./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1880636350
<...>
Warning: Permanently added '10.128.0.216' (ECDSA) to the list of known hosts.
execve("./syz-executor1880636350", ["./syz-executor1880636350"], 0x7ffd1ec3f4a0 /* 10 vars */) = 0
brk(NULL) = 0x55555691f000
brk(0x55555691fc40) = 0x55555691fc40
arch_prctl(ARCH_SET_FS, 0x55555691f300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1880636350", 4096) = 28
brk(0x555556940c40) = 0x555556940c40
brk(0x555556941000) = 0x555556941000
mprotect(0x7f79ab54a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 4993
mkdir("./syzkaller.vbaE6K", 0700) = 0
chmod("./syzkaller.vbaE6K", 0777) = 0
chdir("./syzkaller.vbaE6K") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555691f5d0) = 4994
./strace-static-x86_64: Process 4994 attached
[pid 4994] chdir("./0") = 0
[pid 4994] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4994] setpgid(0, 0) = 0
[pid 4994] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4994] write(3, "1000", 4) = 4
[pid 4994] close(3) = 0
[pid 4994] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4994] memfd_create("syzkaller", 0) = 3
[pid 4994] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f79a306f000
[pid 4994] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 4994] munmap(0x7f79a306f000, 1048576) = 0
[pid 4994] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4994] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4994] close(3) = 0
[pid 4994] mkdir("./file0", 0777) = 0
[ 72.468808][ T4994] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4994 'syz-executor188'
[ 72.499093][ T4994] loop0: detected capacity change from 0 to 2048
[ 72.508900][ T4994] =======================================================
[ 72.508900][ T4994] WARNING: The mand mount option has been deprecated and
[ 72.508900][ T4994] and is ignored by this kernel. Remove the mand
[ 72.508900][ T4994] option from the mount to silence this warning.
[ 72.508900][ T4994] =======================================================
[ 72.549670][ T4994] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[pid 4994] mount("/dev/loop0", "./file0", "udf", MS_NODEV|MS_MANDLOCK|MS_NOATIME|MS_REC|MS_POSIXACL, "") = 0
[pid 4994] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 4994] chdir("./file0") = 0
[pid 4994] ioctl(4, LOOP_CLR_FD) = 0
[pid 4994] close(4) = 0
[pid 4994] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4
[pid 4994] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 4994] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 4994] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[ 72.562044][ T4994] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 4994] memfd_create("syzkaller", 0) = 6
[pid 4994] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f799ad6f000
[pid 4994] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 4994] munmap(0x7f799ad6f000, 2097152) = 0
[pid 4994] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 4994] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4994] ioctl(7, LOOP_CLR_FD) = 0
[pid 4994] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4994] close(7) = 0
[pid 4994] close(6) = 0
[pid 4994] exit_group(0) = ?
[pid 4994] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4994, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556920620 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./0/binderfs") = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x555556928660 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556928660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./0/file0") = 0
getdents64(3, 0x555556920620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555691f5d0) = 4996
./strace-static-x86_64: Process 4996 attached
[pid 4996] chdir("./1") = 0
[pid 4996] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4996] setpgid(0, 0) = 0
[pid 4996] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4996] write(3, "1000", 4) = 4
[pid 4996] close(3) = 0
[pid 4996] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4996] memfd_create("syzkaller", 0) = 3
[pid 4996] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f79a306f000
[pid 4996] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 4996] munmap(0x7f79a306f000, 1048576) = 0
[pid 4996] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4996] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4996] close(3) = 0
[pid 4996] mkdir("./file0", 0777) = 0
[pid 4996] mount("/dev/loop0", "./file0", "udf", MS_NODEV|MS_MANDLOCK|MS_NOATIME|MS_REC|MS_POSIXACL, "") = 0
[pid 4996] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 4996] chdir("./file0") = 0
[pid 4996] ioctl(4, LOOP_CLR_FD) = 0
[pid 4996] close(4) = 0
[pid 4996] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4
[pid 4996] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 4996] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 4996] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[pid 4996] memfd_create("syzkaller", 0) = 6
[pid 4996] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f799ad6f000
[ 72.778020][ T4996] loop0: detected capacity change from 0 to 2048
[ 72.790585][ T4996] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[ 72.802108][ T4996] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 4996] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 4996] munmap(0x7f799ad6f000, 2097152) = 0
[pid 4996] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 4996] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4996] ioctl(7, LOOP_CLR_FD) = 0
[pid 4996] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4996] close(7) = 0
[pid 4996] close(6) = 0
[pid 4996] exit_group(0) = ?
[pid 4996] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4996, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} ---
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556920620 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./1/binderfs") = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x555556928660 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556928660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./1/file0") = 0
getdents64(3, 0x555556920620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./1") = 0
mkdir("./2", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555691f5d0) = 4997
./strace-static-x86_64: Process 4997 attached
[pid 4997] chdir("./2") = 0
[pid 4997] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4997] setpgid(0, 0) = 0
[pid 4997] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4997] write(3, "1000", 4) = 4
[pid 4997] close(3) = 0
[pid 4997] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4997] memfd_create("syzkaller", 0) = 3
[pid 4997] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f79a306f000
[pid 4997] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 4997] munmap(0x7f79a306f000, 1048576) = 0
[pid 4997] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4997] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4997] close(3) = 0
[pid 4997] mkdir("./file0", 0777) = 0
[pid 4997] mount("/dev/loop0", "./file0", "udf", MS_NODEV|MS_MANDLOCK|MS_NOATIME|MS_REC|MS_POSIXACL, "") = 0
[pid 4997] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 4997] chdir("./file0") = 0
[pid 4997] ioctl(4, LOOP_CLR_FD) = 0
[pid 4997] close(4) = 0
[pid 4997] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4
[pid 4997] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 4997] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 4997] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[pid 4997] memfd_create("syzkaller", 0) = 6
[pid 4997] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f799ad6f000
[ 72.992342][ T4997] loop0: detected capacity change from 0 to 2048
[ 73.004983][ T4997] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[ 73.017353][ T4997] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 4997] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 4997] munmap(0x7f799ad6f000, 2097152) = 0
[pid 4997] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 4997] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4997] ioctl(7, LOOP_CLR_FD) = 0
[pid 4997] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 4997] close(7) = 0
[pid 4997] close(6) = 0
[pid 4997] exit_group(0) = ?
[pid 4997] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4997, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=6 /* 0.06 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556920620 /* 4 entries */, 32768) = 112
umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./2/binderfs") = 0
[ 73.132615][ T4993] ==================================================================
[ 73.140726][ T4993] BUG: KASAN: use-after-free in crc_itu_t+0x21c/0x2a0
[ 73.147538][ T4993] Read of size 1 at addr ffff888072f72000 by task syz-executor188/4993
[ 73.155781][ T4993]
[ 73.158106][ T4993] CPU: 0 PID: 4993 Comm: syz-executor188 Not tainted 6.4.0-rc3-syzkaller-00032-g933174ae28ba #0
[ 73.168515][ T4993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/16/2023
[ 73.178568][ T4993] Call Trace:
[ 73.181844][ T4993]
[ 73.184779][ T4993] dump_stack_lvl+0x1e7/0x2d0
[ 73.189470][ T4993] ? nf_tcp_handle_invalid+0x650/0x650
[ 73.194957][ T4993] ? panic+0x770/0x770
[ 73.199028][ T4993] ? _printk+0xd5/0x120
[ 73.203186][ T4993] print_report+0x163/0x540
[ 73.207694][ T4993] ? ktime_get_real_ts64+0x460/0x460
[ 73.212983][ T4993] ? time64_to_tm+0x331/0x4d0
[ 73.217669][ T4993] ? __virt_addr_valid+0x22f/0x2e0
[ 73.222785][ T4993] ? __phys_addr+0xba/0x170
[ 73.227292][ T4993] ? crc_itu_t+0x21c/0x2a0
[ 73.231720][ T4993] kasan_report+0x176/0x1b0
[ 73.236232][ T4993] ? crc_itu_t+0x21c/0x2a0
[ 73.240662][ T4993] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 73.246940][ T4993] crc_itu_t+0x21c/0x2a0
[ 73.251196][ T4993] udf_sync_fs+0x1d2/0x380
[ 73.255626][ T4993] ? udf_put_super+0x160/0x160
[ 73.260404][ T4993] sync_filesystem+0xec/0x220
[ 73.265089][ T4993] generic_shutdown_super+0x6f/0x340
[ 73.270381][ T4993] kill_block_super+0x84/0xf0
[ 73.275065][ T4993] deactivate_locked_super+0xa4/0x110
[ 73.280449][ T4993] cleanup_mnt+0x426/0x4c0
[ 73.284875][ T4993] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.290081][ T4993] task_work_run+0x24a/0x300
[ 73.294675][ T4993] ? dput+0x3a1/0x420
[ 73.298664][ T4993] ? task_work_cancel+0x2b0/0x2b0
[ 73.303724][ T4993] ? __x64_sys_umount+0x126/0x170
[ 73.308761][ T4993] ptrace_notify+0x2cd/0x380
[ 73.313383][ T4993] ? do_notify_parent+0xf50/0xf50
[ 73.318427][ T4993] ? user_path_at_empty+0x12f/0x180
[ 73.323635][ T4993] ? __x64_sys_umount+0x126/0x170
[ 73.328693][ T4993] ? path_umount+0xea0/0xea0
[ 73.333320][ T4993] ? syscall_enter_from_user_mode+0x32/0x230
[ 73.339318][ T4993] syscall_exit_to_user_mode+0x157/0x280
[ 73.344995][ T4993] do_syscall_64+0x4d/0xc0
[ 73.349428][ T4993] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 73.355334][ T4993] RIP: 0033:0x7f79ab4bdeb7
[ 73.359762][ T4993] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 73.379465][ T4993] RSP: 002b:00007fff991304a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 73.387892][ T4993] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f79ab4bdeb7
[ 73.395871][ T4993] RDX: 00007fff99130569 RSI: 000000000000000a RDI: 00007fff99130560
[ 73.403854][ T4993] RBP: 00007fff99130560 R08: 00000000ffffffff R09: 00007fff99130340
[ 73.411836][ T4993] R10: 0000555556920653 R11: 0000000000000202 R12: 00007fff991315d0
[ 73.419813][ T4993] R13: 00005555569205f0 R14: 00007fff991304d0 R15: 0000000000000003
[ 73.427799][ T4993]
[ 73.430820][ T4993]
[ 73.433146][ T4993] The buggy address belongs to the physical page:
[ 73.439559][ T4993] page:ffffea0001cbdc80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x72f72
[ 73.449714][ T4993] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 73.456826][ T4993] page_type: 0xffffffff()
[ 73.461158][ T4993] raw: 00fff00000000000 ffffea0001c9e848 ffffea0001de84c8 0000000000000000
[ 73.469746][ T4993] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 73.478324][ T4993] page dumped because: kasan: bad access detected
[ 73.484742][ T4993] page_owner tracks the page as freed
[ 73.490107][ T4993] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 4997, tgid 4997 (syz-executor188), ts 72961165997, free_ts 73098209585
[ 73.508090][ T4993] post_alloc_hook+0x1e6/0x210
[ 73.512864][ T4993] get_page_from_freelist+0x321c/0x33a0
[ 73.518419][ T4993] __alloc_pages+0x255/0x670
[ 73.523100][ T4993] __folio_alloc+0x13/0x30
[ 73.527524][ T4993] vma_alloc_folio+0x48a/0x9a0
[ 73.532294][ T4993] do_wp_page+0xb35/0x3690
[ 73.536718][ T4993] handle_mm_fault+0x2371/0x5860
[ 73.541664][ T4993] exc_page_fault+0x7d2/0x910
[ 73.546344][ T4993] asm_exc_page_fault+0x26/0x30
[ 73.551199][ T4993] page last free stack trace:
[ 73.555866][ T4993] free_unref_page_prepare+0x903/0xa30
[ 73.561329][ T4993] free_unref_page_list+0x596/0x830
[ 73.566534][ T4993] release_pages+0x2193/0x2470
[ 73.571303][ T4993] tlb_flush_mmu+0x100/0x210
[ 73.575902][ T4993] tlb_finish_mmu+0xd4/0x1f0
[ 73.580494][ T4993] exit_mmap+0x3da/0xaf0
[ 73.584741][ T4993] __mmput+0x115/0x3c0
[ 73.588813][ T4993] exit_mm+0x227/0x310
[ 73.592881][ T4993] do_exit+0x612/0x2290
[ 73.597038][ T4993] do_group_exit+0x206/0x2c0
[ 73.601631][ T4993] __x64_sys_exit_group+0x3f/0x40
[ 73.606746][ T4993] do_syscall_64+0x41/0xc0
[ 73.611175][ T4993] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 73.617075][ T4993]
[ 73.619408][ T4993] Memory state around the buggy address:
[ 73.625042][ T4993] ffff888072f71f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 73.633107][ T4993] ffff888072f71f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 73.641167][ T4993] >ffff888072f72000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.649224][ T4993] ^
[ 73.653288][ T4993] ffff888072f72080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.661350][ T4993] ffff888072f72100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.669415][ T4993] ==================================================================
[ 73.677833][ T4993] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.685056][ T4993] CPU: 0 PID: 4993 Comm: syz-executor188 Not tainted 6.4.0-rc3-syzkaller-00032-g933174ae28ba #0
[ 73.695496][ T4993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/16/2023
[ 73.705559][ T4993] Call Trace:
[ 73.708845][ T4993]
[ 73.711784][ T4993] dump_stack_lvl+0x1e7/0x2d0
[ 73.716487][ T4993] ? nf_tcp_handle_invalid+0x650/0x650
[ 73.721959][ T4993] ? panic+0x770/0x770
[ 73.726037][ T4993] ? preempt_schedule_common+0x83/0xc0
[ 73.731510][ T4993] ? vscnprintf+0x5d/0x80
[ 73.735852][ T4993] panic+0x30f/0x770
[ 73.739754][ T4993] ? check_panic_on_warn+0x21/0xa0
[ 73.744876][ T4993] ? __memcpy_flushcache+0x2b0/0x2b0
[ 73.750169][ T4993] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 73.756154][ T4993] ? _raw_spin_unlock+0x40/0x40
[ 73.761016][ T4993] check_panic_on_warn+0x82/0xa0
[ 73.765967][ T4993] ? crc_itu_t+0x21c/0x2a0
[ 73.770409][ T4993] end_report+0x63/0x110
[ 73.774673][ T4993] kasan_report+0x183/0x1b0
[ 73.779186][ T4993] ? crc_itu_t+0x21c/0x2a0
[ 73.783612][ T4993] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 73.789866][ T4993] crc_itu_t+0x21c/0x2a0
[ 73.794121][ T4993] udf_sync_fs+0x1d2/0x380
[ 73.798547][ T4993] ? udf_put_super+0x160/0x160
[ 73.803322][ T4993] sync_filesystem+0xec/0x220
[ 73.808004][ T4993] generic_shutdown_super+0x6f/0x340
[ 73.813299][ T4993] kill_block_super+0x84/0xf0
[ 73.817983][ T4993] deactivate_locked_super+0xa4/0x110
[ 73.823371][ T4993] cleanup_mnt+0x426/0x4c0
[ 73.827795][ T4993] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.833003][ T4993] task_work_run+0x24a/0x300
[ 73.837596][ T4993] ? dput+0x3a1/0x420
[ 73.841581][ T4993] ? task_work_cancel+0x2b0/0x2b0
[ 73.846614][ T4993] ? __x64_sys_umount+0x126/0x170
[ 73.851648][ T4993] ptrace_notify+0x2cd/0x380
[ 73.856245][ T4993] ? do_notify_parent+0xf50/0xf50
[ 73.861277][ T4993] ? user_path_at_empty+0x12f/0x180
[ 73.866484][ T4993] ? __x64_sys_umount+0x126/0x170
[ 73.871516][ T4993] ? path_umount+0xea0/0xea0
[ 73.876117][ T4993] ? syscall_enter_from_user_mode+0x32/0x230
[ 73.882107][ T4993] syscall_exit_to_user_mode+0x157/0x280
[ 73.887748][ T4993] do_syscall_64+0x4d/0xc0
[ 73.892181][ T4993] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 73.898082][ T4993] RIP: 0033:0x7f79ab4bdeb7
[ 73.902502][ T4993] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 73.922543][ T4993] RSP: 002b:00007fff991304a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 73.930963][ T4993] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f79ab4bdeb7
[ 73.938936][ T4993] RDX: 00007fff99130569 RSI: 000000000000000a RDI: 00007fff99130560
[ 73.946908][ T4993] RBP: 00007fff99130560 R08: 00000000ffffffff R09: 00007fff99130340
[ 73.954878][ T4993] R10: 0000555556920653 R11: 0000000000000202 R12: 00007fff991315d0
[ 73.962852][ T4993] R13: 00005555569205f0 R14: 00007fff991304d0 R15: 0000000000000003
[ 73.970832][ T4993]
[ 73.974212][ T4993] Kernel Offset: disabled
[ 73.978580][ T4993] Rebooting in 86400 seconds..