./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor534683877
<...>
Warning: Permanently added '10.128.1.52' (ED25519) to the list of known hosts.
execve("./syz-executor534683877", ["./syz-executor534683877"], 0x7fff35342260 /* 10 vars */) = 0
brk(NULL) = 0x5555564b3000
brk(0x5555564b3d00) = 0x5555564b3d00
arch_prctl(ARCH_SET_FS, 0x5555564b3380) = 0
set_tid_address(0x5555564b3650) = 5062
set_robust_list(0x5555564b3660, 24) = 0
rseq(0x5555564b3ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor534683877", 4096) = 27
getrandom("\xf7\x08\xcb\x17\x9c\x36\xb5\x62", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555564b3d00
brk(0x5555564d4d00) = 0x5555564d4d00
brk(0x5555564d5000) = 0x5555564d5000
mprotect(0x7fe883d71000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe87b8c1000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7fe87b8c1000, 138412032) = 0
[ 72.738696][ T27] audit: type=1400 audit(1703536959.514:83): avc: denied { execmem } for pid=5062 comm="syz-executor534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 72.800115][ T27] audit: type=1400 audit(1703536959.574:84): avc: denied { read write } for pid=5062 comm="syz-executor534" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 72.824849][ T27] audit: type=1400 audit(1703536959.574:85): avc: denied { open } for pid=5062 comm="syz-executor534" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./bus", 0777) = 0
[ 72.826398][ T5062] loop0: detected capacity change from 0 to 1024
[ 72.849710][ T27] audit: type=1400 audit(1703536959.594:86): avc: denied { ioctl } for pid=5062 comm="syz-executor534" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
mount("/dev/loop0", "./bus", "hfsplus", MS_SYNCHRONOUS|MS_NOATIME|MS_POSIXACL, "") = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
chdir("./bus") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 72.886123][ T27] audit: type=1400 audit(1703536959.664:87): avc: denied { mounton } for pid=5062 comm="syz-executor534" path="/root/bus" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 72.908942][ T27] audit: type=1400 audit(1703536959.674:88): avc: denied { mount } for pid=5062 comm="syz-executor534" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1
[ 72.972821][ T5062] hfsplus: request for non-existent node 32768 in B*Tree
[ 72.980874][ T5062] hfsplus: request for non-existent node 32768 in B*Tree
[ 72.988799][ T5062] ==================================================================
[ 72.996878][ T5062] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x234/0x250
[ 73.004789][ T5062] Read of size 8 at addr ffff88801cf4e7c0 by task syz-executor534/5062
[ 73.013022][ T5062]
[ 73.015342][ T5062] CPU: 1 PID: 5062 Comm: syz-executor534 Not tainted 6.7.0-rc7-syzkaller #0
[ 73.024011][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 73.034063][ T5062] Call Trace:
[ 73.037346][ T5062]
[ 73.040270][ T5062] dump_stack_lvl+0xd9/0x1b0
[ 73.044874][ T5062] print_report+0xc4/0x620
[ 73.049380][ T5062] ? __virt_addr_valid+0x5e/0x2d0
[ 73.054407][ T5062] ? __phys_addr+0xc6/0x140
[ 73.059008][ T5062] kasan_report+0xda/0x110
[ 73.063419][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 73.068752][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 73.073945][ T5062] hfsplus_bnode_read+0x234/0x250
[ 73.078967][ T5062] hfsplus_bnode_dump+0x2a2/0x3d0
[ 73.084079][ T5062] ? hfsplus_bnode_move+0x910/0x910
[ 73.089272][ T5062] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 73.094725][ T5062] ? hfsplus_bnode_move+0x2a/0x910
[ 73.099921][ T5062] ? srcu_readers_active+0xb0/0x250
[ 73.105114][ T5062] ? __mark_inode_dirty+0x297/0xd60
[ 73.110310][ T5062] hfsplus_brec_remove+0x3de/0x4f0
[ 73.115449][ T5062] __hfsplus_delete_attr+0x29e/0x3b0
[ 73.120734][ T5062] ? hfsplus_find_exit+0xc0/0xc0
[ 73.125668][ T5062] ? hfsplus_part_find+0xbb0/0xbb0
[ 73.130779][ T5062] hfsplus_delete_all_attrs+0x26d/0x330
[ 73.136326][ T5062] ? do_raw_spin_lock+0x12e/0x2b0
[ 73.141360][ T5062] ? hfsplus_delete_attr+0x300/0x300
[ 73.146665][ T5062] ? spin_bug+0x1d0/0x1d0
[ 73.150998][ T5062] ? rcu_is_watching+0x12/0xb0
[ 73.155758][ T5062] ? __mark_inode_dirty+0x599/0xd60
[ 73.160954][ T5062] hfsplus_delete_cat+0x83b/0xdd0
[ 73.165976][ T5062] ? hfsplus_create_cat+0x10d0/0x10d0
[ 73.171341][ T5062] ? __mutex_lock+0x1a6/0x9d0
[ 73.176024][ T5062] ? mutex_trylock+0x130/0x130
[ 73.180885][ T5062] hfsplus_unlink+0x213/0x7f0
[ 73.185562][ T5062] ? hfsplus_symlink+0x2b0/0x2b0
[ 73.190493][ T5062] ? preempt_count_sub+0x160/0x160
[ 73.195601][ T5062] vfs_unlink+0x2f1/0x900
[ 73.199937][ T5062] do_unlinkat+0x5bc/0x740
[ 73.204448][ T5062] ? __ia32_sys_rmdir+0x110/0x110
[ 73.209475][ T5062] ? __check_object_size+0x323/0x730
[ 73.214766][ T5062] ? getname_flags.part.0+0x1e2/0x4e0
[ 73.220141][ T5062] __x64_sys_unlink+0xc8/0x110
[ 73.224910][ T5062] do_syscall_64+0x40/0x110
[ 73.229414][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 73.237139][ T5062] RIP: 0033:0x7fe883cfe5f9
[ 73.241548][ T5062] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 73.261500][ T5062] RSP: 002b:00007fffa3abefb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 73.269909][ T5062] RAX: ffffffffffffffda RBX: 00007fffa3abf198 RCX: 00007fe883cfe5f9
[ 73.277878][ T5062] RDX: 00007fe883cfd8f0 RSI: 0000000000000000 RDI: 0000000020000140
[ 73.285844][ T5062] RBP: 00007fe883d71610 R08: 0000000000000640 R09: 0000000000000000
[ 73.293818][ T5062] R10: 00007fffa3abee80 R11: 0000000000000246 R12: 0000000000000001
[ 73.301787][ T5062] R13: 00007fffa3abf188 R14: 0000000000000001 R15: 0000000000000001
[ 73.309757][ T5062]
[ 73.312767][ T5062]
[ 73.315083][ T5062] Allocated by task 5062:
[ 73.319403][ T5062] kasan_save_stack+0x33/0x50
[ 73.324076][ T5062] kasan_set_track+0x25/0x30
[ 73.328659][ T5062] __kasan_kmalloc+0xa3/0xb0
[ 73.333249][ T5062] __kmalloc+0x59/0x90
[ 73.337312][ T5062] __hfs_bnode_create+0x108/0x860
[ 73.342333][ T5062] hfsplus_bnode_find+0x2c4/0xcb0
[ 73.347353][ T5062] hfsplus_brec_find+0x2b9/0x520
[ 73.352392][ T5062] hfsplus_delete_all_attrs+0x246/0x330
[ 73.357934][ T5062] hfsplus_delete_cat+0x83b/0xdd0
[ 73.363741][ T5062] hfsplus_unlink+0x213/0x7f0
[ 73.368410][ T5062] vfs_unlink+0x2f1/0x900
[ 73.372734][ T5062] do_unlinkat+0x5bc/0x740
[ 73.377168][ T5062] __x64_sys_unlink+0xc8/0x110
[ 73.381929][ T5062] do_syscall_64+0x40/0x110
[ 73.386427][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 73.392335][ T5062]
[ 73.394656][ T5062] Last potentially related work creation:
[ 73.400454][ T5062] kasan_save_stack+0x33/0x50
[ 73.405219][ T5062] __kasan_record_aux_stack+0x78/0x80
[ 73.410586][ T5062] insert_work+0x38/0x230
[ 73.414914][ T5062] __queue_work+0x62e/0x11d0
[ 73.419504][ T5062] queue_work_on+0xed/0x110
[ 73.424101][ T5062] call_usermodehelper_exec+0x1d2/0x4c0
[ 73.429733][ T5062] kobject_uevent_env+0x1693/0x1800
[ 73.434955][ T5062] tty_register_device_attr+0x4bc/0x7b0
[ 73.440513][ T5062] tty_register_driver+0x431/0x7f0
[ 73.445628][ T5062] pty_init+0x69c/0x1110
[ 73.449975][ T5062] do_one_initcall+0x11c/0x650
[ 73.454768][ T5062] kernel_init_freeable+0x687/0xc10
[ 73.459974][ T5062] kernel_init+0x1c/0x2a0
[ 73.464301][ T5062] ret_from_fork+0x45/0x80
[ 73.468721][ T5062] ret_from_fork_asm+0x11/0x20
[ 73.473503][ T5062]
[ 73.475824][ T5062] The buggy address belongs to the object at ffff88801cf4e700
[ 73.475824][ T5062] which belongs to the cache kmalloc-192 of size 192
[ 73.489976][ T5062] The buggy address is located 40 bytes to the right of
[ 73.489976][ T5062] allocated 152-byte region [ffff88801cf4e700, ffff88801cf4e798)
[ 73.504562][ T5062]
[ 73.507035][ T5062] The buggy address belongs to the physical page:
[ 73.513431][ T5062] page:ffffea000073d380 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1cf4e
[ 73.523573][ T5062] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 73.531105][ T5062] page_type: 0x10()
[ 73.534916][ T5062] raw: 00fff00000000800 ffff888013040000 ffffea0000786b10 ffffea0000746090
[ 73.543514][ T5062] raw: 0000000000000000 ffff88801cf4e000 0000000100000010 0000000000000000
[ 73.552090][ T5062] page dumped because: kasan: bad access detected
[ 73.558490][ T5062] page_owner tracks the page as allocated
[ 73.564197][ T5062] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 8397747602, free_ts 8396252502
[ 73.583313][ T5062] post_alloc_hook+0x2d0/0x350
[ 73.588084][ T5062] get_page_from_freelist+0xa25/0x36d0
[ 73.593551][ T5062] __alloc_pages+0x22e/0x2420
[ 73.598222][ T5062] cache_grow_begin+0x99/0x3a0
[ 73.602993][ T5062] cache_alloc_refill+0x295/0x3b0
[ 73.608019][ T5062] __kmem_cache_alloc_node+0x3ba/0x460
[ 73.613653][ T5062] kmalloc_trace+0x25/0x60
[ 73.618066][ T5062] call_usermodehelper_setup+0x9a/0x340
[ 73.623606][ T5062] kobject_uevent_env+0x1678/0x1800
[ 73.628804][ T5062] tty_register_device_attr+0x4bc/0x7b0
[ 73.634352][ T5062] tty_register_driver+0x431/0x7f0
[ 73.639454][ T5062] pty_init+0x69c/0x1110
[ 73.643815][ T5062] do_one_initcall+0x11c/0x650
[ 73.648599][ T5062] kernel_init_freeable+0x687/0xc10
[ 73.653889][ T5062] kernel_init+0x1c/0x2a0
[ 73.658220][ T5062] ret_from_fork+0x45/0x80
[ 73.662659][ T5062] page last free stack trace:
[ 73.667413][ T5062] free_unref_page_prepare+0x4fa/0xaa0
[ 73.672983][ T5062] free_unref_page_list+0xe6/0xb40
[ 73.678102][ T5062] release_pages+0x32a/0x14f0
[ 73.682901][ T5062] tlb_batch_pages_flush+0x9a/0x190
[ 73.688114][ T5062] tlb_finish_mmu+0x14b/0x6f0
[ 73.692847][ T5062] exit_mmap+0x38b/0xa70
[ 73.697084][ T5062] __mmput+0x12a/0x4d0
[ 73.701327][ T5062] mmput+0x62/0x70
[ 73.705049][ T5062] free_bprm+0x144/0x3f0
[ 73.709295][ T5062] kernel_execve+0x3e7/0x4e0
[ 73.713876][ T5062] call_usermodehelper_exec_async+0x256/0x4c0
[ 73.720039][ T5062] ret_from_fork+0x45/0x80
[ 73.724463][ T5062] ret_from_fork_asm+0x11/0x20
[ 73.729243][ T5062]
[ 73.731557][ T5062] Memory state around the buggy address:
[ 73.737178][ T5062] ffff88801cf4e680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 73.745337][ T5062] ffff88801cf4e700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 73.753398][ T5062] >ffff88801cf4e780: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.761488][ T5062] ^
[ 73.767633][ T5062] ffff88801cf4e800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 73.775688][ T5062] ffff88801cf4e880: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.783737][ T5062] ==================================================================
[ 73.792481][ T5062] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.799688][ T5062] CPU: 1 PID: 5062 Comm: syz-executor534 Not tainted 6.7.0-rc7-syzkaller #0
[ 73.808377][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 73.816686][ T27] audit: type=1400 audit(1703536960.564:89): avc: denied { append } for pid=4492 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 73.816747][ T27] audit: type=1400 audit(1703536960.564:90): avc: denied { open } for pid=4492 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 73.816802][ T27] audit: type=1400 audit(1703536960.564:91): avc: denied { getattr } for pid=4492 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 73.885394][ T5062] Call Trace:
[ 73.888663][ T5062]
[ 73.891580][ T5062] dump_stack_lvl+0xd9/0x1b0
[ 73.896166][ T5062] panic+0x6dc/0x790
[ 73.900070][ T5062] ? panic_smp_self_stop+0xa0/0xa0
[ 73.905170][ T5062] ? preempt_schedule_thunk+0x1a/0x30
[ 73.910531][ T5062] ? preempt_schedule_common+0x45/0xc0
[ 73.915999][ T5062] ? check_panic_on_warn+0x1f/0xb0
[ 73.921097][ T5062] check_panic_on_warn+0xab/0xb0
[ 73.926025][ T5062] end_report+0x108/0x150
[ 73.930337][ T5062] kasan_report+0xea/0x110
[ 73.934738][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 73.939938][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 73.945136][ T5062] hfsplus_bnode_read+0x234/0x250
[ 73.950147][ T5062] hfsplus_bnode_dump+0x2a2/0x3d0
[ 73.955161][ T5062] ? hfsplus_bnode_move+0x910/0x910
[ 73.960342][ T5062] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 73.965791][ T5062] ? hfsplus_bnode_move+0x2a/0x910
[ 73.970887][ T5062] ? srcu_readers_active+0xb0/0x250
[ 73.976072][ T5062] ? __mark_inode_dirty+0x297/0xd60
[ 73.981341][ T5062] hfsplus_brec_remove+0x3de/0x4f0
[ 73.986440][ T5062] __hfsplus_delete_attr+0x29e/0x3b0
[ 73.991799][ T5062] ? hfsplus_find_exit+0xc0/0xc0
[ 73.996722][ T5062] ? hfsplus_part_find+0xbb0/0xbb0
[ 74.001824][ T5062] hfsplus_delete_all_attrs+0x26d/0x330
[ 74.007361][ T5062] ? do_raw_spin_lock+0x12e/0x2b0
[ 74.012374][ T5062] ? hfsplus_delete_attr+0x300/0x300
[ 74.017645][ T5062] ? spin_bug+0x1d0/0x1d0
[ 74.021967][ T5062] ? rcu_is_watching+0x12/0xb0
[ 74.026978][ T5062] ? __mark_inode_dirty+0x599/0xd60
[ 74.032249][ T5062] hfsplus_delete_cat+0x83b/0xdd0
[ 74.037442][ T5062] ? hfsplus_create_cat+0x10d0/0x10d0
[ 74.042908][ T5062] ? __mutex_lock+0x1a6/0x9d0
[ 74.047632][ T5062] ? mutex_trylock+0x130/0x130
[ 74.052485][ T5062] hfsplus_unlink+0x213/0x7f0
[ 74.057164][ T5062] ? hfsplus_symlink+0x2b0/0x2b0
[ 74.062107][ T5062] ? preempt_count_sub+0x160/0x160
[ 74.067218][ T5062] vfs_unlink+0x2f1/0x900
[ 74.071792][ T5062] do_unlinkat+0x5bc/0x740
[ 74.076220][ T5062] ? __ia32_sys_rmdir+0x110/0x110
[ 74.081418][ T5062] ? __check_object_size+0x323/0x730
[ 74.086709][ T5062] ? getname_flags.part.0+0x1e2/0x4e0
[ 74.092079][ T5062] __x64_sys_unlink+0xc8/0x110
[ 74.096860][ T5062] do_syscall_64+0x40/0x110
[ 74.101356][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 74.107265][ T5062] RIP: 0033:0x7fe883cfe5f9
[ 74.111662][ T5062] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 74.131254][ T5062] RSP: 002b:00007fffa3abefb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 74.139738][ T5062] RAX: ffffffffffffffda RBX: 00007fffa3abf198 RCX: 00007fe883cfe5f9
[ 74.147716][ T5062] RDX: 00007fe883cfd8f0 RSI: 0000000000000000 RDI: 0000000020000140
[ 74.155705][ T5062] RBP: 00007fe883d71610 R08: 0000000000000640 R09: 0000000000000000
[ 74.163667][ T5062] R10: 00007fffa3abee80 R11: 0000000000000246 R12: 0000000000000001
[ 74.171659][ T5062] R13: 00007fffa3abf188 R14: 0000000000000001 R15: 0000000000000001
[ 74.179632][ T5062]
[ 74.182927][ T5062] Kernel Offset: disabled
[ 74.187238][ T5062] Rebooting in 86400 seconds..