./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1585288302
<...>
DUID 00:04:7b:a2:e0:73:6b:5f:a9:8e:d4:f6:53:82:b5:31:a7:5e
forked to background, child pid 4645
[ 31.570819][ T4646] 8021q: adding VLAN 0 to HW filter on device bond0
[ 31.584139][ T4646] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.126' (ECDSA) to the list of known hosts.
execve("./syz-executor1585288302", ["./syz-executor1585288302"], 0x7fff94a7d090 /* 10 vars */) = 0
brk(NULL) = 0x555555d7f000
brk(0x555555d7fc40) = 0x555555d7fc40
arch_prctl(ARCH_SET_FS, 0x555555d7f300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1585288302", 4096) = 28
brk(0x555555da0c40) = 0x555555da0c40
brk(0x555555da1000) = 0x555555da1000
mprotect(0x7fcd906aa000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcd881f0000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7fcd881f0000, 524288) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
syzkaller login: [ 55.259727][ T5067] loop0: detected capacity change from 0 to 1024
[ 55.297214][ T5067] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 96: 0x73 != 0x9b
mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "udf", 0, "umask=00000000000000000000004,noadinicb,unhide,uid=forget,longad,gid=forget,") = 0
openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
open(".", O_RDONLY) = 4
[ 55.307527][ T5067] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found!
[ 55.320392][ T5067] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[ 55.345542][ T5067] ==================================================================
[ 55.353656][ T5067] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x62d/0x7e0
[ 55.362458][ T5067] Write of size 4 at addr ffff88802789fff0 by task syz-executor158/5067
[ 55.370789][ T5067]
[ 55.373100][ T5067] CPU: 1 PID: 5067 Comm: syz-executor158 Not tainted 6.1.0-syzkaller-13872-gb6bb9676f216 #0
[ 55.383142][ T5067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 55.393191][ T5067] Call Trace:
[ 55.396578][ T5067]
[ 55.399533][ T5067] dump_stack_lvl+0x1b1/0x290
[ 55.404229][ T5067] ? nf_tcp_handle_invalid+0x630/0x630
[ 55.409708][ T5067] ? __wake_up_klogd+0xcd/0x100
[ 55.414555][ T5067] ? panic+0x710/0x710
[ 55.418614][ T5067] ? _printk+0xc0/0x100
[ 55.422863][ T5067] print_address_description+0x74/0x340
[ 55.428418][ T5067] print_report+0x107/0x1f0
[ 55.432910][ T5067] ? _raw_spin_lock+0x40/0x40
[ 55.437593][ T5067] ? udf_current_aext+0x5d0/0xa80
[ 55.442622][ T5067] ? __virt_addr_valid+0x21b/0x2d0
[ 55.447735][ T5067] ? __phys_addr+0xb5/0x160
[ 55.452249][ T5067] ? udf_write_aext+0x62d/0x7e0
[ 55.457100][ T5067] kasan_report+0xcd/0x100
[ 55.461512][ T5067] ? udf_write_aext+0x62d/0x7e0
[ 55.466358][ T5067] udf_write_aext+0x62d/0x7e0
[ 55.471029][ T5067] udf_add_entry+0x1712/0x3300
[ 55.475790][ T5067] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 55.481787][ T5067] ? __mark_inode_dirty+0x593/0x600
[ 55.486976][ T5067] ? udf_add_nondir+0x580/0x580
[ 55.491839][ T5067] ? udf_new_inode+0xb04/0xf30
[ 55.496600][ T5067] ? d_alloc+0x193/0x1d0
[ 55.500843][ T5067] udf_mkdir+0x13c/0x980
[ 55.505081][ T5067] ? udf_symlink+0x1680/0x1680
[ 55.509839][ T5067] ? from_kgid+0x193/0x6b0
[ 55.514251][ T5067] ? make_kgid+0x710/0x710
[ 55.518656][ T5067] ? __lookup_hash+0x123/0x240
[ 55.523418][ T5067] ? apparmor_path_mkdir+0x461/0x520
[ 55.528709][ T5067] ? generic_permission+0x229/0x500
[ 55.533918][ T5067] ? inode_permission+0xf5/0x450
[ 55.538852][ T5067] ? bpf_lsm_inode_mkdir+0x5/0x10
[ 55.543877][ T5067] ? security_inode_mkdir+0xdd/0x120
[ 55.549162][ T5067] vfs_mkdir+0x3b3/0x590
[ 55.553406][ T5067] do_mkdirat+0x25b/0x530
[ 55.557730][ T5067] ? __check_object_size+0x15a/0x210
[ 55.563007][ T5067] ? vfs_mkdir+0x590/0x590
[ 55.567418][ T5067] ? getname_flags+0x1ea/0x4e0
[ 55.572175][ T5067] __x64_sys_mkdirat+0x85/0x90
[ 55.576931][ T5067] do_syscall_64+0x3d/0xb0
[ 55.581339][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.587225][ T5067] RIP: 0033:0x7fcd9063cbc9
[ 55.592411][ T5067] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.612003][ T5067] RSP: 002b:00007ffd42cc8a28 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 55.620409][ T5067] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcd9063cbc9
[ 55.628368][ T5067] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000004
[ 55.636367][ T5067] RBP: 00007fcd905fc1d0 R08: 0000000000000000 R09: 0000000000000000
[ 55.644323][ T5067] R10: 000000000000002e R11: 0000000000000246 R12: 00007fcd905fc260
[ 55.652308][ T5067] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 55.660292][ T5067]
[ 55.663493][ T5067]
[ 55.665821][ T5067] Allocated by task 4908:
[ 55.670143][ T5067] kasan_set_track+0x3d/0x60
[ 55.674741][ T5067] __kasan_slab_alloc+0x65/0x70
[ 55.679623][ T5067] kmem_cache_alloc_bulk+0x16a/0x1c0
[ 55.684910][ T5067] mas_alloc_nodes+0x386/0x650
[ 55.689678][ T5067] mas_preallocate+0x133/0x340
[ 55.694522][ T5067] mmap_region+0x147a/0x1e20
[ 55.699105][ T5067] do_mmap+0x8d9/0xf30
[ 55.703159][ T5067] vm_mmap_pgoff+0x19e/0x2b0
[ 55.707737][ T5067] ksys_mmap_pgoff+0x48c/0x6d0
[ 55.712488][ T5067] do_syscall_64+0x3d/0xb0
[ 55.716895][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.722798][ T5067]
[ 55.725115][ T5067] Freed by task 4908:
[ 55.729082][ T5067] kasan_set_track+0x3d/0x60
[ 55.733689][ T5067] kasan_save_free_info+0x27/0x40
[ 55.738791][ T5067] ____kasan_slab_free+0xd6/0x120
[ 55.743810][ T5067] slab_free_freelist_hook+0x12e/0x1a0
[ 55.749267][ T5067] kmem_cache_free_bulk+0x10a/0x170
[ 55.754455][ T5067] mas_destroy+0x2a71/0x37a0
[ 55.759039][ T5067] mas_store_prealloc+0x35d/0x450
[ 55.764054][ T5067] mmap_region+0x15b3/0x1e20
[ 55.768632][ T5067] do_mmap+0x8d9/0xf30
[ 55.772685][ T5067] vm_mmap_pgoff+0x19e/0x2b0
[ 55.777262][ T5067] ksys_mmap_pgoff+0x48c/0x6d0
[ 55.782011][ T5067] do_syscall_64+0x3d/0xb0
[ 55.786420][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.792304][ T5067]
[ 55.794611][ T5067] The buggy address belongs to the object at ffff88802789fe00
[ 55.794611][ T5067] which belongs to the cache maple_node of size 256
[ 55.808664][ T5067] The buggy address is located 240 bytes to the right of
[ 55.808664][ T5067] 256-byte region [ffff88802789fe00, ffff88802789ff00)
[ 55.822469][ T5067]
[ 55.824788][ T5067] The buggy address belongs to the physical page:
[ 55.831208][ T5067] page:ffffea00009e2780 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2789e
[ 55.841363][ T5067] head:ffffea00009e2780 order:1 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
[ 55.851507][ T5067] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 55.859500][ T5067] raw: 00fff00000010200 ffff8880128cd000 dead000000000100 dead000000000122
[ 55.868205][ T5067] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 55.876774][ T5067] page dumped because: kasan: bad access detected
[ 55.883172][ T5067] page_owner tracks the page as allocated
[ 55.888870][ T5067] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4676, tgid 4676 (cmp), ts 30331575427, free_ts 27843451980
[ 55.910410][ T5067] get_page_from_freelist+0x742/0x7c0
[ 55.915777][ T5067] __alloc_pages+0x259/0x560
[ 55.920373][ T5067] alloc_slab_page+0xbd/0x190
[ 55.925124][ T5067] allocate_slab+0x5e/0x3c0
[ 55.929616][ T5067] ___slab_alloc+0x782/0xe20
[ 55.934205][ T5067] __kmem_cache_alloc_bulk+0x143/0x3e0
[ 55.939651][ T5067] kmem_cache_alloc_bulk+0xef/0x1c0
[ 55.944838][ T5067] mas_alloc_nodes+0x386/0x650
[ 55.949591][ T5067] mas_preallocate+0x133/0x340
[ 55.954341][ T5067] __vma_adjust+0x865/0x21b0
[ 55.958919][ T5067] __split_vma+0x36e/0x530
[ 55.963327][ T5067] do_mas_align_munmap+0x35a/0x14e0
[ 55.968523][ T5067] do_mas_munmap+0x245/0x2b0
[ 55.973100][ T5067] __vm_munmap+0x23c/0x340
[ 55.977506][ T5067] elf_map+0x21e/0x300
[ 55.981570][ T5067] load_elf_interp+0x4c9/0xdd0
[ 55.986333][ T5067] page last free stack trace:
[ 55.990986][ T5067] free_pcp_prepare+0x751/0x780
[ 55.995872][ T5067] free_unref_page+0x19/0x4c0
[ 56.000583][ T5067] __unfreeze_partials+0x1a5/0x1e0
[ 56.005692][ T5067] put_cpu_partial+0x106/0x170
[ 56.010451][ T5067] qlist_free_all+0x2b/0x70
[ 56.014961][ T5067] kasan_quarantine_reduce+0x156/0x170
[ 56.020425][ T5067] __kasan_slab_alloc+0x1f/0x70
[ 56.025278][ T5067] __kmem_cache_alloc_node+0x1e0/0x340
[ 56.030730][ T5067] __kmalloc_node+0x9e/0x190
[ 56.035309][ T5067] kvmalloc_node+0x6e/0x180
[ 56.039804][ T5067] seq_read_iter+0x1f6/0xd30
[ 56.044398][ T5067] vfs_read+0x7ac/0xbf0
[ 56.048542][ T5067] ksys_read+0x177/0x2a0
[ 56.052771][ T5067] do_syscall_64+0x3d/0xb0
[ 56.057178][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.063064][ T5067]
[ 56.065376][ T5067] Memory state around the buggy address:
[ 56.070988][ T5067] ffff88802789fe80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 56.079031][ T5067] ffff88802789ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 56.087076][ T5067] >ffff88802789ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 56.095115][ T5067] ^
[ 56.102921][ T5067] ffff8880278a0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 56.110973][ T5067] ffff8880278a0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 56.119024][ T5067] ==================================================================
[ 56.127535][ T5067] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 56.134745][ T5067] CPU: 0 PID: 5067 Comm: syz-executor158 Not tainted 6.1.0-syzkaller-13872-gb6bb9676f216 #0
[ 56.144802][ T5067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 56.154842][ T5067] Call Trace:
[ 56.158110][ T5067]
[ 56.161033][ T5067] dump_stack_lvl+0x1b1/0x290
[ 56.165722][ T5067] ? nf_tcp_handle_invalid+0x630/0x630
[ 56.171197][ T5067] ? panic+0x710/0x710
[ 56.175281][ T5067] ? lock_release+0x81/0x820
[ 56.179873][ T5067] ? vscnprintf+0x59/0x80
[ 56.184207][ T5067] panic+0x2d6/0x710
[ 56.188090][ T5067] ? check_panic_on_warn+0x1d/0xa0
[ 56.193202][ T5067] ? memcpy_page_flushcache+0x100/0x100
[ 56.198739][ T5067] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 56.204711][ T5067] ? _raw_spin_unlock+0x40/0x40
[ 56.209555][ T5067] ? print_report+0x1b4/0x1f0
[ 56.214226][ T5067] check_panic_on_warn+0x80/0xa0
[ 56.219155][ T5067] ? udf_write_aext+0x62d/0x7e0
[ 56.224004][ T5067] end_report+0x47/0x90
[ 56.228510][ T5067] kasan_report+0xda/0x100
[ 56.233791][ T5067] ? udf_write_aext+0x62d/0x7e0
[ 56.238637][ T5067] udf_write_aext+0x62d/0x7e0
[ 56.243395][ T5067] udf_add_entry+0x1712/0x3300
[ 56.248204][ T5067] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 56.254180][ T5067] ? __mark_inode_dirty+0x593/0x600
[ 56.259374][ T5067] ? udf_add_nondir+0x580/0x580
[ 56.264215][ T5067] ? udf_new_inode+0xb04/0xf30
[ 56.268974][ T5067] ? d_alloc+0x193/0x1d0
[ 56.273219][ T5067] udf_mkdir+0x13c/0x980
[ 56.277980][ T5067] ? udf_symlink+0x1680/0x1680
[ 56.282766][ T5067] ? from_kgid+0x193/0x6b0
[ 56.287194][ T5067] ? make_kgid+0x710/0x710
[ 56.291603][ T5067] ? __lookup_hash+0x123/0x240
[ 56.296369][ T5067] ? apparmor_path_mkdir+0x461/0x520
[ 56.301647][ T5067] ? generic_permission+0x229/0x500
[ 56.306839][ T5067] ? inode_permission+0xf5/0x450
[ 56.311767][ T5067] ? bpf_lsm_inode_mkdir+0x5/0x10
[ 56.316814][ T5067] ? security_inode_mkdir+0xdd/0x120
[ 56.322099][ T5067] vfs_mkdir+0x3b3/0x590
[ 56.326426][ T5067] do_mkdirat+0x25b/0x530
[ 56.330749][ T5067] ? __check_object_size+0x15a/0x210
[ 56.336577][ T5067] ? vfs_mkdir+0x590/0x590
[ 56.341017][ T5067] ? getname_flags+0x1ea/0x4e0
[ 56.345894][ T5067] __x64_sys_mkdirat+0x85/0x90
[ 56.350662][ T5067] do_syscall_64+0x3d/0xb0
[ 56.355361][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.361886][ T5067] RIP: 0033:0x7fcd9063cbc9
[ 56.366309][ T5067] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 56.386275][ T5067] RSP: 002b:00007ffd42cc8a28 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 56.395207][ T5067] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcd9063cbc9
[ 56.403343][ T5067] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000004
[ 56.411739][ T5067] RBP: 00007fcd905fc1d0 R08: 0000000000000000 R09: 0000000000000000
[ 56.419704][ T5067] R10: 000000000000002e R11: 0000000000000246 R12: 00007fcd905fc260
[ 56.427664][ T5067] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 56.435637][ T5067]
[ 56.438809][ T5067] Kernel Offset: disabled
[ 56.443140][ T5067] Rebooting in 86400 seconds..