Warning: Permanently added '10.128.15.193' (ED25519) to the list of known hosts. executing program [ 44.407516][ T4162] loop0: detected capacity change from 0 to 512 [ 44.493238][ T4162] EXT4-fs error (device loop0): ext4_xattr_inode_iget:404: comm syz-executor475: inode #1: comm syz-executor475: iget: illegal inode # [ 44.508324][ T4162] EXT4-fs error (device loop0): ext4_xattr_inode_iget:409: comm syz-executor475: error while reading EA inode 1 err=-117 [ 44.521502][ T4162] EXT4-fs (loop0): 1 orphan inode deleted [ 44.527234][ T4162] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 44.543437][ T4162] ================================================================== [ 44.551614][ T4162] BUG: KASAN: use-after-free in ext4_insert_dentry+0x366/0x6c0 [ 44.559183][ T4162] Write of size 250 at addr ffff88807eeeff18 by task syz-executor475/4162 [ 44.567658][ T4162] [ 44.569973][ T4162] CPU: 1 PID: 4162 Comm: syz-executor475 Not tainted 5.15.173-syzkaller #0 [ 44.578533][ T4162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 44.588565][ T4162] Call Trace: [ 44.591824][ T4162] [ 44.594734][ T4162] dump_stack_lvl+0x1e3/0x2d0 [ 44.599398][ T4162] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 44.605004][ T4162] ? _printk+0xd1/0x120 [ 44.609136][ T4162] ? __wake_up_klogd+0xcc/0x100 [ 44.613963][ T4162] ? panic+0x860/0x860 [ 44.618002][ T4162] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 44.623438][ T4162] print_address_description+0x63/0x3b0 [ 44.628958][ T4162] ? ext4_insert_dentry+0x366/0x6c0 [ 44.634135][ T4162] kasan_report+0x16b/0x1c0 [ 44.638612][ T4162] ? ext4_insert_dentry+0x366/0x6c0 [ 44.643787][ T4162] kasan_check_range+0x27e/0x290 [ 44.648693][ T4162] ? ext4_insert_dentry+0x366/0x6c0 [ 44.653869][ T4162] memcpy+0x3c/0x60 [ 44.657649][ T4162] ext4_insert_dentry+0x366/0x6c0 [ 44.662654][ T4162] add_dirent_to_buf+0x384/0x7d0 [ 44.667575][ T4162] ? ext4_dx_add_entry+0x1620/0x1620 [ 44.672845][ T4162] ? __ext4_handle_dirty_metadata+0x2ef/0x800 [ 44.678895][ T4162] make_indexed_dir+0xf34/0x15a0 [ 44.683816][ T4162] ? add_dirent_to_buf+0x7d0/0x7d0 [ 44.688902][ T4162] ? add_dirent_to_buf+0x54e/0x7d0 [ 44.693999][ T4162] ? ext4_dx_add_entry+0x1620/0x1620 [ 44.699257][ T4162] ? __ext4_read_dirblock+0x522/0x890 [ 44.704606][ T4162] ext4_add_entry+0xde2/0x12b0 [ 44.709345][ T4162] ? ext4_inc_count+0x190/0x190 [ 44.714189][ T4162] ? ext4_init_new_dir+0x7c8/0xa20 [ 44.719279][ T4162] ? ext4_init_dot_dotdot+0x4e0/0x4e0 [ 44.724632][ T4162] ext4_mkdir+0x54f/0xce0 [ 44.728942][ T4162] ? ext4_symlink+0xed0/0xed0 [ 44.733594][ T4162] ? inode_permission+0xf7/0x450 [ 44.738502][ T4162] ? bpf_lsm_inode_mkdir+0x5/0x10 [ 44.743500][ T4162] ? security_inode_mkdir+0xb4/0x100 [ 44.748760][ T4162] vfs_mkdir+0x3b6/0x590 [ 44.752980][ T4162] do_mkdirat+0x260/0x520 [ 44.757287][ T4162] ? vfs_mkdir+0x590/0x590 [ 44.761675][ T4162] ? getname_flags+0x1ec/0x4e0 [ 44.766419][ T4162] __x64_sys_mkdirat+0x85/0x90 [ 44.771155][ T4162] do_syscall_64+0x3b/0xb0 [ 44.775560][ T4162] ? clear_bhb_loop+0x15/0x70 [ 44.780223][ T4162] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 44.786090][ T4162] RIP: 0033:0x7fc4d05ed409 [ 44.790490][ T4162] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 44.810068][ T4162] RSP: 002b:00007ffcd6e3e128 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 44.818477][ T4162] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4d05ed409 [ 44.826430][ T4162] RDX: 5be60480b9579340 RSI: 0000000020000940 RDI: 00000000ffffff9c [ 44.834378][ T4162] RBP: 0000000000000000 R08: 00007ffcd6e3e180 R09: 00007ffcd6e3e180 [ 44.842325][ T4162] R10: 00007ffcd6e3e180 R11: 0000000000000246 R12: 00007ffcd6e3e180 [ 44.850271][ T4162] R13: 00007ffcd6e3e260 R14: 431bde82d7b634db R15: 00007fc4d063601d [ 44.858244][ T4162] [ 44.861240][ T4162] [ 44.863535][ T4162] The buggy address belongs to the page: [ 44.869318][ T4162] page:ffffea0001fbbbc0 refcount:3 mapcount:0 mapping:ffff888017895af0 index:0x3f pfn:0x7eeef [ 44.879537][ T4162] memcg:ffff888017684000 [ 44.883755][ T4162] aops:def_blk_aops ino:700000 [ 44.888492][ T4162] flags: 0xfff0000000202a(referenced|dirty|active|private|node=0|zone=1|lastcpupid=0x7ff) [ 44.898360][ T4162] raw: 00fff0000000202a 0000000000000000 dead000000000122 ffff888017895af0 [ 44.906916][ T4162] raw: 000000000000003f ffff888072bed828 00000003ffffffff ffff888017684000 [ 44.915478][ T4162] page dumped because: kasan: bad access detected [ 44.921870][ T4162] page_owner tracks the page as allocated [ 44.927552][ T4162] page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 4162, ts 44543099843, free_ts 39609028253 [ 44.944628][ T4162] get_page_from_freelist+0x3b78/0x3d40 [ 44.950153][ T4162] __alloc_pages+0x272/0x700 [ 44.954714][ T4162] __page_cache_alloc+0xd4/0x4a0 [ 44.959624][ T4162] pagecache_get_page+0xa91/0x1010 [ 44.964708][ T4162] __getblk_gfp+0x22a/0xaf0 [ 44.969181][ T4162] ext4_getblk+0x259/0x710 [ 44.973583][ T4162] ext4_bread+0x2a/0x170 [ 44.977797][ T4162] ext4_append+0x31f/0x5c0 [ 44.982197][ T4162] make_indexed_dir+0x515/0x15a0 [ 44.987110][ T4162] ext4_add_entry+0xde2/0x12b0 [ 44.991846][ T4162] ext4_mkdir+0x54f/0xce0 [ 44.996143][ T4162] vfs_mkdir+0x3b6/0x590 [ 45.000356][ T4162] do_mkdirat+0x260/0x520 [ 45.004651][ T4162] __x64_sys_mkdirat+0x85/0x90 [ 45.009385][ T4162] do_syscall_64+0x3b/0xb0 [ 45.013774][ T4162] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 45.019645][ T4162] page last free stack trace: [ 45.024296][ T4162] free_unref_page_prepare+0xc34/0xcf0 [ 45.029724][ T4162] free_unref_page_list+0x1f7/0x8e0 [ 45.034892][ T4162] release_pages+0x1bb9/0x1f40 [ 45.039629][ T4162] tlb_finish_mmu+0x177/0x320 [ 45.044278][ T4162] exit_mmap+0x3cd/0x670 [ 45.048490][ T4162] __mmput+0x112/0x3b0 [ 45.052546][ T4162] exit_mm+0x688/0x7f0 [ 45.056602][ T4162] do_exit+0x626/0x2480 [ 45.060732][ T4162] do_group_exit+0x144/0x310 [ 45.065291][ T4162] __x64_sys_exit_group+0x3b/0x40 [ 45.070285][ T4162] do_syscall_64+0x3b/0xb0 [ 45.074677][ T4162] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 45.080559][ T4162] [ 45.082856][ T4162] Memory state around the buggy address: [ 45.088465][ T4162] ffff88807eeeff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.096495][ T4162] ffff88807eeeff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.104522][ T4162] >ffff88807eef0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.112548][ T4162] ^ [ 45.116586][ T4162] ffff88807eef0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.124613][ T4162] ffff88807eef0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.132642][ T4162] ================================================================== [ 45.140671][ T4162] Disabling lock debugging due to kernel taint [ 45.147058][ T4162] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 45.154241][ T4162] CPU: 1 PID: 4162 Comm: syz-executor475 Tainted: G B 5.15.173-syzkaller #0 [ 45.164186][ T4162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 45.174209][ T4162] Call Trace: [ 45.177460][ T4162] [ 45.180362][ T4162] dump_stack_lvl+0x1e3/0x2d0 [ 45.185013][ T4162] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 45.190613][ T4162] ? panic+0x860/0x860 [ 45.194657][ T4162] ? preempt_schedule_common+0xa6/0xd0 [ 45.200084][ T4162] ? preempt_schedule+0xd9/0xe0 [ 45.204909][ T4162] panic+0x318/0x860 [ 45.208776][ T4162] ? check_panic_on_warn+0x1d/0xa0 [ 45.213860][ T4162] ? fb_is_primary_device+0xd0/0xd0 [ 45.219028][ T4162] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 45.224981][ T4162] ? _raw_spin_unlock+0x40/0x40 [ 45.229801][ T4162] ? print_memory_metadata+0xe2/0x140 [ 45.235145][ T4162] check_panic_on_warn+0x7e/0xa0 [ 45.240052][ T4162] ? ext4_insert_dentry+0x366/0x6c0 [ 45.245220][ T4162] end_report+0x6d/0xf0 [ 45.249344][ T4162] kasan_report+0x18e/0x1c0 [ 45.253815][ T4162] ? ext4_insert_dentry+0x366/0x6c0 [ 45.258983][ T4162] kasan_check_range+0x27e/0x290 [ 45.263889][ T4162] ? ext4_insert_dentry+0x366/0x6c0 [ 45.269060][ T4162] memcpy+0x3c/0x60 [ 45.272837][ T4162] ext4_insert_dentry+0x366/0x6c0 [ 45.277832][ T4162] add_dirent_to_buf+0x384/0x7d0 [ 45.282741][ T4162] ? ext4_dx_add_entry+0x1620/0x1620 [ 45.287996][ T4162] ? __ext4_handle_dirty_metadata+0x2ef/0x800 [ 45.294039][ T4162] make_indexed_dir+0xf34/0x15a0 [ 45.298950][ T4162] ? add_dirent_to_buf+0x7d0/0x7d0 [ 45.304030][ T4162] ? add_dirent_to_buf+0x54e/0x7d0 [ 45.309112][ T4162] ? ext4_dx_add_entry+0x1620/0x1620 [ 45.314367][ T4162] ? __ext4_read_dirblock+0x522/0x890 [ 45.319707][ T4162] ext4_add_entry+0xde2/0x12b0 [ 45.324447][ T4162] ? ext4_inc_count+0x190/0x190 [ 45.329270][ T4162] ? ext4_init_new_dir+0x7c8/0xa20 [ 45.334352][ T4162] ? ext4_init_dot_dotdot+0x4e0/0x4e0 [ 45.339696][ T4162] ext4_mkdir+0x54f/0xce0 [ 45.343997][ T4162] ? ext4_symlink+0xed0/0xed0 [ 45.348651][ T4162] ? inode_permission+0xf7/0x450 [ 45.353559][ T4162] ? bpf_lsm_inode_mkdir+0x5/0x10 [ 45.358554][ T4162] ? security_inode_mkdir+0xb4/0x100 [ 45.363809][ T4162] vfs_mkdir+0x3b6/0x590 [ 45.368020][ T4162] do_mkdirat+0x260/0x520 [ 45.372319][ T4162] ? vfs_mkdir+0x590/0x590 [ 45.376704][ T4162] ? getname_flags+0x1ec/0x4e0 [ 45.381443][ T4162] __x64_sys_mkdirat+0x85/0x90 [ 45.386175][ T4162] do_syscall_64+0x3b/0xb0 [ 45.390560][ T4162] ? clear_bhb_loop+0x15/0x70 [ 45.395205][ T4162] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 45.401082][ T4162] RIP: 0033:0x7fc4d05ed409 [ 45.405471][ T4162] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 45.425045][ T4162] RSP: 002b:00007ffcd6e3e128 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 45.433429][ T4162] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4d05ed409 [ 45.441389][ T4162] RDX: 5be60480b9579340 RSI: 0000000020000940 RDI: 00000000ffffff9c [ 45.449331][ T4162] RBP: 0000000000000000 R08: 00007ffcd6e3e180 R09: 00007ffcd6e3e180 [ 45.457273][ T4162] R10: 00007ffcd6e3e180 R11: 0000000000000246 R12: 00007ffcd6e3e180 [ 45.465229][ T4162] R13: 00007ffcd6e3e260 R14: 431bde82d7b634db R15: 00007fc4d063601d [ 45.473175][ T4162] [ 45.476370][ T4162] Kernel Offset: disabled [ 45.480681][ T4162] Rebooting in 86400 seconds..