./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3418026586 <...> Warning: Permanently added '10.128.1.135' (ED25519) to the list of known hosts. execve("./syz-executor3418026586", ["./syz-executor3418026586"], 0x7ffd45895af0 /* 10 vars */) = 0 brk(NULL) = 0x55558e308000 brk(0x55558e308d00) = 0x55558e308d00 arch_prctl(ARCH_SET_FS, 0x55558e308380) = 0 set_tid_address(0x55558e308650) = 297 set_robust_list(0x55558e308660, 24) = 0 rseq(0x55558e308ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3418026586", 4096) = 28 getrandom("\x57\xb5\xc2\x08\x54\x6f\xfe\x54", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558e308d00 brk(0x55558e329d00) = 0x55558e329d00 brk(0x55558e32a000) = 0x55558e32a000 mprotect(0x7f78a7437000, 16384, PROT_READ) = 0 mmap(0x3ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ffffffff000 mmap(0x400000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400000000000 mmap(0x400001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400001000000 write(1, "executing program\n", 18executing program ) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f789ef87000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f789ef87000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 24.024365][ T28] audit: type=1400 audit(1741511513.820:66): avc: denied { execmem } for pid=297 comm="syz-executor341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.043995][ T28] audit: type=1400 audit(1741511513.850:67): avc: denied { read write } for pid=297 comm="syz-executor341" name="loop0" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.044754][ T297] loop0: detected capacity change from 0 to 512 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file2", 0777) = 0 [ 24.068302][ T28] audit: type=1400 audit(1741511513.850:68): avc: denied { open } for pid=297 comm="syz-executor341" path="/dev/loop0" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.083229][ T297] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 24.101961][ T28] audit: type=1400 audit(1741511513.850:69): avc: denied { ioctl } for pid=297 comm="syz-executor341" path="/dev/loop0" dev="devtmpfs" ino=114 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.111174][ T297] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 24.140081][ T28] audit: type=1400 audit(1741511513.880:70): avc: denied { mounton } for pid=297 comm="syz-executor341" path="/root/file2" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "nogrpid,resuid=0x0000000000000000,debug_want_extra_isize=0x0000000000000068,debug,nombcache,quota,,e"...) = 0 openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 chdir("./file2") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 lsetxattr("./file1", "trusted.overlay.upper", "\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65079, 0) = 0 creat("./file2", 0655) = 4 [ 24.147219][ T297] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a00ec019, mo2=0002] [ 24.176253][ T297] System zones: 1-12 [ 24.181424][ T297] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2809: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 24.194508][ T297] EXT4-fs (loop0): 1 truncate cleaned up [ 24.200130][ T297] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 24.209269][ T28] audit: type=1400 audit(1741511514.000:71): avc: denied { mount } for pid=297 comm="syz-executor341" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 24.228654][ T297] ================================================================== [ 24.231011][ T28] audit: type=1400 audit(1741511514.000:72): avc: denied { setattr } for pid=297 comm="syz-executor341" name="file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 24.238770][ T297] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x909/0x1fa0 [ 24.261659][ T28] audit: type=1400 audit(1741511514.000:73): avc: denied { write } for pid=297 comm="syz-executor341" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.268712][ T297] Read of size 18446744073709551572 at addr ffff888110289850 by task syz-executor341/297 [ 24.299965][ T297] [ 24.302143][ T297] CPU: 1 PID: 297 Comm: syz-executor341 Not tainted 6.1.128-syzkaller-00002-g44db4837f75e #0 [ 24.312221][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 24.322117][ T297] Call Trace: [ 24.325283][ T297] [ 24.328017][ T297] dump_stack_lvl+0x151/0x1b7 [ 24.332527][ T297] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 24.337830][ T297] ? _printk+0xd1/0x111 [ 24.341827][ T297] ? __virt_addr_valid+0x242/0x2f0 [ 24.346760][ T297] print_report+0x158/0x4e0 [ 24.351102][ T297] ? __virt_addr_valid+0x242/0x2f0 [ 24.356143][ T297] ? kasan_complete_mode_report_info+0x57/0x1b0 [ 24.362233][ T297] ? ext4_xattr_set_entry+0x909/0x1fa0 [ 24.367506][ T297] kasan_report+0x13c/0x170 [ 24.371845][ T297] ? ext4_xattr_set_entry+0x909/0x1fa0 [ 24.377140][ T297] kasan_check_range+0x294/0x2a0 [ 24.381915][ T297] ? ext4_xattr_set_entry+0x909/0x1fa0 [ 24.387207][ T297] memmove+0x2d/0x70 [ 24.390940][ T297] ext4_xattr_set_entry+0x909/0x1fa0 [ 24.396065][ T297] ? ext4_xattr_inode_lookup_create+0x1a60/0x1a60 [ 24.402311][ T297] ? memcpy+0x56/0x70 [ 24.406146][ T297] ext4_xattr_block_set+0x99c/0x37f0 [ 24.411251][ T297] ? ext4_drop_inode+0x90/0x1a0 [ 24.415939][ T297] ? __getblk_gfp+0x3d/0x7d0 [ 24.420363][ T297] ? ext4_xattr_block_find+0x320/0x320 [ 24.425657][ T297] ? xattr_find_entry+0x23c/0x300 [ 24.430514][ T297] ? ext4_xattr_block_find+0x2ac/0x320 [ 24.435810][ T297] ext4_expand_extra_isize_ea+0x10eb/0x1c40 [ 24.441542][ T297] ? ext4_xattr_set+0x3d0/0x3d0 [ 24.446336][ T297] ? rwsem_write_trylock+0x153/0x340 [ 24.451443][ T297] ? dquot_initialize_needed+0x13d/0x370 [ 24.456908][ T297] __ext4_expand_extra_isize+0x31a/0x420 [ 24.462552][ T297] __ext4_mark_inode_dirty+0x4bb/0x7d0 [ 24.467847][ T297] ? sb_end_intwrite+0x130/0x130 [ 24.472620][ T297] ? current_time+0x1ba/0x300 [ 24.477131][ T297] ? atime_needs_update+0x810/0x810 [ 24.482165][ T297] ? __kasan_check_write+0x14/0x20 [ 24.487298][ T297] ? drop_nlink+0xa9/0x110 [ 24.491540][ T297] __ext4_unlink+0x6ed/0xba0 [ 24.495976][ T297] ? __ext4_read_dirblock+0x8e0/0x8e0 [ 24.501273][ T297] ? rwsem_mark_wake+0x770/0x770 [ 24.506033][ T297] ext4_unlink+0x142/0x3f0 [ 24.510310][ T297] vfs_unlink+0x38c/0x630 [ 24.514455][ T297] do_unlinkat+0x483/0x920 [ 24.518718][ T297] ? fsnotify_link_count+0x100/0x100 [ 24.523827][ T297] ? strncpy_from_user+0x169/0x2b0 [ 24.528775][ T297] ? getname_flags+0x1fd/0x520 [ 24.533374][ T297] __x64_sys_unlink+0x49/0x50 [ 24.537887][ T297] x64_sys_call+0x289/0x9a0 [ 24.542227][ T297] do_syscall_64+0x3b/0xb0 [ 24.546477][ T297] ? clear_bhb_loop+0x55/0xb0 [ 24.550990][ T297] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.556732][ T297] RIP: 0033:0x7f78a73c4a39 [ 24.560973][ T297] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 24.580619][ T297] RSP: 002b:00007fffea22e9f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 24.588870][ T297] RAX: ffffffffffffffda RBX: 0000400000000040 RCX: 00007f78a73c4a39 [ 24.596670][ T297] RDX: 00007f78a73c4a39 RSI: 00007f78a73c4a39 RDI: 0000400000000180 [ 24.604485][ T297] RBP: 0031656c69662f2e R08: 0000000000000000 R09: 0000000000000000 [ 24.612293][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 0032656c69662f2e [ 24.620105][ T297] R13: 00007fffea22ebd8 R14: 0000000000000001 R15: 0000000000000001 [ 24.627923][ T297] [ 24.630782][ T297] [ 24.632951][ T297] Allocated by task 297: [ 24.637032][ T297] kasan_set_track+0x4b/0x70 [ 24.641454][ T297] kasan_save_alloc_info+0x1f/0x30 [ 24.646403][ T297] __kasan_kmalloc+0x9c/0xb0 [ 24.650830][ T297] __kmalloc_node_track_caller+0xb3/0x1e0 [ 24.656386][ T297] kmemdup+0x29/0x60 [ 24.660118][ T297] ext4_xattr_block_set+0x80f/0x37f0 [ 24.665236][ T297] ext4_expand_extra_isize_ea+0x10eb/0x1c40 [ 24.670964][ T297] __ext4_expand_extra_isize+0x31a/0x420 [ 24.676433][ T297] __ext4_mark_inode_dirty+0x4bb/0x7d0 [ 24.681727][ T297] __ext4_unlink+0x6ed/0xba0 [ 24.686154][ T297] ext4_unlink+0x142/0x3f0 [ 24.690405][ T297] vfs_unlink+0x38c/0x630 [ 24.694573][ T297] do_unlinkat+0x483/0x920 [ 24.698826][ T297] __x64_sys_unlink+0x49/0x50 [ 24.703347][ T297] x64_sys_call+0x289/0x9a0 [ 24.707677][ T297] do_syscall_64+0x3b/0xb0 [ 24.711941][ T297] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.717673][ T297] [ 24.719829][ T297] The buggy address belongs to the object at ffff888110289800 [ 24.719829][ T297] which belongs to the cache kmalloc-1k of size 1024 [ 24.733724][ T297] The buggy address is located 80 bytes inside of [ 24.733724][ T297] 1024-byte region [ffff888110289800, ffff888110289c00) [ 24.746929][ T297] [ 24.749078][ T297] The buggy address belongs to the physical page: [ 24.755330][ T297] page:ffffea000440a200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110288 [ 24.765399][ T297] head:ffffea000440a200 order:3 compound_mapcount:0 compound_pincount:0 [ 24.773557][ T297] flags: 0x4000000000010200(slab|head|zone=1) [ 24.779466][ T297] raw: 4000000000010200 ffffea000441bc00 dead000000000002 ffff888100043080 [ 24.787917][ T297] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.796679][ T297] page dumped because: kasan: bad access detected [ 24.802905][ T297] page_owner tracks the page as allocated [ 24.808539][ T297] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 92, tgid 92 (S02sysctl), ts 4536907243, free_ts 0 [ 24.828373][ T297] post_alloc_hook+0x213/0x220 [ 24.832964][ T297] prep_new_page+0x1b/0x110 [ 24.837301][ T297] get_page_from_freelist+0x3a98/0x3b10 [ 24.842681][ T297] __alloc_pages+0x234/0x610 [ 24.847109][ T297] alloc_slab_page+0x6c/0xf0 [ 24.851534][ T297] new_slab+0x90/0x3e0 [ 24.855438][ T297] ___slab_alloc+0x6f9/0xb80 [ 24.859868][ T297] __slab_alloc+0x5d/0xa0 [ 24.864036][ T297] __kmem_cache_alloc_node+0x207/0x2a0 [ 24.869328][ T297] __kmalloc+0xa3/0x1e0 [ 24.873321][ T297] alloc_pipe_info+0x204/0x4b0 [ 24.877920][ T297] create_pipe_files+0x89/0x6e0 [ 24.882610][ T297] __do_pipe_flags+0x4c/0x210 [ 24.887121][ T297] do_pipe2+0xd0/0x300 [ 24.891025][ T297] __x64_sys_pipe2+0x5a/0x70 [ 24.895450][ T297] x64_sys_call+0x7bb/0x9a0 [ 24.899800][ T297] page_owner free stack trace missing [ 24.905099][ T297] [ 24.907260][ T297] Memory state around the buggy address: [ 24.912734][ T297] ffff888110289700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.920624][ T297] ffff888110289780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.928525][ T297] >ffff888110289800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.936420][ T297] ^ [ 24.942931][ T297] ffff888110289880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.950831][ T297] ffff888110289900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.958810][ T297] ================================================================== unlink("./file1") = 0 exit_group(0) = ? +++ exited with 0 +++ [ 24.967172][ T28] audit: type=140