0x1b/0x20 [ 57.372619][ T4992] reiserfs_lookup+0x1e2/0x580 [ 57.377384][ T4992] ? reiserfs_init_priv_inode+0x150/0x150 [ 57.383112][ T4992] ? d_hash_and_lookup+0x1b0/0x1b0 [ 57.388231][ T4992] ? __init_waitqueue_head+0xae/0x150 [ 57.393608][ T4992] __lookup_slow+0x282/0x3e0 [ 57.398204][ T4992] ? lookup_one_len+0x2d0/0x2d0 [ 57.403066][ T4992] lookup_one_len+0x18b/0x2d0 [ 57.407743][ T4992] ? lookup_one_common+0x460/0x460 [ 57.412877][ T4992] reiserfs_lookup_privroot+0x89/0x180 [ 57.418344][ T4992] reiserfs_fill_super+0x21c1/0x2620 [ 57.423640][ T4992] ? reiserfs_kill_sb+0x150/0x150 [ 57.428687][ T4992] ? snprintf+0xda/0x120 [ 57.432974][ T4992] ? sb_set_blocksize+0x99/0x100 [ 57.437915][ T4992] mount_bdev+0x2d0/0x3f0 [ 57.442242][ T4992] ? reiserfs_kill_sb+0x150/0x150 [ 57.447268][ T4992] legacy_get_tree+0xef/0x190 [ 57.451943][ T4992] ? remove_save_link+0x540/0x540 [ 57.456968][ T4992] vfs_get_tree+0x8c/0x270 [ 57.461384][ T4992] do_new_mount+0x28f/0xae0 [ 57.465892][ T4992] ? path_mount+0x5f2/0xf80 [ 57.470392][ T4992] ? do_move_mount_old+0x170/0x170 [ 57.475501][ T4992] ? user_path_at_empty+0x12f/0x180 [ 57.480709][ T4992] __se_sys_mount+0x2d9/0x3c0 [ 57.485386][ T4992] ? __x64_sys_mount+0xc0/0xc0 [ 57.490163][ T4992] ? syscall_enter_from_user_mode+0x32/0x230 [ 57.496142][ T4992] ? __x64_sys_mount+0x20/0xc0 [ 57.500905][ T4992] do_syscall_64+0x41/0xc0 [ 57.505324][ T4992] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.511213][ T4992] RIP: 0033:0x7fd092edb5ba [ 57.515621][ T4992] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 d8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 57.535222][ T4992] RSP: 002b:00007ffdb6f96b08 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 57.543627][ T4992] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd092edb5ba [ 57.551592][ T4992] RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007ffdb6f96b20 [ 57.559557][ T4992] RBP: 00007ffdb6f96b20 R08: 00007ffdb6f96b60 R09: 0000000000001120 [ 57.567520][ T4992] R10: 0000000000208000 R11: 0000000000000286 R12: 0000000000000004 [ 57.575483][ T4992] R13: 00005555557562c0 R14: 0000000000208000 R15: 00007ffdb6f96b60 [ 57.583458][ T4992] [ 57.586741][ T4992] Kernel Offset: disabled [ 57.591068][ T4992] Rebooting in 86400 seconds..