Warning: Permanently added '[localhost]:13863' (ED25519) to the list of known hosts.
syzkaller login: [ 85.586500][ T5100] loop0: detected capacity change from 0 to 64
executing program
[ 85.639086][ T5100] ==================================================================
[ 85.641995][ T5100] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x314/0x450
[ 85.644920][ T5100] Write of size 94 at addr ffff88803ddd9080 by task syz-executor265/5100
[ 85.647890][ T5100]
[ 85.648749][ T5100] CPU: 0 UID: 0 PID: 5100 Comm: syz-executor265 Not tainted 6.11.0-syzkaller-11993-g3efc57369a0c #0
[ 85.652475][ T5100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 85.656393][ T5100] Call Trace:
[ 85.659049][ T5100]
[ 85.660293][ T5100] dump_stack_lvl+0x241/0x360
[ 85.662120][ T5100] ? __pfx_dump_stack_lvl+0x10/0x10
[ 85.664046][ T5100] ? __pfx__printk+0x10/0x10
[ 85.665808][ T5100] ? _printk+0xd5/0x120
[ 85.667359][ T5100] ? __virt_addr_valid+0x183/0x530
[ 85.669265][ T5100] ? __virt_addr_valid+0x183/0x530
[ 85.671188][ T5100] print_report+0x169/0x550
[ 85.672862][ T5100] ? __virt_addr_valid+0x183/0x530
[ 85.674768][ T5100] ? __virt_addr_valid+0x183/0x530
[ 85.676638][ T5100] ? __virt_addr_valid+0x45f/0x530
[ 85.678546][ T5100] ? __phys_addr+0xba/0x170
[ 85.680241][ T5100] ? hfs_bnode_read_key+0x314/0x450
[ 85.682174][ T5100] kasan_report+0x143/0x180
[ 85.683834][ T5100] ? hfs_bnode_read_key+0x314/0x450
[ 85.685747][ T5100] kasan_check_range+0x282/0x290
[ 85.687834][ T5100] ? hfs_bnode_read_key+0x314/0x450
[ 85.690125][ T5100] __asan_memcpy+0x40/0x70
[ 85.691940][ T5100] hfs_bnode_read_key+0x314/0x450
[ 85.693776][ T5100] hfs_brec_insert+0x7f3/0xbd0
[ 85.695551][ T5100] ? __pfx_hfs_brec_insert+0x10/0x10
[ 85.697634][ T5100] hfs_cat_create+0x41d/0xa50
[ 85.699385][ T5100] ? __pfx_hfs_cat_create+0x10/0x10
[ 85.701433][ T5100] ? _raw_spin_unlock+0x28/0x50
[ 85.703286][ T5100] ? hfs_new_inode+0x86e/0xaf0
[ 85.705089][ T5100] hfs_mkdir+0x6c/0xe0
[ 85.706582][ T5100] vfs_mkdir+0x2f9/0x4f0
[ 85.708214][ T5100] do_mkdirat+0x264/0x3a0
[ 85.709896][ T5100] ? __might_fault+0xaa/0x120
[ 85.711969][ T5100] ? __pfx_do_mkdirat+0x10/0x10
[ 85.713787][ T5100] ? strncpy_from_user+0x131/0x250
[ 85.715746][ T5100] ? getname_flags+0x1e3/0x540
[ 85.717766][ T5100] __x64_sys_mkdir+0x6c/0x80
[ 85.719600][ T5100] do_syscall_64+0xf3/0x230
[ 85.721604][ T5100] ? clear_bhb_loop+0x35/0x90
[ 85.723408][ T5100] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.725733][ T5100] RIP: 0033:0x7f773d74aa99
[ 85.727667][ T5100] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 85.734799][ T5100] RSP: 002b:00007fff611d9048 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
[ 85.737623][ T5100] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f773d74aa99
[ 85.740269][ T5100] RDX: 00007f773d74aa99 RSI: 0000000000000000 RDI: 0000000020000300
[ 85.743011][ T5100] RBP: 00007f773d7be5f0 R08: 000055557557e4c0 R09: 000055557557e4c0
[ 85.745737][ T5100] R10: 00000000000002b3 R11: 0000000000000246 R12: 00007fff611d9070
[ 85.748459][ T5100] R13: 00007fff611d9298 R14: 431bde82d7b634db R15: 00007f773d79303b
[ 85.751438][ T5100]
[ 85.752689][ T5100]
[ 85.753643][ T5100] Allocated by task 5100:
[ 85.755117][ T5100] kasan_save_track+0x3f/0x80
[ 85.756853][ T5100] __kasan_kmalloc+0x98/0xb0
[ 85.758540][ T5100] __kmalloc_noprof+0x1fc/0x400
[ 85.760365][ T5100] hfs_find_init+0x90/0x1f0
[ 85.762070][ T5100] hfs_cat_create+0x182/0xa50
[ 85.763778][ T5100] hfs_mkdir+0x6c/0xe0
[ 85.765313][ T5100] vfs_mkdir+0x2f9/0x4f0
[ 85.766837][ T5100] do_mkdirat+0x264/0x3a0
[ 85.768456][ T5100] __x64_sys_mkdir+0x6c/0x80
[ 85.770211][ T5100] do_syscall_64+0xf3/0x230
[ 85.771956][ T5100] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.774492][ T5100]
[ 85.775458][ T5100] The buggy address belongs to the object at ffff88803ddd9080
[ 85.775458][ T5100] which belongs to the cache kmalloc-96 of size 96
[ 85.780673][ T5100] The buggy address is located 0 bytes inside of
[ 85.780673][ T5100] allocated 78-byte region [ffff88803ddd9080, ffff88803ddd90ce)
[ 85.785914][ T5100]
[ 85.786840][ T5100] The buggy address belongs to the physical page:
[ 85.789230][ T5100] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3ddd9
[ 85.792352][ T5100] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 85.795028][ T5100] page_type: f5(slab)
[ 85.796534][ T5100] raw: 04fff00000000000 ffff88801ac41280 dead000000000100 dead000000000122
[ 85.799800][ T5100] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[ 85.803243][ T5100] page dumped because: kasan: bad access detected
[ 85.805894][ T5100] page_owner tracks the page as allocated
[ 85.808092][ T5100] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4607, tgid 4607 (udevadm), ts 35788942146, free_ts 35771042938
[ 85.814997][ T5100] post_alloc_hook+0x1f3/0x230
[ 85.816789][ T5100] get_page_from_freelist+0x3045/0x3190
[ 85.818869][ T5100] __alloc_pages_noprof+0x256/0x6c0
[ 85.820859][ T5100] alloc_pages_mpol_noprof+0x3e8/0x680
[ 85.822850][ T5100] alloc_slab_page+0x6a/0x120
[ 85.824785][ T5100] allocate_slab+0x5a/0x2f0
[ 85.826458][ T5100] ___slab_alloc+0xcd1/0x14b0
[ 85.828209][ T5100] __slab_alloc+0x58/0xa0
[ 85.829863][ T5100] __kmalloc_noprof+0x25a/0x400
[ 85.831687][ T5100] kobject_get_path+0xb8/0x230
[ 85.833693][ T5100] kobject_uevent_env+0x2a5/0x8e0
[ 85.835729][ T5100] kobject_synth_uevent+0x4ef/0xae0
[ 85.837864][ T5100] uevent_store+0x24/0x60
[ 85.839550][ T5100] kernfs_fop_write_iter+0x3a0/0x500
[ 85.841467][ T5100] vfs_write+0xa6d/0xc90
[ 85.843055][ T5100] ksys_write+0x183/0x2b0
[ 85.844660][ T5100] page last free pid 4603 tgid 4603 stack trace:
[ 85.846848][ T5100] free_unref_page+0xcfb/0xf20
[ 85.848663][ T5100] stack_depot_save_flags+0x6f6/0x830
[ 85.850840][ T5100] kasan_save_track+0x51/0x80
[ 85.852631][ T5100] __kasan_slab_alloc+0x66/0x80
[ 85.854527][ T5100] kmem_cache_alloc_noprof+0x135/0x2a0
[ 85.856559][ T5100] vm_area_dup+0x27/0x290
[ 85.858249][ T5100] __split_vma+0x1cb/0xc50
[ 85.859998][ T5100] vms_gather_munmap_vmas+0x2ee/0x15d0
[ 85.862023][ T5100] do_vmi_align_munmap+0x423/0x730
[ 85.863962][ T5100] do_vmi_munmap+0x24e/0x2d0
[ 85.865777][ T5100] __vm_munmap+0x24c/0x480
[ 85.867480][ T5100] __x64_sys_munmap+0x68/0x80
[ 85.869302][ T5100] do_syscall_64+0xf3/0x230
[ 85.870990][ T5100] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.873261][ T5100]
[ 85.874210][ T5100] Memory state around the buggy address:
[ 85.876392][ T5100] ffff88803ddd8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 85.879580][ T5100] ffff88803ddd9000: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[ 85.882621][ T5100] >ffff88803ddd9080: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc
[ 85.885553][ T5100] ^
[ 85.888022][ T5100] ffff88803ddd9100: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 85.891094][ T5100] ffff88803ddd9180: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 85.894172][ T5100] ==================================================================
[ 86.184377][ T5100] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.187254][ T5100] CPU: 0 UID: 0 PID: 5100 Comm: syz-executor265 Not tainted 6.11.0-syzkaller-11993-g3efc57369a0c #0
[ 86.191371][ T5100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 86.195497][ T5100] Call Trace:
[ 86.196801][ T5100]
[ 86.197998][ T5100] dump_stack_lvl+0x241/0x360
[ 86.199829][ T5100] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.201859][ T5100] ? __pfx__printk+0x10/0x10
[ 86.203662][ T5100] ? preempt_schedule+0xe1/0xf0
[ 86.205536][ T5100] ? vscnprintf+0x5d/0x90
[ 86.207235][ T5100] panic+0x349/0x880
[ 86.208734][ T5100] ? check_panic_on_warn+0x21/0xb0
[ 86.210713][ T5100] ? __pfx_panic+0x10/0x10
[ 86.212440][ T5100] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 86.214665][ T5100] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 86.217100][ T5100] ? print_report+0x502/0x550
[ 86.218938][ T5100] check_panic_on_warn+0x86/0xb0
[ 86.220910][ T5100] ? hfs_bnode_read_key+0x314/0x450
[ 86.222922][ T5100] end_report+0x77/0x160
[ 86.224510][ T5100] kasan_report+0x154/0x180
[ 86.226305][ T5100] ? hfs_bnode_read_key+0x314/0x450
[ 86.228326][ T5100] kasan_check_range+0x282/0x290
[ 86.230314][ T5100] ? hfs_bnode_read_key+0x314/0x450
[ 86.232334][ T5100] __asan_memcpy+0x40/0x70
[ 86.234041][ T5100] hfs_bnode_read_key+0x314/0x450
[ 86.236009][ T5100] hfs_brec_insert+0x7f3/0xbd0
[ 86.237888][ T5100] ? __pfx_hfs_brec_insert+0x10/0x10
[ 86.240007][ T5100] hfs_cat_create+0x41d/0xa50
[ 86.241854][ T5100] ? __pfx_hfs_cat_create+0x10/0x10
[ 86.243866][ T5100] ? _raw_spin_unlock+0x28/0x50
[ 86.245817][ T5100] ? hfs_new_inode+0x86e/0xaf0
[ 86.247665][ T5100] hfs_mkdir+0x6c/0xe0
[ 86.249255][ T5100] vfs_mkdir+0x2f9/0x4f0
[ 86.250898][ T5100] do_mkdirat+0x264/0x3a0
[ 86.252556][ T5100] ? __might_fault+0xaa/0x120
[ 86.254384][ T5100] ? __pfx_do_mkdirat+0x10/0x10
[ 86.256233][ T5100] ? strncpy_from_user+0x131/0x250
[ 86.258228][ T5100] ? getname_flags+0x1e3/0x540
[ 86.260111][ T5100] __x64_sys_mkdir+0x6c/0x80
[ 86.261892][ T5100] do_syscall_64+0xf3/0x230
[ 86.263624][ T5100] ? clear_bhb_loop+0x35/0x90
[ 86.265409][ T5100] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.267642][ T5100] RIP: 0033:0x7f773d74aa99
[ 86.269389][ T5100] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 86.276669][ T5100] RSP: 002b:00007fff611d9048 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
[ 86.279848][ T5100] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f773d74aa99
[ 86.282781][ T5100] RDX: 00007f773d74aa99 RSI: 0000000000000000 RDI: 0000000020000300
[ 86.285743][ T5100] RBP: 00007f773d7be5f0 R08: 000055557557e4c0 R09: 000055557557e4c0
[ 86.288776][ T5100] R10: 00000000000002b3 R11: 0000000000000246 R12: 00007fff611d9070
[ 86.291946][ T5100] R13: 00007fff611d9298 R14: 431bde82d7b634db R15: 00007f773d79303b
[ 86.294964][ T5100]
[ 86.296421][ T5100] Kernel Offset: disabled
[ 86.298133][ T5100] Rebooting in 86400 seconds..
VM DIAGNOSIS:
14:42:07 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000030 RBX=ffffffff9a711e40 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc90002d5ef50
R8 =ffffffff8549649b R9 =1ffff11006629046 R10=dffffc0000000000 R11=ffffffff85496450
R12=dffffc0000000000 R13=ffffffff9a40cef4 R14=0000000000000030 R15=00000000000003f8
RIP=ffffffff854964ce RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055557557d380 ffffffff 00c00000
GS =0000 ffff88801fc00000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000562f1eb29258 CR3=000000003d88c000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000b0340000 Opmask01=0000000000000000 Opmask02=00000000ffffbdff Opmask03=0000000000000000
Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc2d09b7b0 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2a2a2a2a2a2a2a2a 2a2a2a2a2a2a2a2a
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff0000ff000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff0000ff000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 20676e6964616572 004b4f2034366f66 6e695f706f6f6c20 676e696461657200
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 05424b4c41444057 004b4f0511134a43 4b4c5f554a4a4905 424b4c4144405700
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0127c5efec6c6058 0000000562f1eb1b 0000000000000201 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000562f1eb41808 0000562f1eb41808 0000000000000041 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3a2648393a3a264b 393a3a263e393a3a 2648383a3a26483b 3a0a00307f617930
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 263f323a3a263b32 3a3a263a323a3a26 4c3d3a3a26333d3a 3a263c3d3a3a263f
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000