./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1998409801 <...> Warning: Permanently added '10.128.1.134' (ED25519) to the list of known hosts. execve("./syz-executor1998409801", ["./syz-executor1998409801"], 0x7fff620abaa0 /* 10 vars */) = 0 brk(NULL) = 0x55557dee0000 brk(0x55557dee0d00) = 0x55557dee0d00 arch_prctl(ARCH_SET_FS, 0x55557dee0380) = 0 set_tid_address(0x55557dee0650) = 5827 set_robust_list(0x55557dee0660, 24) = 0 rseq(0x55557dee0ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1998409801", 4096) = 28 getrandom("\x8f\x09\x60\x99\x68\x47\x71\x76", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557dee0d00 brk(0x55557df01d00) = 0x55557df01d00 brk(0x55557df02000) = 0x55557df02000 mprotect(0x7ffa585ea000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.9aEliF", 0700) = 0 chmod("./syzkaller.9aEliF", 0777) = 0 chdir("./syzkaller.9aEliF") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5828 attached [pid 5828] set_robust_list(0x55557dee0660, 24 [pid 5827] <... clone resumed>, child_tidptr=0x55557dee0650) = 5828 [pid 5828] <... set_robust_list resumed>) = 0 [pid 5828] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5828] getppid() = 0 [pid 5828] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5828] unshare(CLONE_NEWNS) = 0 [pid 5828] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5828] unshare(CLONE_NEWIPC) = 0 [pid 5828] unshare(CLONE_NEWCGROUP) = 0 [pid 5828] unshare(CLONE_NEWUTS) = 0 [pid 5828] unshare(CLONE_SYSVSEM) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "16777216", 8) = 8 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "536870912", 9) = 9 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "8192", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5828] close(3) = 0 [pid 5828] getpid() = 1 [pid 5828] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5840] set_robust_list(0x55557dee0660, 24) = 0 [pid 5840] chdir("./0") = 0 [pid 5828] <... clone resumed>, child_tidptr=0x55557dee0650) = 2 [pid 5840] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5840] setpgid(0, 0) = 0 [pid 5840] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "1000", 4) = 4 [pid 5840] close(3) = 0 [pid 5840] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5840] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5840] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 5840] read(200, 0x7ffdd8d08200, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5840] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5840] write(1, "executing program\n", 18executing program ) = 18 [pid 5840] memfd_create("syzkaller", 0) = 3 [pid 5840] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffa50000000 [pid 5840] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5840] munmap(0x7ffa50000000, 138412032) = 0 [pid 5840] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5840] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5840] close(3) = 0 [pid 5840] close(4) = 0 [pid 5840] mkdir("./file1", 0777) = 0 [ 96.621137][ T5840] loop0: detected capacity change from 0 to 32768 [ 96.655412][ T5840] ======================================================= [ 96.655412][ T5840] WARNING: The mand mount option has been deprecated and [ 96.655412][ T5840] and is ignored by this kernel. Remove the mand [ 96.655412][ T5840] option from the mount to silence this warning. [ 96.655412][ T5840] ======================================================= [pid 5840] mount("/dev/loop0", "./file1", "ocfs2", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME, "acl,heartbeat=none,errors=remount-ro,coherency=full,coherency=full,localflocks,coherency=full,noacl,") = 0 [pid 5840] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5840] chdir("./file1") = 0 [pid 5840] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5840] openat(AT_FDCWD, ".", O_RDONLY) = 4 [pid 5840] lseek(4, -4, SEEK_END) = 5497558139188 [pid 5840] getdents(4, NULL /* 0 entries */, 84) = 0 [pid 5840] close(3) = 0 [pid 5840] close(4) = 0 [pid 5840] close(5) = -1 EBADF (Bad file descriptor) [pid 5840] close(6) = -1 EBADF (Bad file descriptor) [pid 5840] close(7) = -1 EBADF (Bad file descriptor) [pid 5840] close(8) = -1 EBADF (Bad file descriptor) [pid 5840] close(9) = -1 EBADF (Bad file descriptor) [pid 5840] close(10) = -1 EBADF (Bad file descriptor) [pid 5840] close(11) = -1 EBADF (Bad file descriptor) [pid 5840] close(12) = -1 EBADF (Bad file descriptor) [pid 5840] close(13) = -1 EBADF (Bad file descriptor) [pid 5840] close(14) = -1 EBADF (Bad file descriptor) [pid 5840] close(15) = -1 EBADF (Bad file descriptor) [pid 5840] close(16) = -1 EBADF (Bad file descriptor) [pid 5840] close(17) = -1 EBADF (Bad file descriptor) [pid 5840] close(18) = -1 EBADF (Bad file descriptor) [ 96.722587][ T5840] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 96.740958][ T5840] (syz-executor199,5840,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #65: rec_len is smaller than minimal - offset=258821, inode=37188846989240003, rec_len=0, name_len=0 [pid 5840] close(19) = -1 EBADF (Bad file descriptor) [pid 5840] close(20) = -1 EBADF (Bad file descriptor) [pid 5840] close(21) = -1 EBADF (Bad file descriptor) [pid 5840] close(22) = -1 EBADF (Bad file descriptor) [pid 5840] close(23) = -1 EBADF (Bad file descriptor) [pid 5840] close(24) = -1 EBADF (Bad file descriptor) [pid 5840] close(25) = -1 EBADF (Bad file descriptor) [pid 5840] close(26) = -1 EBADF (Bad file descriptor) [pid 5840] close(27) = -1 EBADF (Bad file descriptor) [pid 5840] close(28) = -1 EBADF (Bad file descriptor) [pid 5840] close(29) = -1 EBADF (Bad file descriptor) [pid 5840] exit_group(0) = ? [pid 5840] +++ exited with 0 +++ [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=21 /* 0.21 s */} --- [pid 5828] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5828] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=80, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 4 entries */, 32768) = 112 [pid 5828] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 5828] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 97.002970][ T5828] ocfs2: Unmounting device (7,0) on (node local) [pid 5828] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5828] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(4, 0x55557dee9730 /* 2 entries */, 32768) = 48 [pid 5828] getdents64(4, 0x55557dee9730 /* 0 entries */, 32768) = 0 [pid 5828] close(4) = 0 [pid 5828] rmdir("./0/file1") = 0 [pid 5828] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] unlink("./0/binderfs") = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 0 entries */, 32768) = 0 [pid 5828] close(3) = 0 [pid 5828] rmdir("./0") = 0 [pid 5828] mkdir("./1", 0777) = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5828] ioctl(3, LOOP_CLR_FD) = 0 [pid 5828] close(3) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5843 attached , child_tidptr=0x55557dee0650) = 3 [pid 5843] set_robust_list(0x55557dee0660, 24) = 0 [pid 5843] chdir("./1") = 0 [pid 5843] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5843] setpgid(0, 0) = 0 [pid 5843] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "1000", 4) = 4 [pid 5843] close(3) = 0 [pid 5843] read(200, 0x7ffdd8d08200, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5843] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5843] write(1, "executing program\n", 18executing program ) = 18 [pid 5843] memfd_create("syzkaller", 0) = 3 [pid 5843] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffa50000000 [pid 5843] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5843] munmap(0x7ffa50000000, 138412032) = 0 [pid 5843] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5843] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5843] close(3) = 0 [pid 5843] close(4) = 0 [pid 5843] mkdir("./file1", 0777) = 0 [ 97.632857][ T5843] loop0: detected capacity change from 0 to 32768 [pid 5843] mount("/dev/loop0", "./file1", "ocfs2", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME, "acl,heartbeat=none,errors=remount-ro,coherency=full,coherency=full,localflocks,coherency=full,noacl,") = 0 [pid 5843] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5843] chdir("./file1") = 0 [pid 5843] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5843] openat(AT_FDCWD, ".", O_RDONLY) = 4 [pid 5843] lseek(4, -4, SEEK_END) = 5497558139188 [ 97.682866][ T5843] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5843] getdents(4, NULL /* 0 entries */, 84) = 0 [pid 5843] close(3) = 0 [pid 5843] close(4) = 0 [pid 5843] close(5) = -1 EBADF (Bad file descriptor) [pid 5843] close(6) = -1 EBADF (Bad file descriptor) [pid 5843] close(7) = -1 EBADF (Bad file descriptor) [ 97.739686][ T5843] (syz-executor199,5843,0):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #65: rec_len is smaller than minimal - offset=26105, inode=3707764736, rec_len=0, name_len=0 [pid 5843] close(8) = -1 EBADF (Bad file descriptor) [pid 5843] close(9) = -1 EBADF (Bad file descriptor) [pid 5843] close(10) = -1 EBADF (Bad file descriptor) [pid 5843] close(11) = -1 EBADF (Bad file descriptor) [pid 5843] close(12) = -1 EBADF (Bad file descriptor) [pid 5843] close(13) = -1 EBADF (Bad file descriptor) [pid 5843] close(14) = -1 EBADF (Bad file descriptor) [pid 5843] close(15) = -1 EBADF (Bad file descriptor) [pid 5843] close(16) = -1 EBADF (Bad file descriptor) [pid 5843] close(17) = -1 EBADF (Bad file descriptor) [pid 5843] close(18) = -1 EBADF (Bad file descriptor) [pid 5843] close(19) = -1 EBADF (Bad file descriptor) [pid 5843] close(20) = -1 EBADF (Bad file descriptor) [pid 5843] close(21) = -1 EBADF (Bad file descriptor) [pid 5843] close(22) = -1 EBADF (Bad file descriptor) [pid 5843] close(23) = -1 EBADF (Bad file descriptor) [pid 5843] close(24) = -1 EBADF (Bad file descriptor) [pid 5843] close(25) = -1 EBADF (Bad file descriptor) [pid 5843] close(26) = -1 EBADF (Bad file descriptor) [pid 5843] close(27) = -1 EBADF (Bad file descriptor) [pid 5843] close(28) = -1 EBADF (Bad file descriptor) [pid 5843] close(29) = -1 EBADF (Bad file descriptor) [pid 5843] exit_group(0) = ? [pid 5843] +++ exited with 0 +++ [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=22 /* 0.22 s */} --- [pid 5828] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5828] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5828] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=80, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 4 entries */, 32768) = 112 [pid 5828] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 5828] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 97.996577][ T5828] ocfs2: Unmounting device (7,0) on (node local) [pid 5828] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5828] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(4, 0x55557dee9730 /* 2 entries */, 32768) = 48 [pid 5828] getdents64(4, 0x55557dee9730 /* 0 entries */, 32768) = 0 [pid 5828] close(4) = 0 [pid 5828] rmdir("./1/file1") = 0 [pid 5828] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] unlink("./1/binderfs") = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 0 entries */, 32768) = 0 [pid 5828] close(3) = 0 [pid 5828] rmdir("./1") = 0 [pid 5828] mkdir("./2", 0777) = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5828] ioctl(3, LOOP_CLR_FD) = 0 [pid 5828] close(3) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5846 attached , child_tidptr=0x55557dee0650) = 4 [pid 5846] set_robust_list(0x55557dee0660, 24) = 0 [pid 5846] chdir("./2") = 0 [pid 5846] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5846] setpgid(0, 0) = 0 [pid 5846] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5846] write(3, "1000", 4) = 4 [pid 5846] close(3) = 0 [pid 5846] read(200, 0x7ffdd8d08200, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5846] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5846] write(1, "executing program\n", 18executing program ) = 18 [pid 5846] memfd_create("syzkaller", 0) = 3 [pid 5846] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffa50000000 [pid 5846] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5846] munmap(0x7ffa50000000, 138412032) = 0 [pid 5846] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5846] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5846] close(3) = 0 [pid 5846] close(4) = 0 [pid 5846] mkdir("./file1", 0777) = 0 [ 98.668653][ T5846] loop0: detected capacity change from 0 to 32768 [pid 5846] mount("/dev/loop0", "./file1", "ocfs2", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME, "acl,heartbeat=none,errors=remount-ro,coherency=full,coherency=full,localflocks,coherency=full,noacl,") = 0 [pid 5846] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5846] chdir("./file1") = 0 [pid 5846] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5846] openat(AT_FDCWD, ".", O_RDONLY) = 4 [pid 5846] lseek(4, -4, SEEK_END) = 5497558139188 [pid 5846] getdents(4, NULL /* 0 entries */, 84) = 0 [pid 5846] close(3) = 0 [pid 5846] close(4) = 0 [pid 5846] close(5) = -1 EBADF (Bad file descriptor) [pid 5846] close(6) = -1 EBADF (Bad file descriptor) [pid 5846] close(7) = -1 EBADF (Bad file descriptor) [pid 5846] close(8) = -1 EBADF (Bad file descriptor) [ 98.722978][ T5846] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 98.738657][ T5846] (syz-executor199,5846,0):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #65: rec_len is smaller than minimal - offset=26105, inode=0, rec_len=0, name_len=0 [pid 5846] close(9) = -1 EBADF (Bad file descriptor) [pid 5846] close(10) = -1 EBADF (Bad file descriptor) [pid 5846] close(11) = -1 EBADF (Bad file descriptor) [pid 5846] close(12) = -1 EBADF (Bad file descriptor) [pid 5846] close(13) = -1 EBADF (Bad file descriptor) [pid 5846] close(14) = -1 EBADF (Bad file descriptor) [pid 5846] close(15) = -1 EBADF (Bad file descriptor) [pid 5846] close(16) = -1 EBADF (Bad file descriptor) [pid 5846] close(17) = -1 EBADF (Bad file descriptor) [pid 5846] close(18) = -1 EBADF (Bad file descriptor) [pid 5846] close(19) = -1 EBADF (Bad file descriptor) [pid 5846] close(20) = -1 EBADF (Bad file descriptor) [pid 5846] close(21) = -1 EBADF (Bad file descriptor) [pid 5846] close(22) = -1 EBADF (Bad file descriptor) [pid 5846] close(23) = -1 EBADF (Bad file descriptor) [pid 5846] close(24) = -1 EBADF (Bad file descriptor) [pid 5846] close(25) = -1 EBADF (Bad file descriptor) [pid 5846] close(26) = -1 EBADF (Bad file descriptor) [pid 5846] close(27) = -1 EBADF (Bad file descriptor) [pid 5846] close(28) = -1 EBADF (Bad file descriptor) [pid 5846] close(29) = -1 EBADF (Bad file descriptor) [pid 5846] exit_group(0) = ? [pid 5846] +++ exited with 0 +++ [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=19 /* 0.19 s */} --- [pid 5828] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5828] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5828] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=80, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 4 entries */, 32768) = 112 [pid 5828] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 5828] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5828] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(4, 0x55557dee9730 /* 2 entries */, 32768) = 48 [pid 5828] getdents64(4, 0x55557dee9730 /* 0 entries */, 32768) = 0 [pid 5828] close(4) = 0 [pid 5828] rmdir("./2/file1") = 0 [pid 5828] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] unlink("./2/binderfs") = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 0 entries */, 32768) = 0 [pid 5828] close(3) = 0 [pid 5828] rmdir("./2") = 0 [pid 5828] mkdir("./3", 0777) = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5828] ioctl(3, LOOP_CLR_FD) = 0 [ 99.072299][ T5828] ocfs2: Unmounting device (7,0) on (node local) [pid 5828] close(3) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5849 attached , child_tidptr=0x55557dee0650) = 5 [pid 5849] set_robust_list(0x55557dee0660, 24) = 0 [pid 5849] chdir("./3") = 0 [pid 5849] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5849] setpgid(0, 0) = 0 [pid 5849] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5849] write(3, "1000", 4) = 4 [pid 5849] close(3) = 0 [pid 5849] read(200, 0x7ffdd8d08200, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5849] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5849] write(1, "executing program\n", 18executing program ) = 18 [pid 5849] memfd_create("syzkaller", 0) = 3 [pid 5849] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffa50000000 [pid 5849] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5849] munmap(0x7ffa50000000, 138412032) = 0 [pid 5849] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5849] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5849] close(3) = 0 [pid 5849] close(4) = 0 [pid 5849] mkdir("./file1", 0777) = 0 [ 99.468633][ T5849] loop0: detected capacity change from 0 to 32768 [pid 5849] mount("/dev/loop0", "./file1", "ocfs2", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME, "acl,heartbeat=none,errors=remount-ro,coherency=full,coherency=full,localflocks,coherency=full,noacl,") = 0 [pid 5849] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5849] chdir("./file1") = 0 [pid 5849] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 99.525781][ T5849] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5849] openat(AT_FDCWD, ".", O_RDONLY) = 4 [pid 5849] lseek(4, -4, SEEK_END) = 5497558139188 [pid 5849] getdents(4, NULL /* 0 entries */, 84) = 0 [pid 5849] close(3) = 0 [pid 5849] close(4) = 0 [ 99.610995][ T5849] (syz-executor199,5849,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #65: rec_len is smaller than minimal - offset=505245, inode=1152921504606846976, rec_len=0, name_len=0 [pid 5849] close(5) = -1 EBADF (Bad file descriptor) [pid 5849] close(6) = -1 EBADF (Bad file descriptor) [pid 5849] close(7) = -1 EBADF (Bad file descriptor) [pid 5849] close(8) = -1 EBADF (Bad file descriptor) [pid 5849] close(9) = -1 EBADF (Bad file descriptor) [pid 5849] close(10) = -1 EBADF (Bad file descriptor) [pid 5849] close(11) = -1 EBADF (Bad file descriptor) [pid 5849] close(12) = -1 EBADF (Bad file descriptor) [pid 5849] close(13) = -1 EBADF (Bad file descriptor) [pid 5849] close(14) = -1 EBADF (Bad file descriptor) [pid 5849] close(15) = -1 EBADF (Bad file descriptor) [pid 5849] close(16) = -1 EBADF (Bad file descriptor) [pid 5849] close(17) = -1 EBADF (Bad file descriptor) [pid 5849] close(18) = -1 EBADF (Bad file descriptor) [pid 5849] close(19) = -1 EBADF (Bad file descriptor) [pid 5849] close(20) = -1 EBADF (Bad file descriptor) [pid 5849] close(21) = -1 EBADF (Bad file descriptor) [pid 5849] close(22) = -1 EBADF (Bad file descriptor) [pid 5849] close(23) = -1 EBADF (Bad file descriptor) [pid 5849] close(24) = -1 EBADF (Bad file descriptor) [pid 5849] close(25) = -1 EBADF (Bad file descriptor) [pid 5849] close(26) = -1 EBADF (Bad file descriptor) [pid 5849] close(27) = -1 EBADF (Bad file descriptor) [pid 5849] close(28) = -1 EBADF (Bad file descriptor) [pid 5849] close(29) = -1 EBADF (Bad file descriptor) [pid 5849] exit_group(0) = ? [pid 5849] +++ exited with 0 +++ [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=16 /* 0.16 s */} --- [pid 5828] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5828] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=80, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 4 entries */, 32768) = 112 [pid 5828] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 5828] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 99.934761][ T5828] ocfs2: Unmounting device (7,0) on (node local) [pid 5828] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5828] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_EMPTY_PATH) = 0 [pid 5828] getdents64(4, 0x55557dee9730 /* 2 entries */, 32768) = 48 [pid 5828] getdents64(4, 0x55557dee9730 /* 0 entries */, 32768) = 0 [pid 5828] close(4) = 0 [pid 5828] rmdir("./3/file1") = 0 [pid 5828] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] unlink("./3/binderfs") = 0 [pid 5828] getdents64(3, 0x55557dee16f0 /* 0 entries */, 32768) = 0 [pid 5828] close(3) = 0 [pid 5828] rmdir("./3") = 0 [pid 5828] mkdir("./4", 0777) = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5828] ioctl(3, LOOP_CLR_FD) = 0 [pid 5828] close(3) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5852 attached , child_tidptr=0x55557dee0650) = 6 [pid 5852] set_robust_list(0x55557dee0660, 24) = 0 [pid 5852] chdir("./4") = 0 [pid 5852] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5852] setpgid(0, 0) = 0 [pid 5852] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5852] write(3, "1000", 4) = 4 [pid 5852] close(3) = 0 [pid 5852] read(200, 0x7ffdd8d08200, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5852] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5852] write(1, "executing program\n", 18) = 18 [pid 5852] memfd_create("syzkaller", 0) = 3 [pid 5852] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffa50000000 [pid 5852] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5852] munmap(0x7ffa50000000, 138412032) = 0 [pid 5852] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5852] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5852] close(3) = 0 [pid 5852] close(4) = 0 [pid 5852] mkdir("./file1", 0777) = 0 [ 100.527630][ T5852] loop0: detected capacity change from 0 to 32768 [pid 5852] mount("/dev/loop0", "./file1", "ocfs2", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME, "acl,heartbeat=none,errors=remount-ro,coherency=full,coherency=full,localflocks,coherency=full,noacl,") = 0 [pid 5852] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5852] chdir("./file1") = 0 [pid 5852] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5852] openat(AT_FDCWD, ".", O_RDONLY) = 4 [ 100.570078][ T5852] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5852] lseek(4, -4, SEEK_END) = 5497558139188 [ 100.635361][ T5852] ================================================================== [ 100.643579][ T5852] BUG: KASAN: use-after-free in ocfs2_dir_foreach_blk+0x132c/0x1b20 [ 100.651617][ T5852] Read of size 2 at addr ffff8880745c98c9 by task syz-executor199/5852 [ 100.659862][ T5852] [ 100.662238][ T5852] CPU: 0 UID: 0 PID: 5852 Comm: syz-executor199 Not tainted 6.13.0-syzkaller-09793-g69b8923f5003 #0 [ 100.662258][ T5852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 100.662270][ T5852] Call Trace: [ 100.662278][ T5852] [ 100.662285][ T5852] dump_stack_lvl+0x241/0x360 [ 100.662317][ T5852] ? __pfx_dump_stack_lvl+0x10/0x10 [ 100.662357][ T5852] ? __pfx__printk+0x10/0x10 [ 100.662391][ T5852] ? _printk+0xd5/0x120 [ 100.662423][ T5852] ? __virt_addr_valid+0x183/0x530 [ 100.662451][ T5852] ? __virt_addr_valid+0x183/0x530 [ 100.662483][ T5852] print_report+0x169/0x550 [ 100.662502][ T5852] ? __virt_addr_valid+0x183/0x530 [ 100.662521][ T5852] ? __virt_addr_valid+0x183/0x530 [ 100.662541][ T5852] ? __virt_addr_valid+0x45f/0x530 [ 100.662560][ T5852] ? __phys_addr+0xba/0x170 [ 100.662583][ T5852] ? ocfs2_dir_foreach_blk+0x132c/0x1b20 [ 100.662605][ T5852] kasan_report+0x143/0x180 [ 100.662622][ T5852] ? ocfs2_dir_foreach_blk+0x132c/0x1b20 [ 100.662646][ T5852] ocfs2_dir_foreach_blk+0x132c/0x1b20 [ 100.662678][ T5852] ? do_raw_spin_unlock+0x13c/0x8b0 [ 100.662696][ T5852] ? _raw_spin_unlock+0x28/0x50 [ 100.662717][ T5852] ? __pfx_ocfs2_dir_foreach_blk+0x10/0x10 [ 100.662739][ T5852] ? ocfs2_inode_lock_atime+0x25f/0x5b0 [ 100.662758][ T5852] ? __pfx_ocfs2_inode_lock_atime+0x10/0x10 [ 100.662777][ T5852] ? __pfx___might_resched+0x10/0x10 [ 100.662795][ T5852] ocfs2_readdir+0x2a1/0x5e0 [ 100.662817][ T5852] ? __pfx_ocfs2_readdir+0x10/0x10 [ 100.662837][ T5852] ? down_write+0x18c/0x220 [ 100.662856][ T5852] ? __pfx_down_write+0x10/0x10 [ 100.662878][ T5852] ? __pfx_ocfs2_readdir+0x10/0x10 [ 100.662899][ T5852] wrap_directory_iterator+0x91/0xd0 [ 100.662914][ T5852] iterate_dir+0x5a9/0x760 [ 100.662929][ T5852] __se_sys_getdents+0x1fd/0x4e0 [ 100.662943][ T5852] ? _raw_spin_unlock_irq+0x2e/0x50 [ 100.662960][ T5852] ? __pfx___se_sys_getdents+0x10/0x10 [ 100.662974][ T5852] ? __pfx_filldir+0x10/0x10 [ 100.662988][ T5852] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 100.663008][ T5852] ? do_syscall_64+0x100/0x230 [ 100.663029][ T5852] do_syscall_64+0xf3/0x230 [ 100.663048][ T5852] ? clear_bhb_loop+0x35/0x90 [ 100.663070][ T5852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.663090][ T5852] RIP: 0033:0x7ffa5856f939 [ 100.663108][ T5852] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 100.663120][ T5852] RSP: 002b:00007ffdd8d085f8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 100.663136][ T5852] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ffa5856f939 [ 100.663146][ T5852] RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004 [ 100.663155][ T5852] RBP: 0000000000000000 R08: 00007ffdd8d08630 R09: 00007ffdd8d08630 [ 100.663164][ T5852] R10: 00007ffdd8d08630 R11: 0000000000000246 R12: 00007ffdd8d0861c [ 100.663174][ T5852] R13: 0000000000000004 R14: 431bde82d7b634db R15: 00007ffdd8d08650 [ 100.663189][ T5852] [ 100.663194][ T5852] [ 100.955309][ T5852] The buggy address belongs to the physical page: [ 100.961742][ T5852] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x90c pfn:0x745c9 [ 100.970685][ T5852] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 100.977962][ T5852] raw: 00fff00000000000 ffffea0001d17288 ffffea0001d17208 0000000000000000 [ 100.986576][ T5852] raw: 000000000000090c 0000000000000000 00000000ffffffff 0000000000000000 [ 100.995213][ T5852] page dumped because: kasan: bad access detected [ 101.001637][ T5852] page_owner tracks the page as freed [ 101.007011][ T5852] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5849, tgid 5849 (syz-executor199), ts 99408658391, free_ts 100198069162 [ 101.025084][ T5852] post_alloc_hook+0x1f4/0x240 [ 101.029968][ T5852] get_page_from_freelist+0x3651/0x37a0 [ 101.035532][ T5852] __alloc_frozen_pages_noprof+0x292/0x710 [ 101.041356][ T5852] alloc_pages_mpol+0x311/0x660 [ 101.046239][ T5852] folio_alloc_mpol_noprof+0x36/0x70 [ 101.051534][ T5852] shmem_alloc_and_add_folio+0x4a0/0x1090 [ 101.057266][ T5852] shmem_get_folio_gfp+0x621/0x1840 [ 101.062501][ T5852] shmem_write_begin+0x165/0x350 [ 101.067520][ T5852] generic_perform_write+0x346/0x990 [ 101.072885][ T5852] shmem_file_write_iter+0xf9/0x120 [ 101.078131][ T5852] vfs_write+0xacf/0xd10 [ 101.082419][ T5852] ksys_write+0x18f/0x2b0 [ 101.086808][ T5852] do_syscall_64+0xf3/0x230 [ 101.091337][ T5852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.097259][ T5852] page last free pid 5828 tgid 5828 stack trace: [ 101.103603][ T5852] free_unref_folios+0xe2f/0x18a0 [ 101.108643][ T5852] folios_put_refs+0x76c/0x860 [ 101.113629][ T5852] shmem_undo_range+0x593/0x1820 [ 101.118625][ T5852] shmem_evict_inode+0x29b/0xa80 [ 101.123598][ T5852] evict+0x4e8/0x9a0 [ 101.127495][ T5852] __dentry_kill+0x20d/0x630 [ 101.132122][ T5852] dput+0x19f/0x2b0 [ 101.135955][ T5852] __fput+0x60b/0x9f0 [ 101.140058][ T5852] task_work_run+0x24f/0x310 [ 101.144676][ T5852] ptrace_notify+0x2d2/0x380 [ 101.149315][ T5852] syscall_exit_work+0xc7/0x1d0 [ 101.154177][ T5852] syscall_exit_to_user_mode+0x24a/0x340 [ 101.159826][ T5852] do_syscall_64+0x100/0x230 [ 101.164432][ T5852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.170440][ T5852] [ 101.172800][ T5852] Memory state around the buggy address: [ 101.178517][ T5852] ffff8880745c9780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.186584][ T5852] ffff8880745c9800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.194665][ T5852] >ffff8880745c9880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.202725][ T5852] ^ [ 101.209149][ T5852] ffff8880745c9900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.217300][ T5852] ffff8880745c9980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 101.225386][ T5852] ================================================================== [ 101.233851][ T5852] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 101.241073][ T5852] CPU: 0 UID: 0 PID: 5852 Comm: syz-executor199 Not tainted 6.13.0-syzkaller-09793-g69b8923f5003 #0 [ 101.251847][ T5852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 101.262046][ T5852] Call Trace: [ 101.265339][ T5852] [ 101.268278][ T5852] dump_stack_lvl+0x241/0x360 [ 101.272980][ T5852] ? __pfx_dump_stack_lvl+0x10/0x10 [ 101.278195][ T5852] ? __pfx__printk+0x10/0x10 [ 101.282807][ T5852] ? preempt_schedule+0xe1/0xf0 [ 101.287662][ T5852] ? vscnprintf+0x5d/0x90 [ 101.292168][ T5852] panic+0x349/0x880 [ 101.296076][ T5852] ? check_panic_on_warn+0x21/0xb0 [ 101.301199][ T5852] ? __pfx_panic+0x10/0x10 [ 101.305630][ T5852] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 101.311702][ T5852] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 101.318037][ T5852] ? print_report+0x502/0x550 [ 101.322724][ T5852] check_panic_on_warn+0x86/0xb0 [ 101.327760][ T5852] ? ocfs2_dir_foreach_blk+0x132c/0x1b20 [ 101.333617][ T5852] end_report+0x77/0x160 [ 101.337869][ T5852] kasan_report+0x154/0x180 [ 101.342385][ T5852] ? ocfs2_dir_foreach_blk+0x132c/0x1b20 [ 101.348064][ T5852] ocfs2_dir_foreach_blk+0x132c/0x1b20 [ 101.353564][ T5852] ? do_raw_spin_unlock+0x13c/0x8b0 [ 101.358796][ T5852] ? _raw_spin_unlock+0x28/0x50 [ 101.363674][ T5852] ? __pfx_ocfs2_dir_foreach_blk+0x10/0x10 [ 101.369510][ T5852] ? ocfs2_inode_lock_atime+0x25f/0x5b0 [ 101.375072][ T5852] ? __pfx_ocfs2_inode_lock_atime+0x10/0x10 [ 101.381012][ T5852] ? __pfx___might_resched+0x10/0x10 [ 101.386397][ T5852] ocfs2_readdir+0x2a1/0x5e0 [ 101.391006][ T5852] ? __pfx_ocfs2_readdir+0x10/0x10 [ 101.396240][ T5852] ? down_write+0x18c/0x220 [ 101.400776][ T5852] ? __pfx_down_write+0x10/0x10 [ 101.405658][ T5852] ? __pfx_ocfs2_readdir+0x10/0x10 [ 101.410832][ T5852] wrap_directory_iterator+0x91/0xd0 [ 101.416317][ T5852] iterate_dir+0x5a9/0x760 [ 101.420744][ T5852] __se_sys_getdents+0x1fd/0x4e0 [ 101.425702][ T5852] ? _raw_spin_unlock_irq+0x2e/0x50 [ 101.430915][ T5852] ? __pfx___se_sys_getdents+0x10/0x10 [ 101.436383][ T5852] ? __pfx_filldir+0x10/0x10 [ 101.440980][ T5852] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 101.447322][ T5852] ? do_syscall_64+0x100/0x230 [ 101.452191][ T5852] do_syscall_64+0xf3/0x230 [ 101.456715][ T5852] ? clear_bhb_loop+0x35/0x90 [ 101.461417][ T5852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.467417][ T5852] RIP: 0033:0x7ffa5856f939 [ 101.471934][ T5852] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 101.491719][ T5852] RSP: 002b:00007ffdd8d085f8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 101.500157][ T5852] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ffa5856f939 [ 101.508137][ T5852] RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004 [ 101.516129][ T5852] RBP: 0000000000000000 R08: 00007ffdd8d08630 R09: 00007ffdd8d08630 [ 101.524218][ T5852] R10: 00007ffdd8d08630 R11: 0000000000000246 R12: 00007ffdd8d0861c [ 101.532197][ T5852] R13: 0000000000000004 R14: 431bde82d7b634db R15: 00007ffdd8d08650 [ 101.540184][ T5852] [ 101.543502][ T5852] Kernel Offset: disabled [ 101.547879][ T5852] Rebooting in 86400 seconds..