./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1926542039 <...> Warning: Permanently added '10.128.0.37' (ED25519) to the list of known hosts. execve("./syz-executor1926542039", ["./syz-executor1926542039"], 0x7ffc92e76b90 /* 10 vars */) = 0 brk(NULL) = 0x555566c04000 brk(0x555566c04d00) = 0x555566c04d00 arch_prctl(ARCH_SET_FS, 0x555566c04380) = 0 set_tid_address(0x555566c04650) = 5827 set_robust_list(0x555566c04660, 24) = 0 rseq(0x555566c04ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1926542039", 4096) = 28 getrandom("\x8d\xf4\xb1\xf3\x67\x4c\xe0\xea", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555566c04d00 brk(0x555566c25d00) = 0x555566c25d00 brk(0x555566c26000) = 0x555566c26000 mprotect(0x7f6cf3a63000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.nimjRy", 0700) = 0 chmod("./syzkaller.nimjRy", 0777) = 0 chdir("./syzkaller.nimjRy") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5829 attached [pid 5829] set_robust_list(0x555566c04660, 24 [pid 5827] <... clone resumed>, child_tidptr=0x555566c04650) = 5829 [pid 5829] <... set_robust_list resumed>) = 0 [pid 5829] chdir("./0") = 0 [pid 5829] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5829] setpgid(0, 0) = 0 [pid 5829] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "1000", 4) = 4 [pid 5829] close(3) = 0 [pid 5829] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5829] write(1, "executing program\n", 18) = 18 [pid 5829] memfd_create("syzkaller", 0) = 3 [pid 5829] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6ceb400000 [pid 5829] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5829] munmap(0x7f6ceb400000, 138412032) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5829] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5829] close(3) = 0 [pid 5829] close(4) = 0 [pid 5829] mkdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", 0777) = 0 [ 59.855330][ T5829] loop0: detected capacity change from 0 to 512 [pid 5829] mount("/dev/loop0", "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_I_VERSION|0x200, ",errors=continue") = 0 [pid 5829] openat(AT_FDCWD, "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", O_RDONLY|O_DIRECTORY) = 3 [pid 5829] chdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b") = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5829] chdir("./file0") = 0 [pid 5829] openat(AT_FDCWD, "net_prio.prioidx", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 5829] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 005) = 0 [pid 5829] creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 5 [pid 5829] mknod("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 0 [ 59.904842][ T5829] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz-executor192: corrupted in-inode xattr: invalid ea_ino [ 59.919735][ T5829] EXT4-fs error (device loop0): ext4_orphan_get:1393: comm syz-executor192: couldn't read orphan inode 15 (err -117) [ 59.933402][ T5829] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.968220][ T5829] ================================================================== [ 59.976503][ T5829] BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 [ 59.984075][ T5829] Write of size 251 at addr ffff88807571df14 by task syz-executor192/5829 [ 59.992562][ T5829] [ 59.994922][ T5829] CPU: 1 UID: 0 PID: 5829 Comm: syz-executor192 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 [ 60.006034][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 60.016108][ T5829] Call Trace: [ 60.019386][ T5829] [ 60.022311][ T5829] dump_stack_lvl+0x241/0x360 [ 60.026999][ T5829] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.032192][ T5829] ? __pfx__printk+0x10/0x10 [ 60.036779][ T5829] ? _printk+0xd5/0x120 [ 60.040928][ T5829] ? __virt_addr_valid+0x183/0x530 [ 60.046032][ T5829] ? __virt_addr_valid+0x183/0x530 [ 60.051144][ T5829] print_report+0x169/0x550 [ 60.055646][ T5829] ? __virt_addr_valid+0x183/0x530 [ 60.060747][ T5829] ? __virt_addr_valid+0x183/0x530 [ 60.065866][ T5829] ? __virt_addr_valid+0x45f/0x530 [ 60.070991][ T5829] ? __phys_addr+0xba/0x170 [ 60.075491][ T5829] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.080692][ T5829] kasan_report+0x143/0x180 [ 60.085199][ T5829] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.090399][ T5829] kasan_check_range+0x282/0x290 [ 60.095339][ T5829] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.100616][ T5829] __asan_memcpy+0x40/0x70 [ 60.105037][ T5829] ext4_insert_dentry+0x36a/0x6d0 [ 60.110090][ T5829] add_dirent_to_buf+0x3d9/0x750 [ 60.115456][ T5829] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 60.120909][ T5829] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 60.127082][ T5829] make_indexed_dir+0xf98/0x1600 [ 60.132070][ T5829] ? __pfx_make_indexed_dir+0x10/0x10 [ 60.137459][ T5829] ? add_dirent_to_buf+0x398/0x750 [ 60.142573][ T5829] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 60.148036][ T5829] ? __ext4_read_dirblock+0x527/0x890 [ 60.153405][ T5829] ext4_add_entry+0x222a/0x25d0 [ 60.158254][ T5829] ? __pfx_ext4_initxattrs+0x10/0x10 [ 60.163542][ T5829] ? __pfx_security_inode_init_security+0x10/0x10 [ 60.170037][ T5829] ? rcu_is_watching+0x15/0xb0 [ 60.174796][ T5829] ? __brelse+0x59/0xa0 [ 60.178973][ T5829] ? __ext4_new_inode+0x380f/0x4380 [ 60.184162][ T5829] ? __pfx_ext4_add_entry+0x10/0x10 [ 60.189363][ T5829] ext4_add_nondir+0x8d/0x290 [ 60.194035][ T5829] ? ext4_symlink+0x6ce/0xb50 [ 60.198705][ T5829] ext4_symlink+0x920/0xb50 [ 60.203203][ T5829] ? __pfx_ext4_symlink+0x10/0x10 [ 60.208227][ T5829] ? generic_permission+0x1e0/0x550 [ 60.213426][ T5829] ? bpf_lsm_inode_symlink+0x9/0x10 [ 60.218618][ T5829] ? security_inode_symlink+0xbe/0x330 [ 60.224084][ T5829] vfs_symlink+0x137/0x2e0 [ 60.228505][ T5829] do_symlinkat+0x222/0x3a0 [ 60.233007][ T5829] ? __pfx_do_symlinkat+0x10/0x10 [ 60.238023][ T5829] ? strncpy_from_user+0x13a/0x260 [ 60.243133][ T5829] ? getname_flags+0x1e3/0x540 [ 60.247892][ T5829] __x64_sys_symlink+0x7a/0x90 [ 60.252696][ T5829] do_syscall_64+0xf3/0x230 [ 60.257217][ T5829] ? clear_bhb_loop+0x35/0x90 [ 60.261888][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.267787][ T5829] RIP: 0033:0x7f6cf39ef229 [ 60.272205][ T5829] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 60.291809][ T5829] RSP: 002b:00007ffdd606b258 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 60.300226][ T5829] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f6cf39ef229 [ 60.308190][ T5829] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0 [ 60.316157][ T5829] RBP: 0000000000000000 R08: 00007ffdd606b290 R09: 00007ffdd606b290 [ 60.324293][ T5829] R10: 00007ffdd606b290 R11: 0000000000000246 R12: 0000000000000001 [ 60.332254][ T5829] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffdd606b2b0 [ 60.340221][ T5829] [ 60.343229][ T5829] [ 60.345540][ T5829] The buggy address belongs to the physical page: [ 60.351947][ T5829] page: refcount:3 mapcount:0 mapping:ffff888148c8cd78 index:0x3f pfn:0x7571d [ 60.360793][ T5829] memcg:ffff888140adc000 [ 60.365029][ T5829] aops:def_blk_aops ino:700000 dentry name(?):"" [ 60.371353][ T5829] flags: 0xfff00000004114(referenced|dirty|active|private|node=0|zone=1|lastcpupid=0x7ff) [ 60.381245][ T5829] raw: 00fff00000004114 0000000000000000 dead000000000122 ffff888148c8cd78 [ 60.389858][ T5829] raw: 000000000000003f ffff88805f377570 00000003ffffffff ffff888140adc000 [ 60.398440][ T5829] page dumped because: kasan: bad access detected [ 60.404856][ T5829] page_owner tracks the page as allocated [ 60.410569][ T5829] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 5829, tgid 5829 (syz-executor192), ts 59968016324, free_ts 53919646077 [ 60.431276][ T5829] post_alloc_hook+0x1f3/0x230 [ 60.436043][ T5829] get_page_from_freelist+0x3033/0x3180 [ 60.441673][ T5829] __alloc_pages_noprof+0x292/0x710 [ 60.447125][ T5829] alloc_pages_mpol_noprof+0x3e8/0x680 [ 60.452580][ T5829] folio_alloc_noprof+0x128/0x180 [ 60.457681][ T5829] filemap_alloc_folio_noprof+0xdf/0x500 [ 60.463306][ T5829] __filemap_get_folio+0x446/0xbd0 [ 60.468411][ T5829] bdev_getblk+0x1d8/0x550 [ 60.472819][ T5829] ext4_getblk+0x303/0x800 [ 60.477224][ T5829] ext4_bread+0x2e/0x180 [ 60.481455][ T5829] ext4_append+0x327/0x5c0 [ 60.485862][ T5829] make_indexed_dir+0x523/0x1600 [ 60.490789][ T5829] ext4_add_entry+0x222a/0x25d0 [ 60.495633][ T5829] ext4_add_nondir+0x8d/0x290 [ 60.500300][ T5829] ext4_symlink+0x920/0xb50 [ 60.504791][ T5829] vfs_symlink+0x137/0x2e0 [ 60.509200][ T5829] page last free pid 5821 tgid 5821 stack trace: [ 60.515513][ T5829] free_unref_folios+0xee2/0x18a0 [ 60.520527][ T5829] folios_put_refs+0x76c/0x860 [ 60.525279][ T5829] free_pages_and_swap_cache+0x2ea/0x690 [ 60.530901][ T5829] tlb_flush_mmu+0x3a3/0x680 [ 60.535481][ T5829] tlb_finish_mmu+0xd4/0x200 [ 60.540065][ T5829] exit_mmap+0x496/0xc40 [ 60.544300][ T5829] __mmput+0x115/0x380 [ 60.548358][ T5829] exit_mm+0x220/0x310 [ 60.552440][ T5829] do_exit+0x9b2/0x28e0 [ 60.556582][ T5829] do_group_exit+0x207/0x2c0 [ 60.561156][ T5829] __x64_sys_exit_group+0x3f/0x40 [ 60.566165][ T5829] x64_sys_call+0x2634/0x2640 [ 60.570834][ T5829] do_syscall_64+0xf3/0x230 [ 60.575325][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.581298][ T5829] [ 60.583607][ T5829] Memory state around the buggy address: [ 60.589222][ T5829] ffff88807571df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.597269][ T5829] ffff88807571df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.605314][ T5829] >ffff88807571e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.613357][ T5829] ^ [ 60.617412][ T5829] ffff88807571e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.625468][ T5829] ffff88807571e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.633529][ T5829] ================================================================== [ 60.642263][ T5829] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 60.649483][ T5829] CPU: 0 UID: 0 PID: 5829 Comm: syz-executor192 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 [ 60.660713][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 60.670781][ T5829] Call Trace: [ 60.674059][ T5829] [ 60.676981][ T5829] dump_stack_lvl+0x241/0x360 [ 60.682174][ T5829] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.687367][ T5829] ? __pfx__printk+0x10/0x10 [ 60.691946][ T5829] ? preempt_schedule+0xe1/0xf0 [ 60.696788][ T5829] ? vscnprintf+0x5d/0x90 [ 60.701157][ T5829] panic+0x349/0x880 [ 60.705140][ T5829] ? check_panic_on_warn+0x21/0xb0 [ 60.710266][ T5829] ? __pfx_panic+0x10/0x10 [ 60.714678][ T5829] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 60.720678][ T5829] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 60.727021][ T5829] ? print_report+0x502/0x550 [ 60.731688][ T5829] check_panic_on_warn+0x86/0xb0 [ 60.736618][ T5829] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.741806][ T5829] end_report+0x77/0x160 [ 60.746044][ T5829] kasan_report+0x154/0x180 [ 60.750554][ T5829] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.755745][ T5829] kasan_check_range+0x282/0x290 [ 60.760758][ T5829] ? ext4_insert_dentry+0x36a/0x6d0 [ 60.765943][ T5829] __asan_memcpy+0x40/0x70 [ 60.770350][ T5829] ext4_insert_dentry+0x36a/0x6d0 [ 60.775361][ T5829] add_dirent_to_buf+0x3d9/0x750 [ 60.780316][ T5829] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 60.785799][ T5829] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 60.791953][ T5829] make_indexed_dir+0xf98/0x1600 [ 60.796883][ T5829] ? __pfx_make_indexed_dir+0x10/0x10 [ 60.802237][ T5829] ? add_dirent_to_buf+0x398/0x750 [ 60.807336][ T5829] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 60.812797][ T5829] ? __ext4_read_dirblock+0x527/0x890 [ 60.818159][ T5829] ext4_add_entry+0x222a/0x25d0 [ 60.822994][ T5829] ? __pfx_ext4_initxattrs+0x10/0x10 [ 60.828263][ T5829] ? __pfx_security_inode_init_security+0x10/0x10 [ 60.834661][ T5829] ? rcu_is_watching+0x15/0xb0 [ 60.839415][ T5829] ? __brelse+0x59/0xa0 [ 60.843554][ T5829] ? __ext4_new_inode+0x380f/0x4380 [ 60.848734][ T5829] ? __pfx_ext4_add_entry+0x10/0x10 [ 60.853923][ T5829] ext4_add_nondir+0x8d/0x290 [ 60.858604][ T5829] ? ext4_symlink+0x6ce/0xb50 [ 60.863263][ T5829] ext4_symlink+0x920/0xb50 [ 60.867753][ T5829] ? __pfx_ext4_symlink+0x10/0x10 [ 60.872764][ T5829] ? generic_permission+0x1e0/0x550 [ 60.877957][ T5829] ? bpf_lsm_inode_symlink+0x9/0x10 [ 60.883143][ T5829] ? security_inode_symlink+0xbe/0x330 [ 60.888590][ T5829] vfs_symlink+0x137/0x2e0 [ 60.892996][ T5829] do_symlinkat+0x222/0x3a0 [ 60.897485][ T5829] ? __pfx_do_symlinkat+0x10/0x10 [ 60.902496][ T5829] ? strncpy_from_user+0x13a/0x260 [ 60.907591][ T5829] ? getname_flags+0x1e3/0x540 [ 60.912339][ T5829] __x64_sys_symlink+0x7a/0x90 [ 60.917112][ T5829] do_syscall_64+0xf3/0x230 [ 60.921603][ T5829] ? clear_bhb_loop+0x35/0x90 [ 60.926285][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.932250][ T5829] RIP: 0033:0x7f6cf39ef229 [ 60.936649][ T5829] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 60.956244][ T5829] RSP: 002b:00007ffdd606b258 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 60.964646][ T5829] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f6cf39ef229 [ 60.972605][ T5829] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0 [ 60.980560][ T5829] RBP: 0000000000000000 R08: 00007ffdd606b290 R09: 00007ffdd606b290 [ 60.988516][ T5829] R10: 00007ffdd606b290 R11: 0000000000000246 R12: 0000000000000001 [ 60.996473][ T5829] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffdd606b2b0 [ 61.004432][ T5829] [ 61.007695][ T5829] Kernel Offset: disabled [ 61.012017][ T5829] Rebooting in 86400 seconds..