./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4240967590
<...>
Warning: Permanently added '10.128.0.114' (ED25519) to the list of known hosts.
execve("./syz-executor4240967590", ["./syz-executor4240967590"], 0x7ffd84f21570 /* 10 vars */) = 0
brk(NULL) = 0x555556724000
brk(0x555556724d00) = 0x555556724d00
arch_prctl(ARCH_SET_FS, 0x555556724380) = 0
set_tid_address(0x555556724650) = 5057
set_robust_list(0x555556724660, 24) = 0
rseq(0x555556724ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor4240967590", 4096) = 28
getrandom("\x3c\x56\xf8\xe2\xd2\x5d\xf6\x0d", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555556724d00
brk(0x555556745d00) = 0x555556745d00
brk(0x555556746000) = 0x555556746000
mprotect(0x7f8e90054000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8e87b9e000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
munmap(0x7f8e87b9e000, 138412032) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./bus", 0777) = 0
[ 55.771460][ T5057] loop0: detected capacity change from 0 to 32768
[ 55.793255][ T5057] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop0 scanned by syz-executor424 (5057)
[ 55.813514][ T5057] BTRFS info (device loop0): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[ 55.823828][ T5057] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm
[ 55.832615][ T5057] BTRFS info (device loop0): enabling auto defrag
[ 55.839040][ T5057] BTRFS info (device loop0): enabling disk space caching
[ 55.846299][ T5057] BTRFS info (device loop0): max_inline at 0
[ 55.852350][ T5057] BTRFS info (device loop0): force clearing of disk cache
[ 55.859447][ T5057] BTRFS info (device loop0): turning on sync discard
[ 55.866185][ T5057] BTRFS info (device loop0): disk space caching is enabled
[ 55.887516][ T5057] BTRFS info (device loop0): enabling ssd optimizations
[ 55.895865][ T5057] BTRFS info (device loop0): rebuilding free space tree
mount("/dev/loop0", "./bus", "btrfs", MS_NOEXEC, "autodefrag,autodefrag,space_cache=v1,max_inline=%,clear_cache,discard,noenospc_debug,barrier,thread_"...) = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
chdir("./bus") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 55.916800][ T5057] BTRFS info (device loop0): disabling free space tree
[ 55.923732][ T5057] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[ 55.933555][ T5057] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
openat(AT_FDCWD, "/proc/crypto", O_RDONLY) = 4
read(4, "name : cbc(aes)\ndriver : cbc(ecb(aes-aesni))\nmodule : kernel\npriority : 300\n"..., 8224) = 3981
openat(AT_FDCWD, "./file1", O_RDONLY) = 5
[ 56.025992][ T5057] ==================================================================
[ 56.034169][ T5057] BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70
[ 56.040875][ T5057] Read of size 1 at addr ffff88801d7f2a28 by task syz-executor424/5057
[ 56.049114][ T5057]
[ 56.051444][ T5057] CPU: 1 PID: 5057 Comm: syz-executor424 Not tainted 6.7.0-rc5-syzkaller-00200-g3bd7d7488169 #0
[ 56.061857][ T5057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 56.071914][ T5057] Call Trace:
[ 56.075204][ T5057]
[ 56.078140][ T5057] dump_stack_lvl+0x1e7/0x2d0
[ 56.082836][ T5057] ? nf_tcp_handle_invalid+0x650/0x650
[ 56.088311][ T5057] ? panic+0x850/0x850
[ 56.092393][ T5057] ? _printk+0xd5/0x120
[ 56.096558][ T5057] print_report+0x163/0x540
[ 56.101068][ T5057] ? __virt_addr_valid+0x22f/0x2e0
[ 56.106189][ T5057] ? __phys_addr+0xba/0x170
[ 56.110701][ T5057] ? strlen+0x58/0x70
[ 56.114689][ T5057] kasan_report+0x142/0x170
[ 56.119198][ T5057] ? strlen+0x58/0x70
[ 56.123186][ T5057] strlen+0x58/0x70
[ 56.126982][ T5057] getname_kernel+0x1d/0x2e0
[ 56.131562][ T5057] kern_path+0x1d/0x50
[ 56.135614][ T5057] bdev_open_by_path+0xd1/0x540
[ 56.140451][ T5057] ? blkdev_put+0x770/0x770
[ 56.144958][ T5057] btrfs_dev_replace_by_ioctl+0x41b/0x2010
[ 56.150768][ T5057] ? btrfs_finish_block_group_to_copy+0x480/0x480
[ 56.157188][ T5057] ? btrfs_ioctl_dev_replace+0x2be/0x390
[ 56.162807][ T5057] ? do_raw_spin_lock+0x14e/0x370
[ 56.167819][ T5057] ? __lock_acquire+0x1fd0/0x1fd0
[ 56.172835][ T5057] ? do_raw_spin_unlock+0x13b/0x8b0
[ 56.178024][ T5057] btrfs_ioctl_dev_replace+0x2c9/0x390
[ 56.183472][ T5057] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 56.189878][ T5057] __se_sys_ioctl+0xf8/0x170
[ 56.194461][ T5057] do_syscall_64+0x45/0x110
[ 56.198961][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 56.204844][ T5057] RIP: 0033:0x7f8e8ffdc079
[ 56.209247][ T5057] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 56.228838][ T5057] RSP: 002b:00007ffe15cbe138 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 56.237240][ T5057] RAX: ffffffffffffffda RBX: 00007ffe15cbe308 RCX: 00007f8e8ffdc079
[ 56.245200][ T5057] RDX: 0000000020000540 RSI: 00000000ca289435 RDI: 0000000000000005
[ 56.253156][ T5057] RBP: 00007f8e90054610 R08: 00007ffe15cbe308 R09: 00007ffe15cbe308
[ 56.261116][ T5057] R10: 00007ffe15cbe308 R11: 0000000000000246 R12: 0000000000000001
[ 56.269072][ T5057] R13: 00007ffe15cbe2f8 R14: 0000000000000001 R15: 0000000000000001
[ 56.277031][ T5057]
[ 56.280032][ T5057]
[ 56.282337][ T5057] Allocated by task 5057:
[ 56.286643][ T5057] kasan_set_track+0x4f/0x70
[ 56.291219][ T5057] __kasan_kmalloc+0x98/0xb0
[ 56.295792][ T5057] __kmalloc_node_track_caller+0xb1/0x190
[ 56.301496][ T5057] memdup_user+0x2b/0xc0
[ 56.305725][ T5057] btrfs_ioctl_dev_replace+0xb8/0x390
[ 56.311082][ T5057] __se_sys_ioctl+0xf8/0x170
[ 56.315654][ T5057] do_syscall_64+0x45/0x110
[ 56.320142][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 56.326037][ T5057]
[ 56.328359][ T5057] The buggy address belongs to the object at ffff88801d7f2000
[ 56.328359][ T5057] which belongs to the cache kmalloc-4k of size 4096
[ 56.342398][ T5057] The buggy address is located 0 bytes to the right of
[ 56.342398][ T5057] allocated 2600-byte region [ffff88801d7f2000, ffff88801d7f2a28)
[ 56.356959][ T5057]
[ 56.359266][ T5057] The buggy address belongs to the physical page:
[ 56.365658][ T5057] page:ffffea000075fc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d7f0
[ 56.375791][ T5057] head:ffffea000075fc00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 56.384708][ T5057] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 56.392670][ T5057] page_type: 0xffffffff()
[ 56.396989][ T5057] raw: 00fff00000000840 ffff888012c42140 ffffea00007b5600 0000000000000002
[ 56.405567][ T5057] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
[ 56.414135][ T5057] page dumped because: kasan: bad access detected
[ 56.420540][ T5057] page_owner tracks the page as allocated
[ 56.426239][ T5057] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4716, tgid 4716 (ifup), ts 29920494589, free_ts 29905444571
[ 56.446111][ T5057] post_alloc_hook+0x1e6/0x210
[ 56.450864][ T5057] get_page_from_freelist+0x33ea/0x3570
[ 56.456399][ T5057] __alloc_pages+0x255/0x680
[ 56.460970][ T5057] alloc_pages_mpol+0x3de/0x640
[ 56.465802][ T5057] alloc_slab_page+0x6a/0x170
[ 56.470462][ T5057] new_slab+0x84/0x2f0
[ 56.474517][ T5057] ___slab_alloc+0xc8a/0x1330
[ 56.479181][ T5057] __kmem_cache_alloc_node+0x21d/0x300
[ 56.484626][ T5057] __kmalloc+0xa2/0x1a0
[ 56.488762][ T5057] tomoyo_realpath_from_path+0xcf/0x5e0
[ 56.494292][ T5057] tomoyo_check_open_permission+0x255/0x500
[ 56.500171][ T5057] security_file_open+0x63/0xa0
[ 56.505007][ T5057] do_dentry_open+0x327/0x1590
[ 56.509756][ T5057] path_openat+0x2849/0x3290
[ 56.514330][ T5057] do_filp_open+0x234/0x490
[ 56.518819][ T5057] do_sys_openat2+0x13e/0x1d0
[ 56.523493][ T5057] page last free stack trace:
[ 56.528149][ T5057] free_unref_page_prepare+0x931/0xa60
[ 56.533599][ T5057] free_unref_page+0x37/0x3f0
[ 56.538258][ T5057] __unfreeze_partials+0x1e0/0x220
[ 56.543354][ T5057] put_cpu_partial+0x17b/0x250
[ 56.548101][ T5057] __slab_free+0x2b6/0x390
[ 56.552498][ T5057] qlist_free_all+0x75/0xe0
[ 56.556992][ T5057] kasan_quarantine_reduce+0x14b/0x160
[ 56.562438][ T5057] __kasan_slab_alloc+0x23/0x70
[ 56.567270][ T5057] slab_post_alloc_hook+0x6c/0x3c0
[ 56.572369][ T5057] __kmem_cache_alloc_node+0x1d0/0x300
[ 56.577816][ T5057] __kmalloc+0xa2/0x1a0
[ 56.581955][ T5057] tomoyo_realpath_from_path+0xcf/0x5e0
[ 56.587488][ T5057] tomoyo_path_perm+0x2b7/0x730
[ 56.592325][ T5057] security_inode_getattr+0xd3/0x120
[ 56.597595][ T5057] vfs_getattr+0x46/0x430
[ 56.601910][ T5057] vfs_fstatat+0xd6/0x190
[ 56.606225][ T5057]
[ 56.608532][ T5057] Memory state around the buggy address:
[ 56.614141][ T5057] ffff88801d7f2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 56.622185][ T5057] ffff88801d7f2980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 56.630228][ T5057] >ffff88801d7f2a00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 56.638264][ T5057] ^
[ 56.643619][ T5057] ffff88801d7f2a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 56.651660][ T5057] ffff88801d7f2b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 56.659712][ T5057] ==================================================================
[ 56.668939][ T5057] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 56.676141][ T5057] CPU: 0 PID: 5057 Comm: syz-executor424 Not tainted 6.7.0-rc5-syzkaller-00200-g3bd7d7488169 #0
[ 56.686527][ T5057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 56.696559][ T5057] Call Trace:
[ 56.699815][ T5057]
[ 56.702726][ T5057] dump_stack_lvl+0x1e7/0x2d0
[ 56.707389][ T5057] ? nf_tcp_handle_invalid+0x650/0x650
[ 56.712837][ T5057] ? panic+0x850/0x850
[ 56.716918][ T5057] ? vscnprintf+0x5d/0x80
[ 56.721259][ T5057] panic+0x349/0x850
[ 56.725164][ T5057] ? check_panic_on_warn+0x21/0xa0
[ 56.730257][ T5057] ? __memcpy_flushcache+0x2b0/0x2b0
[ 56.735524][ T5057] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 56.741482][ T5057] ? _raw_spin_unlock+0x40/0x40
[ 56.746307][ T5057] ? print_report+0x4fb/0x540
[ 56.750964][ T5057] check_panic_on_warn+0x82/0xa0
[ 56.755886][ T5057] ? strlen+0x58/0x70
[ 56.759887][ T5057] end_report+0x6e/0x140
[ 56.764121][ T5057] kasan_report+0x153/0x170
[ 56.768605][ T5057] ? strlen+0x58/0x70
[ 56.772565][ T5057] strlen+0x58/0x70
[ 56.776350][ T5057] getname_kernel+0x1d/0x2e0
[ 56.780922][ T5057] kern_path+0x1d/0x50
[ 56.784971][ T5057] bdev_open_by_path+0xd1/0x540
[ 56.789800][ T5057] ? blkdev_put+0x770/0x770
[ 56.794283][ T5057] btrfs_dev_replace_by_ioctl+0x41b/0x2010
[ 56.800072][ T5057] ? btrfs_finish_block_group_to_copy+0x480/0x480
[ 56.806467][ T5057] ? btrfs_ioctl_dev_replace+0x2be/0x390
[ 56.812086][ T5057] ? do_raw_spin_lock+0x14e/0x370
[ 56.817117][ T5057] ? __lock_acquire+0x1fd0/0x1fd0
[ 56.822123][ T5057] ? do_raw_spin_unlock+0x13b/0x8b0
[ 56.827301][ T5057] btrfs_ioctl_dev_replace+0x2c9/0x390
[ 56.832738][ T5057] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 56.839130][ T5057] __se_sys_ioctl+0xf8/0x170
[ 56.843701][ T5057] do_syscall_64+0x45/0x110
[ 56.848187][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 56.854066][ T5057] RIP: 0033:0x7f8e8ffdc079
[ 56.858459][ T5057] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 56.878043][ T5057] RSP: 002b:00007ffe15cbe138 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 56.886437][ T5057] RAX: ffffffffffffffda RBX: 00007ffe15cbe308 RCX: 00007f8e8ffdc079
[ 56.894388][ T5057] RDX: 0000000020000540 RSI: 00000000ca289435 RDI: 0000000000000005
[ 56.902336][ T5057] RBP: 00007f8e90054610 R08: 00007ffe15cbe308 R09: 00007ffe15cbe308
[ 56.910283][ T5057] R10: 00007ffe15cbe308 R11: 0000000000000246 R12: 0000000000000001
[ 56.918231][ T5057] R13: 00007ffe15cbe2f8 R14: 0000000000000001 R15: 0000000000000001
[ 56.926185][ T5057]
[ 56.929401][ T5057] Kernel Offset: disabled
[ 56.933705][ T5057] Rebooting in 86400 seconds..