./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor123307601
<...>
Warning: Permanently added '10.128.1.163' (ED25519) to the list of known hosts.
execve("./syz-executor123307601", ["./syz-executor123307601"], 0x7ffca5c463a0 /* 10 vars */) = 0
brk(NULL) = 0x555556e63000
brk(0x555556e63d00) = 0x555556e63d00
arch_prctl(ARCH_SET_FS, 0x555556e63380) = 0
set_tid_address(0x555556e63650) = 5025
set_robust_list(0x555556e63660, 24) = 0
rseq(0x555556e63ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor123307601", 4096) = 27
getrandom("\xc9\x62\x89\x47\x31\x6d\xc0\xe4", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555556e63d00
brk(0x555556e84d00) = 0x555556e84d00
brk(0x555556e85000) = 0x555556e85000
mprotect(0x7fd2fa484000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.D36mQU", 0700) = 0
chmod("./syzkaller.D36mQU", 0777) = 0
chdir("./syzkaller.D36mQU") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e63650) = 5026
./strace-static-x86_64: Process 5026 attached
[pid 5026] set_robust_list(0x555556e63660, 24) = 0
[pid 5026] chdir("./0") = 0
[pid 5026] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5026] setpgid(0, 0) = 0
[pid 5026] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5026] write(3, "1000", 4) = 4
[pid 5026] close(3) = 0
[pid 5026] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5026] memfd_create("syzkaller", 0) = 3
[pid 5026] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd2f1fb2000
[pid 5026] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 5026] munmap(0x7fd2f1fb2000, 1048576) = 0
[pid 5026] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5026] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5026] close(3) = 0
[pid 5026] mkdir("./file1", 0777) = 0
[ 69.710919][ T5026] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5026 'syz-executor123'
[ 69.735948][ T5026] loop0: detected capacity change from 0 to 2048
[ 69.744801][ T5026] =======================================================
[ 69.744801][ T5026] WARNING: The mand mount option has been deprecated and
[pid 5026] mount("/dev/loop0", "./file1", "udf", MS_NODEV|MS_NOEXEC|MS_MANDLOCK|MS_POSIXACL, "noadinicb,utf8,adinicb,iocharset=cp865,noadinicb,") = 0
[pid 5026] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid 5026] chdir("./file1") = 0
[pid 5026] ioctl(4, LOOP_CLR_FD) = 0
[pid 5026] close(4) = 0
[ 69.744801][ T5026] and is ignored by this kernel. Remove the mand
[ 69.744801][ T5026] option from the mount to silence this warning.
[ 69.744801][ T5026] =======================================================
[ 69.781321][ T5026] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[ 69.793281][ T5026] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 5026] open("./bus", O_RDWR|O_CREAT|O_SYNC|O_DIRECT|O_NOATIME|FASYNC, 000) = 4
[pid 5026] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 5026] memfd_create("syzkaller", 0) = 5
[pid 5026] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd2e9cb2000
[pid 5026] write(5, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x08\x02\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x03\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xf5\x00\x00\x00\x02\x00\x00\x00\xf7\x9a\x81\x47\x2b\x73\xcf\x43\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 5026] munmap(0x7fd2e9cb2000, 2097152) = 0
[ 69.807760][ T27] audit: type=1800 audit(1691001246.871:2): pid=5026 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor123" name="bus" dev="loop0" ino=1367 res=0 errno=0
[pid 5026] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6
[pid 5026] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 5026] ioctl(6, LOOP_CLR_FD) = 0
[pid 5026] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 5026] close(6) = 0
[pid 5026] close(5) = 0
[pid 5026] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5
[pid 5026] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 1048576
[pid 5026] exit_group(0) = ?
[pid 5026] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5026, si_uid=0, si_status=0, si_utime=0, si_stime=15 /* 0.15 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x555556e646f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 70.066705][ T5025] ==================================================================
[ 70.075225][ T5025] BUG: KASAN: use-after-free in crc_itu_t+0xd7/0xe0
[ 70.081850][ T5025] Read of size 1 at addr ffff888073f81000 by task syz-executor123/5025
[ 70.090101][ T5025]
[ 70.092444][ T5025] CPU: 0 PID: 5025 Comm: syz-executor123 Not tainted 6.5.0-rc4-next-20230802-syzkaller #0
[ 70.102354][ T5025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
[ 70.112422][ T5025] Call Trace:
[ 70.115705][ T5025]
[ 70.118655][ T5025] dump_stack_lvl+0xd9/0x1b0
[ 70.123270][ T5025] print_report+0xc4/0x620
[ 70.127711][ T5025] ? __virt_addr_valid+0x5e/0x2d0
[ 70.132750][ T5025] ? __phys_addr+0xc6/0x140
[ 70.137270][ T5025] kasan_report+0xda/0x110
[ 70.141710][ T5025] ? crc_itu_t+0xd7/0xe0
[ 70.145997][ T5025] ? crc_itu_t+0xd7/0xe0
[ 70.150272][ T5025] crc_itu_t+0xd7/0xe0
[ 70.154385][ T5025] udf_finalize_lvid+0xf2/0x1f0
[ 70.159257][ T5025] ? udf_mount+0x40/0x40
[ 70.163532][ T5025] udf_sync_fs+0xea/0x150
[ 70.167898][ T5025] ? udf_finalize_lvid+0x1f0/0x1f0
[ 70.173156][ T5025] sync_filesystem+0x109/0x280
[ 70.177948][ T5025] generic_shutdown_super+0x74/0x480
[ 70.183262][ T5025] kill_block_super+0x3b/0xc0
[ 70.187955][ T5025] deactivate_locked_super+0x9a/0x170
[ 70.193351][ T5025] deactivate_super+0xde/0x100
[ 70.198134][ T5025] cleanup_mnt+0x222/0x3d0
[ 70.202565][ T5025] task_work_run+0x14d/0x240
[ 70.207179][ T5025] ? task_work_cancel+0x30/0x30
[ 70.212143][ T5025] ptrace_notify+0x10c/0x130
[ 70.216761][ T5025] syscall_exit_to_user_mode_prepare+0x120/0x220
[ 70.223102][ T5025] syscall_exit_to_user_mode+0xd/0x50
[ 70.228506][ T5025] do_syscall_64+0x44/0xb0
[ 70.232963][ T5025] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 70.238885][ T5025] RIP: 0033:0x7fd2fa3f2807
[ 70.243307][ T5025] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 70.263019][ T5025] RSP: 002b:00007ffe32361c98 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 70.271457][ T5025] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd2fa3f2807
[ 70.279450][ T5025] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffe32361d50
[ 70.287442][ T5025] RBP: 00007ffe32361d50 R08: 0000000000000000 R09: 0000000000000000
[ 70.295435][ T5025] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffe32362dc0
[ 70.303424][ T5025] R13: 0000555556e646c0 R14: 431bde82d7b634db R15: 00007ffe32362de0
[ 70.311455][ T5025]
[ 70.314479][ T5025]
[ 70.316801][ T5025] The buggy address belongs to the physical page:
[ 70.323212][ T5025] page:ffffea0001cfe040 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73f81
[ 70.333380][ T5025] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 70.340511][ T5025] page_type: 0xffffffff()
[ 70.344861][ T5025] raw: 00fff00000000000 ffffea0001cfe088 ffffea0001ad3988 0000000000000000
[ 70.353514][ T5025] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 70.362112][ T5025] page dumped because: kasan: bad access detected
[ 70.368535][ T5025] page_owner tracks the page as freed
[ 70.373911][ T5025] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5014, tgid 5014 (sshd), ts 61750378993, free_ts 61865757653
[ 70.391917][ T5025] post_alloc_hook+0x2d2/0x350
[ 70.396706][ T5025] get_page_from_freelist+0x10d7/0x31b0
[ 70.402283][ T5025] __alloc_pages+0x1d0/0x4a0
[ 70.406900][ T5025] __folio_alloc+0x16/0x40
[ 70.411338][ T5025] vma_alloc_folio+0x156/0x890
[ 70.416119][ T5025] __handle_mm_fault+0x1051/0x3f90
[ 70.421245][ T5025] handle_mm_fault+0x47a/0xa00
[ 70.426018][ T5025] do_user_addr_fault+0x2e7/0xfe0
[ 70.431054][ T5025] exc_page_fault+0x5c/0xd0
[ 70.435581][ T5025] asm_exc_page_fault+0x26/0x30
[ 70.440447][ T5025] page last free stack trace:
[ 70.445113][ T5025] free_unref_page_prepare+0x508/0xb90
[ 70.450598][ T5025] free_unref_page_list+0xe6/0xb30
[ 70.455727][ T5025] release_pages+0x32a/0x14e0
[ 70.460413][ T5025] tlb_batch_pages_flush+0x9a/0x190
[ 70.465632][ T5025] tlb_finish_mmu+0x14b/0x6f0
[ 70.470336][ T5025] unmap_region.constprop.0+0x2e6/0x3b0
[ 70.475910][ T5025] do_vmi_align_munmap+0xde3/0x15f0
[ 70.481122][ T5025] do_vmi_munmap+0x20e/0x450
[ 70.485738][ T5025] __vm_munmap+0x144/0x390
[ 70.490184][ T5025] __x64_sys_munmap+0x62/0x80
[ 70.494890][ T5025] do_syscall_64+0x38/0xb0
[ 70.499333][ T5025] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 70.505266][ T5025]
[ 70.507593][ T5025] Memory state around the buggy address:
[ 70.513225][ T5025] ffff888073f80f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 70.521317][ T5025] ffff888073f80f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 70.529387][ T5025] >ffff888073f81000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 70.537454][ T5025] ^
[ 70.541520][ T5025] ffff888073f81080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 70.549604][ T5025] ffff888073f81100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 70.557700][ T5025] ==================================================================
[ 70.566516][ T5025] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 70.573750][ T5025] CPU: 0 PID: 5025 Comm: syz-executor123 Not tainted 6.5.0-rc4-next-20230802-syzkaller #0
[ 70.583838][ T5025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
[ 70.593911][ T5025] Call Trace:
[ 70.597202][ T5025]
[ 70.600148][ T5025] dump_stack_lvl+0xd9/0x1b0
[ 70.604771][ T5025] panic+0x6a4/0x750
[ 70.608693][ T5025] ? panic_smp_self_stop+0xa0/0xa0
[ 70.613831][ T5025] ? trace_irq_enable.constprop.0+0xd0/0x100
[ 70.619838][ T5025] ? preempt_schedule_thunk+0x1a/0x30
[ 70.625247][ T5025] ? preempt_schedule_common+0x45/0xc0
[ 70.630755][ T5025] check_panic_on_warn+0xab/0xb0
[ 70.635725][ T5025] end_report+0x108/0x150
[ 70.640090][ T5025] kasan_report+0xea/0x110
[ 70.644539][ T5025] ? crc_itu_t+0xd7/0xe0
[ 70.648841][ T5025] ? crc_itu_t+0xd7/0xe0
[ 70.653121][ T5025] crc_itu_t+0xd7/0xe0
[ 70.657224][ T5025] udf_finalize_lvid+0xf2/0x1f0
[ 70.662105][ T5025] ? udf_mount+0x40/0x40
[ 70.666374][ T5025] udf_sync_fs+0xea/0x150
[ 70.670743][ T5025] ? udf_finalize_lvid+0x1f0/0x1f0
[ 70.675879][ T5025] sync_filesystem+0x109/0x280
[ 70.680680][ T5025] generic_shutdown_super+0x74/0x480
[ 70.685997][ T5025] kill_block_super+0x3b/0xc0
[ 70.690697][ T5025] deactivate_locked_super+0x9a/0x170
[ 70.696096][ T5025] deactivate_super+0xde/0x100
[ 70.700936][ T5025] cleanup_mnt+0x222/0x3d0
[ 70.705390][ T5025] task_work_run+0x14d/0x240
[ 70.710017][ T5025] ? task_work_cancel+0x30/0x30
[ 70.714904][ T5025] ptrace_notify+0x10c/0x130
[ 70.719513][ T5025] syscall_exit_to_user_mode_prepare+0x120/0x220
[ 70.725865][ T5025] syscall_exit_to_user_mode+0xd/0x50
[ 70.731281][ T5025] do_syscall_64+0x44/0xb0
[ 70.735729][ T5025] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 70.741651][ T5025] RIP: 0033:0x7fd2fa3f2807
[ 70.746081][ T5025] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 70.765725][ T5025] RSP: 002b:00007ffe32361c98 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 70.774155][ T5025] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd2fa3f2807
[ 70.782145][ T5025] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffe32361d50
[ 70.790130][ T5025] RBP: 00007ffe32361d50 R08: 0000000000000000 R09: 0000000000000000
[ 70.798114][ T5025] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffe32362dc0
[ 70.806100][ T5025] R13: 0000555556e646c0 R14: 431bde82d7b634db R15: 00007ffe32362de0
[ 70.814185][ T5025]
[ 70.817429][ T5025] Kernel Offset: disabled
[ 70.821757][ T5025] Rebooting in 86400 seconds..