./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor334042639
<...>
no interfaces have a carrier
forked to background, child pid 31[ 20.610838][ T3181] 8021q: adding VLAN 0 to HW filter on device bond0
80
[ 20.619415][ T3181] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.185' (ECDSA) to the list of known hosts.
execve("./syz-executor334042639", ["./syz-executor334042639"], 0x7ffcf2f614c0 /* 10 vars */) = 0
brk(NULL) = 0x55555624b000
brk(0x55555624bd00) = 0x55555624bd00
arch_prctl(ARCH_SET_FS, 0x55555624b3c0) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor334042639", 4096) = 27
brk(0x55555626cd00) = 0x55555626cd00
brk(0x55555626d000) = 0x55555626d000
mprotect(0x7fde79507000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 3608
openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3
write(3, "10000000000", 11) = 11
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3
write(3, "20", 2) = 2
close(3) = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
write(3, "100", 3) = 3
close(3) = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3
write(3, "7 4 1 3", 7) = 7
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3
write(3, "3608", 4) = 4
close(3) = 0
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7fde794587b0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fde79458df0}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7fde794587b0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fde79458df0}, NULL, 8) = 0
getpid() = 3608
mkdir("./syzkaller.dQgQa2", 0700) = 0
chmod("./syzkaller.dQgQa2", 0777) = 0
chdir("./syzkaller.dQgQa2") = 0
memfd_create("syzkaller", 0) = 3
ftruncate(3, 135266304) = 0
pwrite64(3, "\x00\x5e\x00\x00\x68\x02\x00\x00\x97\x3d\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x84\x3d\x00\x00\x00\x04\x00\x00\x73\x56\x4d\x38\x84\x03\x00\x00\x1e\x00\x00\x00\x00\x00\x27\xd0\x00\x10\xcc\x03\x02\x00\x01\x00\x52\x65\x49\x73\x45\x72\x33\x46\x73\x00\x00\x00\x03\x00\x00\x00\x02", 69, 8192) = 69
pwrite64(3, "\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\xed\x15\x00\x00\x00\x00\x1e\x00\x00\x84\x3d\x00\x00\x00\x04\x00\x00\x73\x56\x4d\x38\x84\x03", 34, 64577536) = 34
pwrite64(3, "\x01\x00\x02\x00\x5c\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x2c\x00\xd4\x0f\x01\x00\x01\x00\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00\xf4\x01\x00\x00\x02\x00\x30\x00\xa4\x0f", 70, 64581632) = 70
pwrite64(3, "\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x28\x00\x04\x00\x02\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x20\x00\x04\x00\x2e\x2e\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x00\x00\x00\x00\xed\x41\x00\x00\x03\x44\x4e\x3e\x03", 61, 64585632) = 61
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
mkdir("./file0", 0777) = 0
syzkaller login: [ 41.336873][ T3608] loop0: detected capacity change from 0 to 264192
[ 41.346087][ T3608] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[ 41.359220][ T3608] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal
[ 41.368481][ T3608] REISERFS (device loop0): using ordered data mode
[ 41.375025][ T3608] reiserfs: using flush barriers
[ 41.380500][ T3608] REISERFS (device loop0): journal params: device loop0, size 15748, journal first block 18, max trans len 1024, max batch 900, max commit age 0, max trans age 30
[ 41.399413][ T3608] REISERFS (device loop0): checking transaction log (loop0)
[ 41.407361][ T3608] REISERFS (device loop0): Using r5 hash to sort names
[ 41.414266][ T3608] REISERFS (device loop0): using 3.5.x disk format
[ 41.420801][ T3608] ==================================================================
[ 41.428860][ T3608] BUG: KASAN: use-after-free in search_by_entry_key+0x81f/0x960
[ 41.436483][ T3608] Read of size 4 at addr ffff88806f9edfc4 by task syz-executor334/3608
[ 41.444700][ T3608]
[ 41.447007][ T3608] CPU: 0 PID: 3608 Comm: syz-executor334 Not tainted 6.1.0-rc2-syzkaller-00062-ga970174d7a10 #0
[ 41.457398][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
[ 41.467435][ T3608] Call Trace:
[ 41.470697][ T3608]
[ 41.473610][ T3608] dump_stack_lvl+0xcd/0x134
[ 41.478201][ T3608] print_report+0x15e/0x45d
[ 41.482726][ T3608] ? __phys_addr+0xc4/0x140
[ 41.487221][ T3608] ? search_by_entry_key+0x81f/0x960
[ 41.492514][ T3608] kasan_report+0xbb/0x1f0
[ 41.496934][ T3608] ? search_by_entry_key+0x81f/0x960
[ 41.502213][ T3608] search_by_entry_key+0x81f/0x960
[ 41.507339][ T3608] reiserfs_find_entry.part.0+0x139/0xdf0
[ 41.513053][ T3608] ? lock_downgrade+0x6e0/0x6e0
[ 41.517893][ T3608] ? mutex_lock_io_nested+0x1190/0x1190
[ 41.523430][ T3608] ? search_by_entry_key+0x960/0x960
[ 41.528707][ T3608] ? rcu_read_lock_sched_held+0xd/0x70
[ 41.534243][ T3608] ? lock_release+0x5cb/0x810
[ 41.538910][ T3608] reiserfs_lookup+0x24a/0x490
[ 41.543684][ T3608] ? reiserfs_unlink+0x760/0x760
[ 41.548614][ T3608] ? d_alloc_parallel+0x690/0x1400
[ 41.553887][ T3608] ? prb_final_commit+0xa0/0xa0
[ 41.558734][ T3608] __lookup_slow+0x24c/0x460
[ 41.563321][ T3608] ? __lookup_hash+0x180/0x180
[ 41.568069][ T3608] ? lock_downgrade+0x6e0/0x6e0
[ 41.572909][ T3608] ? verify_cpu+0xc0/0x100
[ 41.577326][ T3608] ? verify_cpu+0xc0/0x100
[ 41.581752][ T3608] ? d_lookup+0x101/0x170
[ 41.586071][ T3608] lookup_one_len+0x16a/0x1a0
[ 41.590737][ T3608] ? try_lookup_one_len+0x180/0x180
[ 41.596010][ T3608] ? down_write_killable_nested+0x250/0x250
[ 41.601897][ T3608] reiserfs_lookup_privroot+0x92/0x280
[ 41.607356][ T3608] reiserfs_fill_super+0x1a8b/0x2e90
[ 41.612728][ T3608] ? reiserfs_remount+0x1530/0x1530
[ 41.617920][ T3608] ? sget+0x472/0x580
[ 41.621978][ T3608] ? snprintf+0xbb/0xf0
[ 41.626124][ T3608] ? vsprintf+0x30/0x30
[ 41.630267][ T3608] ? wait_for_completion_io_timeout+0x20/0x20
[ 41.636327][ T3608] ? up_write+0x1ac/0x520
[ 41.640653][ T3608] ? set_blocksize+0x2e5/0x370
[ 41.645409][ T3608] mount_bdev+0x34d/0x410
[ 41.649729][ T3608] ? reiserfs_remount+0x1530/0x1530
[ 41.654928][ T3608] ? reiserfs_kill_sb+0x1e0/0x1e0
[ 41.659949][ T3608] legacy_get_tree+0x105/0x220
[ 41.664706][ T3608] vfs_get_tree+0x89/0x2f0
[ 41.669111][ T3608] path_mount+0x1326/0x1e20
[ 41.673607][ T3608] ? kmem_cache_free+0xea/0x5b0
[ 41.678459][ T3608] ? finish_automount+0x960/0x960
[ 41.683495][ T3608] ? putname+0xfe/0x140
[ 41.687642][ T3608] __x64_sys_mount+0x27f/0x300
[ 41.692592][ T3608] ? copy_mnt_ns+0xae0/0xae0
[ 41.697174][ T3608] ? _raw_spin_unlock_irq+0x2a/0x40
[ 41.702388][ T3608] ? ptrace_notify+0xfa/0x140
[ 41.707059][ T3608] do_syscall_64+0x35/0xb0
[ 41.711471][ T3608] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.717385][ T3608] RIP: 0033:0x7fde794a36ba
[ 41.721789][ T3608] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 41.741481][ T3608] RSP: 002b:00007ffc5b0013c8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 41.749885][ T3608] RAX: ffffffffffffffda RBX: 00007ffc5b001420 RCX: 00007fde794a36ba
[ 41.757848][ T3608] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc5b0013e0
[ 41.765812][ T3608] RBP: 0000000000000003 R08: 00007ffc5b001420 R09: 0000000000000000
[ 41.773774][ T3608] R10: 0000000000010001 R11: 0000000000000286 R12: 00007ffc5b0013e0
[ 41.781737][ T3608] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000004
[ 41.789726][ T3608]
[ 41.792749][ T3608]
[ 41.795057][ T3608] The buggy address belongs to the physical page:
[ 41.801459][ T3608] page:ffffea0001be7b40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6f9ed
[ 41.811603][ T3608] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 41.818713][ T3608] raw: 00fff00000000000 ffffea0001be7b88 ffff8880b9a408a0 0000000000000000
[ 41.827289][ T3608] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 41.835861][ T3608] page dumped because: kasan: bad access detected
[ 41.842256][ T3608] page_owner tracks the page as freed
[ 41.847607][ T3608] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 3594, tgid 3594 (sshd), ts 35106391393, free_ts 35119806059
[ 41.865571][ T3608] get_page_from_freelist+0x10b5/0x2d50
[ 41.871118][ T3608] __alloc_pages+0x1c7/0x5a0
[ 41.875697][ T3608] __folio_alloc+0x12/0x40
[ 41.880102][ T3608] vma_alloc_folio+0xf9/0x780
[ 41.884803][ T3608] __handle_mm_fault+0x178c/0x3a40
[ 41.889916][ T3608] handle_mm_fault+0x1c8/0x780
[ 41.894758][ T3608] do_user_addr_fault+0x475/0x1210
[ 41.900045][ T3608] exc_page_fault+0x94/0x170
[ 41.904625][ T3608] asm_exc_page_fault+0x22/0x30
[ 41.909492][ T3608] page last free stack trace:
[ 41.914150][ T3608] free_pcp_prepare+0x65c/0xd90
[ 41.919015][ T3608] free_unref_page_list+0x172/0xc40
[ 41.924217][ T3608] release_pages+0xc86/0x1360
[ 41.928883][ T3608] tlb_batch_pages_flush+0xa8/0x1a0
[ 41.934067][ T3608] tlb_finish_mmu+0x147/0x7e0
[ 41.938727][ T3608] unmap_region+0x26a/0x300
[ 41.943220][ T3608] do_mas_align_munmap+0x851/0xee0
[ 41.948351][ T3608] do_mas_munmap+0x26a/0x2b0
[ 41.952944][ T3608] __vm_munmap+0x14f/0x290
[ 41.957353][ T3608] __x64_sys_munmap+0x55/0x80
[ 41.962024][ T3608] do_syscall_64+0x35/0xb0
[ 41.966433][ T3608] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.972325][ T3608]
[ 41.974630][ T3608] Memory state around the buggy address:
[ 41.980238][ T3608] ffff88806f9ede80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 41.988280][ T3608] ffff88806f9edf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 41.996322][ T3608] >ffff88806f9edf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 42.004363][ T3608] ^
[ 42.010520][ T3608] ffff88806f9ee000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 42.018665][ T3608] ffff88806f9ee080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 42.026719][ T3608] ==================================================================
[ 42.035111][ T3608] Kernel panic - not syncing: panic_on_warn set ...
[ 42.041701][ T3608] CPU: 0 PID: 3608 Comm: syz-executor334 Not tainted 6.1.0-rc2-syzkaller-00062-ga970174d7a10 #0
[ 42.052118][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
[ 42.062159][ T3608] Call Trace:
[ 42.065446][ T3608]
[ 42.068359][ T3608] dump_stack_lvl+0xcd/0x134
[ 42.073039][ T3608] panic+0x2c8/0x622
[ 42.077014][ T3608] ? panic_print_sys_info.part.0+0x110/0x110
[ 42.082980][ T3608] ? preempt_schedule_common+0x59/0xc0
[ 42.088428][ T3608] ? preempt_schedule_thunk+0x16/0x18
[ 42.093795][ T3608] end_report.part.0+0x3f/0x7c
[ 42.098723][ T3608] ? search_by_entry_key+0x81f/0x960
[ 42.103999][ T3608] kasan_report.cold+0xa/0xf
[ 42.108572][ T3608] ? search_by_entry_key+0x81f/0x960
[ 42.113851][ T3608] search_by_entry_key+0x81f/0x960
[ 42.118944][ T3608] reiserfs_find_entry.part.0+0x139/0xdf0
[ 42.124642][ T3608] ? lock_downgrade+0x6e0/0x6e0
[ 42.129472][ T3608] ? mutex_lock_io_nested+0x1190/0x1190
[ 42.134999][ T3608] ? search_by_entry_key+0x960/0x960
[ 42.140265][ T3608] ? rcu_read_lock_sched_held+0xd/0x70
[ 42.145707][ T3608] ? lock_release+0x5cb/0x810
[ 42.150374][ T3608] reiserfs_lookup+0x24a/0x490
[ 42.155145][ T3608] ? reiserfs_unlink+0x760/0x760
[ 42.160083][ T3608] ? d_alloc_parallel+0x690/0x1400
[ 42.165190][ T3608] ? prb_final_commit+0xa0/0xa0
[ 42.170042][ T3608] __lookup_slow+0x24c/0x460
[ 42.174634][ T3608] ? __lookup_hash+0x180/0x180
[ 42.179384][ T3608] ? lock_downgrade+0x6e0/0x6e0
[ 42.184230][ T3608] ? verify_cpu+0xc0/0x100
[ 42.188647][ T3608] ? verify_cpu+0xc0/0x100
[ 42.193060][ T3608] ? d_lookup+0x101/0x170
[ 42.197396][ T3608] lookup_one_len+0x16a/0x1a0
[ 42.202073][ T3608] ? try_lookup_one_len+0x180/0x180
[ 42.207265][ T3608] ? down_write_killable_nested+0x250/0x250
[ 42.213186][ T3608] reiserfs_lookup_privroot+0x92/0x280
[ 42.218653][ T3608] reiserfs_fill_super+0x1a8b/0x2e90
[ 42.223967][ T3608] ? reiserfs_remount+0x1530/0x1530
[ 42.229169][ T3608] ? sget+0x472/0x580
[ 42.233147][ T3608] ? snprintf+0xbb/0xf0
[ 42.237987][ T3608] ? vsprintf+0x30/0x30
[ 42.242132][ T3608] ? wait_for_completion_io_timeout+0x20/0x20
[ 42.248203][ T3608] ? up_write+0x1ac/0x520
[ 42.252537][ T3608] ? set_blocksize+0x2e5/0x370
[ 42.257306][ T3608] mount_bdev+0x34d/0x410
[ 42.261634][ T3608] ? reiserfs_remount+0x1530/0x1530
[ 42.266849][ T3608] ? reiserfs_kill_sb+0x1e0/0x1e0
[ 42.271879][ T3608] legacy_get_tree+0x105/0x220
[ 42.276636][ T3608] vfs_get_tree+0x89/0x2f0
[ 42.281057][ T3608] path_mount+0x1326/0x1e20
[ 42.285549][ T3608] ? kmem_cache_free+0xea/0x5b0
[ 42.290411][ T3608] ? finish_automount+0x960/0x960
[ 42.295428][ T3608] ? putname+0xfe/0x140
[ 42.299577][ T3608] __x64_sys_mount+0x27f/0x300
[ 42.304421][ T3608] ? copy_mnt_ns+0xae0/0xae0
[ 42.309087][ T3608] ? _raw_spin_unlock_irq+0x2a/0x40
[ 42.314286][ T3608] ? ptrace_notify+0xfa/0x140
[ 42.318955][ T3608] do_syscall_64+0x35/0xb0
[ 42.323394][ T3608] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 42.329296][ T3608] RIP: 0033:0x7fde794a36ba
[ 42.333702][ T3608] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 42.353488][ T3608] RSP: 002b:00007ffc5b0013c8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[ 42.361902][ T3608] RAX: ffffffffffffffda RBX: 00007ffc5b001420 RCX: 00007fde794a36ba
[ 42.369871][ T3608] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc5b0013e0
[ 42.377838][ T3608] RBP: 0000000000000003 R08: 00007ffc5b001420 R09: 0000000000000000
[ 42.385797][ T3608] R10: 0000000000010001 R11: 0000000000000286 R12: 00007ffc5b0013e0
[ 42.393758][ T3608] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000004
[ 42.401742][ T3608]
[ 42.405429][ T3608] Kernel Offset: disabled
[ 42.409745][ T3608] Rebooting in 86400 seconds..