./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4272419338
<...>
Warning: Permanently added '10.128.0.91' (ED25519) to the list of known hosts.
execve("./syz-executor4272419338", ["./syz-executor4272419338"], 0x7fff32b98da0 /* 10 vars */) = 0
brk(NULL) = 0x55556799f000
brk(0x55556799fd00) = 0x55556799fd00
arch_prctl(ARCH_SET_FS, 0x55556799f380) = 0
set_tid_address(0x55556799f650) = 5076
set_robust_list(0x55556799f660, 24) = 0
rseq(0x55556799fca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor4272419338", 4096) = 28
getrandom("\x11\x97\x8a\x6c\x7c\x8e\x6a\x5b", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55556799fd00
brk(0x5555679c0d00) = 0x5555679c0d00
brk(0x5555679c1000) = 0x5555679c1000
mprotect(0x7f722cc04000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.7a9jcJ", 0700) = 0
chmod("./syzkaller.7a9jcJ", 0777) = 0
chdir("./syzkaller.7a9jcJ") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5077 attached
, child_tidptr=0x55556799f650) = 5077
[pid 5077] set_robust_list(0x55556799f660, 24) = 0
[pid 5077] chdir("./0") = 0
[pid 5077] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5077] setpgid(0, 0) = 0
[pid 5077] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5077] write(3, "1000", 4) = 4
[pid 5077] close(3) = 0
[pid 5077] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5077] memfd_create("syzkaller", 0) = 3
[pid 5077] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7224600000
[pid 5077] write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x02\x02\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x0f\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\xff\x03\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\x8f\x24\x2d\x5f\x49\x6d\x50\x0b\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 5077] munmap(0x7f7224600000, 138412032) = 0
[pid 5077] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5077] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5077] close(3) = 0
[pid 5077] close(4) = 0
[pid 5077] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[ 74.330114][ T5077] loop0: detected capacity change from 0 to 4096
[pid 5077] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "ntfs3", MS_SYNCHRONOUS|MS_STRICTATIME, "fmask=00000000000000000000177,showmeta,acl,prealloc,showmeta,iocharset=cp1251,sparse,dmask=000000000"...) = 0
[pid 5077] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5077] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5077] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5077] open("./bus", O_RDWR|O_CREAT|O_SYNC|FASYNC, 000) = 4
[pid 5077] mknodat(AT_FDCWD, "./file0", S_IFCHR|S_ISUID|S_ISGID|S_ISVTX|0733, makedev(0x1, 0x3)) = 0
[pid 5077] openat(AT_FDCWD, "./file0", O_RDONLY) = 5
[pid 5077] creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 6
[pid 5077] rename("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = -1 ENOENT (No such file or directory)
[pid 5077] exit_group(0) = ?
[pid 5077] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5077, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} ---
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555679a06f0 /* 4 entries */, 32768) = 176
[ 74.426905][ T5077] ntfs3: loop0: ino=22, "file0" ntfs_rename
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555679a8730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555679a8730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
getdents64(3, 0x5555679a06f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5079 attached
, child_tidptr=0x55556799f650) = 5079
[pid 5079] set_robust_list(0x55556799f660, 24) = 0
[pid 5079] chdir("./1") = 0
[pid 5079] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5079] setpgid(0, 0) = 0
[pid 5079] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5079] write(3, "1000", 4) = 4
[pid 5079] close(3) = 0
[pid 5079] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5079] memfd_create("syzkaller", 0) = 3
[pid 5079] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7224600000
[pid 5079] write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x02\x02\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x0f\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\xff\x03\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\x8f\x24\x2d\x5f\x49\x6d\x50\x0b\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 5079] munmap(0x7f7224600000, 138412032) = 0
[pid 5079] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5079] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5079] close(3) = 0
[pid 5079] close(4) = 0
[pid 5079] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[ 74.756247][ T5079] loop0: detected capacity change from 0 to 4096
[pid 5079] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "ntfs3", MS_SYNCHRONOUS|MS_STRICTATIME, "fmask=00000000000000000000177,showmeta,acl,prealloc,showmeta,iocharset=cp1251,sparse,dmask=000000000"...) = 0
[pid 5079] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5079] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5079] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5079] open("./bus", O_RDWR|O_CREAT|O_SYNC|FASYNC, 000) = 4
[pid 5079] mknodat(AT_FDCWD, "./file0", S_IFCHR|S_ISUID|S_ISGID|S_ISVTX|0733, makedev(0x1, 0x3)) = 0
[ 74.844917][ T5079] ==================================================================
[ 74.853052][ T5079] BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0
[ 74.861588][ T5079] Read of size 8 at addr ffff888076eed7c8 by task syz-executor427/5079
[ 74.869818][ T5079]
[ 74.872140][ T5079] CPU: 0 PID: 5079 Comm: syz-executor427 Not tainted 6.9.0-rc5-syzkaller-00053-ge33c4963bf53 #0
[ 74.882544][ T5079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 74.892593][ T5079] Call Trace:
[ 74.895867][ T5079]
[ 74.898797][ T5079] dump_stack_lvl+0x241/0x360
[ 74.903505][ T5079] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.908723][ T5079] ? __pfx__printk+0x10/0x10
[ 74.913324][ T5079] ? _printk+0xd5/0x120
[ 74.917491][ T5079] ? __virt_addr_valid+0x183/0x520
[ 74.922615][ T5079] ? __virt_addr_valid+0x183/0x520
[ 74.927740][ T5079] print_report+0x169/0x550
[ 74.932253][ T5079] ? __virt_addr_valid+0x183/0x520
[ 74.937374][ T5079] ? __virt_addr_valid+0x183/0x520
[ 74.942498][ T5079] ? __virt_addr_valid+0x44e/0x520
[ 74.947621][ T5079] ? __phys_addr+0xba/0x170
[ 74.952167][ T5079] ? __list_add_valid_or_report+0x4c/0xf0
[ 74.957889][ T5079] kasan_report+0x143/0x180
[ 74.962433][ T5079] ? __list_add_valid_or_report+0x4c/0xf0
[ 74.968159][ T5079] __list_add_valid_or_report+0x4c/0xf0
[ 74.973797][ T5079] chrdev_open+0x2a9/0x630
[ 74.978227][ T5079] ? __pfx_chrdev_open+0x10/0x10
[ 74.983182][ T5079] ? security_file_open+0x406/0x570
[ 74.988388][ T5079] ? __pfx_try_module_get+0x1/0x10
[ 74.993511][ T5079] ? __pfx_chrdev_open+0x10/0x10
[ 74.998457][ T5079] do_dentry_open+0x907/0x15a0
[ 75.003245][ T5079] path_openat+0x2860/0x3240
[ 75.007844][ T5079] ? __pfx_stack_trace_save+0x10/0x10
[ 75.013231][ T5079] ? __lock_acquire+0x1346/0x1fd0
[ 75.018258][ T5079] ? mark_lock+0x9a/0x350
[ 75.022598][ T5079] ? __pfx_path_openat+0x10/0x10
[ 75.027550][ T5079] do_filp_open+0x235/0x490
[ 75.032062][ T5079] ? __pfx_do_filp_open+0x10/0x10
[ 75.037112][ T5079] ? _raw_spin_unlock+0x28/0x50
[ 75.041977][ T5079] ? alloc_fd+0x59d/0x640
[ 75.046320][ T5079] do_sys_openat2+0x13e/0x1d0
[ 75.051014][ T5079] ? __pfx_do_sys_openat2+0x10/0x10
[ 75.056212][ T5079] ? lockdep_hardirqs_on+0x99/0x150
[ 75.061435][ T5079] ? _raw_spin_unlock_irq+0x2e/0x50
[ 75.066657][ T5079] ? ptrace_notify+0x279/0x380
[ 75.071436][ T5079] __x64_sys_openat+0x247/0x2a0
[ 75.076292][ T5079] ? __pfx___x64_sys_openat+0x10/0x10
[ 75.081669][ T5079] ? do_syscall_64+0x102/0x240
[ 75.086451][ T5079] do_syscall_64+0xf5/0x240
[ 75.090970][ T5079] ? clear_bhb_loop+0x35/0x90
[ 75.095653][ T5079] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.101556][ T5079] RIP: 0033:0x7f722cb71329
[ 75.105974][ T5079] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 75.125583][ T5079] RSP: 002b:00007fff23332778 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 75.134001][ T5079] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f722cb71329
[ 75.141972][ T5079] RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c
[ 75.149941][ T5079] RBP: 0000000000000000 R08: 00007fff233327b0 R09: 00007fff233327b0
[ 75.157915][ T5079] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff2333279c
[ 75.165924][ T5079] R13: 0000000000000001 R14: 431bde82d7b634db R15: 00007fff233327d0
[ 75.173909][ T5079]
[ 75.176926][ T5079]
[ 75.179248][ T5079] Allocated by task 5077:
[ 75.183571][ T5079] kasan_save_track+0x3f/0x80
[ 75.188255][ T5079] __kasan_slab_alloc+0x66/0x80
[ 75.193109][ T5079] kmem_cache_alloc_lru+0x178/0x350
[ 75.198315][ T5079] ntfs_alloc_inode+0x28/0x80
[ 75.202993][ T5079] new_inode_pseudo+0x69/0x1e0
[ 75.207767][ T5079] new_inode+0x22/0x1d0
[ 75.211928][ T5079] ntfs_new_inode+0x45/0x100
[ 75.216532][ T5079] ntfs_create_inode+0x687/0x3c30
[ 75.221561][ T5079] ntfs_mknod+0x41/0x60
[ 75.225726][ T5079] vfs_mknod+0x36d/0x3b0
[ 75.229981][ T5079] do_mknodat+0x3ec/0x5b0
[ 75.234307][ T5079] __x64_sys_mknodat+0xa9/0xc0
[ 75.239086][ T5079] do_syscall_64+0xf5/0x240
[ 75.243597][ T5079] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.249488][ T5079]
[ 75.251806][ T5079] Freed by task 0:
[ 75.255520][ T5079] kasan_save_track+0x3f/0x80
[ 75.260198][ T5079] kasan_save_free_info+0x40/0x50
[ 75.265243][ T5079] poison_slab_object+0xa6/0xe0
[ 75.270130][ T5079] __kasan_slab_free+0x37/0x60
[ 75.274929][ T5079] kmem_cache_free+0x10b/0x2c0
[ 75.279704][ T5079] rcu_core+0xafd/0x1830
[ 75.283944][ T5079] __do_softirq+0x2c6/0x980
[ 75.288455][ T5079]
[ 75.290790][ T5079] Last potentially related work creation:
[ 75.296604][ T5079] kasan_save_stack+0x3f/0x60
[ 75.301298][ T5079] __kasan_record_aux_stack+0xac/0xc0
[ 75.306689][ T5079] call_rcu+0x167/0xa70
[ 75.310859][ T5079] __dentry_kill+0x20d/0x630
[ 75.315462][ T5079] shrink_kill+0xa9/0x2c0
[ 75.319793][ T5079] shrink_dentry_list+0x2c0/0x5b0
[ 75.324822][ T5079] shrink_dcache_parent+0xcb/0x3b0
[ 75.329937][ T5079] do_one_tree+0x23/0xe0
[ 75.334217][ T5079] shrink_dcache_for_umount+0x7d/0x130
[ 75.339687][ T5079] generic_shutdown_super+0x6a/0x2d0
[ 75.344982][ T5079] kill_block_super+0x44/0x90
[ 75.349667][ T5079] ntfs3_kill_sb+0x44/0x1b0
[ 75.354174][ T5079] deactivate_locked_super+0xc4/0x130
[ 75.359548][ T5079] cleanup_mnt+0x426/0x4c0
[ 75.363980][ T5079] task_work_run+0x24f/0x310
[ 75.368579][ T5079] ptrace_notify+0x2d2/0x380
[ 75.373177][ T5079] syscall_exit_work+0xc6/0x190
[ 75.378032][ T5079] syscall_exit_to_user_mode+0x273/0x370
[ 75.383673][ T5079] do_syscall_64+0x102/0x240
[ 75.388276][ T5079] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.394174][ T5079]
[ 75.396494][ T5079] The buggy address belongs to the object at ffff888076eed120
[ 75.396494][ T5079] which belongs to the cache ntfs_inode_cache of size 1760
[ 75.411071][ T5079] The buggy address is located 1704 bytes inside of
[ 75.411071][ T5079] freed 1760-byte region [ffff888076eed120, ffff888076eed800)
[ 75.425040][ T5079]
[ 75.427365][ T5079] The buggy address belongs to the physical page:
[ 75.433772][ T5079] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76ee8
[ 75.442532][ T5079] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 75.450071][ T5079] flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
[ 75.458047][ T5079] page_type: 0xffffffff()
[ 75.462380][ T5079] raw: 00fff80000000840 ffff888019777dc0 dead000000000122 0000000000000000
[ 75.470968][ T5079] raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
[ 75.479556][ T5079] head: 00fff80000000840 ffff888019777dc0 dead000000000122 0000000000000000
[ 75.488226][ T5079] head: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
[ 75.496899][ T5079] head: 00fff80000000003 ffffea0001dbba01 dead000000000122 00000000ffffffff
[ 75.505568][ T5079] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
[ 75.514232][ T5079] page dumped because: kasan: bad access detected
[ 75.520635][ T5079] page_owner tracks the page as allocated
[ 75.526363][ T5079] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 5077, tgid 1360935967 (syz-executor427), ts 5077, free_ts 25749663853
[ 75.548849][ T5079] post_alloc_hook+0x1ea/0x210
[ 75.553626][ T5079] get_page_from_freelist+0x3410/0x35b0
[ 75.559197][ T5079] __alloc_pages+0x256/0x6c0
[ 75.563821][ T5079] alloc_slab_page+0x5f/0x160
[ 75.568519][ T5079] new_slab+0x84/0x2f0
[ 75.572601][ T5079] ___slab_alloc+0xc73/0x1260
[ 75.577288][ T5079] kmem_cache_alloc_lru+0x253/0x350
[ 75.582501][ T5079] ntfs_alloc_inode+0x28/0x80
[ 75.587183][ T5079] iget5_locked+0xa4/0x280
[ 75.591608][ T5079] ntfs_iget5+0xc7/0x3b70
[ 75.595936][ T5079] ntfs_fill_super+0x2f01/0x49c0
[ 75.600876][ T5079] get_tree_bdev+0x3f7/0x570
[ 75.605485][ T5079] vfs_get_tree+0x90/0x2a0
[ 75.609911][ T5079] do_new_mount+0x2be/0xb40
[ 75.614430][ T5079] __se_sys_mount+0x2d9/0x3c0
[ 75.619133][ T5079] do_syscall_64+0xf5/0x240
[ 75.623680][ T5079] page last free pid 1 tgid 1 stack trace:
[ 75.629494][ T5079] free_unref_page_prepare+0x97b/0xaa0
[ 75.634977][ T5079] free_unref_page+0x37/0x3f0
[ 75.639659][ T5079] free_contig_range+0x9e/0x160
[ 75.644515][ T5079] destroy_args+0x8a/0x890
[ 75.648950][ T5079] debug_vm_pgtable+0x4be/0x550
[ 75.653808][ T5079] do_one_initcall+0x248/0x880
[ 75.658580][ T5079] do_initcall_level+0x157/0x210
[ 75.663527][ T5079] do_initcalls+0x3f/0x80
[ 75.667863][ T5079] kernel_init_freeable+0x435/0x5d0
[ 75.673067][ T5079] kernel_init+0x1d/0x2b0
[ 75.677396][ T5079] ret_from_fork+0x4b/0x80
[ 75.681820][ T5079] ret_from_fork_asm+0x1a/0x30
[ 75.686612][ T5079]
[ 75.688945][ T5079] Memory state around the buggy address:
[ 75.694593][ T5079] ffff888076eed680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.702665][ T5079] ffff888076eed700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.710726][ T5079] >ffff888076eed780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.718796][ T5079] ^
[ 75.725222][ T5079] ffff888076eed800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 75.733300][ T5079] ffff888076eed880: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.741367][ T5079] ==================================================================
[ 75.750032][ T5079] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.757428][ T5079] CPU: 0 PID: 5079 Comm: syz-executor427 Not tainted 6.9.0-rc5-syzkaller-00053-ge33c4963bf53 #0
[ 75.767938][ T5079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 75.778000][ T5079] Call Trace:
[ 75.781285][ T5079]
[ 75.784219][ T5079] dump_stack_lvl+0x241/0x360
[ 75.788914][ T5079] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.794131][ T5079] ? __pfx__printk+0x10/0x10
[ 75.798736][ T5079] ? vscnprintf+0x5d/0x90
[ 75.803071][ T5079] panic+0x349/0x860
[ 75.806984][ T5079] ? check_panic_on_warn+0x21/0xb0
[ 75.812106][ T5079] ? __pfx_panic+0x10/0x10
[ 75.816531][ T5079] ? mark_lock+0x9a/0x350
[ 75.820865][ T5079] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 75.826776][ T5079] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 75.832682][ T5079] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 75.839020][ T5079] ? print_report+0x502/0x550
[ 75.843707][ T5079] check_panic_on_warn+0x86/0xb0
[ 75.848667][ T5079] ? __list_add_valid_or_report+0x4c/0xf0
[ 75.854391][ T5079] end_report+0x77/0x160
[ 75.858643][ T5079] kasan_report+0x154/0x180
[ 75.863169][ T5079] ? __list_add_valid_or_report+0x4c/0xf0
[ 75.868894][ T5079] __list_add_valid_or_report+0x4c/0xf0
[ 75.874446][ T5079] chrdev_open+0x2a9/0x630
[ 75.878885][ T5079] ? __pfx_chrdev_open+0x10/0x10
[ 75.883835][ T5079] ? security_file_open+0x406/0x570
[ 75.889040][ T5079] ? __pfx_try_module_get+0x1/0x10
[ 75.894160][ T5079] ? __pfx_chrdev_open+0x10/0x10
[ 75.899108][ T5079] do_dentry_open+0x907/0x15a0
[ 75.903899][ T5079] path_openat+0x2860/0x3240
[ 75.908506][ T5079] ? __pfx_stack_trace_save+0x10/0x10
[ 75.913896][ T5079] ? __lock_acquire+0x1346/0x1fd0
[ 75.918933][ T5079] ? mark_lock+0x9a/0x350
[ 75.923276][ T5079] ? __pfx_path_openat+0x10/0x10
[ 75.928228][ T5079] do_filp_open+0x235/0x490
[ 75.932738][ T5079] ? __pfx_do_filp_open+0x10/0x10
[ 75.937779][ T5079] ? _raw_spin_unlock+0x28/0x50
[ 75.942639][ T5079] ? alloc_fd+0x59d/0x640
[ 75.946985][ T5079] do_sys_openat2+0x13e/0x1d0
[ 75.951681][ T5079] ? __pfx_do_sys_openat2+0x10/0x10
[ 75.956888][ T5079] ? lockdep_hardirqs_on+0x99/0x150
[ 75.962100][ T5079] ? _raw_spin_unlock_irq+0x2e/0x50
[ 75.967311][ T5079] ? ptrace_notify+0x279/0x380
[ 75.972087][ T5079] __x64_sys_openat+0x247/0x2a0
[ 75.976946][ T5079] ? __pfx___x64_sys_openat+0x10/0x10
[ 75.982326][ T5079] ? do_syscall_64+0x102/0x240
[ 75.987105][ T5079] do_syscall_64+0xf5/0x240
[ 75.991624][ T5079] ? clear_bhb_loop+0x35/0x90
[ 75.996312][ T5079] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.002214][ T5079] RIP: 0033:0x7f722cb71329
[ 76.006640][ T5079] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 76.026248][ T5079] RSP: 002b:00007fff23332778 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 76.034665][ T5079] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f722cb71329
[ 76.042640][ T5079] RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c
[ 76.050701][ T5079] RBP: 0000000000000000 R08: 00007fff233327b0 R09: 00007fff233327b0
[ 76.058673][ T5079] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff2333279c
[ 76.066647][ T5079] R13: 0000000000000001 R14: 431bde82d7b634db R15: 00007fff233327d0
[ 76.074629][ T5079]
[ 76.077741][ T5079] Kernel Offset: disabled
[ 76.082062][ T5079] Rebooting in 86400 seconds..