./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2687076447
<...>
Warning: Permanently added '10.128.0.249' (ECDSA) to the list of known hosts.
execve("./syz-executor2687076447", ["./syz-executor2687076447"], 0x7ffc08b48550 /* 10 vars */) = 0
brk(NULL) = 0x5555558de000
brk(0x5555558dec40) = 0x5555558dec40
arch_prctl(ARCH_SET_FS, 0x5555558de300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2687076447", 4096) = 28
brk(0x5555558ffc40) = 0x5555558ffc40
brk(0x555555900000) = 0x555555900000
mprotect(0x7f0cfeb7c000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0cf6600000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7f0cf6600000, 524288) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
mount("/dev/loop0", "./file0", "hfsplus", MS_SYNCHRONOUS|MS_RELATIME|MS_I_VERSION|MS_LAZYTIME, "force") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
syzkaller login: [ 52.483177][ T3632] loop0: detected capacity change from 0 to 1024
[ 52.507000][ T3632] hfsplus: request for non-existent node 393216 in B*Tree
[ 52.514344][ T3632] hfsplus: request for non-existent node 393216 in B*Tree
[ 52.522256][ T3632] ==================================================================
[ 52.530321][ T3632] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0xc9/0x200
[ 52.538264][ T3632] Read of size 8 at addr ffff888017837bc0 by task syz-executor268/3632
[ 52.546850][ T3632]
[ 52.549160][ T3632] CPU: 0 PID: 3632 Comm: syz-executor268 Not tainted 6.1.0-rc6-syzkaller-00315-gfaf68e3523c2 #0
[ 52.559554][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 52.569597][ T3632] Call Trace:
[ 52.572863][ T3632]
[ 52.575778][ T3632] dump_stack_lvl+0x1b1/0x28e
[ 52.580456][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 52.585900][ T3632] ? __wake_up_klogd+0xcd/0x100
[ 52.590739][ T3632] ? panic+0x710/0x710
[ 52.594794][ T3632] ? _printk+0xc0/0x100
[ 52.598934][ T3632] ? _raw_spin_lock_irqsave+0x8e/0x100
[ 52.604380][ T3632] print_address_description+0x74/0x340
[ 52.609916][ T3632] print_report+0x107/0x1f0
[ 52.614404][ T3632] ? __virt_addr_valid+0x21b/0x2d0
[ 52.619499][ T3632] ? __phys_addr+0xb5/0x160
[ 52.623982][ T3632] ? hfsplus_bnode_read+0xc9/0x200
[ 52.629075][ T3632] kasan_report+0xcd/0x100
[ 52.633471][ T3632] ? hfsplus_bnode_read+0xc9/0x200
[ 52.638566][ T3632] hfsplus_bnode_read+0xc9/0x200
[ 52.643487][ T3632] hfsplus_bnode_dump+0x29a/0x530
[ 52.648495][ T3632] ? hfsplus_bnode_move+0x930/0x930
[ 52.653677][ T3632] ? hfsplus_bnode_write_u16+0x96/0xf0
[ 52.659116][ T3632] ? wbc_attach_and_unlock_inode+0xf0/0x540
[ 52.664990][ T3632] ? hfsplus_bnode_move+0x2e6/0x930
[ 52.670167][ T3632] ? __mark_inode_dirty+0x24a/0x600
[ 52.675345][ T3632] ? hfs_find_rec_by_key+0x1f0/0x1f0
[ 52.680613][ T3632] hfsplus_brec_remove+0x430/0x4f0
[ 52.685715][ T3632] __hfsplus_delete_attr+0x219/0x3d0
[ 52.690991][ T3632] ? hfsplus_delete_attr+0x2d0/0x2d0
[ 52.696281][ T3632] ? __kmalloc+0xcc/0x1a0
[ 52.700594][ T3632] ? mutex_lock_nested+0x17/0x20
[ 52.705519][ T3632] hfsplus_delete_all_attrs+0x292/0x430
[ 52.711048][ T3632] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 52.717023][ T3632] ? __hfsplus_delete_attr+0x3d0/0x3d0
[ 52.722464][ T3632] ? trace_writeback_dirty_inode_enqueue+0xdb/0x2b0
[ 52.729038][ T3632] hfsplus_delete_cat+0xa64/0xe90
[ 52.734043][ T3632] ? hfsplus_mark_inode_dirty+0x30/0x30
[ 52.739571][ T3632] ? mutex_lock_io_nested+0x60/0x60
[ 52.744753][ T3632] ? read_lock_is_recursive+0x10/0x10
[ 52.750102][ T3632] ? __might_sleep+0xc0/0xc0
[ 52.754675][ T3632] hfsplus_unlink+0x342/0x7d0
[ 52.759332][ T3632] ? read_lock_is_recursive+0x10/0x10
[ 52.764683][ T3632] ? hfsplus_link+0x820/0x820
[ 52.769344][ T3632] ? down_write+0x1a5/0x270
[ 52.773827][ T3632] ? HAS_UNMAPPED_ID+0x1ed/0x240
[ 52.778746][ T3632] ? down_read_killable+0x80/0x80
[ 52.783748][ T3632] ? may_delete+0x557/0x6f0
[ 52.788239][ T3632] ? bpf_lsm_inode_unlink+0x5/0x10
[ 52.793335][ T3632] ? security_inode_unlink+0xfa/0x130
[ 52.798700][ T3632] vfs_unlink+0x357/0x5f0
[ 52.803007][ T3632] do_unlinkat+0x484/0x940
[ 52.807406][ T3632] ? try_break_deleg+0x120/0x120
[ 52.812320][ T3632] ? __check_object_size+0x15a/0x210
[ 52.817588][ T3632] ? strncpy_from_user+0x1d6/0x330
[ 52.822691][ T3632] __x64_sys_unlink+0x45/0x50
[ 52.827346][ T3632] do_syscall_64+0x3d/0xb0
[ 52.831745][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 52.837626][ T3632] RIP: 0033:0x7f0cfeb0e809
[ 52.842018][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 52.861601][ T3632] RSP: 002b:00007ffc5e1884c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 52.869995][ T3632] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0cfeb0e809
[ 52.877946][ T3632] RDX: 00007f0cfeacce83 RSI: 0000000000000000 RDI: 0000000020000000
[ 52.885903][ T3632] RBP: 00007f0cfeace0a0 R08: 00000000000005f2 R09: 0000000000000000
[ 52.893915][ T3632] R10: 00007ffc5e188390 R11: 0000000000000246 R12: 00007f0cfeace130
[ 52.901875][ T3632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 52.909842][ T3632]
[ 52.912849][ T3632]
[ 52.915158][ T3632] Allocated by task 3632:
[ 52.919464][ T3632] kasan_set_track+0x3d/0x60
[ 52.924040][ T3632] __kasan_kmalloc+0x97/0xb0
[ 52.928610][ T3632] __kmalloc+0xaf/0x1a0
[ 52.932757][ T3632] __hfs_bnode_create+0xec/0x7f0
[ 52.937680][ T3632] hfsplus_bnode_find+0x23d/0xd80
[ 52.942687][ T3632] hfsplus_brec_find+0x145/0x520
[ 52.947613][ T3632] hfsplus_delete_all_attrs+0x269/0x430
[ 52.953143][ T3632] hfsplus_delete_cat+0xa64/0xe90
[ 52.958156][ T3632] hfsplus_unlink+0x342/0x7d0
[ 52.962814][ T3632] vfs_unlink+0x357/0x5f0
[ 52.967123][ T3632] do_unlinkat+0x484/0x940
[ 52.971520][ T3632] __x64_sys_unlink+0x45/0x50
[ 52.976173][ T3632] do_syscall_64+0x3d/0xb0
[ 52.980565][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 52.986437][ T3632]
[ 52.988741][ T3632] Last potentially related work creation:
[ 52.994433][ T3632] kasan_save_stack+0x2b/0x50
[ 52.999086][ T3632] __kasan_record_aux_stack+0xb0/0xc0
[ 53.004433][ T3632] insert_work+0x54/0x3e0
[ 53.008740][ T3632] __queue_work+0xaaa/0xd60
[ 53.013218][ T3632] queue_work_on+0x11b/0x200
[ 53.017785][ T3632] inet6addr_event+0xe8/0x150
[ 53.022443][ T3632] atomic_notifier_call_chain+0x157/0x260
[ 53.028144][ T3632] ipv6_del_addr+0x747/0xbf0
[ 53.032716][ T3632] inet6_addr_del+0x434/0x5f0
[ 53.037372][ T3632] inet6_rtm_deladdr+0x2dc/0x3c0
[ 53.042295][ T3632] rtnetlink_rcv_msg+0x772/0xe60
[ 53.047209][ T3632] netlink_rcv_skb+0x1f0/0x460
[ 53.051951][ T3632] netlink_unicast+0x7e7/0x9c0
[ 53.056708][ T3632] netlink_sendmsg+0x9b3/0xcd0
[ 53.061453][ T3632] ____sys_sendmsg+0x5be/0x9b0
[ 53.066195][ T3632] __sys_sendmsg+0x23e/0x340
[ 53.070797][ T3632] do_syscall_64+0x3d/0xb0
[ 53.075188][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.081055][ T3632]
[ 53.083360][ T3632] The buggy address belongs to the object at ffff888017837b00
[ 53.083360][ T3632] which belongs to the cache kmalloc-192 of size 192
[ 53.097388][ T3632] The buggy address is located 0 bytes to the right of
[ 53.097388][ T3632] 192-byte region [ffff888017837b00, ffff888017837bc0)
[ 53.111417][ T3632]
[ 53.113725][ T3632] The buggy address belongs to the physical page:
[ 53.120133][ T3632] page:ffffea00005e0dc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888017837f00 pfn:0x17837
[ 53.131562][ T3632] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 53.139091][ T3632] raw: 00fff00000000200 ffffea00005e11c0 dead000000000003 ffff888012841a00
[ 53.147650][ T3632] raw: ffff888017837f00 000000008010000f 00000001ffffffff 0000000000000000
[ 53.156203][ T3632] page dumped because: kasan: bad access detected
[ 53.162587][ T3632] page_owner tracks the page as allocated
[ 53.168275][ T3632] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 1913293158, free_ts 0
[ 53.184851][ T3632] get_page_from_freelist+0x742/0x7c0
[ 53.190206][ T3632] __alloc_pages+0x259/0x560
[ 53.194861][ T3632] alloc_page_interleave+0x22/0x1c0
[ 53.200040][ T3632] alloc_slab_page+0x70/0xf0
[ 53.204610][ T3632] allocate_slab+0x5e/0x4b0
[ 53.209094][ T3632] ___slab_alloc+0x782/0xe20
[ 53.214006][ T3632] __kmem_cache_alloc_node+0x252/0x310
[ 53.219442][ T3632] kmalloc_trace+0x26/0x60
[ 53.223839][ T3632] call_usermodehelper_setup+0x8a/0x260
[ 53.229360][ T3632] kobject_uevent_env+0x7c1/0x8e0
[ 53.234364][ T3632] device_add+0xa56/0xf90
[ 53.238669][ T3632] add_memory_block+0x2c8/0x520
[ 53.243514][ T3632] memory_dev_init+0x101/0x1a8
[ 53.248278][ T3632] driver_init+0x43/0x4d
[ 53.252519][ T3632] do_basic_setup+0x16/0x81
[ 53.257016][ T3632] kernel_init_freeable+0x428/0x5d5
[ 53.262205][ T3632] page_owner free stack trace missing
[ 53.267549][ T3632]
[ 53.269852][ T3632] Memory state around the buggy address:
[ 53.275465][ T3632] ffff888017837a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 53.283508][ T3632] ffff888017837b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 53.291555][ T3632] >ffff888017837b80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 53.299594][ T3632] ^
[ 53.305724][ T3632] ffff888017837c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 53.313765][ T3632] ffff888017837c80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
[ 53.321809][ T3632] ==================================================================
[ 53.330241][ T3632] Kernel panic - not syncing: panic_on_warn set ...
[ 53.336834][ T3632] CPU: 1 PID: 3632 Comm: syz-executor268 Not tainted 6.1.0-rc6-syzkaller-00315-gfaf68e3523c2 #0
[ 53.347243][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 53.357287][ T3632] Call Trace:
[ 53.360557][ T3632]
[ 53.363476][ T3632] dump_stack_lvl+0x1b1/0x28e
[ 53.368147][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 53.373601][ T3632] ? panic+0x710/0x710
[ 53.377660][ T3632] ? preempt_schedule_common+0xb7/0xe0
[ 53.383112][ T3632] ? vscnprintf+0x59/0x80
[ 53.387436][ T3632] panic+0x2d6/0x710
[ 53.391332][ T3632] ? memcpy_page_flushcache+0xfc/0xfc
[ 53.396701][ T3632] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 53.402674][ T3632] ? print_report+0x1b4/0x1f0
[ 53.407340][ T3632] ? hfsplus_bnode_read+0xc9/0x200
[ 53.412442][ T3632] end_report+0x91/0xa0
[ 53.416588][ T3632] kasan_report+0xda/0x100
[ 53.420997][ T3632] ? hfsplus_bnode_read+0xc9/0x200
[ 53.426103][ T3632] hfsplus_bnode_read+0xc9/0x200
[ 53.431034][ T3632] hfsplus_bnode_dump+0x29a/0x530
[ 53.436052][ T3632] ? hfsplus_bnode_move+0x930/0x930
[ 53.441239][ T3632] ? hfsplus_bnode_write_u16+0x96/0xf0
[ 53.446687][ T3632] ? wbc_attach_and_unlock_inode+0xf0/0x540
[ 53.452568][ T3632] ? hfsplus_bnode_move+0x2e6/0x930
[ 53.457762][ T3632] ? __mark_inode_dirty+0x24a/0x600
[ 53.462952][ T3632] ? hfs_find_rec_by_key+0x1f0/0x1f0
[ 53.468228][ T3632] hfsplus_brec_remove+0x430/0x4f0
[ 53.473337][ T3632] __hfsplus_delete_attr+0x219/0x3d0
[ 53.478710][ T3632] ? hfsplus_delete_attr+0x2d0/0x2d0
[ 53.483989][ T3632] ? __kmalloc+0xcc/0x1a0
[ 53.488312][ T3632] ? mutex_lock_nested+0x17/0x20
[ 53.493244][ T3632] hfsplus_delete_all_attrs+0x292/0x430
[ 53.498791][ T3632] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 53.504762][ T3632] ? __hfsplus_delete_attr+0x3d0/0x3d0
[ 53.510218][ T3632] ? trace_writeback_dirty_inode_enqueue+0xdb/0x2b0
[ 53.516805][ T3632] hfsplus_delete_cat+0xa64/0xe90
[ 53.521830][ T3632] ? hfsplus_mark_inode_dirty+0x30/0x30
[ 53.527376][ T3632] ? mutex_lock_io_nested+0x60/0x60
[ 53.532572][ T3632] ? read_lock_is_recursive+0x10/0x10
[ 53.537948][ T3632] ? __might_sleep+0xc0/0xc0
[ 53.542551][ T3632] hfsplus_unlink+0x342/0x7d0
[ 53.547225][ T3632] ? read_lock_is_recursive+0x10/0x10
[ 53.552594][ T3632] ? hfsplus_link+0x820/0x820
[ 53.557270][ T3632] ? down_write+0x1a5/0x270
[ 53.561764][ T3632] ? HAS_UNMAPPED_ID+0x1ed/0x240
[ 53.566698][ T3632] ? down_read_killable+0x80/0x80
[ 53.571714][ T3632] ? may_delete+0x557/0x6f0
[ 53.576208][ T3632] ? bpf_lsm_inode_unlink+0x5/0x10
[ 53.581311][ T3632] ? security_inode_unlink+0xfa/0x130
[ 53.586680][ T3632] vfs_unlink+0x357/0x5f0
[ 53.591003][ T3632] do_unlinkat+0x484/0x940
[ 53.595420][ T3632] ? try_break_deleg+0x120/0x120
[ 53.600346][ T3632] ? __check_object_size+0x15a/0x210
[ 53.605626][ T3632] ? strncpy_from_user+0x1d6/0x330
[ 53.610736][ T3632] __x64_sys_unlink+0x45/0x50
[ 53.615405][ T3632] do_syscall_64+0x3d/0xb0
[ 53.619815][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.625703][ T3632] RIP: 0033:0x7f0cfeb0e809
[ 53.630110][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 53.649709][ T3632] RSP: 002b:00007ffc5e1884c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 53.658115][ T3632] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0cfeb0e809
[ 53.666077][ T3632] RDX: 00007f0cfeacce83 RSI: 0000000000000000 RDI: 0000000020000000
[ 53.674039][ T3632] RBP: 00007f0cfeace0a0 R08: 00000000000005f2 R09: 0000000000000000
[ 53.682003][ T3632] R10: 00007ffc5e188390 R11: 0000000000000246 R12: 00007f0cfeace130
[ 53.689967][ T3632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 53.697933][ T3632]
[ 53.701092][ T3632] Kernel Offset: disabled
[ 53.705406][ T3632] Rebooting in 86400 seconds..