./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor156705297

<...>
forked to background, child pid 4646
no interfaces have a carrier
[   31.481155][ T4647] 8021q: adding VLAN 0 to HW filter on device bond0
[   31.490518][ T4647] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.0.125' (ECDSA) to the list of known hosts.
execve("./syz-executor156705297", ["./syz-executor156705297"], 0x7ffcaf1b5cc0 /* 10 vars */) = 0
brk(NULL)                               = 0x5555556b8000
brk(0x5555556b8c40)                     = 0x5555556b8c40
arch_prctl(ARCH_SET_FS, 0x5555556b8300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor156705297", 4096) = 27
brk(0x5555556d9c40)                     = 0x5555556d9c40
brk(0x5555556da000)                     = 0x5555556da000
mprotect(0x7f19ed1d3000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555556b85d0) = 5082
./strace-static-x86_64: Process 5082 attached
[pid  5082] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5082] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5082] setsid()                    = 1
[pid  5082] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5082] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5082] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5082] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5082] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5082] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5082] unshare(CLONE_NEWNS)        = 0
[pid  5082] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5082] unshare(CLONE_NEWIPC)       = 0
[pid  5082] unshare(CLONE_NEWCGROUP)    = 0
[pid  5082] unshare(CLONE_NEWUTS)       = 0
[pid  5082] unshare(CLONE_SYSVSEM)      = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "16777216", 8)     = 8
[pid  5082] close(3)                    = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "536870912", 9)    = 9
[pid  5082] close(3)                    = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "1024", 4)         = 4
[pid  5082] close(3)                    = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "8192", 4)         = 4
[pid  5082] close(3)                    = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "1024", 4)         = 4
[pid  5082] close(3)                    = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "1024", 4)         = 4
[pid  5082] close(3)                    = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5082] close(3)                    = 0
[pid  5082] getpid()                    = 1
[pid  5082] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5082] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5082] unshare(CLONE_NEWNET)       = 0
[pid  5082] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "0 65535", 7)      = 7
[pid  5082] close(3)                    = 0
[pid  5082] mkdir("/dev/binderfs", 0777) = 0
[pid  5082] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5082] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5082] memfd_create("syzkaller", 0) = 3
[pid  5082] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f19e4d18000
[pid  5082] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
[pid  5082] munmap(0x7f19e4d18000, 4194304) = 0
[pid  5082] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5082] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5082] close(3)                    = 0
[pid  5082] mkdir("./file0", 0777)      = 0
syzkaller login: [   54.926821][ T5082] loop0: detected capacity change from 0 to 8192
[   54.938168][ T5082] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[   54.951522][ T5082] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal
[   54.961053][ T5082] REISERFS (device loop0): using ordered data mode
[   54.967550][ T5082] reiserfs: using flush barriers
[   54.973801][ T5082] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[   54.990567][ T5082] REISERFS (device loop0): checking transaction log (loop0)
[pid  5082] mount("/dev/loop0", "./file0", "reiserfs", MS_SYNCHRONOUS|MS_DIRSYNC|MS_RELATIME|MS_STRICTATIME, "") = 0
[pid  5082] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid  5082] chdir("./file0")            = 0
[pid  5082] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5082] close(4)                    = 0
[pid  5082] open("./bus", O_RDWR|O_CREAT|O_SYNC|O_NOATIME|FASYNC, 000) = 4
[   55.039114][ T5082] REISERFS (device loop0): Using r5 hash to sort names
[   55.046893][ T5082] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
[   55.074408][ T5082] ==================================================================
[   55.082516][ T5082] BUG: KASAN: use-after-free in leaf_paste_in_buffer+0x739/0xca0
[   55.090276][ T5082] Write of size 408 at addr ffff8880720e7e68 by task syz-executor156/5082
[   55.098789][ T5082] 
[   55.101099][ T5082] CPU: 1 PID: 5082 Comm: syz-executor156 Not tainted 6.1.0-syzkaller-14587-g51094a24b85e #0
[   55.111137][ T5082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   55.121179][ T5082] Call Trace:
[   55.124448][ T5082]  <TASK>
[   55.127359][ T5082]  dump_stack_lvl+0x1b1/0x290
[   55.132032][ T5082]  ? nf_tcp_handle_invalid+0x630/0x630
[   55.137475][ T5082]  ? __wake_up_klogd+0xcd/0x100
[   55.142397][ T5082]  ? panic+0x710/0x710
[   55.146445][ T5082]  ? _printk+0xc0/0x100
[   55.150579][ T5082]  print_address_description+0x74/0x340
[   55.156109][ T5082]  print_report+0x107/0x1f0
[   55.160597][ T5082]  ? _raw_spin_lock+0x40/0x40
[   55.165254][ T5082]  ? __virt_addr_valid+0x21b/0x2d0
[   55.170355][ T5082]  ? __phys_addr+0xb5/0x160
[   55.174854][ T5082]  ? leaf_paste_in_buffer+0x739/0xca0
[   55.180220][ T5082]  kasan_report+0xcd/0x100
[   55.184633][ T5082]  ? leaf_paste_in_buffer+0x739/0xca0
[   55.190002][ T5082]  kasan_check_range+0x2a7/0x2e0
[   55.194934][ T5082]  ? leaf_paste_in_buffer+0x739/0xca0
[   55.200301][ T5082]  memcpy+0x3c/0x60
[   55.204097][ T5082]  leaf_paste_in_buffer+0x739/0xca0
[   55.209295][ T5082]  leaf_copy_boundary_item+0xc76/0x20f0
[   55.214838][ T5082]  leaf_move_items+0xc74/0x1330
[   55.219683][ T5082]  ? reiserfs_convert_objectid_map_v1+0x6d0/0x6d0
[   55.226096][ T5082]  ? read_lock_is_recursive+0x10/0x10
[   55.231460][ T5082]  leaf_shift_left+0xb7/0x420
[   55.236132][ T5082]  balance_leaf+0x2f2f/0x123a0
[   55.240911][ T5082]  ? do_balance+0x8d0/0x8d0
[   55.245407][ T5082]  ? rcu_read_lock_sched_held+0x87/0x110
[   55.251028][ T5082]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   55.256997][ T5082]  ? trace_raw_output_contention_end+0xd0/0xd0
[   55.263140][ T5082]  ? trace_contention_end+0x72/0x1d0
[   55.268413][ T5082]  ? __mutex_lock_common+0x45f/0x26e0
[   55.273785][ T5082]  ? write_boundary_block+0xb0/0xb0
[   55.278974][ T5082]  ? __mutex_unlock_slowpath+0x222/0x770
[   55.284605][ T5082]  ? __might_sleep+0xc0/0xc0
[   55.289186][ T5082]  ? reiserfs_write_lock_nested+0x5b/0xd0
[   55.294897][ T5082]  ? mutex_lock_io_nested+0x60/0x60
[   55.300084][ T5082]  ? get_empty_nodes+0x5a3/0xd00
[   55.305012][ T5082]  ? indirect_part_size+0x8/0x10
[   55.309940][ T5082]  ? __wake_up+0x1f0/0x1f0
[   55.314346][ T5082]  ? get_neighbors+0x1020/0x1020
[   55.319277][ T5082]  ? mutex_lock_nested+0x17/0x20
[   55.324206][ T5082]  ? reiserfs_write_lock_nested+0x5b/0xd0
[   55.329921][ T5082]  ? reiserfs_prepare_for_journal+0x239/0x250
[   55.335976][ T5082]  ? fix_nodes+0x73e4/0x8560
[   55.340566][ T5082]  do_balance+0x2d6/0x8d0
[   55.344889][ T5082]  ? get_right_neighbor_position+0x200/0x200
[   55.350862][ T5082]  ? stack_trace_save+0x1e0/0x1e0
[   55.355879][ T5082]  ? reiserfs_paste_into_item+0x3f5/0x880
[   55.361605][ T5082]  reiserfs_paste_into_item+0x740/0x880
[   55.367156][ T5082]  ? __kernel_text_address+0x9/0x40
[   55.372351][ T5082]  ? reiserfs_cut_from_item+0x25b0/0x25b0
[   55.378080][ T5082]  ? rcu_read_lock_sched_held+0x87/0x110
[   55.384225][ T5082]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   55.390202][ T5082]  ? __kmem_cache_alloc_node+0x21a/0x340
[   55.395824][ T5082]  ? reiserfs_get_block+0x19e4/0x5180
[   55.401184][ T5082]  ? trace_kmalloc+0x30/0xf0
[   55.405769][ T5082]  ? __kmalloc+0xcc/0x190
[   55.410089][ T5082]  reiserfs_get_block+0x223f/0x5180
[   55.415296][ T5082]  ? make_le_item_head+0x5b0/0x5b0
[   55.420400][ T5082]  ? register_lock_class+0xc2/0x930
[   55.425587][ T5082]  ? create_page_buffers+0x1c8/0x4b0
[   55.430865][ T5082]  ? __block_write_begin_int+0x1e0/0x1a80
[   55.436576][ T5082]  ? reiserfs_write_begin+0x247/0x510
[   55.441935][ T5082]  ? generic_cont_expand_simple+0x151/0x250
[   55.447819][ T5082]  ? reiserfs_setattr+0x642/0x1200
[   55.452921][ T5082]  ? do_truncate+0x200/0x2f0
[   55.457594][ T5082]  ? do_sys_ftruncate+0x2b0/0x350
[   55.462603][ T5082]  ? is_dynamic_key+0x1f0/0x1f0
[   55.467445][ T5082]  ? mark_lock+0x9a/0x350
[   55.471768][ T5082]  ? __lock_acquire+0x1292/0x1f60
[   55.476787][ T5082]  ? rcu_read_lock_sched_held+0x22/0x110
[   55.482408][ T5082]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   55.488388][ T5082]  ? __lock_acquire+0x1f60/0x1f60
[   55.493400][ T5082]  ? alloc_page_buffers+0x326/0x460
[   55.498596][ T5082]  ? create_page_buffers+0x244/0x4b0
[   55.503874][ T5082]  __block_write_begin_int+0x54c/0x1a80
[   55.509417][ T5082]  ? xas_load+0x127/0x150
[   55.513749][ T5082]  ? make_le_item_head+0x5b0/0x5b0
[   55.518852][ T5082]  ? page_zero_new_buffers+0x940/0x940
[   55.524304][ T5082]  ? __block_write_begin+0x51/0x150
[   55.529499][ T5082]  ? reiserfs_write_begin+0x180/0x510
[   55.534863][ T5082]  reiserfs_write_begin+0x247/0x510
[   55.540055][ T5082]  generic_cont_expand_simple+0x151/0x250
[   55.545777][ T5082]  ? submit_bh+0x20/0x20
[   55.550014][ T5082]  ? mutex_lock_nested+0x17/0x20
[   55.554942][ T5082]  reiserfs_setattr+0x642/0x1200
[   55.559873][ T5082]  ? reiserfs_commit_write+0x580/0x580
[   55.565323][ T5082]  ? ktime_get_coarse_real_ts64+0x12c/0x140
[   55.571212][ T5082]  ? current_time+0x1ea/0x300
[   55.575881][ T5082]  ? atime_needs_update+0x780/0x780
[   55.581072][ T5082]  ? security_inode_setattr+0x109/0x150
[   55.586621][ T5082]  ? reiserfs_commit_write+0x580/0x580
[   55.592069][ T5082]  notify_change+0xe50/0x1100
[   55.596746][ T5082]  do_truncate+0x200/0x2f0
[   55.601150][ T5082]  ? put_page_bootmem+0x2d0/0x2d0
[   55.606170][ T5082]  do_sys_ftruncate+0x2b0/0x350
[   55.611012][ T5082]  do_syscall_64+0x3d/0xb0
[   55.615436][ T5082]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.621322][ T5082] RIP: 0033:0x7f19ed164e89
[   55.625728][ T5082] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   55.645326][ T5082] RSP: 002b:00007ffe266616d8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
[   55.653726][ T5082] RAX: ffffffffffffffda RBX: 00007f19ed1d3ed0 RCX: 00007f19ed164e89
[   55.661796][ T5082] RDX: 00007f19ed164e89 RSI: 0000000002007ffb RDI: 0000000000000004
[   55.669766][ T5082] RBP: 00007ffe266616e8 R08: 00007f19ed1d3e40 R09: 00007f19ed1d3e40
[   55.677741][ T5082] R10: 00000000000010f8 R11: 0000000000000246 R12: 00007ffe266616f0
[   55.685704][ T5082] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   55.693671][ T5082]  </TASK>
[   55.696679][ T5082] 
[   55.698992][ T5082] The buggy address belongs to the physical page:
[   55.705404][ T5082] page:ffffea0001c839c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x720e7
[   55.715825][ T5082] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   55.722944][ T5082] raw: 00fff00000000000 ffffea0001c83a08 ffffea0001c83988 0000000000000000
[   55.731519][ T5082] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[   55.740081][ T5082] page dumped because: kasan: bad access detected
[   55.746476][ T5082] page_owner tracks the page as freed
[   55.751825][ T5082] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 11676057789, free_ts 12809195847
[   55.766763][ T5082]  split_map_pages+0x25b/0x540
[   55.771539][ T5082]  isolate_freepages_range+0x4ac/0x510
[   55.776999][ T5082]  alloc_contig_range+0x6a9/0x980
[   55.782023][ T5082]  alloc_contig_pages+0x3c8/0x4e0
[   55.787048][ T5082]  debug_vm_pgtable_alloc_huge_page+0xcd/0x120
[   55.793196][ T5082]  init_args+0xa3a/0xdc0
[   55.797519][ T5082]  debug_vm_pgtable+0x9a/0x4a0
[   55.802279][ T5082]  do_one_initcall+0x1d1/0x410
[   55.807031][ T5082]  do_initcall_level+0x168/0x220
[   55.811957][ T5082]  do_initcalls+0x43/0x90
[   55.816274][ T5082]  kernel_init_freeable+0x428/0x5e0
[   55.821462][ T5082]  kernel_init+0x19/0x2b0
[   55.825781][ T5082]  ret_from_fork+0x1f/0x30
[   55.830187][ T5082] page last free stack trace:
[   55.834842][ T5082]  free_pcp_prepare+0x751/0x780
[   55.839687][ T5082]  free_unref_page+0x19/0x4c0
[   55.844353][ T5082]  free_contig_range+0xa3/0x160
[   55.849197][ T5082]  destroy_args+0xfe/0x940
[   55.853609][ T5082]  debug_vm_pgtable+0x43d/0x4a0
[   55.858449][ T5082]  do_one_initcall+0x1d1/0x410
[   55.863986][ T5082]  do_initcall_level+0x168/0x220
[   55.868910][ T5082]  do_initcalls+0x43/0x90
[   55.873232][ T5082]  kernel_init_freeable+0x428/0x5e0
[   55.878426][ T5082]  kernel_init+0x19/0x2b0
[   55.882768][ T5082]  ret_from_fork+0x1f/0x30
[   55.887174][ T5082] 
[   55.889486][ T5082] Memory state around the buggy address:
[   55.895097][ T5082]  ffff8880720e7d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.903143][ T5082]  ffff8880720e7d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.911276][ T5082] >ffff8880720e7e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.919318][ T5082]                                                           ^
[   55.926757][ T5082]  ffff8880720e7e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.934802][ T5082]  ffff8880720e7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.942845][ T5082] ==================================================================
[   55.951163][ T5082] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   55.958378][ T5082] CPU: 0 PID: 5082 Comm: syz-executor156 Not tainted 6.1.0-syzkaller-14587-g51094a24b85e #0
[   55.968446][ T5082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   55.978493][ T5082] Call Trace:
[   55.981762][ T5082]  <TASK>
[   55.984685][ T5082]  dump_stack_lvl+0x1b1/0x290
[   55.989365][ T5082]  ? nf_tcp_handle_invalid+0x630/0x630
[   55.994816][ T5082]  ? panic+0x710/0x710
[   55.998876][ T5082]  ? lock_release+0x81/0x820
[   56.003460][ T5082]  ? vscnprintf+0x59/0x80
[   56.007781][ T5082]  panic+0x2d6/0x710
[   56.011667][ T5082]  ? check_panic_on_warn+0x1d/0xa0
[   56.016772][ T5082]  ? memcpy_page_flushcache+0x100/0x100
[   56.022307][ T5082]  ? _raw_spin_unlock_irqrestore+0x110/0x120
[   56.028281][ T5082]  ? _raw_spin_unlock+0x40/0x40
[   56.033128][ T5082]  ? print_report+0x1b4/0x1f0
[   56.037802][ T5082]  check_panic_on_warn+0x80/0xa0
[   56.042734][ T5082]  ? leaf_paste_in_buffer+0x739/0xca0
[   56.048101][ T5082]  end_report+0x47/0x90
[   56.052248][ T5082]  kasan_report+0xda/0x100
[   56.056656][ T5082]  ? leaf_paste_in_buffer+0x739/0xca0
[   56.062543][ T5082]  kasan_check_range+0x2a7/0x2e0
[   56.067475][ T5082]  ? leaf_paste_in_buffer+0x739/0xca0
[   56.072842][ T5082]  memcpy+0x3c/0x60
[   56.076641][ T5082]  leaf_paste_in_buffer+0x739/0xca0
[   56.081841][ T5082]  leaf_copy_boundary_item+0xc76/0x20f0
[   56.087388][ T5082]  leaf_move_items+0xc74/0x1330
[   56.092235][ T5082]  ? reiserfs_convert_objectid_map_v1+0x6d0/0x6d0
[   56.098645][ T5082]  ? read_lock_is_recursive+0x10/0x10
[   56.104014][ T5082]  leaf_shift_left+0xb7/0x420
[   56.108689][ T5082]  balance_leaf+0x2f2f/0x123a0
[   56.113464][ T5082]  ? do_balance+0x8d0/0x8d0
[   56.117957][ T5082]  ? rcu_read_lock_sched_held+0x87/0x110
[   56.123583][ T5082]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   56.129555][ T5082]  ? trace_raw_output_contention_end+0xd0/0xd0
[   56.135712][ T5082]  ? trace_contention_end+0x72/0x1d0
[   56.140988][ T5082]  ? __mutex_lock_common+0x45f/0x26e0
[   56.146350][ T5082]  ? write_boundary_block+0xb0/0xb0
[   56.151541][ T5082]  ? __mutex_unlock_slowpath+0x222/0x770
[   56.157169][ T5082]  ? __might_sleep+0xc0/0xc0
[   56.161750][ T5082]  ? reiserfs_write_lock_nested+0x5b/0xd0
[   56.167463][ T5082]  ? mutex_lock_io_nested+0x60/0x60
[   56.172652][ T5082]  ? get_empty_nodes+0x5a3/0xd00
[   56.177581][ T5082]  ? indirect_part_size+0x8/0x10
[   56.182510][ T5082]  ? __wake_up+0x1f0/0x1f0
[   56.186916][ T5082]  ? get_neighbors+0x1020/0x1020
[   56.191846][ T5082]  ? mutex_lock_nested+0x17/0x20
[   56.196773][ T5082]  ? reiserfs_write_lock_nested+0x5b/0xd0
[   56.202488][ T5082]  ? reiserfs_prepare_for_journal+0x239/0x250
[   56.208580][ T5082]  ? fix_nodes+0x73e4/0x8560
[   56.213169][ T5082]  do_balance+0x2d6/0x8d0
[   56.217493][ T5082]  ? get_right_neighbor_position+0x200/0x200
[   56.223465][ T5082]  ? stack_trace_save+0x1e0/0x1e0
[   56.228481][ T5082]  ? reiserfs_paste_into_item+0x3f5/0x880
[   56.234190][ T5082]  reiserfs_paste_into_item+0x740/0x880
[   56.239726][ T5082]  ? __kernel_text_address+0x9/0x40
[   56.244925][ T5082]  ? reiserfs_cut_from_item+0x25b0/0x25b0
[   56.250654][ T5082]  ? rcu_read_lock_sched_held+0x87/0x110
[   56.256279][ T5082]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   56.262257][ T5082]  ? __kmem_cache_alloc_node+0x21a/0x340
[   56.267881][ T5082]  ? reiserfs_get_block+0x19e4/0x5180
[   56.273242][ T5082]  ? trace_kmalloc+0x30/0xf0
[   56.277821][ T5082]  ? __kmalloc+0xcc/0x190
[   56.282147][ T5082]  reiserfs_get_block+0x223f/0x5180
[   56.287394][ T5082]  ? make_le_item_head+0x5b0/0x5b0
[   56.292495][ T5082]  ? register_lock_class+0xc2/0x930
[   56.297691][ T5082]  ? create_page_buffers+0x1c8/0x4b0
[   56.302966][ T5082]  ? __block_write_begin_int+0x1e0/0x1a80
[   56.308682][ T5082]  ? reiserfs_write_begin+0x247/0x510
[   56.314048][ T5082]  ? generic_cont_expand_simple+0x151/0x250
[   56.319932][ T5082]  ? reiserfs_setattr+0x642/0x1200
[   56.325032][ T5082]  ? do_truncate+0x200/0x2f0
[   56.329611][ T5082]  ? do_sys_ftruncate+0x2b0/0x350
[   56.334631][ T5082]  ? is_dynamic_key+0x1f0/0x1f0
[   56.339475][ T5082]  ? mark_lock+0x9a/0x350
[   56.343795][ T5082]  ? __lock_acquire+0x1292/0x1f60
[   56.348813][ T5082]  ? rcu_read_lock_sched_held+0x22/0x110
[   56.354436][ T5082]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   56.360416][ T5082]  ? __lock_acquire+0x1f60/0x1f60
[   56.365428][ T5082]  ? alloc_page_buffers+0x326/0x460
[   56.370621][ T5082]  ? create_page_buffers+0x244/0x4b0
[   56.375898][ T5082]  __block_write_begin_int+0x54c/0x1a80
[   56.381438][ T5082]  ? xas_load+0x127/0x150
[   56.385767][ T5082]  ? make_le_item_head+0x5b0/0x5b0
[   56.390867][ T5082]  ? page_zero_new_buffers+0x940/0x940
[   56.396319][ T5082]  ? __block_write_begin+0x51/0x150
[   56.401508][ T5082]  ? reiserfs_write_begin+0x180/0x510
[   56.406871][ T5082]  reiserfs_write_begin+0x247/0x510
[   56.412065][ T5082]  generic_cont_expand_simple+0x151/0x250
[   56.417777][ T5082]  ? submit_bh+0x20/0x20
[   56.422022][ T5082]  ? mutex_lock_nested+0x17/0x20
[   56.426959][ T5082]  reiserfs_setattr+0x642/0x1200
[   56.431887][ T5082]  ? reiserfs_commit_write+0x580/0x580
[   56.437344][ T5082]  ? ktime_get_coarse_real_ts64+0x12c/0x140
[   56.443245][ T5082]  ? current_time+0x1ea/0x300
[   56.447914][ T5082]  ? atime_needs_update+0x780/0x780
[   56.453114][ T5082]  ? security_inode_setattr+0x109/0x150
[   56.458685][ T5082]  ? reiserfs_commit_write+0x580/0x580
[   56.464133][ T5082]  notify_change+0xe50/0x1100
[   56.468805][ T5082]  do_truncate+0x200/0x2f0
[   56.473210][ T5082]  ? put_page_bootmem+0x2d0/0x2d0
[   56.478245][ T5082]  do_sys_ftruncate+0x2b0/0x350
[   56.483089][ T5082]  do_syscall_64+0x3d/0xb0
[   56.487506][ T5082]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   56.493391][ T5082] RIP: 0033:0x7f19ed164e89
[   56.497797][ T5082] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   56.517390][ T5082] RSP: 002b:00007ffe266616d8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
[   56.525793][ T5082] RAX: ffffffffffffffda RBX: 00007f19ed1d3ed0 RCX: 00007f19ed164e89
[   56.533772][ T5082] RDX: 00007f19ed164e89 RSI: 0000000002007ffb RDI: 0000000000000004
[   56.541744][ T5082] RBP: 00007ffe266616e8 R08: 00007f19ed1d3e40 R09: 00007f19ed1d3e40
[   56.549719][ T5082] R10: 00000000000010f8 R11: 0000000000000246 R12: 00007ffe266616f0
[   56.557683][ T5082] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   56.565655][ T5082]  </TASK>
[   56.568822][ T5082] Kernel Offset: disabled
[   56.573135][ T5082] Rebooting in 86400 seconds..