./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3961656147
<...>
Warning: Permanently added '10.128.0.168' (ED25519) to the list of known hosts.
execve("./syz-executor3961656147", ["./syz-executor3961656147"], 0x7ffe6d0c5d30 /* 10 vars */) = 0
brk(NULL) = 0x55557c771000
brk(0x55557c771d00) = 0x55557c771d00
arch_prctl(ARCH_SET_FS, 0x55557c771380) = 0
set_tid_address(0x55557c771650) = 5844
set_robust_list(0x55557c771660, 24) = 0
rseq(0x55557c771ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3961656147", 4096) = 28
getrandom("\xdd\x9a\xa3\x17\x56\x1e\x0a\xd8", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55557c771d00
brk(0x55557c792d00) = 0x55557c792d00
brk(0x55557c793000) = 0x55557c793000
mprotect(0x7ff2c4721000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5845 attached
, child_tidptr=0x55557c771650) = 5845
[pid 5845] set_robust_list(0x55557c771660, 24) = 0
[pid 5845] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5845] setpgid(0, 0) = 0
[pid 5845] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5845] write(3, "1000", 4) = 4
[pid 5845] close(3) = 0
executing program
[pid 5845] write(1, "executing program\n", 18) = 18
[pid 5845] memfd_create("syzkaller", 0) = 3
[pid 5845] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2bc200000
[pid 5845] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768
[pid 5845] munmap(0x7ff2bc200000, 138412032) = 0
[pid 5845] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5845] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5845] close(3) = 0
[pid 5845] close(4) = 0
[pid 5845] mkdir("./file1", 0777) = 0
[pid 5845] mount("/dev/loop0", "./file1", "hfs", 0, "") = 0
[pid 5845] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid 5845] chdir("./file1") = 0
[pid 5845] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5845] openat(AT_FDCWD, ".", O_RDONLY) = 4
[pid 5845] mkdirat(4, "./bus", 000) = 0
[ 93.344983][ T5845] loop0: detected capacity change from 0 to 64
[ 93.401896][ T5845] ==================================================================
[ 93.410019][ T5845] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read+0xbc/0x220
[ 93.417536][ T5845] Write of size 94 at addr ffff888141376a80 by task syz-executor396/5845
[ 93.425964][ T5845]
[ 93.428295][ T5845] CPU: 0 UID: 0 PID: 5845 Comm: syz-executor396 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0
[ 93.439073][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 93.449160][ T5845] Call Trace:
[ 93.452445][ T5845]
[ 93.455386][ T5845] dump_stack_lvl+0x116/0x1f0
[ 93.460113][ T5845] print_report+0xc3/0x620
[ 93.464569][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.470245][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.475919][ T5845] ? __phys_addr+0xc6/0x150
[ 93.480458][ T5845] kasan_report+0xd9/0x110
[ 93.484947][ T5845] ? hfs_bnode_read+0xbc/0x220
[ 93.489743][ T5845] ? hfs_bnode_read+0xbc/0x220
[ 93.494539][ T5845] kasan_check_range+0xef/0x1a0
[ 93.499415][ T5845] __asan_memcpy+0x3c/0x60
[ 93.503859][ T5845] hfs_bnode_read+0xbc/0x220
[ 93.508484][ T5845] hfs_bnode_read_key+0x14e/0x1f0
[ 93.513562][ T5845] ? __pfx_hfs_bnode_read_key+0x10/0x10
[ 93.519154][ T5845] ? srso_alias_return_thunk+0x52/0xfbef5
[ 93.524948][ T5845] ? _raw_spin_unlock+0x28/0x50
[ 93.529825][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.535498][ T5845] ? hfs_bnode_put.part.0+0x1e3/0x280
[ 93.540907][ T5845] hfs_brec_insert+0x66b/0xb90
[ 93.545710][ T5845] ? __pfx_hfs_brec_insert+0x10/0x10
[ 93.551029][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.556707][ T5845] hfs_cat_move+0x3f0/0x7e0
[ 93.561249][ T5845] ? __pfx_hfs_cat_move+0x10/0x10
[ 93.566311][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.571983][ T5845] ? __pfx_lock_acquire.part.0+0x10/0x10
[ 93.577645][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.583322][ T5845] ? rcu_is_watching+0x12/0xc0
[ 93.588206][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.593886][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.599573][ T5845] ? down_write_nested+0x152/0x210
[ 93.604721][ T5845] hfs_rename+0xe8/0x200
[ 93.608998][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.614667][ T5845] ? __pfx_hfs_rename+0x10/0x10
[ 93.619547][ T5845] vfs_rename+0xf8b/0x21f0
[ 93.623991][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.629704][ T5845] ? __pfx_vfs_rename+0x10/0x10
[ 93.634589][ T5845] ? _raw_spin_unlock+0x28/0x50
[ 93.639460][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.645130][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.650796][ T5845] ? security_path_rename+0x136/0x3c0
[ 93.656217][ T5845] do_renameat2+0xc5f/0xdd0
[ 93.660758][ T5845] ? __pfx_do_renameat2+0x10/0x10
[ 93.665819][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.671489][ T5845] ? lock_acquire+0x2f/0xb0
[ 93.676038][ T5845] ? __might_fault+0xe3/0x190
[ 93.680736][ T5845] ? __might_fault+0xe3/0x190
[ 93.685446][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.691142][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 93.696806][ T5845] ? getname_flags.part.0+0x1c5/0x550
[ 93.702197][ T5845] __x64_sys_renameat2+0xe7/0x130
[ 93.707261][ T5845] do_syscall_64+0xcd/0x250
[ 93.711828][ T5845] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.717761][ T5845] RIP: 0033:0x7ff2c46adad9
[ 93.722191][ T5845] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 93.741825][ T5845] RSP: 002b:00007fff22f2dbd8 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
[ 93.750270][ T5845] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff2c46adad9
[ 93.758262][ T5845] RDX: 0000000000000004 RSI: 0000000020000380 RDI: 0000000000000004
[ 93.766248][ T5845] RBP: 00007ff2c47215f0 R08: 0000000000000000 R09: 000055557c7724c0
[ 93.774243][ T5845] R10: 0000000020000200 R11: 0000000000000246 R12: 00007fff22f2dc00
[ 93.782237][ T5845] R13: 00007fff22f2de28 R14: 431bde82d7b634db R15: 00007ff2c46f603b
[ 93.790239][ T5845]
[ 93.793266][ T5845]
[ 93.795591][ T5845] Allocated by task 5845:
[ 93.799925][ T5845] kasan_save_stack+0x33/0x60
[ 93.804676][ T5845] kasan_save_track+0x14/0x30
[ 93.809388][ T5845] __kasan_kmalloc+0xaa/0xb0
[ 93.814100][ T5845] __kmalloc_noprof+0x1e8/0x400
[ 93.819001][ T5845] hfs_find_init+0x95/0x220
[ 93.823549][ T5845] hfs_cat_move+0x15a/0x7e0
[ 93.828084][ T5845] hfs_rename+0xe8/0x200
[ 93.832357][ T5845] vfs_rename+0xf8b/0x21f0
[ 93.836790][ T5845] do_renameat2+0xc5f/0xdd0
[ 93.841322][ T5845] __x64_sys_renameat2+0xe7/0x130
[ 93.846467][ T5845] do_syscall_64+0xcd/0x250
[ 93.851002][ T5845] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.856929][ T5845]
[ 93.859250][ T5845] The buggy address belongs to the object at ffff888141376a80
[ 93.859250][ T5845] which belongs to the cache kmalloc-96 of size 96
[ 93.873159][ T5845] The buggy address is located 0 bytes inside of
[ 93.873159][ T5845] allocated 78-byte region [ffff888141376a80, ffff888141376ace)
[ 93.887084][ T5845]
[ 93.889409][ T5845] The buggy address belongs to the physical page:
[ 93.895823][ T5845] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x141376
[ 93.904686][ T5845] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
[ 93.911910][ T5845] page_type: f5(slab)
[ 93.916129][ T5845] raw: 057ff00000000000 ffff88801b041280 dead000000000100 dead000000000122
[ 93.924735][ T5845] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[ 93.933353][ T5845] page dumped because: kasan: bad access detected
[ 93.939779][ T5845] page_owner tracks the page as allocated
[ 93.945498][ T5845] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 20294449508, free_ts 0
[ 93.963169][ T5845] post_alloc_hook+0x2d1/0x350
[ 93.967997][ T5845] get_page_from_freelist+0xfce/0x2f80
[ 93.973497][ T5845] __alloc_pages_noprof+0x223/0x25a0
[ 93.978824][ T5845] alloc_pages_mpol_noprof+0x2c9/0x610
[ 93.984327][ T5845] new_slab+0x2c9/0x410
[ 93.988539][ T5845] ___slab_alloc+0xdac/0x1880
[ 93.993335][ T5845] __slab_alloc.constprop.0+0x56/0xb0
[ 93.998767][ T5845] __kmalloc_cache_noprof+0x2b4/0x300
[ 94.004179][ T5845] dev_pm_qos_expose_flags+0x96/0x310
[ 94.009582][ T5845] usb_hub_create_port_device+0x8fd/0xde0
[ 94.015346][ T5845] hub_probe+0x1e1f/0x3200
[ 94.019807][ T5845] usb_probe_interface+0x30c/0x9d0
[ 94.024935][ T5845] really_probe+0x241/0xa90
[ 94.029462][ T5845] __driver_probe_device+0x1de/0x440
[ 94.034772][ T5845] driver_probe_device+0x4c/0x1b0
[ 94.039820][ T5845] __device_attach_driver+0x1df/0x310
[ 94.045222][ T5845] page_owner free stack trace missing
[ 94.050594][ T5845]
[ 94.052916][ T5845] Memory state around the buggy address:
[ 94.058553][ T5845] ffff888141376980: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 94.066643][ T5845] ffff888141376a00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 94.074745][ T5845] >ffff888141376a80: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc
[ 94.083087][ T5845] ^
[ 94.089522][ T5845] ffff888141376b00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 94.097615][ T5845] ffff888141376b80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 94.105708][ T5845] ==================================================================
[ 94.114469][ T5845] Kernel panic - not syncing: kasan.fault=panic_on_write set ...
[ 94.122245][ T5845] CPU: 0 UID: 0 PID: 5845 Comm: syz-executor396 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0
[ 94.133056][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 94.143192][ T5845] Call Trace:
[ 94.146498][ T5845]
[ 94.149452][ T5845] dump_stack_lvl+0x3d/0x1f0
[ 94.154099][ T5845] panic+0x71d/0x800
[ 94.158047][ T5845] ? __pfx_panic+0x10/0x10
[ 94.162509][ T5845] ? lockdep_hardirqs_on+0x7c/0x110
[ 94.167753][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.173447][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.179143][ T5845] ? preempt_schedule_common+0x44/0xc0
[ 94.184650][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.190331][ T5845] ? preempt_schedule_thunk+0x1a/0x30
[ 94.195744][ T5845] end_report+0x169/0x180
[ 94.200134][ T5845] kasan_report+0xe9/0x110
[ 94.204613][ T5845] ? hfs_bnode_read+0xbc/0x220
[ 94.209419][ T5845] ? hfs_bnode_read+0xbc/0x220
[ 94.214228][ T5845] kasan_check_range+0xef/0x1a0
[ 94.219119][ T5845] __asan_memcpy+0x3c/0x60
[ 94.223580][ T5845] hfs_bnode_read+0xbc/0x220
[ 94.228217][ T5845] hfs_bnode_read_key+0x14e/0x1f0
[ 94.233282][ T5845] ? __pfx_hfs_bnode_read_key+0x10/0x10
[ 94.238870][ T5845] ? srso_alias_return_thunk+0x52/0xfbef5
[ 94.244643][ T5845] ? _raw_spin_unlock+0x28/0x50
[ 94.249525][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.255214][ T5845] ? hfs_bnode_put.part.0+0x1e3/0x280
[ 94.260670][ T5845] hfs_brec_insert+0x66b/0xb90
[ 94.265488][ T5845] ? __pfx_hfs_brec_insert+0x10/0x10
[ 94.270854][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.276548][ T5845] hfs_cat_move+0x3f0/0x7e0
[ 94.281110][ T5845] ? __pfx_hfs_cat_move+0x10/0x10
[ 94.286193][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.291969][ T5845] ? __pfx_lock_acquire.part.0+0x10/0x10
[ 94.297643][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.303329][ T5845] ? rcu_is_watching+0x12/0xc0
[ 94.308147][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.313835][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.319620][ T5845] ? down_write_nested+0x152/0x210
[ 94.324893][ T5845] hfs_rename+0xe8/0x200
[ 94.329194][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.334885][ T5845] ? __pfx_hfs_rename+0x10/0x10
[ 94.339785][ T5845] vfs_rename+0xf8b/0x21f0
[ 94.344235][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.349927][ T5845] ? __pfx_vfs_rename+0x10/0x10
[ 94.354816][ T5845] ? _raw_spin_unlock+0x28/0x50
[ 94.359701][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.365387][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.371073][ T5845] ? security_path_rename+0x136/0x3c0
[ 94.376485][ T5845] do_renameat2+0xc5f/0xdd0
[ 94.381044][ T5845] ? __pfx_do_renameat2+0x10/0x10
[ 94.386121][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.391813][ T5845] ? lock_acquire+0x2f/0xb0
[ 94.396354][ T5845] ? __might_fault+0xe3/0x190
[ 94.401065][ T5845] ? __might_fault+0xe3/0x190
[ 94.405777][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.411465][ T5845] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.417152][ T5845] ? getname_flags.part.0+0x1c5/0x550
[ 94.422559][ T5845] __x64_sys_renameat2+0xe7/0x130
[ 94.427641][ T5845] do_syscall_64+0xcd/0x250
[ 94.432196][ T5845] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.438144][ T5845] RIP: 0033:0x7ff2c46adad9
[ 94.442584][ T5845] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 94.462319][ T5845] RSP: 002b:00007fff22f2dbd8 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
[ 94.470775][ T5845] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff2c46adad9
[ 94.478773][ T5845] RDX: 0000000000000004 RSI: 0000000020000380 RDI: 0000000000000004
[ 94.486807][ T5845] RBP: 00007ff2c47215f0 R08: 0000000000000000 R09: 000055557c7724c0
[ 94.494806][ T5845] R10: 0000000020000200 R11: 0000000000000246 R12: 00007fff22f2dc00
[ 94.502802][ T5845] R13: 00007fff22f2de28 R14: 431bde82d7b634db R15: 00007ff2c46f603b
[ 94.510808][ T5845]
[ 94.514119][ T5845] Kernel Offset: disabled
[ 94.518454][ T5845] Rebooting in 86400 seconds..