./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3308382311

<...>
Warning: Permanently added '10.128.1.215' (ED25519) to the list of known hosts.
execve("./syz-executor3308382311", ["./syz-executor3308382311"], 0x7fff3fbaf4d0 /* 10 vars */) = 0
brk(NULL)                               = 0x55556325a000
brk(0x55556325ad00)                     = 0x55556325ad00
arch_prctl(ARCH_SET_FS, 0x55556325a380) = 0
set_tid_address(0x55556325a650)         = 5831
set_robust_list(0x55556325a660, 24)     = 0
rseq(0x55556325aca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3308382311", 4096) = 28
getrandom("\x02\x07\xb0\x55\xd8\x0c\xe3\x83", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55556325ad00
brk(0x55556327bd00)                     = 0x55556327bd00
brk(0x55556327c000)                     = 0x55556327c000
mprotect(0x7f46f3cf2000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5832 attached
 <unfinished ...>
[pid  5832] set_robust_list(0x55556325a660, 24) = 0
[pid  5832] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5831] <... clone resumed>, child_tidptr=0x55556325a650) = 5832
[pid  5832] <... prctl resumed>)        = 0
[pid  5832] setpgid(0, 0)               = 0
[pid  5832] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5832] write(3, "1000", 4)         = 4
[pid  5832] close(3)                    = 0
[pid  5832] write(1, "executing program\n", 18executing program
) = 18
[pid  5832] memfd_create("syzkaller", 0) = 3
[pid  5832] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f46eb800000
[pid  5832] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
[pid  5832] munmap(0x7f46eb800000, 138412032) = 0
[pid  5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5832] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5832] close(3)                    = 0
[pid  5832] close(4)                    = 0
[pid  5832] mkdir("./file0", 0777)      = 0
[   72.895950][ T5832] loop0: detected capacity change from 0 to 8192
[   72.943384][ T5832] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[   72.956687][ T5832] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal
[   72.966919][ T5832] REISERFS (device loop0): using ordered data mode
[   72.973459][ T5832] reiserfs: using flush barriers
[   72.980049][ T5832] REISERFS (device loop0): journal params: device ram0, size 127, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30
[   72.996744][ T5832] REISERFS (device loop0): checking transaction log (ram0)
[   73.014747][ T5832] ==================================================================
[   73.022932][ T5832] BUG: KASAN: use-after-free in reiserfs_read_locked_inode+0x20db/0x29b0
[   73.031387][ T5832] Read of size 4 at addr ffff888072f1c000 by task syz-executor330/5832
[   73.039626][ T5832] 
[   73.041964][ T5832] CPU: 1 UID: 0 PID: 5832 Comm: syz-executor330 Not tainted 6.12.0-rc6-syzkaller #0
[   73.051359][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   73.061438][ T5832] Call Trace:
[   73.064729][ T5832]  <TASK>
[   73.067663][ T5832]  dump_stack_lvl+0x241/0x360
[   73.072367][ T5832]  ? __pfx_dump_stack_lvl+0x10/0x10
[   73.077572][ T5832]  ? __pfx__printk+0x10/0x10
[   73.082171][ T5832]  ? _printk+0xd5/0x120
[   73.086345][ T5832]  ? __virt_addr_valid+0x183/0x530
[   73.091463][ T5832]  ? __virt_addr_valid+0x183/0x530
[   73.096575][ T5832]  print_report+0x169/0x550
[   73.101090][ T5832]  ? __virt_addr_valid+0x183/0x530
[   73.106212][ T5832]  ? __virt_addr_valid+0x183/0x530
[   73.111336][ T5832]  ? __virt_addr_valid+0x45f/0x530
[   73.116463][ T5832]  ? __phys_addr+0xba/0x170
[   73.120977][ T5832]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   73.127064][ T5832]  kasan_report+0x143/0x180
[   73.131588][ T5832]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   73.137674][ T5832]  reiserfs_read_locked_inode+0x20db/0x29b0
[   73.143584][ T5832]  ? __pfx_lock_release+0x10/0x10
[   73.148622][ T5832]  ? __pfx_reiserfs_read_locked_inode+0x10/0x10
[   73.154881][ T5832]  ? _raw_spin_unlock+0x28/0x50
[   73.159744][ T5832]  ? __pfx_reiserfs_init_locked_inode+0x10/0x10
[   73.166022][ T5832]  reiserfs_fill_super+0x1361/0x2640
[   73.171326][ T5832]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   73.176972][ T5832]  ? do_raw_spin_lock+0x14f/0x370
[   73.182011][ T5832]  ? __pfx_snprintf+0x10/0x10
[   73.186702][ T5832]  ? set_blocksize+0x1f9/0x360
[   73.191486][ T5832]  ? sb_set_blocksize+0x98/0xf0
[   73.196347][ T5832]  ? setup_bdev_super+0x4e6/0x5d0
[   73.201388][ T5832]  mount_bdev+0x20a/0x2d0
[   73.205761][ T5832]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   73.211411][ T5832]  ? __pfx_mount_bdev+0x10/0x10
[   73.216274][ T5832]  ? vfs_parse_fs_string+0x190/0x230
[   73.221575][ T5832]  ? __pfx_vfs_parse_fs_string+0x10/0x10
[   73.227222][ T5832]  legacy_get_tree+0xee/0x190
[   73.231947][ T5832]  ? __pfx_get_super_block+0x10/0x10
[   73.237243][ T5832]  vfs_get_tree+0x90/0x2b0
[   73.241672][ T5832]  do_new_mount+0x2be/0xb40
[   73.246192][ T5832]  ? __pfx_do_new_mount+0x10/0x10
[   73.251234][ T5832]  __se_sys_mount+0x2d6/0x3c0
[   73.255943][ T5832]  ? __pfx___se_sys_mount+0x10/0x10
[   73.261156][ T5832]  ? do_syscall_64+0x100/0x230
[   73.265931][ T5832]  ? __x64_sys_mount+0x20/0xc0
[   73.270729][ T5832]  do_syscall_64+0xf3/0x230
[   73.275256][ T5832]  ? clear_bhb_loop+0x35/0x90
[   73.279952][ T5832]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   73.285883][ T5832] RIP: 0033:0x7f46f3c7fdba
[   73.290321][ T5832] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   73.310031][ T5832] RSP: 002b:00007ffd30201748 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   73.318473][ T5832] RAX: ffffffffffffffda RBX: 00007ffd30201760 RCX: 00007f46f3c7fdba
[   73.326461][ T5832] RDX: 0000000020001100 RSI: 0000000020001140 RDI: 00007ffd30201760
[   73.334453][ T5832] RBP: 0000000000000004 R08: 00007ffd302017a0 R09: 00000000000010e2
[   73.342442][ T5832] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
[   73.350422][ T5832] R13: 00007ffd302017a0 R14: 0000000000000003 R15: 0000000000400000
[   73.358410][ T5832]  </TASK>
[   73.361435][ T5832] 
[   73.363813][ T5832] The buggy address belongs to the physical page:
[   73.370234][ T5832] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f264afca pfn:0x72f1c
[   73.379717][ T5832] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   73.386887][ T5832] raw: 00fff00000000000 ffffea0001cbc748 ffff8880b8744af0 0000000000000000
[   73.395488][ T5832] raw: 00000007f264afca 0000000000000000 00000000ffffffff 0000000000000000
[   73.404078][ T5832] page dumped because: kasan: bad access detected
[   73.410498][ T5832] page_owner tracks the page as freed
[   73.415865][ T5832] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5820, tgid 5820 (sshd), ts 66309989258, free_ts 66414819063
[   73.433849][ T5832]  post_alloc_hook+0x1f3/0x230
[   73.438644][ T5832]  get_page_from_freelist+0x3033/0x3180
[   73.444228][ T5832]  __alloc_pages_noprof+0x292/0x710
[   73.449440][ T5832]  alloc_pages_mpol_noprof+0x3e8/0x680
[   73.454936][ T5832]  vma_alloc_folio_noprof+0x12e/0x230
[   73.460316][ T5832]  folio_prealloc+0x31/0x170
[   73.464917][ T5832]  handle_pte_fault+0x24dd/0x6820
[   73.469957][ T5832]  handle_mm_fault+0x1053/0x1ad0
[   73.474902][ T5832]  exc_page_fault+0x459/0x8c0
[   73.479611][ T5832]  asm_exc_page_fault+0x26/0x30
[   73.484482][ T5832] page last free pid 5820 tgid 5820 stack trace:
[   73.490813][ T5832]  free_unref_folios+0xee2/0x18a0
[   73.495854][ T5832]  folios_put_refs+0x76c/0x860
[   73.500627][ T5832]  free_pages_and_swap_cache+0x2ea/0x690
[   73.506275][ T5832]  tlb_flush_mmu+0x3a3/0x680
[   73.510878][ T5832]  tlb_finish_mmu+0xd4/0x200
[   73.515487][ T5832]  vms_clear_ptes+0x437/0x530
[   73.520181][ T5832]  vms_complete_munmap_vmas+0x208/0x910
[   73.525747][ T5832]  do_vmi_align_munmap+0x613/0x730
[   73.530890][ T5832]  do_vmi_munmap+0x24e/0x2d0
[   73.535580][ T5832]  __vm_munmap+0x24c/0x480
[   73.540012][ T5832]  __x64_sys_munmap+0x60/0x70
[   73.544701][ T5832]  do_syscall_64+0xf3/0x230
[   73.549211][ T5832]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   73.555116][ T5832] 
[   73.557443][ T5832] Memory state around the buggy address:
[   73.563075][ T5832]  ffff888072f1bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   73.571150][ T5832]  ffff888072f1bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   73.579229][ T5832] >ffff888072f1c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   73.587307][ T5832]                    ^
[   73.591384][ T5832]  ffff888072f1c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   73.599470][ T5832]  ffff888072f1c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   73.607536][ T5832] ==================================================================
[   73.615946][ T5832] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   73.623185][ T5832] CPU: 1 UID: 0 PID: 5832 Comm: syz-executor330 Not tainted 6.12.0-rc6-syzkaller #0
[   73.632639][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   73.642705][ T5832] Call Trace:
[   73.645990][ T5832]  <TASK>
[   73.648924][ T5832]  dump_stack_lvl+0x241/0x360
[   73.653615][ T5832]  ? __pfx_dump_stack_lvl+0x10/0x10
[   73.658820][ T5832]  ? __pfx__printk+0x10/0x10
[   73.663416][ T5832]  ? preempt_schedule+0xe1/0xf0
[   73.668274][ T5832]  ? vscnprintf+0x5d/0x90
[   73.672624][ T5832]  panic+0x349/0x880
[   73.676562][ T5832]  ? check_panic_on_warn+0x21/0xb0
[   73.681705][ T5832]  ? __pfx_panic+0x10/0x10
[   73.686142][ T5832]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   73.692138][ T5832]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   73.698470][ T5832]  ? print_report+0x502/0x550
[   73.703164][ T5832]  check_panic_on_warn+0x86/0xb0
[   73.708113][ T5832]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   73.714197][ T5832]  end_report+0x77/0x160
[   73.718455][ T5832]  kasan_report+0x154/0x180
[   73.722973][ T5832]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   73.729056][ T5832]  reiserfs_read_locked_inode+0x20db/0x29b0
[   73.734974][ T5832]  ? __pfx_lock_release+0x10/0x10
[   73.740032][ T5832]  ? __pfx_reiserfs_read_locked_inode+0x10/0x10
[   73.746292][ T5832]  ? _raw_spin_unlock+0x28/0x50
[   73.751148][ T5832]  ? __pfx_reiserfs_init_locked_inode+0x10/0x10
[   73.757407][ T5832]  reiserfs_fill_super+0x1361/0x2640
[   73.762710][ T5832]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   73.768355][ T5832]  ? do_raw_spin_lock+0x14f/0x370
[   73.773393][ T5832]  ? __pfx_snprintf+0x10/0x10
[   73.778089][ T5832]  ? set_blocksize+0x1f9/0x360
[   73.782870][ T5832]  ? sb_set_blocksize+0x98/0xf0
[   73.787730][ T5832]  ? setup_bdev_super+0x4e6/0x5d0
[   73.792765][ T5832]  mount_bdev+0x20a/0x2d0
[   73.797113][ T5832]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   73.802756][ T5832]  ? __pfx_mount_bdev+0x10/0x10
[   73.807614][ T5832]  ? vfs_parse_fs_string+0x190/0x230
[   73.812907][ T5832]  ? __pfx_vfs_parse_fs_string+0x10/0x10
[   73.818552][ T5832]  legacy_get_tree+0xee/0x190
[   73.823244][ T5832]  ? __pfx_get_super_block+0x10/0x10
[   73.828569][ T5832]  vfs_get_tree+0x90/0x2b0
[   73.832997][ T5832]  do_new_mount+0x2be/0xb40
[   73.837515][ T5832]  ? __pfx_do_new_mount+0x10/0x10
[   73.842574][ T5832]  __se_sys_mount+0x2d6/0x3c0
[   73.847270][ T5832]  ? __pfx___se_sys_mount+0x10/0x10
[   73.852506][ T5832]  ? do_syscall_64+0x100/0x230
[   73.857281][ T5832]  ? __x64_sys_mount+0x20/0xc0
[   73.862062][ T5832]  do_syscall_64+0xf3/0x230
[   73.866581][ T5832]  ? clear_bhb_loop+0x35/0x90
[   73.871295][ T5832]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   73.877221][ T5832] RIP: 0033:0x7f46f3c7fdba
[   73.881654][ T5832] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   73.901287][ T5832] RSP: 002b:00007ffd30201748 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   73.909738][ T5832] RAX: ffffffffffffffda RBX: 00007ffd30201760 RCX: 00007f46f3c7fdba
[   73.917911][ T5832] RDX: 0000000020001100 RSI: 0000000020001140 RDI: 00007ffd30201760
[   73.925906][ T5832] RBP: 0000000000000004 R08: 00007ffd302017a0 R09: 00000000000010e2
[   73.933906][ T5832] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
[   73.941908][ T5832] R13: 00007ffd302017a0 R14: 0000000000000003 R15: 0000000000400000
[   73.949900][ T5832]  </TASK>
[   73.953313][ T5832] Kernel Offset: disabled
[   73.957664][ T5832] Rebooting in 86400 seconds..