./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1975767555
<...>
Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts.
execve("./syz-executor1975767555", ["./syz-executor1975767555"], 0x7fff667a4f60 /* 10 vars */) = 0
brk(NULL) = 0x5555560d8000
brk(0x5555560d8d00) = 0x5555560d8d00
arch_prctl(ARCH_SET_FS, 0x5555560d8380) = 0
set_tid_address(0x5555560d8650) = 5042
set_robust_list(0x5555560d8660, 24) = 0
rseq(0x5555560d8ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1975767555", 4096) = 28
getrandom("\x7c\xa2\x4e\x4c\xd6\x7f\x97\xaf", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555560d8d00
brk(0x5555560f9d00) = 0x5555560f9d00
brk(0x5555560fa000) = 0x5555560fa000
mprotect(0x7f7315e6c000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f730d9bc000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7f730d9bc000, 524288) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./bus", 0777) = 0
[ 71.194105][ T5042] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5042 'syz-executor197'
[ 71.213301][ T5042] loop0: detected capacity change from 0 to 1024
[ 71.222550][ T5042] =======================================================
[ 71.222550][ T5042] WARNING: The mand mount option has been deprecated and
[ 71.222550][ T5042] and is ignored by this kernel. Remove the mand
mount("/dev/loop0", "./bus", "hfsplus", MS_SYNCHRONOUS|MS_MANDLOCK|MS_NODIRATIME|MS_RELATIME|MS_LAZYTIME, "") = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
chdir("./bus") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 71.222550][ T5042] option from the mount to silence this warning.
[ 71.222550][ T5042] =======================================================
[ 71.265962][ T5042] hfsplus: request for non-existent node 256 in B*Tree
[ 71.272835][ T5042] hfsplus: request for non-existent node 256 in B*Tree
[ 71.280397][ T5042] ==================================================================
[ 71.288465][ T5042] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x232/0x250
[ 71.296390][ T5042] Read of size 8 at addr ffff888025e07ac0 by task syz-executor197/5042
[ 71.304618][ T5042]
[ 71.306948][ T5042] CPU: 0 PID: 5042 Comm: syz-executor197 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0
[ 71.316841][ T5042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 71.326905][ T5042] Call Trace:
[ 71.330199][ T5042] <TASK>
[ 71.333141][ T5042] dump_stack_lvl+0xd9/0x1b0
[ 71.337765][ T5042] print_report+0xc4/0x620
[ 71.342180][ T5042] ? __virt_addr_valid+0x5e/0x2d0
[ 71.347197][ T5042] ? __phys_addr+0xc6/0x140
[ 71.351690][ T5042] kasan_report+0xda/0x110
[ 71.356113][ T5042] ? hfsplus_bnode_read+0x232/0x250
[ 71.361308][ T5042] ? hfsplus_bnode_read+0x232/0x250
[ 71.366589][ T5042] hfsplus_bnode_read+0x232/0x250
[ 71.371620][ T5042] hfsplus_bnode_dump+0x2a2/0x3d0
[ 71.376640][ T5042] ? hfsplus_bnode_move+0x910/0x910
[ 71.381834][ T5042] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 71.387288][ T5042] ? hfsplus_bnode_move+0x2a/0x910
[ 71.392399][ T5042] ? srcu_invoke_callbacks+0x60/0x460
[ 71.397764][ T5042] ? __mark_inode_dirty+0x297/0xd50
[ 71.402954][ T5042] hfsplus_brec_remove+0x3de/0x4f0
[ 71.408069][ T5042] __hfsplus_delete_attr+0x29e/0x3b0
[ 71.413350][ T5042] ? hfsplus_find_exit+0xc0/0xc0
[ 71.418293][ T5042] ? hfsplus_part_find+0xbb0/0xbb0
[ 71.423415][ T5042] hfsplus_delete_all_attrs+0x26d/0x330
[ 71.429039][ T5042] ? hfsplus_delete_attr+0x300/0x300
[ 71.434314][ T5042] ? rcu_is_watching+0x12/0xb0
[ 71.439088][ T5042] ? __mark_inode_dirty+0x297/0xd50
[ 71.444358][ T5042] hfsplus_delete_cat+0x819/0xd90
[ 71.449394][ T5042] ? trace_contention_end+0xd6/0x100
[ 71.454671][ T5042] ? hfsplus_create_cat+0x10a0/0x10a0
[ 71.460041][ T5042] ? lock_acquire+0x464/0x510
[ 71.464709][ T5042] hfsplus_unlink+0x213/0x7f0
[ 71.469392][ T5042] ? hfsplus_symlink+0x2b0/0x2b0
[ 71.474418][ T5042] ? down_write_killable_nested+0x250/0x250
[ 71.480320][ T5042] vfs_unlink+0x2f1/0x900
[ 71.484645][ T5042] ? bpf_lsm_path_unlink+0x9/0x10
[ 71.489658][ T5042] do_unlinkat+0x3da/0x6d0
[ 71.494069][ T5042] ? __ia32_sys_rmdir+0x110/0x110
[ 71.499211][ T5042] ? __check_object_size+0x323/0x740
[ 71.504493][ T5042] ? getname_flags.part.0+0x1d5/0x4d0
[ 71.509856][ T5042] __x64_sys_unlink+0xc8/0x110
[ 71.514614][ T5042] do_syscall_64+0x38/0xb0
[ 71.519030][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 71.524919][ T5042] RIP: 0033:0x7f7315df95f9
[ 71.529319][ T5042] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 71.548936][ T5042] RSP: 002b:00007ffd62394308 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 71.557343][ T5042] RAX: ffffffffffffffda RBX: 00007ffd623944e8 RCX: 00007f7315df95f9
[ 71.565306][ T5042] RDX: 00007f7315df88f0 RSI: 0000000000000000 RDI: 0000000020000000
[ 71.573272][ T5042] RBP: 00007f7315e6c610 R08: 000000000000066d R09: 0000000000000000
[ 71.581240][ T5042] R10: 00007ffd623941d0 R11: 0000000000000246 R12: 0000000000000001
[ 71.589208][ T5042] R13: 00007ffd623944d8 R14: 0000000000000001 R15: 0000000000000001
[ 71.597273][ T5042] </TASK>
[ 71.600277][ T5042]
[ 71.602584][ T5042] Allocated by task 5042:
[ 71.606897][ T5042] kasan_save_stack+0x33/0x50
[ 71.611570][ T5042] kasan_set_track+0x25/0x30
[ 71.616150][ T5042] __kasan_kmalloc+0xa2/0xb0
[ 71.620741][ T5042] __kmalloc+0x60/0x100
[ 71.624900][ T5042] __hfs_bnode_create+0x108/0x860
[ 71.629937][ T5042] hfsplus_bnode_find+0x2c4/0xcb0
[ 71.634965][ T5042] hfsplus_brec_find+0x2b9/0x520
[ 71.639986][ T5042] hfsplus_delete_all_attrs+0x246/0x330
[ 71.645534][ T5042] hfsplus_delete_cat+0x819/0xd90
[ 71.650548][ T5042] hfsplus_unlink+0x213/0x7f0
[ 71.655218][ T5042] vfs_unlink+0x2f1/0x900
[ 71.659540][ T5042] do_unlinkat+0x3da/0x6d0
[ 71.663961][ T5042] __x64_sys_unlink+0xc8/0x110
[ 71.668719][ T5042] do_syscall_64+0x38/0xb0
[ 71.673127][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 71.679108][ T5042]
[ 71.681414][ T5042] The buggy address belongs to the object at ffff888025e07a00
[ 71.681414][ T5042] which belongs to the cache kmalloc-192 of size 192
[ 71.695452][ T5042] The buggy address is located 40 bytes to the right of
[ 71.695452][ T5042] allocated 152-byte region [ffff888025e07a00, ffff888025e07a98)
[ 71.710030][ T5042]
[ 71.712352][ T5042] The buggy address belongs to the physical page:
[ 71.718745][ T5042] page:ffffea00009781c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25e07
[ 71.728879][ T5042] anon flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 71.736876][ T5042] page_type: 0xffffffff()
[ 71.741239][ T5042] raw: 00fff00000000200 ffff888012841a00 ffffea0000a3b180 0000000000000005
[ 71.749806][ T5042] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 71.758370][ T5042] page dumped because: kasan: bad access detected
[ 71.764784][ T5042] page_owner tracks the page as allocated
[ 71.770476][ T5042] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 22991475915, free_ts 22866273542
[ 71.788013][ T5042] post_alloc_hook+0x2d2/0x350
[ 71.792772][ T5042] get_page_from_freelist+0x10d7/0x31b0
[ 71.798309][ T5042] __alloc_pages+0x1d0/0x4a0
[ 71.802883][ T5042] alloc_page_interleave+0x1e/0x250
[ 71.808070][ T5042] alloc_pages+0x22a/0x270
[ 71.812474][ T5042] allocate_slab+0x24e/0x380
[ 71.817053][ T5042] ___slab_alloc+0x8bc/0x1570
[ 71.821721][ T5042] __slab_alloc.constprop.0+0x56/0xa0
[ 71.827088][ T5042] __kmem_cache_alloc_node+0x137/0x350
[ 71.832545][ T5042] kmalloc_trace+0x25/0xe0
[ 71.836954][ T5042] push_stack+0x7c/0x550
[ 71.841303][ T5042] do_check_common+0x708e/0xd370
[ 71.846234][ T5042] bpf_check+0x8436/0xac50
[ 71.850634][ T5042] bpf_prog_load+0x153a/0x2270
[ 71.855385][ T5042] __sys_bpf+0xeed/0x4f10
[ 71.859705][ T5042] kern_sys_bpf+0x13a/0x650
[ 71.864206][ T5042] page last free stack trace:
[ 71.868862][ T5042] free_unref_page_prepare+0x508/0xb90
[ 71.874314][ T5042] free_unref_page+0x33/0x3b0
[ 71.878984][ T5042] vfree+0x181/0x7a0
[ 71.882874][ T5042] delayed_vfree_work+0x56/0x70
[ 71.887732][ T5042] process_one_work+0x887/0x15d0
[ 71.892667][ T5042] worker_thread+0x8bb/0x1290
[ 71.897339][ T5042] kthread+0x33a/0x430
[ 71.901398][ T5042] ret_from_fork+0x45/0x80
[ 71.905804][ T5042] ret_from_fork_asm+0x11/0x20
[ 71.910558][ T5042]
[ 71.912866][ T5042] Memory state around the buggy address:
[ 71.918479][ T5042] ffff888025e07980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 71.926522][ T5042] ffff888025e07a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.934565][ T5042] >ffff888025e07a80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 71.942694][ T5042] ^
[ 71.948829][ T5042] ffff888025e07b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.956875][ T5042] ffff888025e07b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 71.964933][ T5042] ==================================================================
[ 71.980187][ T5042] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.987405][ T5042] CPU: 0 PID: 5042 Comm: syz-executor197 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0
[ 71.997302][ T5042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 72.007343][ T5042] Call Trace:
[ 72.010607][ T5042] <TASK>
[ 72.013524][ T5042] dump_stack_lvl+0xd9/0x1b0
[ 72.018117][ T5042] panic+0x6a6/0x750
[ 72.022005][ T5042] ? panic_smp_self_stop+0xa0/0xa0
[ 72.027106][ T5042] ? preempt_schedule_thunk+0x1a/0x30
[ 72.032472][ T5042] ? preempt_schedule_common+0x45/0xc0
[ 72.037976][ T5042] check_panic_on_warn+0xab/0xb0
[ 72.042917][ T5042] end_report+0x108/0x150
[ 72.047245][ T5042] kasan_report+0xea/0x110
[ 72.051658][ T5042] ? hfsplus_bnode_read+0x232/0x250
[ 72.056857][ T5042] ? hfsplus_bnode_read+0x232/0x250
[ 72.062053][ T5042] hfsplus_bnode_read+0x232/0x250
[ 72.067075][ T5042] hfsplus_bnode_dump+0x2a2/0x3d0
[ 72.072093][ T5042] ? hfsplus_bnode_move+0x910/0x910
[ 72.077291][ T5042] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 72.082768][ T5042] ? hfsplus_bnode_move+0x2a/0x910
[ 72.087896][ T5042] ? srcu_invoke_callbacks+0x60/0x460
[ 72.093287][ T5042] ? __mark_inode_dirty+0x297/0xd50
[ 72.098492][ T5042] hfsplus_brec_remove+0x3de/0x4f0
[ 72.103717][ T5042] __hfsplus_delete_attr+0x29e/0x3b0
[ 72.109024][ T5042] ? hfsplus_find_exit+0xc0/0xc0
[ 72.114077][ T5042] ? hfsplus_part_find+0xbb0/0xbb0
[ 72.119218][ T5042] hfsplus_delete_all_attrs+0x26d/0x330
[ 72.124770][ T5042] ? hfsplus_delete_attr+0x300/0x300
[ 72.130080][ T5042] ? rcu_is_watching+0x12/0xb0
[ 72.134845][ T5042] ? __mark_inode_dirty+0x297/0xd50
[ 72.140047][ T5042] hfsplus_delete_cat+0x819/0xd90
[ 72.145089][ T5042] ? trace_contention_end+0xd6/0x100
[ 72.150385][ T5042] ? hfsplus_create_cat+0x10a0/0x10a0
[ 72.155776][ T5042] ? lock_acquire+0x464/0x510
[ 72.160467][ T5042] hfsplus_unlink+0x213/0x7f0
[ 72.165159][ T5042] ? hfsplus_symlink+0x2b0/0x2b0
[ 72.170120][ T5042] ? down_write_killable_nested+0x250/0x250
[ 72.176027][ T5042] vfs_unlink+0x2f1/0x900
[ 72.180369][ T5042] ? bpf_lsm_path_unlink+0x9/0x10
[ 72.185401][ T5042] do_unlinkat+0x3da/0x6d0
[ 72.189831][ T5042] ? __ia32_sys_rmdir+0x110/0x110
[ 72.194869][ T5042] ? __check_object_size+0x323/0x740
[ 72.200169][ T5042] ? getname_flags.part.0+0x1d5/0x4d0
[ 72.205550][ T5042] __x64_sys_unlink+0xc8/0x110
[ 72.210329][ T5042] do_syscall_64+0x38/0xb0
[ 72.214766][ T5042] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 72.220674][ T5042] RIP: 0033:0x7f7315df95f9
[ 72.225088][ T5042] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 72.244695][ T5042] RSP: 002b:00007ffd62394308 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 72.253109][ T5042] RAX: ffffffffffffffda RBX: 00007ffd623944e8 RCX: 00007f7315df95f9
[ 72.261077][ T5042] RDX: 00007f7315df88f0 RSI: 0000000000000000 RDI: 0000000020000000
[ 72.269045][ T5042] RBP: 00007f7315e6c610 R08: 000000000000066d R09: 0000000000000000
[ 72.277017][ T5042] R10: 00007ffd623941d0 R11: 0000000000000246 R12: 0000000000000001
[ 72.284988][ T5042] R13: 00007ffd623944d8 R14: 0000000000000001 R15: 0000000000000001
[ 72.292964][ T5042] </TASK>
[ 72.296172][ T5042] Kernel Offset: disabled
[ 72.300482][ T5042] Rebooting in 86400 seconds..