./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1329897255 <...> Warning: Permanently added '10.128.0.88' (ED25519) to the list of known hosts. execve("./syz-executor1329897255", ["./syz-executor1329897255"], 0x7ffe8f1b5290 /* 10 vars */) = 0 brk(NULL) = 0x55555631b000 brk(0x55555631bd00) = 0x55555631bd00 arch_prctl(ARCH_SET_FS, 0x55555631b380) = 0 set_tid_address(0x55555631b650) = 5820 set_robust_list(0x55555631b660, 24) = 0 rseq(0x55555631bca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1329897255", 4096) = 28 getrandom("\x8e\x5d\xf5\xf3\x83\x89\xdc\xe0", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555631bd00 brk(0x55555633cd00) = 0x55555633cd00 brk(0x55555633d000) = 0x55555633d000 mprotect(0x7f774e648000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555631b650) = 5821 ./strace-static-x86_64: Process 5821 attached [pid 5820] openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC [pid 5821] set_robust_list(0x55555631b660, 24 [pid 5820] <... openat resumed>) = 3 [pid 5821] <... set_robust_list resumed>) = 0 [pid 5820] write(3, "10000000000", 11) = 11 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "20", 2) = 2 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "1", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "0", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "0", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "1", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "100", 3) = 3 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "0", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "0", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "7 4 1 3", 7) = 7 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "1", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "1", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "0", 1) = 1 [pid 5820] close(3) = 0 [pid 5820] openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "5821", 4) = 4 [pid 5820] close(3) = 0 [pid 5820] kill(5821, SIGKILL) = 0 [pid 5821] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5821, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5820}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5820}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5824 attached [pid 5824] set_robust_list(0x55555631b660, 24 [pid 5820] <... clone resumed>, child_tidptr=0x55555631b650) = 5824 [pid 5824] <... set_robust_list resumed>) = 0 [pid 5824] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5824] setpgid(0, 0) = 0 [pid 5824] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5824] write(3, "1000", 4) = 4 [pid 5824] close(3) = 0 [pid 5824] write(1, "executing program\n", 18executing program ) = 18 [pid 5824] memfd_create("syzkaller", 0) = 3 [pid 5824] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7746000000 [pid 5824] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5824] munmap(0x7f7746000000, 138412032) = 0 [pid 5824] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5824] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5824] close(3) = 0 [pid 5824] close(4) = 0 [pid 5824] mkdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", 0777) = 0 [ 70.051107][ T5824] loop0: detected capacity change from 0 to 512 [pid 5824] mount("/dev/loop0", "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", "ext4", MS_DIRSYNC|MS_NOSYMFOLLOW|MS_NOATIME|MS_I_VERSION|0x200, ",errors=continue") = 0 [pid 5824] openat(AT_FDCWD, "\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b", O_RDONLY|O_DIRECTORY) = 3 [pid 5824] chdir("\xe9\x1f\x71\x89\x59\x1e\x92\x33\x61\x4b") = 0 [pid 5824] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5824] chdir("./file0") = 0 [pid 5824] openat(AT_FDCWD, "net_prio.prioidx", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 5824] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 005) = 0 [pid 5824] creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 5 [ 70.089634][ T5824] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz-executor132: corrupted in-inode xattr: invalid ea_ino [ 70.104748][ T5824] EXT4-fs error (device loop0): ext4_orphan_get:1394: comm syz-executor132: couldn't read orphan inode 15 (err -117) [ 70.118816][ T5824] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [pid 5824] symlink("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [ 70.185880][ T5824] ================================================================== [ 70.194104][ T5824] BUG: KASAN: slab-use-after-free in ext4_insert_dentry+0x36a/0x6d0 [ 70.202119][ T5824] Write of size 250 at addr ffff88806afc1f18 by task syz-executor132/5824 [ 70.210706][ T5824] [ 70.213059][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0 [ 70.224523][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 70.234741][ T5824] Call Trace: [ 70.238136][ T5824] [ 70.241160][ T5824] dump_stack_lvl+0x241/0x360 [ 70.245851][ T5824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 70.251059][ T5824] ? __pfx__printk+0x10/0x10 [ 70.255652][ T5824] ? _printk+0xd5/0x120 [ 70.259834][ T5824] ? __virt_addr_valid+0x183/0x530 [ 70.264953][ T5824] ? __virt_addr_valid+0x183/0x530 [ 70.270063][ T5824] print_report+0x169/0x550 [ 70.274720][ T5824] ? __virt_addr_valid+0x183/0x530 [ 70.279913][ T5824] ? __virt_addr_valid+0x183/0x530 [ 70.285056][ T5824] ? __virt_addr_valid+0x45f/0x530 [ 70.290249][ T5824] ? __phys_addr+0xba/0x170 [ 70.294846][ T5824] ? ext4_insert_dentry+0x36a/0x6d0 [ 70.300050][ T5824] kasan_report+0x143/0x180 [ 70.304573][ T5824] ? ext4_insert_dentry+0x36a/0x6d0 [ 70.309774][ T5824] kasan_check_range+0x282/0x290 [ 70.314703][ T5824] ? ext4_insert_dentry+0x36a/0x6d0 [ 70.319998][ T5824] __asan_memcpy+0x40/0x70 [ 70.324630][ T5824] ext4_insert_dentry+0x36a/0x6d0 [ 70.329749][ T5824] add_dirent_to_buf+0x3d9/0x750 [ 70.334686][ T5824] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 70.340129][ T5824] ? __ext4_handle_dirty_metadata+0x34b/0x820 [ 70.346201][ T5824] make_indexed_dir+0xf98/0x1600 [ 70.351133][ T5824] ? __pfx_make_indexed_dir+0x10/0x10 [ 70.356494][ T5824] ? add_dirent_to_buf+0x398/0x750 [ 70.361603][ T5824] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 70.367094][ T5824] ? __ext4_read_dirblock+0x527/0x890 [ 70.372459][ T5824] ext4_add_entry+0xcf7/0xfa0 [ 70.377119][ T5824] ? __pfx_ext4_add_entry+0x10/0x10 [ 70.382300][ T5824] ? __pfx_ext4_init_new_dir+0x10/0x10 [ 70.387748][ T5824] ? smack_inode_permission+0x2dc/0x380 [ 70.393294][ T5824] ext4_mkdir+0x554/0xcf0 [ 70.397610][ T5824] ? __pfx_ext4_mkdir+0x10/0x10 [ 70.402441][ T5824] ? bpf_lsm_inode_mkdir+0x9/0x10 [ 70.407448][ T5824] ? security_inode_mkdir+0xbe/0x340 [ 70.412725][ T5824] vfs_mkdir+0x2f9/0x4f0 [ 70.416979][ T5824] do_mkdirat+0x264/0x3a0 [ 70.421293][ T5824] ? __check_object_size+0x48e/0x900 [ 70.426563][ T5824] ? __pfx_do_mkdirat+0x10/0x10 [ 70.431407][ T5824] ? getname_flags+0x1e3/0x540 [ 70.436257][ T5824] __x64_sys_mkdirat+0x87/0xa0 [ 70.441027][ T5824] do_syscall_64+0xf3/0x230 [ 70.445540][ T5824] ? clear_bhb_loop+0x35/0x90 [ 70.450260][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.456170][ T5824] RIP: 0033:0x7f774e5d8d39 [ 70.460583][ T5824] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 70.480193][ T5824] RSP: 002b:00007fff907f19e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 70.488605][ T5824] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f774e5d8d39 [ 70.496570][ T5824] RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 00000000ffffff9c [ 70.504531][ T5824] RBP: 0000000000000004 R08: 00007fff907f1a18 R09: 00007fff907f1a18 [ 70.512499][ T5824] R10: 00007fff907f1a18 R11: 0000000000000246 R12: 00007fff907f1a40 [ 70.520475][ T5824] R13: 00007f774e64e5e0 R14: 431bde82d7b634db R15: 00007fff907f1a20 [ 70.528485][ T5824] [ 70.531574][ T5824] [ 70.533905][ T5824] The buggy address belongs to the physical page: [ 70.540309][ T5824] page: refcount:3 mapcount:0 mapping:ffff888148c94d78 index:0x3f pfn:0x6afc1 [ 70.549148][ T5824] memcg:ffff888140adc000 [ 70.553376][ T5824] aops:def_blk_aops ino:700000 dentry name(?):"" [ 70.559883][ T5824] flags: 0xfff00000004114(referenced|dirty|active|private|node=0|zone=1|lastcpupid=0x7ff) [ 70.569779][ T5824] raw: 00fff00000004114 0000000000000000 dead000000000122 ffff888148c94d78 [ 70.578461][ T5824] raw: 000000000000003f ffff888075c4d9f8 00000003ffffffff ffff888140adc000 [ 70.587066][ T5824] page dumped because: kasan: bad access detected [ 70.593486][ T5824] page_owner tracks the page as allocated [ 70.599209][ T5824] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x148c40(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5824, tgid 5824 (syz-executor132), ts 70184402240, free_ts 70183711372 [ 70.618824][ T5824] post_alloc_hook+0x1f3/0x230 [ 70.623584][ T5824] get_page_from_freelist+0x3651/0x37a0 [ 70.629298][ T5824] __alloc_pages_noprof+0x292/0x710 [ 70.634583][ T5824] alloc_pages_mpol_noprof+0x3e8/0x680 [ 70.640110][ T5824] folio_alloc_noprof+0x128/0x180 [ 70.645118][ T5824] filemap_alloc_folio_noprof+0xdf/0x500 [ 70.650753][ T5824] __filemap_get_folio+0x446/0xbd0 [ 70.655867][ T5824] bdev_getblk+0x1d8/0x550 [ 70.660275][ T5824] ext4_getblk+0x31b/0x880 [ 70.664775][ T5824] ext4_bread+0x2e/0x180 [ 70.668995][ T5824] ext4_append+0x327/0x5c0 [ 70.673403][ T5824] make_indexed_dir+0x523/0x1600 [ 70.678323][ T5824] ext4_add_entry+0xcf7/0xfa0 [ 70.683027][ T5824] ext4_mkdir+0x554/0xcf0 [ 70.687342][ T5824] vfs_mkdir+0x2f9/0x4f0 [ 70.691598][ T5824] do_mkdirat+0x264/0x3a0 [ 70.695914][ T5824] page last free pid 0 tgid 0 stack trace: [ 70.701700][ T5824] free_unref_page+0xde3/0x1130 [ 70.706550][ T5824] skb_release_data+0x6dc/0x8a0 [ 70.711395][ T5824] __kfree_skb+0x55/0x70 [ 70.715617][ T5824] tcp_rcv_established+0xfb7/0x1f20 [ 70.720815][ T5824] tcp_v4_do_rcv+0x96d/0xc70 [ 70.725397][ T5824] tcp_v4_rcv+0x2dc0/0x37f0 [ 70.729916][ T5824] ip_protocol_deliver_rcu+0x22e/0x440 [ 70.735545][ T5824] ip_local_deliver_finish+0x341/0x5f0 [ 70.741002][ T5824] NF_HOOK+0x3a4/0x450 [ 70.745274][ T5824] ip_sublist_rcv_finish+0x3be/0x4f0 [ 70.750568][ T5824] ip_sublist_rcv+0x75d/0xab0 [ 70.755253][ T5824] ip_list_rcv+0x42b/0x480 [ 70.759668][ T5824] __netif_receive_skb_list_core+0x94e/0x980 [ 70.765652][ T5824] netif_receive_skb_list_internal+0xa51/0xe30 [ 70.771804][ T5824] napi_complete_done+0x2b5/0x870 [ 70.776814][ T5824] virtnet_poll+0x2de9/0x39b0 [ 70.781489][ T5824] [ 70.783792][ T5824] Memory state around the buggy address: [ 70.789400][ T5824] ffff88806afc1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.797447][ T5824] ffff88806afc1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.805494][ T5824] >ffff88806afc2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.813542][ T5824] ^ [ 70.817597][ T5824] ffff88806afc2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 70.825649][ T5824] ffff88806afc2100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 70.833692][ T5824] ================================================================== [ 70.842272][ T5824] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 70.849491][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0 [ 70.860597][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 70.870648][ T5824] Call Trace: [ 70.873946][ T5824] [ 70.876883][ T5824] dump_stack_lvl+0x241/0x360 [ 70.881577][ T5824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 70.886810][ T5824] ? __pfx__printk+0x10/0x10 [ 70.891418][ T5824] ? preempt_schedule+0xe1/0xf0 [ 70.896287][ T5824] ? vscnprintf+0x5d/0x90 [ 70.900642][ T5824] panic+0x349/0x880 [ 70.904553][ T5824] ? check_panic_on_warn+0x21/0xb0 [ 70.909666][ T5824] ? __pfx_panic+0x10/0x10 [ 70.914081][ T5824] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 70.920058][ T5824] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 70.926562][ T5824] ? print_report+0x502/0x550 [ 70.931233][ T5824] check_panic_on_warn+0x86/0xb0 [ 70.936166][ T5824] ? ext4_insert_dentry+0x36a/0x6d0 [ 70.941363][ T5824] end_report+0x77/0x160 [ 70.945603][ T5824] kasan_report+0x154/0x180 [ 70.950097][ T5824] ? ext4_insert_dentry+0x36a/0x6d0 [ 70.955288][ T5824] kasan_check_range+0x282/0x290 [ 70.960218][ T5824] ? ext4_insert_dentry+0x36a/0x6d0 [ 70.965416][ T5824] __asan_memcpy+0x40/0x70 [ 70.969829][ T5824] ext4_insert_dentry+0x36a/0x6d0 [ 70.975372][ T5824] add_dirent_to_buf+0x3d9/0x750 [ 70.980304][ T5824] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 70.985929][ T5824] ? __ext4_handle_dirty_metadata+0x34b/0x820 [ 70.991994][ T5824] make_indexed_dir+0xf98/0x1600 [ 70.996930][ T5824] ? __pfx_make_indexed_dir+0x10/0x10 [ 71.002318][ T5824] ? add_dirent_to_buf+0x398/0x750 [ 71.007425][ T5824] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 71.012893][ T5824] ? __ext4_read_dirblock+0x527/0x890 [ 71.018268][ T5824] ext4_add_entry+0xcf7/0xfa0 [ 71.022940][ T5824] ? __pfx_ext4_add_entry+0x10/0x10 [ 71.028153][ T5824] ? __pfx_ext4_init_new_dir+0x10/0x10 [ 71.033623][ T5824] ? smack_inode_permission+0x2dc/0x380 [ 71.039168][ T5824] ext4_mkdir+0x554/0xcf0 [ 71.043497][ T5824] ? __pfx_ext4_mkdir+0x10/0x10 [ 71.048345][ T5824] ? bpf_lsm_inode_mkdir+0x9/0x10 [ 71.053366][ T5824] ? security_inode_mkdir+0xbe/0x340 [ 71.058672][ T5824] vfs_mkdir+0x2f9/0x4f0 [ 71.062941][ T5824] do_mkdirat+0x264/0x3a0 [ 71.067286][ T5824] ? __check_object_size+0x48e/0x900 [ 71.072580][ T5824] ? __pfx_do_mkdirat+0x10/0x10 [ 71.077437][ T5824] ? getname_flags+0x1e3/0x540 [ 71.082471][ T5824] __x64_sys_mkdirat+0x87/0xa0 [ 71.087244][ T5824] do_syscall_64+0xf3/0x230 [ 71.091745][ T5824] ? clear_bhb_loop+0x35/0x90 [ 71.096464][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.102363][ T5824] RIP: 0033:0x7f774e5d8d39 [ 71.106776][ T5824] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 71.126663][ T5824] RSP: 002b:00007fff907f19e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 71.135097][ T5824] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f774e5d8d39 [ 71.143078][ T5824] RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 00000000ffffff9c [ 71.151049][ T5824] RBP: 0000000000000004 R08: 00007fff907f1a18 R09: 00007fff907f1a18 [ 71.159011][ T5824] R10: 00007fff907f1a18 R11: 0000000000000246 R12: 00007fff907f1a40 [ 71.166977][ T5824] R13: 00007f774e64e5e0 R14: 431bde82d7b634db R15: 00007fff907f1a20 [ 71.174955][ T5824] [ 71.178192][ T5824] Kernel Offset: disabled [ 71.182598][ T5824] Rebooting in 86400 seconds..