./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2057912967
<...>
Warning: Permanently added '10.128.0.139' (ED25519) to the list of known hosts.
execve("./syz-executor2057912967", ["./syz-executor2057912967"], 0x7ffe8449a000 /* 10 vars */) = 0
brk(NULL) = 0x555568d56000
brk(0x555568d56d00) = 0x555568d56d00
arch_prctl(ARCH_SET_FS, 0x555568d56380) = 0
set_tid_address(0x555568d56650) = 5086
set_robust_list(0x555568d56660, 24) = 0
rseq(0x555568d56ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2057912967", 4096) = 28
getrandom("\x0a\x23\x1a\x10\x43\x0a\x37\x88", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555568d56d00
brk(0x555568d77d00) = 0x555568d77d00
brk(0x555568d78000) = 0x555568d78000
mprotect(0x7f81f2ed2000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
[ 61.605011][ T5086] ==================================================================
[ 61.613247][ T5086] BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x7b/0xe0
[ 61.620820][ T5086] Write of size 36 at addr ffff8880203f2e88 by task syz-executor205/5086
[ 61.629411][ T5086]
[ 61.631823][ T5086] CPU: 1 PID: 5086 Comm: syz-executor205 Not tainted 6.9.0-rc2-next-20240402-syzkaller #0
[ 61.642041][ T5086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 61.652343][ T5086] Call Trace:
[ 61.655610][ T5086]
[ 61.658524][ T5086] dump_stack_lvl+0x241/0x360
[ 61.663303][ T5086] ? __pfx_dump_stack_lvl+0x10/0x10
[ 61.668668][ T5086] ? __pfx__printk+0x10/0x10
[ 61.673554][ T5086] ? _printk+0xd5/0x120
[ 61.677716][ T5086] ? __virt_addr_valid+0x183/0x520
[ 61.682814][ T5086] ? __virt_addr_valid+0x183/0x520
[ 61.688183][ T5086] print_report+0x169/0x550
[ 61.693362][ T5086] ? __virt_addr_valid+0x183/0x520
[ 61.698460][ T5086] ? __virt_addr_valid+0x183/0x520
[ 61.703556][ T5086] ? __virt_addr_valid+0x44e/0x520
[ 61.708828][ T5086] ? __phys_addr+0xba/0x170
[ 61.713507][ T5086] ? _copy_from_user+0x7b/0xe0
[ 61.718341][ T5086] kasan_report+0x143/0x180
[ 61.723020][ T5086] ? _copy_from_user+0x7b/0xe0
[ 61.727767][ T5086] kasan_check_range+0x282/0x290
[ 61.732784][ T5086] _copy_from_user+0x7b/0xe0
[ 61.737512][ T5086] do_handle_open+0x204/0x660
[ 61.742361][ T5086] ? __pfx_do_handle_open+0x10/0x10
[ 61.747644][ T5086] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 61.754028][ T5086] ? exc_page_fault+0x585/0x8e0
[ 61.758976][ T5086] do_syscall_64+0xfb/0x240
[ 61.763476][ T5086] entry_SYSCALL_64_after_hwframe+0x72/0x7a
[ 61.769379][ T5086] RIP: 0033:0x7f81f2e5f269
[ 61.774015][ T5086] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 61.793850][ T5086] RSP: 002b:00007ffcde6f13c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000130
[ 61.802602][ T5086] RAX: ffffffffffffffda RBX: 00007ffcde6f15a8 RCX: 00007f81f2e5f269
[ 61.810558][ T5086] RDX: 0000000000000000 RSI: 00000000200091c0 RDI: 00000000ffffffff
[ 61.818534][ T5086] RBP: 00007f81f2ed2610 R08: 0000000000000000 R09: 0000000000000000
[ 61.826640][ T5086] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001
[ 61.834890][ T5086] R13: 00007ffcde6f1598 R14: 0000000000000001 R15: 0000000000000001
[ 61.842876][ T5086]
[ 61.845887][ T5086]
[ 61.848226][ T5086] Allocated by task 5086:
[ 61.852626][ T5086] kasan_save_track+0x3f/0x80
[ 61.857293][ T5086] __kasan_kmalloc+0x98/0xb0
[ 61.861919][ T5086] __kmalloc_noprof+0x200/0x410
[ 61.866941][ T5086] do_handle_open+0x162/0x660
[ 61.871717][ T5086] do_syscall_64+0xfb/0x240
[ 61.876382][ T5086] entry_SYSCALL_64_after_hwframe+0x72/0x7a
[ 61.882345][ T5086]
[ 61.884648][ T5086] The buggy address belongs to the object at ffff8880203f2e80
[ 61.884648][ T5086] which belongs to the cache kmalloc-64 of size 64
[ 61.898506][ T5086] The buggy address is located 8 bytes inside of
[ 61.898506][ T5086] allocated 36-byte region [ffff8880203f2e80, ffff8880203f2ea4)
[ 61.912875][ T5086]
[ 61.915204][ T5086] The buggy address belongs to the physical page:
[ 61.921713][ T5086] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x203f2
[ 61.930727][ T5086] ksm flags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)
[ 61.938250][ T5086] page_type: 0xffffefff(slab)
[ 61.942997][ T5086] raw: 00fff80000000000 ffff888015041640 ffffea0000869bc0 dead000000000003
[ 61.951959][ T5086] raw: 0000000000000000 0000000080200020 00000001ffffefff 0000000000000000
[ 61.960529][ T5086] page dumped because: kasan: bad access detected
[ 61.967216][ T5086] page_owner tracks the page as allocated
[ 61.973018][ T5086] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 4542, tgid -909298647 (udevd), ts 4542, free_ts 33444169271
[ 61.990894][ T5086] post_alloc_hook+0x1f3/0x230
[ 61.995645][ T5086] get_page_from_freelist+0x2e7e/0x2f40
[ 62.001169][ T5086] __alloc_pages_noprof+0x256/0x6c0
[ 62.006440][ T5086] alloc_slab_page+0x5f/0x120
[ 62.011100][ T5086] allocate_slab+0x5a/0x2e0
[ 62.015779][ T5086] ___slab_alloc+0xea8/0x1430
[ 62.020786][ T5086] __slab_alloc+0x58/0xa0
[ 62.025361][ T5086] __kmalloc_noprof+0x25e/0x410
[ 62.031169][ T5086] tomoyo_encode+0x26f/0x540
[ 62.035824][ T5086] tomoyo_realpath_from_path+0x59e/0x5e0
[ 62.041634][ T5086] tomoyo_path_perm+0x2b7/0x740
[ 62.046553][ T5086] security_inode_getattr+0xd8/0x130
[ 62.051903][ T5086] vfs_getattr+0x45/0x430
[ 62.056301][ T5086] vfs_fstatat+0xd6/0x190
[ 62.060847][ T5086] __x64_sys_newfstatat+0x125/0x1b0
[ 62.066979][ T5086] do_syscall_64+0xfb/0x240
[ 62.072149][ T5086] page last free pid 4548 tgid 4548 stack trace:
[ 62.078566][ T5086] free_unref_page+0xd3c/0xec0
[ 62.083682][ T5086] __slab_free+0x31b/0x3d0
[ 62.088280][ T5086] qlist_free_all+0x9e/0x140
[ 62.092950][ T5086] kasan_quarantine_reduce+0x14f/0x170
[ 62.098585][ T5086] __kasan_slab_alloc+0x23/0x80
[ 62.103606][ T5086] __kmalloc_noprof+0x1a9/0x410
[ 62.108443][ T5086] tomoyo_realpath_from_path+0xcf/0x5e0
[ 62.113968][ T5086] tomoyo_path2_perm+0x3eb/0xbb0
[ 62.118898][ T5086] tomoyo_path_rename+0x198/0x1e0
[ 62.123989][ T5086] security_path_rename+0x179/0x220
[ 62.129163][ T5086] do_renameat2+0x94a/0x13f0
[ 62.134082][ T5086] __x64_sys_rename+0x86/0xa0
[ 62.138888][ T5086] do_syscall_64+0xfb/0x240
[ 62.143504][ T5086] entry_SYSCALL_64_after_hwframe+0x72/0x7a
[ 62.149390][ T5086]
[ 62.151696][ T5086] Memory state around the buggy address:
[ 62.157304][ T5086] ffff8880203f2d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 62.165476][ T5086] ffff8880203f2e00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 62.173894][ T5086] >ffff8880203f2e80: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc
[ 62.182041][ T5086] ^
[ 62.187142][ T5086] ffff8880203f2f00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 62.195182][ T5086] ffff8880203f2f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 62.203219][ T5086] ==================================================================
[ 62.212064][ T5086] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 62.219453][ T5086] CPU: 1 PID: 5086 Comm: syz-executor205 Not tainted 6.9.0-rc2-next-20240402-syzkaller #0
[ 62.229442][ T5086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 62.239494][ T5086] Call Trace:
[ 62.242855][ T5086]
[ 62.245841][ T5086] dump_stack_lvl+0x241/0x360
[ 62.250607][ T5086] ? __pfx_dump_stack_lvl+0x10/0x10
[ 62.255807][ T5086] ? __pfx__printk+0x10/0x10
[ 62.260396][ T5086] ? preempt_schedule+0xe1/0xf0
[ 62.265416][ T5086] ? vscnprintf+0x5d/0x90
[ 62.269736][ T5086] panic+0x349/0x860
[ 62.273816][ T5086] ? check_panic_on_warn+0x21/0xb0
[ 62.278931][ T5086] ? __pfx_panic+0x10/0x10
[ 62.283345][ T5086] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 62.289540][ T5086] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 62.295954][ T5086] ? print_report+0x502/0x550
[ 62.300711][ T5086] check_panic_on_warn+0x86/0xb0
[ 62.305992][ T5086] ? _copy_from_user+0x7b/0xe0
[ 62.310805][ T5086] end_report+0x77/0x160
[ 62.315153][ T5086] kasan_report+0x154/0x180
[ 62.319994][ T5086] ? _copy_from_user+0x7b/0xe0
[ 62.325028][ T5086] kasan_check_range+0x282/0x290
[ 62.329965][ T5086] _copy_from_user+0x7b/0xe0
[ 62.334560][ T5086] do_handle_open+0x204/0x660
[ 62.339319][ T5086] ? __pfx_do_handle_open+0x10/0x10
[ 62.344516][ T5086] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 62.351283][ T5086] ? exc_page_fault+0x585/0x8e0
[ 62.356144][ T5086] do_syscall_64+0xfb/0x240
[ 62.360732][ T5086] entry_SYSCALL_64_after_hwframe+0x72/0x7a
[ 62.367685][ T5086] RIP: 0033:0x7f81f2e5f269
[ 62.372304][ T5086] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 62.392712][ T5086] RSP: 002b:00007ffcde6f13c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000130
[ 62.401211][ T5086] RAX: ffffffffffffffda RBX: 00007ffcde6f15a8 RCX: 00007f81f2e5f269
[ 62.409536][ T5086] RDX: 0000000000000000 RSI: 00000000200091c0 RDI: 00000000ffffffff
[ 62.417955][ T5086] RBP: 00007f81f2ed2610 R08: 0000000000000000 R09: 0000000000000000
[ 62.426006][ T5086] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001
[ 62.434071][ T5086] R13: 00007ffcde6f1598 R14: 0000000000000001 R15: 0000000000000001
[ 62.442134][ T5086]
[ 62.445587][ T5086] Kernel Offset: disabled
[ 62.449925][ T5086] Rebooting in 86400 seconds..