./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4066338464

<...>
Warning: Permanently added '10.128.0.245' (ED25519) to the list of known hosts.
execve("./syz-executor4066338464", ["./syz-executor4066338464"], 0x7ffd8da6f7b0 /* 10 vars */) = 0
brk(NULL)                               = 0x555555c6a000
brk(0x555555c6ad00)                     = 0x555555c6ad00
arch_prctl(ARCH_SET_FS, 0x555555c6a380) = 0
set_tid_address(0x555555c6a650)         = 5064
set_robust_list(0x555555c6a660, 24)     = 0
rseq(0x555555c6aca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor4066338464", 4096) = 28
getrandom("\xf6\x44\xe5\xb2\x6b\x36\x09\xd1", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555555c6ad00
brk(0x555555c8bd00)                     = 0x555555c8bd00
brk(0x555555c8c000)                     = 0x555555c8c000
mprotect(0x7f72df186000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5066 attached
 <unfinished ...>
[pid  5066] set_robust_list(0x555555c6a660, 24) = 0
[pid  5066] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5064] <... clone resumed>, child_tidptr=0x555555c6a650) = 5066
[pid  5066] <... prctl resumed>)        = 0
[pid  5066] setpgid(0, 0)               = 0
[pid  5066] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5066] write(3, "1000", 4)         = 4
[pid  5066] close(3)                    = 0
[pid  5066] getuid()                    = 0
[pid  5066] memfd_create("syzkaller", 0) = 3
[pid  5066] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f72d6cd3000
[pid  5066] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
[pid  5066] munmap(0x7f72d6cd3000, 138412032) = 0
[pid  5066] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5066] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5066] close(3)                    = 0
[pid  5066] mkdir("./file0", 0777)      = 0
[   55.496419][ T5066] loop0: detected capacity change from 0 to 8192
[   55.520989][ T5066] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[   55.534083][ T5066] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal
[   55.543560][ T5066] REISERFS (device loop0): using ordered data mode
[   55.550126][ T5066] reiserfs: using flush barriers
[   55.556255][ T5066] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[   55.572924][ T5066] REISERFS (device loop0): checking transaction log (loop0)
[   55.581668][ T5066] REISERFS (device loop0): Using r5 hash to sort names
[   55.588934][ T5066] ==================================================================
[   55.596983][ T5066] BUG: KASAN: use-after-free in search_by_entry_key+0x80b/0x940
[   55.604642][ T5066] Read of size 4 at addr ffff88807367f754 by task syz-executor406/5066
[   55.612854][ T5066] 
[   55.615153][ T5066] CPU: 0 PID: 5066 Comm: syz-executor406 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0
[   55.625536][ T5066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[   55.635568][ T5066] Call Trace:
[   55.638830][ T5066]  <TASK>
[   55.641739][ T5066]  dump_stack_lvl+0xd9/0x1b0
[   55.646341][ T5066]  print_report+0xc4/0x620
[   55.650746][ T5066]  ? __virt_addr_valid+0x5e/0x2d0
[   55.655759][ T5066]  ? __phys_addr+0xc6/0x140
[   55.660272][ T5066]  kasan_report+0xda/0x110
[   55.664691][ T5066]  ? search_by_entry_key+0x80b/0x940
[   55.669973][ T5066]  ? search_by_entry_key+0x80b/0x940
[   55.675251][ T5066]  search_by_entry_key+0x80b/0x940
[   55.680362][ T5066]  reiserfs_find_entry+0x1dc/0xe70
[   55.685472][ T5066]  ? search_by_entry_key+0x940/0x940
[   55.690752][ T5066]  reiserfs_lookup+0x1f5/0x690
[   55.695505][ T5066]  ? reiserfs_unlink+0x740/0x740
[   55.700444][ T5066]  __lookup_slow+0x24d/0x450
[   55.705022][ T5066]  ? lookup_open.isra.0+0x13b0/0x13b0
[   55.710382][ T5066]  ? reacquire_held_locks+0x4c0/0x4c0
[   55.715745][ T5066]  ? secondary_startup_64_no_verify+0x11b/0x17b
[   55.721978][ T5066]  ? secondary_startup_64_no_verify+0x11b/0x17b
[   55.728209][ T5066]  ? d_lookup+0xe9/0x180
[   55.732441][ T5066]  lookup_one_len+0x17d/0x1b0
[   55.737105][ T5066]  ? __lookup_slow+0x450/0x450
[   55.741856][ T5066]  reiserfs_lookup_privroot+0x94/0x200
[   55.747302][ T5066]  reiserfs_fill_super+0x1ab6/0x3160
[   55.752577][ T5066]  ? reiserfs_remount+0x1640/0x1640
[   55.757762][ T5066]  ? up_write+0x510/0x510
[   55.762081][ T5066]  ? lock_sync+0x190/0x190
[   55.766493][ T5066]  ? reiserfs_remount+0x1640/0x1640
[   55.771674][ T5066]  mount_bdev+0x1f3/0x2e0
[   55.775992][ T5066]  ? sget+0x640/0x640
[   55.779963][ T5066]  ? apparmor_capable+0x126/0x1e0
[   55.784977][ T5066]  ? reiserfs_kill_sb+0x1e0/0x1e0
[   55.789985][ T5066]  legacy_get_tree+0x109/0x220
[   55.794744][ T5066]  vfs_get_tree+0x8c/0x370
[   55.799149][ T5066]  path_mount+0x1492/0x1ed0
[   55.803639][ T5066]  ? kmem_cache_free+0xf8/0x350
[   55.808479][ T5066]  ? finish_automount+0xa40/0xa40
[   55.813492][ T5066]  ? putname+0x12e/0x170
[   55.817724][ T5066]  __x64_sys_mount+0x293/0x310
[   55.822477][ T5066]  ? copy_mnt_ns+0xb60/0xb60
[   55.827054][ T5066]  ? syscall_trace_enter.constprop.0+0xaf/0x1e0
[   55.833281][ T5066]  do_syscall_64+0x40/0x110
[   55.837772][ T5066]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[   55.843739][ T5066] RIP: 0033:0x7f72df1130aa
[   55.848138][ T5066] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   55.867729][ T5066] RSP: 002b:00007ffde5b49388 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   55.876122][ T5066] RAX: ffffffffffffffda RBX: 00007ffde5b49390 RCX: 00007f72df1130aa
[   55.884074][ T5066] RDX: 0000000020000000 RSI: 0000000020000440 RDI: 00007ffde5b49390
[   55.892030][ T5066] RBP: 0000000000000004 R08: 00007ffde5b493d0 R09: 0000000000001102
[   55.899984][ T5066] R10: 000000000120c081 R11: 0000000000000286 R12: 00007ffde5b493d0
[   55.907941][ T5066] R13: 0000000000000003 R14: 0000000000400000 R15: 00007f72df15a03b
[   55.915899][ T5066]  </TASK>
[   55.918901][ T5066] 
[   55.921205][ T5066] The buggy address belongs to the physical page:
[   55.927591][ T5066] page:ffffea0001cd9fc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x7367f
[   55.937719][ T5066] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   55.944805][ T5066] page_type: 0xffffffff()
[   55.949118][ T5066] raw: 00fff00000000000 ffffea0001cc3c08 ffff8880b9842630 0000000000000000
[   55.957682][ T5066] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[   55.966241][ T5066] page dumped because: kasan: bad access detected
[   55.972641][ T5066] page_owner tracks the page as freed
[   55.977985][ T5066] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5053, tgid 5053 (sshd), ts 48811994334, free_ts 48868290802
[   55.995942][ T5066]  post_alloc_hook+0x2d0/0x350
[   56.000700][ T5066]  get_page_from_freelist+0xa25/0x36d0
[   56.006151][ T5066]  __alloc_pages+0x22e/0x2420
[   56.010820][ T5066]  alloc_pages_mpol+0x258/0x5f0
[   56.015656][ T5066]  vma_alloc_folio+0xad/0x220
[   56.020332][ T5066]  __handle_mm_fault+0xe07/0x3d70
[   56.025351][ T5066]  handle_mm_fault+0x47a/0xa10
[   56.030107][ T5066]  do_user_addr_fault+0x30b/0x1000
[   56.035205][ T5066]  exc_page_fault+0x5d/0xc0
[   56.039700][ T5066]  asm_exc_page_fault+0x26/0x30
[   56.044538][ T5066] page last free stack trace:
[   56.049188][ T5066]  free_unref_page_prepare+0x4fa/0xaa0
[   56.054637][ T5066]  free_unref_page_list+0xe6/0xb40
[   56.059738][ T5066]  release_pages+0x32a/0x14f0
[   56.064397][ T5066]  tlb_batch_pages_flush+0x9a/0x190
[   56.069583][ T5066]  tlb_finish_mmu+0x14b/0x6f0
[   56.074249][ T5066]  unmap_region.constprop.0+0x2e6/0x3b0
[   56.079778][ T5066]  do_vmi_align_munmap+0xde6/0x1600
[   56.084962][ T5066]  do_vmi_munmap+0x20e/0x450
[   56.089562][ T5066]  __vm_munmap+0x144/0x390
[   56.093961][ T5066]  __x64_sys_munmap+0x62/0x80
[   56.098624][ T5066]  do_syscall_64+0x40/0x110
[   56.103118][ T5066]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[   56.108994][ T5066] 
[   56.111297][ T5066] Memory state around the buggy address:
[   56.116905][ T5066]  ffff88807367f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   56.124947][ T5066]  ffff88807367f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   56.133098][ T5066] >ffff88807367f700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   56.141140][ T5066]                                                  ^
[   56.147795][ T5066]  ffff88807367f780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   56.156021][ T5066]  ffff88807367f800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   56.164065][ T5066] ==================================================================
[   56.172225][ T5066] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   56.179420][ T5066] CPU: 0 PID: 5066 Comm: syz-executor406 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0
[   56.189827][ T5066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[   56.199875][ T5066] Call Trace:
[   56.203141][ T5066]  <TASK>
[   56.206055][ T5066]  dump_stack_lvl+0xd9/0x1b0
[   56.210638][ T5066]  panic+0x6dc/0x790
[   56.214610][ T5066]  ? panic_smp_self_stop+0xa0/0xa0
[   56.219712][ T5066]  ? check_panic_on_warn+0x1f/0xb0
[   56.224811][ T5066]  check_panic_on_warn+0xab/0xb0
[   56.229741][ T5066]  end_report+0x108/0x150
[   56.234064][ T5066]  kasan_report+0xea/0x110
[   56.238472][ T5066]  ? search_by_entry_key+0x80b/0x940
[   56.243760][ T5066]  ? search_by_entry_key+0x80b/0x940
[   56.249041][ T5066]  search_by_entry_key+0x80b/0x940
[   56.254144][ T5066]  reiserfs_find_entry+0x1dc/0xe70
[   56.259247][ T5066]  ? search_by_entry_key+0x940/0x940
[   56.264525][ T5066]  reiserfs_lookup+0x1f5/0x690
[   56.269279][ T5066]  ? reiserfs_unlink+0x740/0x740
[   56.274215][ T5066]  __lookup_slow+0x24d/0x450
[   56.278796][ T5066]  ? lookup_open.isra.0+0x13b0/0x13b0
[   56.284161][ T5066]  ? reacquire_held_locks+0x4c0/0x4c0
[   56.289528][ T5066]  ? secondary_startup_64_no_verify+0x11b/0x17b
[   56.295761][ T5066]  ? secondary_startup_64_no_verify+0x11b/0x17b
[   56.301994][ T5066]  ? d_lookup+0xe9/0x180
[   56.306227][ T5066]  lookup_one_len+0x17d/0x1b0
[   56.310898][ T5066]  ? __lookup_slow+0x450/0x450
[   56.315650][ T5066]  reiserfs_lookup_privroot+0x94/0x200
[   56.321095][ T5066]  reiserfs_fill_super+0x1ab6/0x3160
[   56.326369][ T5066]  ? reiserfs_remount+0x1640/0x1640
[   56.331556][ T5066]  ? up_write+0x510/0x510
[   56.335876][ T5066]  ? lock_sync+0x190/0x190
[   56.340293][ T5066]  ? reiserfs_remount+0x1640/0x1640
[   56.345483][ T5066]  mount_bdev+0x1f3/0x2e0
[   56.349812][ T5066]  ? sget+0x640/0x640
[   56.353788][ T5066]  ? apparmor_capable+0x126/0x1e0
[   56.358803][ T5066]  ? reiserfs_kill_sb+0x1e0/0x1e0
[   56.363812][ T5066]  legacy_get_tree+0x109/0x220
[   56.368573][ T5066]  vfs_get_tree+0x8c/0x370
[   56.372979][ T5066]  path_mount+0x1492/0x1ed0
[   56.377475][ T5066]  ? kmem_cache_free+0xf8/0x350
[   56.382317][ T5066]  ? finish_automount+0xa40/0xa40
[   56.387364][ T5066]  ? putname+0x12e/0x170
[   56.391595][ T5066]  __x64_sys_mount+0x293/0x310
[   56.396348][ T5066]  ? copy_mnt_ns+0xb60/0xb60
[   56.400928][ T5066]  ? syscall_trace_enter.constprop.0+0xaf/0x1e0
[   56.407158][ T5066]  do_syscall_64+0x40/0x110
[   56.411649][ T5066]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[   56.417530][ T5066] RIP: 0033:0x7f72df1130aa
[   56.421930][ T5066] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   56.441522][ T5066] RSP: 002b:00007ffde5b49388 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   56.449922][ T5066] RAX: ffffffffffffffda RBX: 00007ffde5b49390 RCX: 00007f72df1130aa
[   56.457881][ T5066] RDX: 0000000020000000 RSI: 0000000020000440 RDI: 00007ffde5b49390
[   56.465834][ T5066] RBP: 0000000000000004 R08: 00007ffde5b493d0 R09: 0000000000001102
[   56.473787][ T5066] R10: 000000000120c081 R11: 0000000000000286 R12: 00007ffde5b493d0
[   56.481743][ T5066] R13: 0000000000000003 R14: 0000000000400000 R15: 00007f72df15a03b
[   56.489705][ T5066]  </TASK>
[   56.492936][ T5066] Kernel Offset: disabled
[   56.497236][ T5066] Rebooting in 86400 seconds..