./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2674891227
<...>
Warning: Permanently added '10.128.0.14' (ED25519) to the list of known hosts.
execve("./syz-executor2674891227", ["./syz-executor2674891227"], 0x7ffdf8b83840 /* 10 vars */) = 0
brk(NULL) = 0x5555566a9000
brk(0x5555566a9d00) = 0x5555566a9d00
arch_prctl(ARCH_SET_FS, 0x5555566a9380) = 0
set_tid_address(0x5555566a9650) = 5037
set_robust_list(0x5555566a9660, 24) = 0
rseq(0x5555566a9ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2674891227", 4096) = 28
getrandom("\xde\xdd\x91\x90\x3d\xa5\x2a\x38", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555566a9d00
brk(0x5555566cad00) = 0x5555566cad00
brk(0x5555566cb000) = 0x5555566cb000
mprotect(0x7fb30016b000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.vJiILo", 0700) = 0
chmod("./syzkaller.vJiILo", 0777) = 0
chdir("./syzkaller.vJiILo") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5038 attached
, child_tidptr=0x5555566a9650) = 5038
[pid 5038] set_robust_list(0x5555566a9660, 24) = 0
[pid 5038] chdir("./0") = 0
[pid 5038] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5038] setpgid(0, 0) = 0
[pid 5038] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5038] write(3, "1000", 4) = 4
[pid 5038] close(3) = 0
[pid 5038] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5038] memfd_create("syzkaller", 0) = 3
[pid 5038] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb2f7cb8000
[pid 5038] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
[pid 5038] munmap(0x7fb2f7cb8000, 524288) = 0
[pid 5038] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5038] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5038] close(3) = 0
[pid 5038] mkdir("./file0", 0777) = 0
[pid 5038] mount("/dev/loop0", "./file0", "hfsplus", 0, "") = 0
[pid 5038] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5038] chdir("./file0") = 0
[pid 5038] ioctl(4, LOOP_CLR_FD) = 0
[pid 5038] close(4) = 0
[pid 5038] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4
[ 72.735932][ T5038] syz-executor267[5038]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[ 72.768734][ T5038] loop0: detected capacity change from 0 to 1024
[pid 5038] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048) = 0
[pid 5038] exit_group(0) = ?
[pid 5038] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5038, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555566aa6f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 72.858553][ T1273] ==================================================================
[ 72.866672][ T1273] BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0x908/0x12f0
[ 72.875944][ T1273] Read of size 1024 at addr ffff888020b4ec00 by task kworker/u4:7/1273
[ 72.884457][ T1273]
[ 72.886783][ T1273] CPU: 0 PID: 1273 Comm: kworker/u4:7 Not tainted 6.6.0-rc2-syzkaller-00018-g2cf0f7156238 #0
[ 72.897015][ T1273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
[ 72.907160][ T1273] Workqueue: loop0 loop_rootcg_workfn
[ 72.912539][ T1273] Call Trace:
[ 72.915817][ T1273]
[ 72.918749][ T1273] dump_stack_lvl+0x1e7/0x2d0
[ 72.923450][ T1273] ? nf_tcp_handle_invalid+0x650/0x650
[ 72.928924][ T1273] ? panic+0x770/0x770
[ 72.932994][ T1273] ? _printk+0xd5/0x120
[ 72.937151][ T1273] print_report+0x163/0x540
[ 72.941676][ T1273] ? __virt_addr_valid+0x22f/0x2e0
[ 72.946785][ T1273] ? __phys_addr+0xba/0x170
[ 72.951292][ T1273] ? copy_page_from_iter_atomic+0x908/0x12f0
[ 72.957296][ T1273] kasan_report+0x175/0x1b0
[ 72.961824][ T1273] ? copy_page_from_iter_atomic+0x908/0x12f0
[ 72.967829][ T1273] kasan_check_range+0x27e/0x290
[ 72.972781][ T1273] ? copy_page_from_iter_atomic+0x908/0x12f0
[ 72.979036][ T1273] __asan_memcpy+0x29/0x70
[ 72.983461][ T1273] copy_page_from_iter_atomic+0x908/0x12f0
[ 72.989303][ T1273] ? iov_iter_zero+0xf60/0xf60
[ 72.994101][ T1273] ? shmem_write_begin+0x1c1/0x300
[ 72.999245][ T1273] ? shmem_writepage+0x1ac0/0x1ac0
[ 73.004377][ T1273] ? inode_maybe_inc_iversion+0x1a3/0x1f0
[ 73.010123][ T1273] ? fault_in_iov_iter_readable+0x232/0x280
[ 73.016058][ T1273] generic_perform_write+0x392/0x630
[ 73.021378][ T1273] ? generic_file_direct_write+0x3f0/0x3f0
[ 73.027202][ T1273] ? preempt_count_add+0x93/0x180
[ 73.032336][ T1273] ? __mnt_drop_write_file+0xbb/0x100
[ 73.037720][ T1273] ? file_update_time+0x19c/0x1b0
[ 73.042769][ T1273] shmem_file_write_iter+0xfc/0x120
[ 73.047990][ T1273] do_iter_write+0x84f/0xde0
[ 73.052592][ T1273] ? vfs_iter_write+0xa0/0xa0
[ 73.057276][ T1273] ? rcu_read_lock_bh_held+0x120/0x120
[ 73.062745][ T1273] ? vfs_iter_write+0x70/0xa0
[ 73.067424][ T1273] loop_process_work+0x14c3/0x22a0
[ 73.072542][ T1273] ? psi_task_switch+0x441/0x770
[ 73.077500][ T1273] ? loop_workfn+0x50/0x50
[ 73.081922][ T1273] ? read_lock_is_recursive+0x20/0x20
[ 73.087298][ T1273] ? print_irqtrace_events+0x220/0x220
[ 73.092772][ T1273] ? process_scheduled_works+0x825/0x1400
[ 73.098500][ T1273] process_scheduled_works+0x90f/0x1400
[ 73.104082][ T1273] ? assign_work+0x3d0/0x3d0
[ 73.108775][ T1273] ? assign_work+0x364/0x3d0
[ 73.113381][ T1273] worker_thread+0xa5f/0xff0
[ 73.118042][ T1273] kthread+0x2d3/0x370
[ 73.122120][ T1273] ? pr_cont_work+0x5e0/0x5e0
[ 73.126811][ T1273] ? kthread_blkcg+0xd0/0xd0
[ 73.131405][ T1273] ret_from_fork+0x48/0x80
[ 73.135835][ T1273] ? kthread_blkcg+0xd0/0xd0
[ 73.140458][ T1273] ret_from_fork_asm+0x11/0x20
[ 73.145240][ T1273]
[ 73.148350][ T1273]
[ 73.150675][ T1273] Allocated by task 5038:
[ 73.155018][ T1273] kasan_set_track+0x4f/0x70
[ 73.159618][ T1273] __kasan_kmalloc+0x98/0xb0
[ 73.164223][ T1273] __kmalloc+0xb9/0x230
[ 73.168400][ T1273] hfsplus_read_wrapper+0x545/0x1330
[ 73.173717][ T1273] hfsplus_fill_super+0x38e/0x1c90
[ 73.178836][ T1273] mount_bdev+0x237/0x300
[ 73.183190][ T1273] legacy_get_tree+0xef/0x190
[ 73.187910][ T1273] vfs_get_tree+0x8c/0x280
[ 73.192425][ T1273] do_new_mount+0x28f/0xae0
[ 73.196942][ T1273] __se_sys_mount+0x2d9/0x3c0
[ 73.201625][ T1273] do_syscall_64+0x41/0xc0
[ 73.206043][ T1273] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 73.212027][ T1273]
[ 73.214349][ T1273] The buggy address belongs to the object at ffff888020b4ec00
[ 73.214349][ T1273] which belongs to the cache kmalloc-512 of size 512
[ 73.228403][ T1273] The buggy address is located 0 bytes inside of
[ 73.228403][ T1273] allocated 512-byte region [ffff888020b4ec00, ffff888020b4ee00)
[ 73.242376][ T1273]
[ 73.244700][ T1273] The buggy address belongs to the physical page:
[ 73.251113][ T1273] page:ffffea000082d300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20b4c
[ 73.261371][ T1273] head:ffffea000082d300 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 73.270307][ T1273] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 73.278284][ T1273] page_type: 0xffffffff()
[ 73.282616][ T1273] raw: 00fff00000000840 ffff888012841c80 ffffea000085e900 dead000000000002
[ 73.291200][ T1273] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 73.299783][ T1273] page dumped because: kasan: bad access detected
[ 73.306206][ T1273] page_owner tracks the page as allocated
[ 73.311918][ T1273] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12443144717, free_ts 0
[ 73.331630][ T1273] post_alloc_hook+0x1e6/0x210
[ 73.336411][ T1273] get_page_from_freelist+0x31db/0x3360
[ 73.341963][ T1273] __alloc_pages+0x255/0x670
[ 73.346561][ T1273] alloc_page_interleave+0x22/0x1d0
[ 73.351767][ T1273] alloc_slab_page+0x6a/0x160
[ 73.356452][ T1273] new_slab+0x84/0x2f0
[ 73.361044][ T1273] ___slab_alloc+0xc85/0x1310
[ 73.365724][ T1273] __kmem_cache_alloc_node+0x1af/0x270
[ 73.371186][ T1273] kmalloc_trace+0x2a/0xe0
[ 73.375607][ T1273] dev_pm_qos_constraints_allocate+0x8f/0x400
[ 73.381697][ T1273] __dev_pm_qos_add_request+0x121/0x4a0
[ 73.387701][ T1273] dev_pm_qos_add_request+0x3a/0x60
[ 73.392949][ T1273] usb_hub_create_port_device+0x4c6/0xc40
[ 73.398689][ T1273] hub_probe+0x2469/0x3570
[ 73.403124][ T1273] usb_probe_interface+0x5c4/0xb00
[ 73.408261][ T1273] really_probe+0x294/0xc30
[ 73.412774][ T1273] page_owner free stack trace missing
[ 73.418171][ T1273]
[ 73.420511][ T1273] Memory state around the buggy address:
[ 73.426244][ T1273] ffff888020b4ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 73.434318][ T1273] ffff888020b4ed80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 73.442388][ T1273] >ffff888020b4ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.450445][ T1273] ^
[ 73.454508][ T1273] ffff888020b4ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.462569][ T1273] ffff888020b4ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.470713][ T1273] ==================================================================
[ 73.479412][ T1273] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.486749][ T1273] CPU: 0 PID: 1273 Comm: kworker/u4:7 Not tainted 6.6.0-rc2-syzkaller-00018-g2cf0f7156238 #0
[ 73.496905][ T1273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
[ 73.507044][ T1273] Workqueue: loop0 loop_rootcg_workfn
[ 73.512442][ T1273] Call Trace:
[ 73.515823][ T1273]
[ 73.518764][ T1273] dump_stack_lvl+0x1e7/0x2d0
[ 73.523456][ T1273] ? nf_tcp_handle_invalid+0x650/0x650
[ 73.528921][ T1273] ? panic+0x770/0x770
[ 73.532999][ T1273] ? lock_release+0xbf/0x9d0
[ 73.537598][ T1273] ? vscnprintf+0x5d/0x80
[ 73.541995][ T1273] panic+0x30f/0x770
[ 73.545904][ T1273] ? check_panic_on_warn+0x21/0xa0
[ 73.551039][ T1273] ? __memcpy_flushcache+0x2b0/0x2b0
[ 73.556358][ T1273] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 73.562292][ T1273] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 73.568220][ T1273] ? _raw_spin_unlock+0x40/0x40
[ 73.573088][ T1273] ? print_report+0x4fb/0x540
[ 73.577789][ T1273] check_panic_on_warn+0x82/0xa0
[ 73.582762][ T1273] ? copy_page_from_iter_atomic+0x908/0x12f0
[ 73.588757][ T1273] end_report+0x6e/0x130
[ 73.593014][ T1273] kasan_report+0x186/0x1b0
[ 73.597531][ T1273] ? copy_page_from_iter_atomic+0x908/0x12f0
[ 73.603531][ T1273] kasan_check_range+0x27e/0x290
[ 73.608478][ T1273] ? copy_page_from_iter_atomic+0x908/0x12f0
[ 73.614468][ T1273] __asan_memcpy+0x29/0x70
[ 73.618888][ T1273] copy_page_from_iter_atomic+0x908/0x12f0
[ 73.624715][ T1273] ? iov_iter_zero+0xf60/0xf60
[ 73.629488][ T1273] ? shmem_write_begin+0x1c1/0x300
[ 73.634616][ T1273] ? shmem_writepage+0x1ac0/0x1ac0
[ 73.639832][ T1273] ? inode_maybe_inc_iversion+0x1a3/0x1f0
[ 73.645565][ T1273] ? fault_in_iov_iter_readable+0x232/0x280
[ 73.651477][ T1273] generic_perform_write+0x392/0x630
[ 73.656778][ T1273] ? generic_file_direct_write+0x3f0/0x3f0
[ 73.662597][ T1273] ? preempt_count_add+0x93/0x180
[ 73.667635][ T1273] ? __mnt_drop_write_file+0xbb/0x100
[ 73.673017][ T1273] ? file_update_time+0x19c/0x1b0
[ 73.678077][ T1273] shmem_file_write_iter+0xfc/0x120
[ 73.683290][ T1273] do_iter_write+0x84f/0xde0
[ 73.687891][ T1273] ? vfs_iter_write+0xa0/0xa0
[ 73.692572][ T1273] ? rcu_read_lock_bh_held+0x120/0x120
[ 73.698061][ T1273] ? vfs_iter_write+0x70/0xa0
[ 73.702852][ T1273] loop_process_work+0x14c3/0x22a0
[ 73.707974][ T1273] ? psi_task_switch+0x441/0x770
[ 73.712947][ T1273] ? loop_workfn+0x50/0x50
[ 73.717370][ T1273] ? read_lock_is_recursive+0x20/0x20
[ 73.722753][ T1273] ? print_irqtrace_events+0x220/0x220
[ 73.728227][ T1273] ? process_scheduled_works+0x825/0x1400
[ 73.733957][ T1273] process_scheduled_works+0x90f/0x1400
[ 73.739528][ T1273] ? assign_work+0x3d0/0x3d0
[ 73.744127][ T1273] ? assign_work+0x364/0x3d0
[ 73.748726][ T1273] worker_thread+0xa5f/0xff0
[ 73.753340][ T1273] kthread+0x2d3/0x370
[ 73.757499][ T1273] ? pr_cont_work+0x5e0/0x5e0
[ 73.762188][ T1273] ? kthread_blkcg+0xd0/0xd0
[ 73.766798][ T1273] ret_from_fork+0x48/0x80
[ 73.771230][ T1273] ? kthread_blkcg+0xd0/0xd0
[ 73.775828][ T1273] ret_from_fork_asm+0x11/0x20
[ 73.780612][ T1273]
[ 73.783874][ T1273] Kernel Offset: disabled
[ 73.788199][ T1273] Rebooting in 86400 seconds..