./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2886650186

<...>
Warning: Permanently added '10.128.10.7' (ED25519) to the list of known hosts.
execve("./syz-executor2886650186", ["./syz-executor2886650186"], 0x7ffcafd32170 /* 10 vars */) = 0
brk(NULL)                               = 0x5555564d4000
brk(0x5555564d4d00)                     = 0x5555564d4d00
arch_prctl(ARCH_SET_FS, 0x5555564d4380) = 0
set_tid_address(0x5555564d4650)         = 5029
set_robust_list(0x5555564d4660, 24)     = 0
rseq(0x5555564d4ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2886650186", 4096) = 28
getrandom("\x25\x2a\xb4\xf8\x0b\xfe\xd6\x71", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555564d4d00
brk(0x5555564f5d00)                     = 0x5555564f5d00
brk(0x5555564f6000)                     = 0x5555564f6000
mprotect(0x7fa11fc29000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0)            = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa117773000
[   58.678642][ T5029] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5029 'syz-executor288'
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
munmap(0x7fa117773000, 16777216)        = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 4
ioctl(4, LOOP_SET_FD, 3)                = 0
close(3)                                = 0
mkdir("./file0", 0777)                  = 0
mount("/dev/loop0", "./file0", "jfs", MS_REC, "") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0")                        = 0
ioctl(4, LOOP_CLR_FD)                   = 0
close(4)                                = 0
[   58.822679][ T5029] loop0: detected capacity change from 0 to 32768
[   58.846846][ T5029] ==================================================================
[   58.854974][ T5029] BUG: KASAN: slab-use-after-free in dbAllocBits+0x617/0x630
[   58.862358][ T5029] Read of size 8 at addr ffff888076c01eb8 by task syz-executor288/5029
[   58.870612][ T5029] 
[   58.872934][ T5029] CPU: 1 PID: 5029 Comm: syz-executor288 Not tainted 6.5.0-rc4-next-20230803-syzkaller #0
[   58.882833][ T5029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
[   58.892902][ T5029] Call Trace:
[   58.896195][ T5029]  <TASK>
[   58.899318][ T5029]  dump_stack_lvl+0xd9/0x1b0
[   58.903954][ T5029]  print_report+0xc4/0x620
[   58.908427][ T5029]  ? __virt_addr_valid+0x5e/0x2d0
[   58.913503][ T5029]  ? __phys_addr+0xc6/0x140
[   58.918058][ T5029]  kasan_report+0xda/0x110
[   58.922511][ T5029]  ? dbAllocBits+0x617/0x630
[   58.927114][ T5029]  ? dbAllocBits+0x617/0x630
[   58.931725][ T5029]  dbAllocBits+0x617/0x630
[   58.936155][ T5029]  dbAllocDmap+0x5c/0x100
[   58.940497][ T5029]  dbAlloc+0x780/0xaa0
[   58.944598][ T5029]  ea_get+0xc0d/0x12c0
[   58.948720][ T5029]  ? ea_release+0x220/0x220
[   58.953259][ T5029]  __jfs_setxattr+0x1ed/0x1050
[   58.958056][ T5029]  ? ea_write+0xd00/0xd00
[   58.962418][ T5029]  ? posix_acl_to_xattr+0x2cb/0x380
[   58.967643][ T5029]  __jfs_set_acl+0x110/0x1a0
[   58.972267][ T5029]  jfs_set_acl+0x252/0x330
[   58.976712][ T5029]  ? jfs_get_acl+0x160/0x160
[   58.981331][ T5029]  ? make_vfsuid+0x108/0x160
[   58.985939][ T5029]  ? fscontext_read+0x70/0x2e0
[   58.990735][ T5029]  ? __sanitizer_cov_trace_switch+0x54/0x90
[   58.996679][ T5029]  ? posix_acl_valid+0x2f2/0x340
[   59.001664][ T5029]  set_posix_acl+0x259/0x320
[   59.006276][ T5029]  vfs_set_acl+0x539/0x900
[   59.010731][ T5029]  do_set_acl+0xda/0x1b0
[   59.014998][ T5029]  do_setxattr+0xeb/0x170
[   59.019371][ T5029]  setxattr+0x159/0x170
[   59.023566][ T5029]  ? do_setxattr+0x170/0x170
[   59.028209][ T5029]  ? __mnt_want_write+0x217/0x300
[   59.033435][ T5029]  path_setxattr+0x1a3/0x1d0
[   59.038058][ T5029]  ? setxattr+0x170/0x170
[   59.042424][ T5029]  ? trace_irq_enable.constprop.0+0xd0/0x100
[   59.048426][ T5029]  __x64_sys_lsetxattr+0xc1/0x160
[   59.053482][ T5029]  do_syscall_64+0x38/0xb0
[   59.057925][ T5029]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   59.063846][ T5029] RIP: 0033:0x7fa11fbb0679
[   59.068277][ T5029] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   59.087901][ T5029] RSP: 002b:00007ffdaeb69408 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
[   59.096349][ T5029] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fa11fbb0679
[   59.104334][ T5029] RDX: 0000000020000180 RSI: 0000000020000040 RDI: 0000000020000000
[   59.112317][ T5029] RBP: 00007fa11fc29610 R08: 0000000000000000 R09: 0000000000000000
[   59.120391][ T5029] R10: 0000000000000024 R11: 0000000000000246 R12: 0000000000000001
[   59.128374][ T5029] R13: 00007ffdaeb695d8 R14: 0000000000000001 R15: 0000000000000001
[   59.136366][ T5029]  </TASK>
[   59.139392][ T5029] 
[   59.141721][ T5029] Allocated by task 4484:
[   59.146049][ T5029]  kasan_save_stack+0x33/0x50
[   59.150752][ T5029]  kasan_set_track+0x25/0x30
[   59.155392][ T5029]  __kasan_slab_alloc+0x81/0x90
[   59.160271][ T5029]  kmem_cache_alloc+0x172/0x3b0
[   59.165147][ T5029]  getname_flags.part.0+0x50/0x4d0
[   59.170279][ T5029]  getname+0x90/0xe0
[   59.174199][ T5029]  do_sys_openat2+0x100/0x1e0
[   59.178906][ T5029]  __x64_sys_openat+0x175/0x210
[   59.183786][ T5029]  do_syscall_64+0x38/0xb0
[   59.188243][ T5029]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   59.194170][ T5029] 
[   59.196508][ T5029] Freed by task 4484:
[   59.200495][ T5029]  kasan_save_stack+0x33/0x50
[   59.205214][ T5029]  kasan_set_track+0x25/0x30
[   59.209855][ T5029]  kasan_save_free_info+0x2b/0x40
[   59.214902][ T5029]  ____kasan_slab_free+0x15e/0x1b0
[   59.220047][ T5029]  slab_free_freelist_hook+0x114/0x1e0
[   59.225536][ T5029]  kmem_cache_free+0xf0/0x490
[   59.230246][ T5029]  putname+0x101/0x140
[   59.234336][ T5029]  do_sys_openat2+0x15c/0x1e0
[   59.239044][ T5029]  __x64_sys_openat+0x175/0x210
[   59.243925][ T5029]  do_syscall_64+0x38/0xb0
[   59.248364][ T5029]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   59.254288][ T5029] 
[   59.256615][ T5029] The buggy address belongs to the object at ffff888076c01100
[   59.256615][ T5029]  which belongs to the cache names_cache of size 4096
[   59.270763][ T5029] The buggy address is located 3512 bytes inside of
[   59.270763][ T5029]  freed 4096-byte region [ffff888076c01100, ffff888076c02100)
[   59.284756][ T5029] 
[   59.287098][ T5029] The buggy address belongs to the physical page:
[   59.293509][ T5029] page:ffffea0001db0000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76c00
[   59.303680][ T5029] head:ffffea0001db0000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   59.312620][ T5029] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   59.320621][ T5029] page_type: 0xffffffff()
[   59.324981][ T5029] raw: 00fff00000010200 ffff888014a44780 dead000000000122 0000000000000000
[   59.333610][ T5029] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
[   59.342260][ T5029] page dumped because: kasan: bad access detected
[   59.348699][ T5029] page_owner tracks the page as allocated
[   59.354425][ T5029] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4484, tgid 4484 (udevd), ts 38584697194, free_ts 38575567893
[   59.375288][ T5029]  post_alloc_hook+0x2d2/0x350
[   59.380097][ T5029]  get_page_from_freelist+0x10d7/0x31b0
[   59.385684][ T5029]  __alloc_pages+0x1d0/0x4a0
[   59.390296][ T5029]  alloc_pages+0x1a9/0x270
[   59.394743][ T5029]  allocate_slab+0x24e/0x380
[   59.399355][ T5029]  ___slab_alloc+0x8bc/0x1570
[   59.404056][ T5029]  __slab_alloc.constprop.0+0x56/0xa0
[   59.409476][ T5029]  kmem_cache_alloc+0x392/0x3b0
[   59.414350][ T5029]  getname_flags.part.0+0x50/0x4d0
[   59.419480][ T5029]  getname+0x90/0xe0
[   59.423402][ T5029]  do_sys_openat2+0x100/0x1e0
[   59.428105][ T5029]  __x64_sys_openat+0x175/0x210
[   59.432995][ T5029]  do_syscall_64+0x38/0xb0
[   59.437438][ T5029]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   59.443357][ T5029] page last free stack trace:
[   59.448033][ T5029]  free_unref_page_prepare+0x508/0xb90
[   59.453521][ T5029]  free_unref_page+0x33/0x3b0
[   59.458230][ T5029]  __unfreeze_partials+0x21d/0x240
[   59.463368][ T5029]  qlist_free_all+0x6a/0x170
[   59.467974][ T5029]  kasan_quarantine_reduce+0x18b/0x1d0
[   59.473448][ T5029]  __kasan_slab_alloc+0x65/0x90
[   59.478328][ T5029]  kmem_cache_alloc+0x172/0x3b0
[   59.483209][ T5029]  alloc_empty_file+0x73/0x1d0
[   59.487994][ T5029]  path_openat+0xdc/0x29c0
[   59.492433][ T5029]  do_filp_open+0x1de/0x430
[   59.496962][ T5029]  do_sys_openat2+0x176/0x1e0
[   59.501685][ T5029]  __x64_sys_openat+0x175/0x210
[   59.506572][ T5029]  do_syscall_64+0x38/0xb0
[   59.511008][ T5029]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   59.516941][ T5029] 
[   59.519269][ T5029] Memory state around the buggy address:
[   59.524902][ T5029]  ffff888076c01d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.532973][ T5029]  ffff888076c01e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.541044][ T5029] >ffff888076c01e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.549114][ T5029]                                         ^
[   59.555012][ T5029]  ffff888076c01f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.563084][ T5029]  ffff888076c01f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   59.571154][ T5029] ==================================================================
[   59.579636][ T5029] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   59.586871][ T5029] CPU: 1 PID: 5029 Comm: syz-executor288 Not tainted 6.5.0-rc4-next-20230803-syzkaller #0
[   59.596810][ T5029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
[   59.606868][ T5029] Call Trace:
[   59.610142][ T5029]  <TASK>
[   59.613074][ T5029]  dump_stack_lvl+0xd9/0x1b0
[   59.617682][ T5029]  panic+0x6a4/0x750
[   59.621604][ T5029]  ? panic_smp_self_stop+0xa0/0xa0
[   59.626727][ T5029]  ? trace_irq_enable.constprop.0+0xd0/0x100
[   59.632716][ T5029]  ? preempt_schedule_thunk+0x1a/0x30
[   59.638110][ T5029]  ? preempt_schedule_common+0x45/0xc0
[   59.643611][ T5029]  check_panic_on_warn+0xab/0xb0
[   59.648605][ T5029]  end_report+0x108/0x150
[   59.652955][ T5029]  kasan_report+0xea/0x110
[   59.657395][ T5029]  ? dbAllocBits+0x617/0x630
[   59.661994][ T5029]  ? dbAllocBits+0x617/0x630
[   59.666596][ T5029]  dbAllocBits+0x617/0x630
[   59.671020][ T5029]  dbAllocDmap+0x5c/0x100
[   59.675356][ T5029]  dbAlloc+0x780/0xaa0
[   59.679433][ T5029]  ea_get+0xc0d/0x12c0
[   59.683516][ T5029]  ? ea_release+0x220/0x220
[   59.688045][ T5029]  __jfs_setxattr+0x1ed/0x1050
[   59.692846][ T5029]  ? ea_write+0xd00/0xd00
[   59.697202][ T5029]  ? posix_acl_to_xattr+0x2cb/0x380
[   59.702428][ T5029]  __jfs_set_acl+0x110/0x1a0
[   59.707051][ T5029]  jfs_set_acl+0x252/0x330
[   59.711492][ T5029]  ? jfs_get_acl+0x160/0x160
[   59.716111][ T5029]  ? make_vfsuid+0x108/0x160
[   59.720715][ T5029]  ? fscontext_read+0x70/0x2e0
[   59.725507][ T5029]  ? __sanitizer_cov_trace_switch+0x54/0x90
[   59.731439][ T5029]  ? posix_acl_valid+0x2f2/0x340
[   59.736398][ T5029]  set_posix_acl+0x259/0x320
[   59.741009][ T5029]  vfs_set_acl+0x539/0x900
[   59.745447][ T5029]  do_set_acl+0xda/0x1b0
[   59.749709][ T5029]  do_setxattr+0xeb/0x170
[   59.754072][ T5029]  setxattr+0x159/0x170
[   59.758267][ T5029]  ? do_setxattr+0x170/0x170
[   59.762909][ T5029]  ? __mnt_want_write+0x217/0x300
[   59.767972][ T5029]  path_setxattr+0x1a3/0x1d0
[   59.772593][ T5029]  ? setxattr+0x170/0x170
[   59.776962][ T5029]  ? trace_irq_enable.constprop.0+0xd0/0x100
[   59.782966][ T5029]  __x64_sys_lsetxattr+0xc1/0x160
[   59.788029][ T5029]  do_syscall_64+0x38/0xb0
[   59.792481][ T5029]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   59.798405][ T5029] RIP: 0033:0x7fa11fbb0679
[   59.802830][ T5029] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   59.822454][ T5029] RSP: 002b:00007ffdaeb69408 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
[   59.830883][ T5029] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fa11fbb0679
[   59.838872][ T5029] RDX: 0000000020000180 RSI: 0000000020000040 RDI: 0000000020000000
[   59.846873][ T5029] RBP: 00007fa11fc29610 R08: 0000000000000000 R09: 0000000000000000
[   59.854854][ T5029] R10: 0000000000000024 R11: 0000000000000246 R12: 0000000000000001
[   59.862834][ T5029] R13: 00007ffdaeb695d8 R14: 0000000000000001 R15: 0000000000000001
[   59.870822][ T5029]  </TASK>
[   59.874095][ T5029] Kernel Offset: disabled
[   59.878417][ T5029] Rebooting in 86400 seconds..