Warning: Permanently added '10.128.0.185' (ED25519) to the list of known hosts. executing program syzkaller login: [ 36.081697][ T4221] loop0: detected capacity change from 0 to 1024 [ 36.094679][ T4221] ================================================================== [ 36.096458][ T4221] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read_key+0x3bc/0x658 [ 36.098256][ T4221] Write of size 4026 at addr ffff0000deb9e800 by task syz-executor164/4221 [ 36.100121][ T4221] [ 36.100632][ T4221] CPU: 0 PID: 4221 Comm: syz-executor164 Not tainted 6.1.75-syzkaller #0 [ 36.102508][ T4221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 36.104577][ T4221] Call trace: [ 36.105252][ T4221] dump_backtrace+0x1c8/0x1f4 [ 36.106263][ T4221] show_stack+0x2c/0x3c [ 36.107238][ T4221] dump_stack_lvl+0x108/0x170 [ 36.108346][ T4221] print_report+0x174/0x4c0 [ 36.109398][ T4221] kasan_report+0xd4/0x130 [ 36.110357][ T4221] kasan_check_range+0x264/0x2a4 [ 36.111367][ T4221] memcpy+0x60/0x90 [ 36.112226][ T4221] hfsplus_bnode_read_key+0x3bc/0x658 [ 36.113327][ T4221] hfsplus_brec_insert+0x520/0xaa0 [ 36.114422][ T4221] hfsplus_create_attr+0x3b0/0x568 [ 36.115545][ T4221] __hfsplus_setxattr+0x990/0x1d10 [ 36.116723][ T4221] hfsplus_setxattr+0xb4/0xec [ 36.117874][ T4221] hfsplus_user_setxattr+0x54/0x6c [ 36.118963][ T4221] __vfs_setxattr+0x388/0x3a4 [ 36.119973][ T4221] __vfs_setxattr_noperm+0x110/0x528 [ 36.121220][ T4221] __vfs_setxattr_locked+0x1ec/0x218 [ 36.122432][ T4221] vfs_setxattr+0x1a8/0x344 [ 36.123438][ T4221] setxattr+0x230/0x294 [ 36.124325][ T4221] path_setxattr+0x17c/0x258 [ 36.125310][ T4221] __arm64_sys_setxattr+0xbc/0xd8 [ 36.126382][ T4221] invoke_syscall+0x98/0x2c0 [ 36.127365][ T4221] el0_svc_common+0x138/0x258 [ 36.128338][ T4221] do_el0_svc+0x64/0x218 [ 36.129230][ T4221] el0_svc+0x58/0x168 [ 36.130048][ T4221] el0t_64_sync_handler+0x84/0xf0 [ 36.131115][ T4221] el0t_64_sync+0x18c/0x190 [ 36.132112][ T4221] [ 36.132609][ T4221] Allocated by task 4221: [ 36.133537][ T4221] kasan_set_track+0x4c/0x80 [ 36.134478][ T4221] kasan_save_alloc_info+0x24/0x30 [ 36.135600][ T4221] __kasan_kmalloc+0xac/0xc4 [ 36.136644][ T4221] __kmalloc+0xd8/0x1c4 [ 36.137520][ T4221] hfsplus_find_init+0x84/0x1bc [ 36.138633][ T4221] hfsplus_create_attr+0x14c/0x568 [ 36.139725][ T4221] __hfsplus_setxattr+0x990/0x1d10 [ 36.140915][ T4221] hfsplus_setxattr+0xb4/0xec [ 36.141862][ T4221] hfsplus_user_setxattr+0x54/0x6c [ 36.142977][ T4221] __vfs_setxattr+0x388/0x3a4 [ 36.143958][ T4221] __vfs_setxattr_noperm+0x110/0x528 [ 36.145107][ T4221] __vfs_setxattr_locked+0x1ec/0x218 [ 36.146243][ T4221] vfs_setxattr+0x1a8/0x344 [ 36.147223][ T4221] setxattr+0x230/0x294 [ 36.148116][ T4221] path_setxattr+0x17c/0x258 [ 36.149178][ T4221] __arm64_sys_setxattr+0xbc/0xd8 [ 36.150308][ T4221] invoke_syscall+0x98/0x2c0 [ 36.151266][ T4221] el0_svc_common+0x138/0x258 [ 36.152251][ T4221] do_el0_svc+0x64/0x218 [ 36.153192][ T4221] el0_svc+0x58/0x168 [ 36.154056][ T4221] el0t_64_sync_handler+0x84/0xf0 [ 36.155141][ T4221] el0t_64_sync+0x18c/0x190 [ 36.156064][ T4221] [ 36.156556][ T4221] The buggy address belongs to the object at ffff0000deb9e800 [ 36.156556][ T4221] which belongs to the cache kmalloc-1k of size 1024 [ 36.159787][ T4221] The buggy address is located 0 bytes inside of [ 36.159787][ T4221] 1024-byte region [ffff0000deb9e800, ffff0000deb9ec00) [ 36.162625][ T4221] [ 36.163194][ T4221] The buggy address belongs to the physical page: [ 36.164613][ T4221] page:00000000779b7626 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eb98 [ 36.166819][ T4221] head:00000000779b7626 order:3 compound_mapcount:0 compound_pincount:0 [ 36.168600][ T4221] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 36.170296][ T4221] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002780 [ 36.172052][ T4221] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 36.173912][ T4221] page dumped because: kasan: bad access detected [ 36.175233][ T4221] [ 36.175719][ T4221] Memory state around the buggy address: [ 36.176958][ T4221] ffff0000deb9e900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.178732][ T4221] ffff0000deb9e980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.180589][ T4221] >ffff0000deb9ea00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.182333][ T4221] ^ [ 36.183401][ T4221] ffff0000deb9ea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.185207][ T4221] ffff0000deb9eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.186978][ T4221] ================================================================== [ 36.190028][ T4221] Disabling lock debugging due to kernel taint