./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor716144376 <...> Warning: Permanently added '10.128.1.119' (ECDSA) to the list of known hosts. execve("./syz-executor716144376", ["./syz-executor716144376"], 0x7fff3b307200 /* 10 vars */) = 0 brk(NULL) = 0x555557237000 brk(0x555557237c40) = 0x555557237c40 arch_prctl(ARCH_SET_FS, 0x555557237300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor716144376", 4096) = 27 brk(0x555557258c40) = 0x555557258c40 brk(0x555557259000) = 0x555557259000 mprotect(0x7fb5ad955000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdirat(AT_FDCWD, "./file0", 000) = 0 pipe2([3, 4], 0) = 0 write(4, "\x15\x00\x00\x00\x65\xff\xff\x09\x7b\x00\x00\x08\x00\x39\x50\x32\x30\x30\x30\x2e\x4c", 21) = 21 dup(4) = 5 write(5, "\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 24) = 24 write(5, "\x4c\x01\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 311) = 311 mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000005,") = 0 [ 51.488453][ T3337] ================================================================== [ 51.496541][ T3337] BUG: KASAN: slab-out-of-bounds in _copy_to_iter+0xd18/0x1140 [ 51.504176][ T3337] Write of size 12 at addr ffff888022c117c7 by task kworker/0:4/3337 [ 51.512303][ T3337] [ 51.514607][ T3337] CPU: 0 PID: 3337 Comm: kworker/0:4 Not tainted 6.1.0-rc6-syzkaller #0 [ 51.522904][ T3337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 51.532942][ T3337] Workqueue: events p9_read_work [ 51.537870][ T3337] Call Trace: [ 51.541335][ T3337] [ 51.544244][ T3337] dump_stack_lvl+0xd1/0x138 [ 51.548816][ T3337] print_report+0x15e/0x45d [ 51.553311][ T3337] ? __phys_addr+0xc8/0x140 [ 51.557815][ T3337] ? _copy_to_iter+0xd18/0x1140 [ 51.562656][ T3337] kasan_report+0xbf/0x1f0 [ 51.567230][ T3337] ? _copy_to_iter+0xd18/0x1140 [ 51.572063][ T3337] kasan_check_range+0x141/0x190 [ 51.576991][ T3337] memcpy+0x3d/0x60 [ 51.580791][ T3337] _copy_to_iter+0xd18/0x1140 [ 51.585452][ T3337] ? _copy_from_iter+0xf40/0xf40 [ 51.590476][ T3337] ? pipe_read+0x13d/0x1110 [ 51.594983][ T3337] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 51.600526][ T3337] ? lock_chain_count+0x20/0x20 [ 51.605384][ T3337] ? page_copy_sane+0x28f/0x410 [ 51.610235][ T3337] copy_page_to_iter+0xe0/0xa20 [ 51.615071][ T3337] pipe_read+0x50e/0x1110 [ 51.619404][ T3337] ? pipe_ioctl+0x2c0/0x2c0 [ 51.623894][ T3337] ? aa_file_perm+0x599/0x1240 [ 51.628642][ T3337] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 51.634616][ T3337] __kernel_read+0x2ca/0x7c0 [ 51.639194][ T3337] ? __ia32_sys_llseek+0x380/0x380 [ 51.644298][ T3337] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 51.650270][ T3337] ? fsnotify_perm.part.0+0x221/0x610 [ 51.655635][ T3337] ? apparmor_file_permission+0x268/0x4e0 [ 51.661348][ T3337] kernel_read+0xc3/0x1c0 [ 51.665665][ T3337] p9_read_work+0x2b0/0x1040 [ 51.670241][ T3337] ? do_raw_spin_lock+0x124/0x2b0 [ 51.675249][ T3337] ? p9_conn_cancel+0x8c0/0x8c0 [ 51.680092][ T3337] process_one_work+0x9bf/0x1710 [ 51.685016][ T3337] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 51.690371][ T3337] ? rwlock_bug.part.0+0x90/0x90 [ 51.695290][ T3337] ? _raw_spin_lock_irq+0x45/0x50 [ 51.700307][ T3337] worker_thread+0x669/0x1090 [ 51.704974][ T3337] ? __kthread_parkme+0x163/0x220 [ 51.710079][ T3337] ? process_one_work+0x1710/0x1710 [ 51.715265][ T3337] kthread+0x2e8/0x3a0 [ 51.719322][ T3337] ? kthread_complete_and_exit+0x40/0x40 [ 51.724939][ T3337] ret_from_fork+0x1f/0x30 [ 51.729348][ T3337] [ 51.732348][ T3337] [ 51.734653][ T3337] Allocated by task 3633: [ 51.738958][ T3337] kasan_save_stack+0x22/0x40 [ 51.743620][ T3337] kasan_set_track+0x25/0x30 [ 51.748193][ T3337] __kasan_kmalloc+0xa5/0xb0 [ 51.752764][ T3337] __kmalloc+0x5a/0xd0 [ 51.756812][ T3337] p9_fcall_init+0x97/0x210 [ 51.761302][ T3337] p9_tag_alloc+0x208/0x840 [ 51.765787][ T3337] p9_client_prepare_req+0x177/0x590 [ 51.771055][ T3337] p9_client_rpc+0x1a1/0xd70 [ 51.775625][ T3337] p9_client_walk+0x1a0/0x540 [ 51.780458][ T3337] v9fs_fid_xattr_set+0xe4/0x2b0 [ 51.785379][ T3337] v9fs_xattr_handler_set+0x6f/0x120 [ 51.790643][ T3337] __vfs_setxattr+0x119/0x180 [ 51.795305][ T3337] __vfs_setxattr_noperm+0x129/0x5f0 [ 51.800572][ T3337] __vfs_setxattr_locked+0x1d3/0x260 [ 51.805855][ T3337] vfs_setxattr+0x143/0x340 [ 51.810342][ T3337] setxattr+0x146/0x160 [ 51.814480][ T3337] path_setxattr+0x197/0x1c0 [ 51.819051][ T3337] __x64_sys_setxattr+0xc4/0x160 [ 51.823971][ T3337] do_syscall_64+0x39/0xb0 [ 51.828374][ T3337] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 51.834255][ T3337] [ 51.836558][ T3337] The buggy address belongs to the object at ffff888022c117c0 [ 51.836558][ T3337] which belongs to the cache kmalloc-16 of size 16 [ 51.850416][ T3337] The buggy address is located 7 bytes inside of [ 51.850416][ T3337] 16-byte region [ffff888022c117c0, ffff888022c117d0) [ 51.863497][ T3337] [ 51.865817][ T3337] The buggy address belongs to the physical page: [ 51.872207][ T3337] page:ffffea00008b0440 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22c11 [ 51.882339][ T3337] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 51.889870][ T3337] raw: 00fff00000000200 dead000000000100 dead000000000122 ffff8880120413c0 [ 51.898435][ T3337] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 51.906993][ T3337] page dumped because: kasan: bad access detected [ 51.913381][ T3337] page_owner tracks the page as allocated [ 51.919071][ T3337] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3000, tgid 3000 (udevadm), ts 12517826833, free_ts 10304392140 [ 51.936937][ T3337] get_page_from_freelist+0x10b5/0x2d50 [ 51.942477][ T3337] __alloc_pages+0x1cb/0x5b0 [ 51.947055][ T3337] alloc_pages+0x1aa/0x270 [ 51.951457][ T3337] allocate_slab+0x213/0x300 [ 51.956028][ T3337] ___slab_alloc+0xa91/0x1400 [ 51.960688][ T3337] __slab_alloc.constprop.0+0x56/0xa0 [ 51.966045][ T3337] __kmem_cache_alloc_node+0x199/0x3e0 [ 51.971489][ T3337] __kmalloc+0x4a/0xd0 [ 51.975540][ T3337] kobject_get_path+0xc2/0x230 [ 51.980305][ T3337] kobject_uevent_env+0x257/0x1620 [ 51.985398][ T3337] kobject_synth_uevent+0x705/0x850 [ 51.990576][ T3337] bus_uevent_store+0x4a/0x90 [ 51.995238][ T3337] bus_attr_store+0x76/0xa0 [ 51.999736][ T3337] sysfs_kf_write+0x114/0x170 [ 52.004394][ T3337] kernfs_fop_write_iter+0x3fc/0x610 [ 52.009659][ T3337] vfs_write+0x9ed/0xdd0 [ 52.013886][ T3337] page last free stack trace: [ 52.018536][ T3337] free_pcp_prepare+0x65c/0xd90 [ 52.023374][ T3337] free_unref_page+0x1d/0x4d0 [ 52.028040][ T3337] kasan_depopulate_vmalloc_pte+0x60/0x80 [ 52.033842][ T3337] __apply_to_page_range+0x68c/0x1030 [ 52.039219][ T3337] kasan_release_vmalloc+0xab/0xc0 [ 52.044333][ T3337] __purge_vmap_area_lazy+0x885/0x1c50 [ 52.049774][ T3337] _vm_unmap_aliases.part.0+0x420/0x550 [ 52.055310][ T3337] vm_unmap_aliases+0x49/0x50 [ 52.059985][ T3337] change_page_attr_set_clr+0x241/0x500 [ 52.065517][ T3337] set_memory_nx+0xb6/0x110 [ 52.070012][ T3337] free_init_pages+0x77/0xc0 [ 52.074581][ T3337] kernel_init+0x32/0x1d0 [ 52.078894][ T3337] ret_from_fork+0x1f/0x30 [ 52.083301][ T3337] [ 52.085606][ T3337] Memory state around the buggy address: [ 52.091212][ T3337] ffff888022c11680: fa fb fc fc 00 01 fc fc 00 05 fc fc 00 01 fc fc [ 52.099253][ T3337] ffff888022c11700: 00 01 fc fc fa fb fc fc 00 06 fc fc fa fb fc fc [ 52.107298][ T3337] >ffff888022c11780: fa fb fc fc fa fb fc fc 00 03 fc fc 00 03 fc fc [ 52.115334][ T3337] ^ [ 52.121721][ T3337] ffff888022c11800: 00 03 fc fc fa fb fc fc 00 02 fc fc fa fb fc fc [ 52.129774][ T3337] ffff888022c11880: fa fb fc fc fa fb fc fc 00 03 fc fc 00 03 fc fc [ 52.137811][ T3337] ================================================================== [ 52.146504][ T3337] Kernel panic - not syncing: panic_on_warn set ... [ 52.153086][ T3337] CPU: 0 PID: 3337 Comm: kworker/0:4 Not tainted 6.1.0-rc6-syzkaller #0 [ 52.161504][ T3337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 52.171622][ T3337] Workqueue: events p9_read_work [ 52.176543][ T3337] Call Trace: [ 52.179796][ T3337] [ 52.182714][ T3337] dump_stack_lvl+0xd1/0x138 [ 52.187374][ T3337] panic+0x2cc/0x626 [ 52.191260][ T3337] ? panic_print_sys_info.part.0+0x110/0x110 [ 52.197317][ T3337] ? preempt_schedule_common+0x59/0xc0 [ 52.202756][ T3337] ? preempt_schedule_thunk+0x1a/0x1c [ 52.208115][ T3337] end_report.part.0+0x3f/0x7c [ 52.212854][ T3337] ? _copy_to_iter+0xd18/0x1140 [ 52.217695][ T3337] kasan_report.cold+0xa/0xf [ 52.222260][ T3337] ? _copy_to_iter+0xd18/0x1140 [ 52.227106][ T3337] kasan_check_range+0x141/0x190 [ 52.232027][ T3337] memcpy+0x3d/0x60 [ 52.235816][ T3337] _copy_to_iter+0xd18/0x1140 [ 52.240469][ T3337] ? _copy_from_iter+0xf40/0xf40 [ 52.245383][ T3337] ? pipe_read+0x13d/0x1110 [ 52.249863][ T3337] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 52.255389][ T3337] ? lock_chain_count+0x20/0x20 [ 52.260231][ T3337] ? page_copy_sane+0x28f/0x410 [ 52.265067][ T3337] copy_page_to_iter+0xe0/0xa20 [ 52.269903][ T3337] pipe_read+0x50e/0x1110 [ 52.274224][ T3337] ? pipe_ioctl+0x2c0/0x2c0 [ 52.278714][ T3337] ? aa_file_perm+0x599/0x1240 [ 52.283463][ T3337] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 52.289455][ T3337] __kernel_read+0x2ca/0x7c0 [ 52.294032][ T3337] ? __ia32_sys_llseek+0x380/0x380 [ 52.299131][ T3337] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 52.305104][ T3337] ? fsnotify_perm.part.0+0x221/0x610 [ 52.310460][ T3337] ? apparmor_file_permission+0x268/0x4e0 [ 52.316174][ T3337] kernel_read+0xc3/0x1c0 [ 52.320488][ T3337] p9_read_work+0x2b0/0x1040 [ 52.325065][ T3337] ? do_raw_spin_lock+0x124/0x2b0 [ 52.330071][ T3337] ? p9_conn_cancel+0x8c0/0x8c0 [ 52.334911][ T3337] process_one_work+0x9bf/0x1710 [ 52.339835][ T3337] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 52.345193][ T3337] ? rwlock_bug.part.0+0x90/0x90 [ 52.350111][ T3337] ? _raw_spin_lock_irq+0x45/0x50 [ 52.355123][ T3337] worker_thread+0x669/0x1090 [ 52.359785][ T3337] ? __kthread_parkme+0x163/0x220 [ 52.364796][ T3337] ? process_one_work+0x1710/0x1710 [ 52.369977][ T3337] kthread+0x2e8/0x3a0 [ 52.374026][ T3337] ? kthread_complete_and_exit+0x40/0x40 [ 52.379641][ T3337] ret_from_fork+0x1f/0x30 [ 52.384049][ T3337] [ 52.387787][ T3337] Kernel Offset: disabled [ 52.392113][ T3337] Rebooting in 86400 seconds..