./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1550581802
<...>
DUID 00:04:dd:0f:a4:e5:cb:b8:04:95:2f:30:92:03:b3:b6:0d:bc
forked to background, child pid 4659
[ 33.929545][ T4660] 8021q: adding VLAN 0 to HW filter on device bond0
[ 33.946237][ T4660] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.10.32' (ECDSA) to the list of known hosts.
execve("./syz-executor1550581802", ["./syz-executor1550581802"], 0x7ffd1446dff0 /* 10 vars */) = 0
brk(NULL) = 0x5555567cd000
brk(0x5555567cdc40) = 0x5555567cdc40
arch_prctl(ARCH_SET_FS, 0x5555567cd300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1550581802", 4096) = 28
brk(0x5555567eec40) = 0x5555567eec40
brk(0x5555567ef000) = 0x5555567ef000
mprotect(0x7f8c8832c000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 4991
mkdir("./syzkaller.aJA9CC", 0700) = 0
chmod("./syzkaller.aJA9CC", 0777) = 0
chdir("./syzkaller.aJA9CC") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555567cd5d0) = 4992
./strace-static-x86_64: Process 4992 attached
[pid 4992] chdir("./0") = 0
[pid 4992] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4992] setpgid(0, 0) = 0
[pid 4992] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4992] write(3, "1000", 4) = 4
[pid 4992] close(3) = 0
[pid 4992] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4992] memfd_create("syzkaller", 0) = 3
[pid 4992] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8c7fe51000
[pid 4992] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 4992] munmap(0x7f8c7fe51000, 1048576) = 0
[pid 4992] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4992] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4992] close(3) = 0
[pid 4992] mkdir("./file0", 0777) = 0
[pid 4992] mount("/dev/loop0", "./file0", "udf", MS_NOEXEC|MS_POSIXACL|MS_LAZYTIME, "fileset=00000000000000065537,iocharset=macgreek,mode=00000000000000000000033,partition=0000000000000"...) = 0
[pid 4992] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 4992] ioctl(4, LOOP_CLR_FD) = 0
[pid 4992] close(4) = 0
[pid 4992] sendfile(-1, -1, NULL, 281474978811909) = -1 EBADF (Bad file descriptor)
[pid 4992] chdir(NULL) = -1 EFAULT (Bad address)
[pid 4992] creat("./bus", 000) = 4
[pid 4992] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 4992] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 4992] openat(AT_FDCWD, NULL, O_RDONLY) = -1 EFAULT (Bad address)
[pid 4992] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[pid 4992] memfd_create("syzkaller", 0) = 6
[pid 4992] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8c77b51000
syzkaller login: [ 60.220922][ T4992] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4992 'syz-executor155'
[ 60.245148][ T4992] loop0: detected capacity change from 0 to 2048
[ 60.259174][ T4992] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 4992] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 4992] munmap(0x7f8c77b51000, 2097152) = 0
[pid 4992] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 4992] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4992] ioctl(7, LOOP_CLR_FD) = 0
[pid 4992] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4992] close(7) = 0
[pid 4992] close(6) = 0
[pid 4992] getdents(-1, NULL, 0) = -1 EBADF (Bad file descriptor)
[pid 4992] exit_group(0) = ?
[pid 4992] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4992, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555567ce620 /* 5 entries */, 32768) = 136
umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0
unlink("./0/bus") = 0
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./0/binderfs") = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555567d6660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555567d6660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./0/file0") = 0
getdents64(3, 0x5555567ce620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555567cd5d0) = 4994
./strace-static-x86_64: Process 4994 attached
[pid 4994] chdir("./1") = 0
[pid 4994] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4994] setpgid(0, 0) = 0
[pid 4994] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4994] write(3, "1000", 4) = 4
[pid 4994] close(3) = 0
[pid 4994] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4994] memfd_create("syzkaller", 0) = 3
[pid 4994] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8c7fe51000
[pid 4994] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 4994] munmap(0x7f8c7fe51000, 1048576) = 0
[pid 4994] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4994] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4994] close(3) = 0
[pid 4994] mkdir("./file0", 0777) = 0
[pid 4994] mount("/dev/loop0", "./file0", "udf", MS_NOEXEC|MS_POSIXACL|MS_LAZYTIME, "fileset=00000000000000065537,iocharset=macgreek,mode=00000000000000000000033,partition=0000000000000"...) = 0
[pid 4994] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 4994] ioctl(4, LOOP_CLR_FD) = 0
[pid 4994] close(4) = 0
[pid 4994] sendfile(-1, -1, NULL, 281474978811909) = -1 EBADF (Bad file descriptor)
[pid 4994] chdir(NULL) = -1 EFAULT (Bad address)
[pid 4994] creat("./bus", 000) = 4
[pid 4994] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 4994] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 4994] openat(AT_FDCWD, NULL, O_RDONLY) = -1 EFAULT (Bad address)
[pid 4994] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[pid 4994] memfd_create("syzkaller", 0) = 6
[pid 4994] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8c77b51000
[ 60.428937][ T4994] loop0: detected capacity change from 0 to 2048
[ 60.441337][ T4994] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 4994] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 4994] munmap(0x7f8c77b51000, 2097152) = 0
[pid 4994] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 4994] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4994] ioctl(7, LOOP_CLR_FD) = 0
[pid 4994] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4994] close(7) = 0
[pid 4994] close(6) = 0
[pid 4994] getdents(-1, NULL, 0) = -1 EBADF (Bad file descriptor)
[pid 4994] exit_group(0) = ?
[pid 4994] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4994, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} ---
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555567ce620 /* 5 entries */, 32768) = 136
umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0
unlink("./1/bus") = 0
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./1/binderfs") = 0
[ 60.552066][ T4991] ==================================================================
[ 60.560156][ T4991] BUG: KASAN: use-after-free in crc_itu_t+0x21c/0x2a0
[ 60.566946][ T4991] Read of size 1 at addr ffff88807394f000 by task syz-executor155/4991
[ 60.575163][ T4991]
[ 60.577471][ T4991] CPU: 1 PID: 4991 Comm: syz-executor155 Not tainted 6.4.0-rc1-syzkaller-00133-g9a48d6046722 #0
[ 60.587881][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 60.597922][ T4991] Call Trace:
[ 60.601191][ T4991]
[ 60.604114][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 60.608792][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 60.614263][ T4991] ? panic+0x770/0x770
[ 60.618324][ T4991] ? _printk+0xd5/0x120
[ 60.622468][ T4991] print_report+0x163/0x540
[ 60.626960][ T4991] ? ktime_get_real_ts64+0x460/0x460
[ 60.632237][ T4991] ? time64_to_tm+0x331/0x4d0
[ 60.636901][ T4991] ? __virt_addr_valid+0x22f/0x2e0
[ 60.642026][ T4991] ? __phys_addr+0xba/0x170
[ 60.646521][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 60.650928][ T4991] kasan_report+0x176/0x1b0
[ 60.655432][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 60.659849][ T4991] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 60.666091][ T4991] crc_itu_t+0x21c/0x2a0
[ 60.670330][ T4991] udf_close_lvid+0x57e/0x9a0
[ 60.675004][ T4991] ? udf_open_lvid+0x5b0/0x5b0
[ 60.679762][ T4991] ? clear_inode+0x150/0x150
[ 60.684351][ T4991] ? module_put+0x144/0x2e0
[ 60.688863][ T4991] udf_put_super+0xcd/0x160
[ 60.693367][ T4991] ? udf_free_in_core_inode+0x30/0x30
[ 60.698737][ T4991] generic_shutdown_super+0x134/0x340
[ 60.704111][ T4991] kill_block_super+0x84/0xf0
[ 60.708790][ T4991] deactivate_locked_super+0xa4/0x110
[ 60.714154][ T4991] cleanup_mnt+0x426/0x4c0
[ 60.718567][ T4991] ? _raw_spin_unlock_irq+0x23/0x50
[ 60.723774][ T4991] task_work_run+0x24a/0x300
[ 60.728353][ T4991] ? dput+0x3a1/0x420
[ 60.732325][ T4991] ? task_work_cancel+0x2b0/0x2b0
[ 60.737341][ T4991] ? __x64_sys_umount+0x126/0x170
[ 60.742363][ T4991] ptrace_notify+0x2cd/0x380
[ 60.746948][ T4991] ? do_notify_parent+0xf50/0xf50
[ 60.751970][ T4991] ? user_path_at_empty+0x12f/0x180
[ 60.757186][ T4991] ? __x64_sys_umount+0x126/0x170
[ 60.762205][ T4991] ? path_umount+0xea0/0xea0
[ 60.766788][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 60.772760][ T4991] syscall_exit_to_user_mode+0x157/0x280
[ 60.778389][ T4991] do_syscall_64+0x4d/0xc0
[ 60.782801][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 60.788685][ T4991] RIP: 0033:0x7f8c882a00a7
[ 60.793091][ T4991] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 60.812684][ T4991] RSP: 002b:00007ffc6f117728 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 60.821097][ T4991] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8c882a00a7
[ 60.829066][ T4991] RDX: 00007ffc6f1177e9 RSI: 000000000000000a RDI: 00007ffc6f1177e0
[ 60.837028][ T4991] RBP: 00007ffc6f1177e0 R08: 00000000ffffffff R09: 00007ffc6f1175c0
[ 60.844999][ T4991] R10: 00005555567ce66b R11: 0000000000000206 R12: 00007ffc6f118850
[ 60.852962][ T4991] R13: 00005555567ce5f0 R14: 00007ffc6f117750 R15: 0000000000000002
[ 60.860939][ T4991]
[ 60.863953][ T4991]
[ 60.866269][ T4991] The buggy address belongs to the physical page:
[ 60.872676][ T4991] page:ffffea0001ce53c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x7394f
[ 60.882815][ T4991] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 60.889912][ T4991] page_type: 0xffffffff()
[ 60.894229][ T4991] raw: 00fff00000000000 ffffea0001cc5188 ffff8880b9943260 0000000000000000
[ 60.902805][ T4991] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 60.911377][ T4991] page dumped because: kasan: bad access detected
[ 60.917777][ T4991] page_owner tracks the page as freed
[ 60.923139][ T4991] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 4994, tgid 4994 (syz-executor155), ts 60457614807, free_ts 60521083773
[ 60.941098][ T4991] post_alloc_hook+0x1e6/0x210
[ 60.945864][ T4991] get_page_from_freelist+0x321c/0x33a0
[ 60.951407][ T4991] __alloc_pages+0x255/0x670
[ 60.955997][ T4991] __folio_alloc+0x13/0x30
[ 60.960402][ T4991] vma_alloc_folio+0x48a/0x9a0
[ 60.965172][ T4991] do_wp_page+0xb35/0x3690
[ 60.969578][ T4991] handle_mm_fault+0x2371/0x5860
[ 60.974507][ T4991] exc_page_fault+0x7d2/0x910
[ 60.979176][ T4991] asm_exc_page_fault+0x26/0x30
[ 60.984016][ T4991] page last free stack trace:
[ 60.988679][ T4991] free_unref_page_prepare+0x903/0xa30
[ 60.994133][ T4991] free_unref_page_list+0x596/0x830
[ 60.999328][ T4991] release_pages+0x2193/0x2470
[ 61.004082][ T4991] tlb_flush_mmu+0x100/0x210
[ 61.008673][ T4991] tlb_finish_mmu+0xd4/0x1f0
[ 61.013267][ T4991] exit_mmap+0x3da/0xaf0
[ 61.017504][ T4991] __mmput+0x115/0x3c0
[ 61.021568][ T4991] exit_mm+0x227/0x310
[ 61.025632][ T4991] do_exit+0x612/0x2290
[ 61.029780][ T4991] do_group_exit+0x206/0x2c0
[ 61.034360][ T4991] __x64_sys_exit_group+0x3f/0x40
[ 61.039373][ T4991] do_syscall_64+0x41/0xc0
[ 61.043788][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 61.049692][ T4991]
[ 61.052015][ T4991] Memory state around the buggy address:
[ 61.057649][ T4991] ffff88807394ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 61.065701][ T4991] ffff88807394ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 61.073762][ T4991] >ffff88807394f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.081808][ T4991] ^
[ 61.085864][ T4991] ffff88807394f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.093911][ T4991] ffff88807394f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.101958][ T4991] ==================================================================
[ 61.110520][ T4991] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 61.117726][ T4991] CPU: 1 PID: 4991 Comm: syz-executor155 Not tainted 6.4.0-rc1-syzkaller-00133-g9a48d6046722 #0
[ 61.128142][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 61.138198][ T4991] Call Trace:
[ 61.141490][ T4991]
[ 61.144418][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 61.149101][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 61.154560][ T4991] ? panic+0x770/0x770
[ 61.158635][ T4991] ? preempt_schedule_common+0x83/0xc0
[ 61.164092][ T4991] ? vscnprintf+0x5d/0x80
[ 61.168418][ T4991] panic+0x30f/0x770
[ 61.172304][ T4991] ? check_panic_on_warn+0x21/0xa0
[ 61.177425][ T4991] ? __memcpy_flushcache+0x2b0/0x2b0
[ 61.182720][ T4991] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 61.188693][ T4991] ? _raw_spin_unlock+0x40/0x40
[ 61.193537][ T4991] check_panic_on_warn+0x82/0xa0
[ 61.198474][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 61.202885][ T4991] end_report+0x63/0x110
[ 61.207131][ T4991] kasan_report+0x183/0x1b0
[ 61.211642][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 61.216060][ T4991] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 61.222308][ T4991] crc_itu_t+0x21c/0x2a0
[ 61.226553][ T4991] udf_close_lvid+0x57e/0x9a0
[ 61.231235][ T4991] ? udf_open_lvid+0x5b0/0x5b0
[ 61.236008][ T4991] ? clear_inode+0x150/0x150
[ 61.240599][ T4991] ? module_put+0x144/0x2e0
[ 61.245096][ T4991] udf_put_super+0xcd/0x160
[ 61.249599][ T4991] ? udf_free_in_core_inode+0x30/0x30
[ 61.254967][ T4991] generic_shutdown_super+0x134/0x340
[ 61.260335][ T4991] kill_block_super+0x84/0xf0
[ 61.265005][ T4991] deactivate_locked_super+0xa4/0x110
[ 61.270372][ T4991] cleanup_mnt+0x426/0x4c0
[ 61.274786][ T4991] ? _raw_spin_unlock_irq+0x23/0x50
[ 61.279983][ T4991] task_work_run+0x24a/0x300
[ 61.284568][ T4991] ? dput+0x3a1/0x420
[ 61.288546][ T4991] ? task_work_cancel+0x2b0/0x2b0
[ 61.293563][ T4991] ? __x64_sys_umount+0x126/0x170
[ 61.298580][ T4991] ptrace_notify+0x2cd/0x380
[ 61.303166][ T4991] ? do_notify_parent+0xf50/0xf50
[ 61.308187][ T4991] ? user_path_at_empty+0x12f/0x180
[ 61.313380][ T4991] ? __x64_sys_umount+0x126/0x170
[ 61.318430][ T4991] ? path_umount+0xea0/0xea0
[ 61.323013][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 61.328986][ T4991] syscall_exit_to_user_mode+0x157/0x280
[ 61.334611][ T4991] do_syscall_64+0x4d/0xc0
[ 61.339023][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 61.344908][ T4991] RIP: 0033:0x7f8c882a00a7
[ 61.349346][ T4991] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 61.368947][ T4991] RSP: 002b:00007ffc6f117728 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 61.377357][ T4991] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8c882a00a7
[ 61.385353][ T4991] RDX: 00007ffc6f1177e9 RSI: 000000000000000a RDI: 00007ffc6f1177e0
[ 61.393316][ T4991] RBP: 00007ffc6f1177e0 R08: 00000000ffffffff R09: 00007ffc6f1175c0
[ 61.401283][ T4991] R10: 00005555567ce66b R11: 0000000000000206 R12: 00007ffc6f118850
[ 61.409251][ T4991] R13: 00005555567ce5f0 R14: 00007ffc6f117750 R15: 0000000000000002
[ 61.417229][ T4991]
[ 61.420526][ T4991] Kernel Offset: disabled
[ 61.424847][ T4991] Rebooting in 86400 seconds..