./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2016834123 <...> Warning: Permanently added '10.128.0.44' (ED25519) to the list of known hosts. execve("./syz-executor2016834123", ["./syz-executor2016834123"], 0x7ffd34c12280 /* 10 vars */) = 0 brk(NULL) = 0x555556703000 brk(0x555556703d00) = 0x555556703d00 arch_prctl(ARCH_SET_FS, 0x555556703380) = 0 set_tid_address(0x555556703650) = 5032 set_robust_list(0x555556703660, 24) = 0 rseq(0x555556703ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2016834123", 4096) = 28 getrandom("\x14\x75\xa0\x7e\x03\x26\x6e\xcd", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556703d00 brk(0x555556724d00) = 0x555556724d00 brk(0x555556725000) = 0x555556725000 mprotect(0x7f68753b4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f686cf03000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f686cf03000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 54.687750][ T5032] syz-executor201[5032]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 54.737977][ T5032] loop0: detected capacity change from 0 to 8192 [ 54.749476][ T5032] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 54.762559][ T5032] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 54.771781][ T5032] REISERFS (device loop0): using ordered data mode [ 54.778304][ T5032] reiserfs: using flush barriers [ 54.784364][ T5032] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 54.800940][ T5032] REISERFS (device loop0): checking transaction log (loop0) mount("/dev/loop0", "./file0", "reiserfs", MS_DIRSYNC, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 open("./file0", O_WRONLY|O_CREAT|O_TRUNC|O_APPEND|O_NOFOLLOW|O_NOATIME|FASYNC, 000) = 4 write(4, " ./bus/f", 8) = 8 open("./bus", O_RDWR|O_CREAT|O_SYNC|O_DIRECT|O_NOATIME|FASYNC, 000) = 5 [ 54.849205][ T5032] REISERFS (device loop0): Using r5 hash to sort names [ 54.856289][ T5032] REISERFS (device loop0): using 3.5.x disk format [ 54.863649][ T5032] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 54.892371][ T28] audit: type=1800 audit(1697365139.916:2): pid=5032 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor201" name="bus" dev="loop0" ino=3 res=0 errno=0 [ 54.897460][ T5032] ================================================================== [ 54.920073][ T5032] BUG: KASAN: out-of-bounds in leaf_paste_in_buffer+0x1bc/0xab0 [ 54.927742][ T5032] Read of size 18446744073709551305 at addr ffff88807d5fa000 by task syz-executor201/5032 [ 54.937610][ T5032] [ 54.939919][ T5032] CPU: 0 PID: 5032 Comm: syz-executor201 Not tainted 6.6.0-rc5-syzkaller-00250-g70f8c6f8f880 #0 [ 54.950306][ T5032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 54.960692][ T5032] Call Trace: [ 54.963960][ T5032] [ 54.966875][ T5032] dump_stack_lvl+0x1e7/0x2d0 [ 54.971534][ T5032] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.976973][ T5032] ? panic+0x770/0x770 [ 54.981032][ T5032] ? _printk+0xd5/0x120 [ 54.985172][ T5032] print_report+0x163/0x540 [ 54.989661][ T5032] ? __virt_addr_valid+0x22f/0x2e0 [ 54.994752][ T5032] ? __phys_addr+0xba/0x170 [ 54.999239][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.004605][ T5032] kasan_report+0x175/0x1b0 [ 55.009108][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.014471][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.019831][ T5032] kasan_check_range+0x27e/0x290 [ 55.024770][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.030139][ T5032] __asan_memmove+0x29/0x70 [ 55.034638][ T5032] leaf_paste_in_buffer+0x1bc/0xab0 [ 55.039832][ T5032] balance_leaf+0x6680/0x12510 [ 55.044595][ T5032] ? print_irqtrace_events+0x220/0x220 [ 55.050048][ T5032] ? do_balance+0x8f0/0x8f0 [ 55.054543][ T5032] ? write_boundary_block+0xb0/0xb0 [ 55.059726][ T5032] ? do_raw_spin_lock+0x14d/0x3a0 [ 55.064742][ T5032] ? __lock_acquire+0x7f70/0x7f70 [ 55.069757][ T5032] ? do_raw_spin_unlock+0x13b/0x8b0 [ 55.074950][ T5032] ? __getblk_gfp+0x581/0x630 [ 55.079621][ T5032] ? get_empty_nodes+0xadd/0xd70 [ 55.084556][ T5032] ? direntry_part_size+0xb4/0x1a0 [ 55.089666][ T5032] ? __wake_up+0x1d0/0x1d0 [ 55.094069][ T5032] ? get_neighbors+0x1010/0x1010 [ 55.099000][ T5032] ? is_leaf_removable+0x8c0/0x8c0 [ 55.104104][ T5032] ? get_neighbors+0x631/0x1010 [ 55.108950][ T5032] ? reiserfs_prepare_for_journal+0x26d/0x280 [ 55.115005][ T5032] ? fix_nodes+0x7b03/0x8ce0 [ 55.119594][ T5032] do_balance+0x30d/0x8f0 [ 55.123916][ T5032] ? get_right_neighbor_position+0x210/0x210 [ 55.129888][ T5032] ? reiserfs_paste_into_item+0x3f3/0x870 [ 55.135598][ T5032] reiserfs_paste_into_item+0x732/0x870 [ 55.141134][ T5032] ? reiserfs_cut_from_item+0x2580/0x2580 [ 55.146867][ T5032] ? reiserfs_get_block+0x19aa/0x5130 [ 55.152231][ T5032] ? rcu_is_watching+0x15/0xb0 [ 55.156983][ T5032] ? __kmalloc+0xe6/0x230 [ 55.161304][ T5032] reiserfs_get_block+0x2250/0x5130 [ 55.166510][ T5032] ? make_le_item_head+0x570/0x570 [ 55.171611][ T5032] ? do_truncate+0x220/0x300 [ 55.176192][ T5032] ? verify_lock_unused+0x140/0x140 [ 55.181397][ T5032] ? __lock_acquire+0x7f70/0x7f70 [ 55.186415][ T5032] ? _raw_spin_unlock+0x28/0x40 [ 55.191255][ T5032] ? folio_create_buffers+0x132/0x250 [ 55.196615][ T5032] __block_write_begin_int+0x54d/0x1ac0 [ 55.202155][ T5032] ? folio_add_lru+0x27b/0x9d0 [ 55.206912][ T5032] ? make_le_item_head+0x570/0x570 [ 55.212016][ T5032] ? folio_zero_new_buffers+0x530/0x530 [ 55.217554][ T5032] ? __block_write_begin+0x64/0x150 [ 55.222740][ T5032] reiserfs_write_begin+0x24d/0x520 [ 55.227927][ T5032] ? reiserfs_write_lock+0x7a/0xd0 [ 55.233033][ T5032] generic_cont_expand_simple+0x18b/0x2a0 [ 55.238740][ T5032] ? submit_bh+0x20/0x20 [ 55.242969][ T5032] ? smk_access+0x4ab/0x4e0 [ 55.247466][ T5032] reiserfs_setattr+0x57d/0x1140 [ 55.252395][ T5032] ? reiserfs_commit_write+0x5b0/0x5b0 [ 55.257848][ T5032] ? current_time+0x1e0/0x2b0 [ 55.262518][ T5032] ? inode_set_ctime_current+0x2f0/0x2f0 [ 55.268143][ T5032] ? evm_inode_setattr+0x100/0x740 [ 55.273246][ T5032] ? bpf_lsm_inode_setattr+0x9/0x10 [ 55.278434][ T5032] ? security_inode_setattr+0xd7/0x130 [ 55.283882][ T5032] ? reiserfs_commit_write+0x5b0/0x5b0 [ 55.289334][ T5032] notify_change+0xb99/0xe60 [ 55.293919][ T5032] do_truncate+0x220/0x300 [ 55.298326][ T5032] ? put_page_bootmem+0x2e0/0x2e0 [ 55.303344][ T5032] do_sys_ftruncate+0x2f3/0x390 [ 55.308186][ T5032] do_syscall_64+0x41/0xc0 [ 55.312593][ T5032] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.318474][ T5032] RIP: 0033:0x7f68753407b9 [ 55.322878][ T5032] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 55.342468][ T5032] RSP: 002b:00007fff8c1868a8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 55.350865][ T5032] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f68753407b9 [ 55.358821][ T5032] RDX: 00007f68753407b9 RSI: 0000000002007fff RDI: 0000000000000005 [ 55.366779][ T5032] RBP: 00007f68753b4610 R08: 00007fff8c186a78 R09: 00007fff8c186a78 [ 55.374735][ T5032] R10: 00007fff8c186a78 R11: 0000000000000246 R12: 0000000000000001 [ 55.382692][ T5032] R13: 00007fff8c186a68 R14: 0000000000000001 R15: 0000000000000001 [ 55.390652][ T5032] [ 55.393658][ T5032] [ 55.395969][ T5032] The buggy address belongs to the physical page: [ 55.402361][ T5032] page:ffffea0001f57e80 refcount:1 mapcount:1 mapping:0000000000000000 index:0x555aa06c3 pfn:0x7d5fa [ 55.413189][ T5032] memcg:ffff888014e4a000 [ 55.417411][ T5032] anon flags: 0xfff000000a0028(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x7ff) [ 55.428150][ T5032] page_type: 0x0() [ 55.431855][ T5032] raw: 00fff000000a0028 ffffea0001f57a88 ffffea0001ee2c08 ffff888013ed2111 [ 55.440422][ T5032] raw: 0000000555aa06c3 0000000000000000 0000000100000000 ffff888014e4a000 [ 55.448983][ T5032] page dumped because: kasan: bad access detected [ 55.455376][ T5032] page_owner tracks the page as allocated [ 55.461074][ T5032] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 4873, tgid 4873 (dhcpcd), ts 38691792131, free_ts 38683342879 [ 55.478247][ T5032] post_alloc_hook+0x1e6/0x210 [ 55.483003][ T5032] get_page_from_freelist+0x31db/0x3360 [ 55.488538][ T5032] __alloc_pages+0x255/0x670 [ 55.493117][ T5032] __folio_alloc+0x13/0x30 [ 55.497520][ T5032] vma_alloc_folio+0x48a/0x9a0 [ 55.502272][ T5032] do_wp_page+0x1456/0x4190 [ 55.506764][ T5032] handle_mm_fault+0x1b45/0x62b0 [ 55.511692][ T5032] exc_page_fault+0x455/0x860 [ 55.516356][ T5032] asm_exc_page_fault+0x26/0x30 [ 55.521193][ T5032] page last free stack trace: [ 55.525850][ T5032] free_unref_page_prepare+0x8c3/0x9f0 [ 55.531294][ T5032] free_unref_page_list+0x596/0x830 [ 55.536480][ T5032] release_pages+0x2113/0x23f0 [ 55.541228][ T5032] tlb_flush_mmu+0x34c/0x4e0 [ 55.545806][ T5032] tlb_finish_mmu+0xd4/0x1f0 [ 55.550381][ T5032] exit_mmap+0x4d3/0xc50 [ 55.554611][ T5032] __mmput+0x115/0x3c0 [ 55.558668][ T5032] exit_mm+0x21f/0x300 [ 55.562726][ T5032] do_exit+0x9af/0x2650 [ 55.566871][ T5032] do_group_exit+0x206/0x2c0 [ 55.571448][ T5032] __x64_sys_exit_group+0x3f/0x40 [ 55.576459][ T5032] do_syscall_64+0x41/0xc0 [ 55.580859][ T5032] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.586740][ T5032] [ 55.589051][ T5032] Memory state around the buggy address: [ 55.594660][ T5032] ffff88807d5f9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.602704][ T5032] ffff88807d5f9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.610746][ T5032] >ffff88807d5fa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.618788][ T5032] ^ [ 55.622835][ T5032] ffff88807d5fa080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.630882][ T5032] ffff88807d5fa100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.638923][ T5032] ================================================================== [ 55.647470][ T5032] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 55.654663][ T5032] CPU: 1 PID: 5032 Comm: syz-executor201 Not tainted 6.6.0-rc5-syzkaller-00250-g70f8c6f8f880 #0 [ 55.665320][ T5032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 55.675361][ T5032] Call Trace: [ 55.678629][ T5032] [ 55.681549][ T5032] dump_stack_lvl+0x1e7/0x2d0 [ 55.686221][ T5032] ? nf_tcp_handle_invalid+0x650/0x650 [ 55.691665][ T5032] ? panic+0x770/0x770 [ 55.695721][ T5032] ? preempt_schedule_common+0x83/0xc0 [ 55.701171][ T5032] ? vscnprintf+0x5d/0x80 [ 55.705493][ T5032] panic+0x30f/0x770 [ 55.709376][ T5032] ? check_panic_on_warn+0x21/0xa0 [ 55.714474][ T5032] ? __memcpy_flushcache+0x2b0/0x2b0 [ 55.719751][ T5032] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 55.725720][ T5032] ? _raw_spin_unlock+0x40/0x40 [ 55.730571][ T5032] ? print_report+0x4fb/0x540 [ 55.735252][ T5032] check_panic_on_warn+0x82/0xa0 [ 55.740181][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.745541][ T5032] end_report+0x6e/0x130 [ 55.749776][ T5032] kasan_report+0x186/0x1b0 [ 55.754271][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.759628][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.764988][ T5032] kasan_check_range+0x27e/0x290 [ 55.769915][ T5032] ? leaf_paste_in_buffer+0x1bc/0xab0 [ 55.775275][ T5032] __asan_memmove+0x29/0x70 [ 55.779770][ T5032] leaf_paste_in_buffer+0x1bc/0xab0 [ 55.784960][ T5032] balance_leaf+0x6680/0x12510 [ 55.789721][ T5032] ? print_irqtrace_events+0x220/0x220 [ 55.795173][ T5032] ? do_balance+0x8f0/0x8f0 [ 55.799663][ T5032] ? write_boundary_block+0xb0/0xb0 [ 55.804847][ T5032] ? do_raw_spin_lock+0x14d/0x3a0 [ 55.809862][ T5032] ? __lock_acquire+0x7f70/0x7f70 [ 55.814874][ T5032] ? do_raw_spin_unlock+0x13b/0x8b0 [ 55.820074][ T5032] ? __getblk_gfp+0x581/0x630 [ 55.824741][ T5032] ? get_empty_nodes+0xadd/0xd70 [ 55.829666][ T5032] ? direntry_part_size+0xb4/0x1a0 [ 55.834770][ T5032] ? __wake_up+0x1d0/0x1d0 [ 55.839178][ T5032] ? get_neighbors+0x1010/0x1010 [ 55.844111][ T5032] ? is_leaf_removable+0x8c0/0x8c0 [ 55.849210][ T5032] ? get_neighbors+0x631/0x1010 [ 55.854051][ T5032] ? reiserfs_prepare_for_journal+0x26d/0x280 [ 55.860124][ T5032] ? fix_nodes+0x7b03/0x8ce0 [ 55.864714][ T5032] do_balance+0x30d/0x8f0 [ 55.869033][ T5032] ? get_right_neighbor_position+0x210/0x210 [ 55.875009][ T5032] ? reiserfs_paste_into_item+0x3f3/0x870 [ 55.880716][ T5032] reiserfs_paste_into_item+0x732/0x870 [ 55.886254][ T5032] ? reiserfs_cut_from_item+0x2580/0x2580 [ 55.891984][ T5032] ? reiserfs_get_block+0x19aa/0x5130 [ 55.897348][ T5032] ? rcu_is_watching+0x15/0xb0 [ 55.902103][ T5032] ? __kmalloc+0xe6/0x230 [ 55.906422][ T5032] reiserfs_get_block+0x2250/0x5130 [ 55.911624][ T5032] ? make_le_item_head+0x570/0x570 [ 55.916721][ T5032] ? do_truncate+0x220/0x300 [ 55.921301][ T5032] ? verify_lock_unused+0x140/0x140 [ 55.926506][ T5032] ? __lock_acquire+0x7f70/0x7f70 [ 55.931521][ T5032] ? _raw_spin_unlock+0x28/0x40 [ 55.936364][ T5032] ? folio_create_buffers+0x132/0x250 [ 55.941722][ T5032] __block_write_begin_int+0x54d/0x1ac0 [ 55.947254][ T5032] ? folio_add_lru+0x27b/0x9d0 [ 55.952011][ T5032] ? make_le_item_head+0x570/0x570 [ 55.957117][ T5032] ? folio_zero_new_buffers+0x530/0x530 [ 55.962652][ T5032] ? __block_write_begin+0x64/0x150 [ 55.967837][ T5032] reiserfs_write_begin+0x24d/0x520 [ 55.973025][ T5032] ? reiserfs_write_lock+0x7a/0xd0 [ 55.978129][ T5032] generic_cont_expand_simple+0x18b/0x2a0 [ 55.983837][ T5032] ? submit_bh+0x20/0x20 [ 55.988071][ T5032] ? smk_access+0x4ab/0x4e0 [ 55.992570][ T5032] reiserfs_setattr+0x57d/0x1140 [ 55.997501][ T5032] ? reiserfs_commit_write+0x5b0/0x5b0 [ 56.002952][ T5032] ? current_time+0x1e0/0x2b0 [ 56.007618][ T5032] ? inode_set_ctime_current+0x2f0/0x2f0 [ 56.013241][ T5032] ? evm_inode_setattr+0x100/0x740 [ 56.018342][ T5032] ? bpf_lsm_inode_setattr+0x9/0x10 [ 56.023524][ T5032] ? security_inode_setattr+0xd7/0x130 [ 56.028976][ T5032] ? reiserfs_commit_write+0x5b0/0x5b0 [ 56.034425][ T5032] notify_change+0xb99/0xe60 [ 56.039008][ T5032] do_truncate+0x220/0x300 [ 56.043415][ T5032] ? put_page_bootmem+0x2e0/0x2e0 [ 56.048434][ T5032] do_sys_ftruncate+0x2f3/0x390 [ 56.053276][ T5032] do_syscall_64+0x41/0xc0 [ 56.057680][ T5032] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.063563][ T5032] RIP: 0033:0x7f68753407b9 [ 56.067964][ T5032] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 56.087561][ T5032] RSP: 002b:00007fff8c1868a8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 56.095964][ T5032] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f68753407b9 [ 56.103923][ T5032] RDX: 00007f68753407b9 RSI: 0000000002007fff RDI: 0000000000000005 [ 56.111882][ T5032] RBP: 00007f68753b4610 R08: 00007fff8c186a78 R09: 00007fff8c186a78 [ 56.119841][ T5032] R10: 00007fff8c186a78 R11: 0000000000000246 R12: 0000000000000001 [ 56.127803][ T5032] R13: 00007fff8c186a68 R14: 0000000000000001 R15: 0000000000000001 [ 56.135764][ T5032] [ 56.138948][ T5032] Kernel Offset: disabled [ 56.143257][ T5032] Rebooting in 86400 seconds..