Warning: Permanently added '10.128.1.191' (ED25519) to the list of known hosts.
[*] Starting reproducer for jffs2_erase_pending_blocks UAF...
[+] Process running as UID 0 (root).
[+] /dev/mtd0 exists.
[+] /dev/mtdblock0 exists.
[+] mkdir /tmp/mnt1 successful.
[+] mkdir /tmp/mnt2 successful.
[+] open /dev/mtd0 successful.
[+] ioctl MEMGETINFO successful: size=131072, erasesize=4096
[+] ioctl MEMERASE entire partition successful.
[+] close /dev/mtd0 successful.
[*] Executing Phase 1: direct fspick + fsconfig + umount sequence...
[*] Phase 1 iteration 0: mounting mtd0 read-only...
[+] mount successful.
[+] fspick successful (fd=3).
[+] fsconfig RECONFIGURE successful: GC thread spawned while SB_RDONLY is set.
[+] close fspick fd successful.
[+] umount /tmp/mnt1 successful: sb_info freed while GC thread is running.
[ 127.464199][ T6037] jffs2: notice: (6037) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 127.520077][ T6038] ==================================================================
[ 127.520089][ T6038] BUG: KASAN: slab-use-after-free in mutex_lock_interruptible_nested+0x55/0x1c0
[ 127.520118][ T6038] Read of size 1 at addr ffff8880338f2128 by task jffs2_gcd_mtd0/6038
[ 127.520130][ T6038]
[ 127.520153][ T6038] CPU: 0 UID: 0 PID: 6038 Comm: jffs2_gcd_mtd0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 127.520168][ T6038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 127.520179][ T6038] Call Trace:
[ 127.520184][ T6038]
[ 127.520190][ T6038] dump_stack_lvl+0xe8/0x150
[ 127.520207][ T6038] print_address_description+0x55/0x1e0
[ 127.520222][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 127.520235][ T6038] print_report+0x58/0x70
[ 127.520248][ T6038] kasan_report+0x117/0x150
[ 127.520258][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 127.520273][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 127.520284][ T6038] __kasan_check_byte+0x2a/0x40
[ 127.520293][ T6038] lock_acquire+0x7d/0x350
[ 127.520308][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 127.520319][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 127.520329][ T6038] mutex_lock_interruptible_nested+0x55/0x1c0
[ 127.520343][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 127.520355][ T6038] jffs2_garbage_collect_pass+0xb0/0x2170
[ 127.520365][ T6038] ? reacquire_held_locks+0x117/0x1a0
[ 127.520375][ T6038] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 127.520390][ T6038] ? rt_spin_unlock+0x159/0x200
[ 127.520403][ T6038] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 127.520414][ T6038] ? rt_spin_unlock+0x165/0x200
[ 127.520427][ T6038] ? sigprocmask+0x24c/0x2a0
[ 127.520441][ T6038] ? __pfx_sigprocmask+0x10/0x10
[ 127.520452][ T6038] ? rt_spin_unlock+0x159/0x200
[ 127.520467][ T6038] jffs2_garbage_collect_thread+0x693/0x720
[ 127.520482][ T6038] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 127.520494][ T6038] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 127.520507][ T6038] ? __kthread_parkme+0x71/0x1f0
[ 127.520516][ T6038] ? __kthread_parkme+0x199/0x1f0
[ 127.520526][ T6038] kthread+0x38b/0x470
[ 127.520536][ T6038] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 127.520547][ T6038] ? __pfx_kthread+0x10/0x10
[ 127.520557][ T6038] ret_from_fork+0x514/0xb70
[ 127.520568][ T6038] ? __pfx_ret_from_fork+0x10/0x10
[ 127.520578][ T6038] ? __switch_to+0xc78/0x1410
[ 127.520593][ T6038] ? __pfx_kthread+0x10/0x10
[ 127.520603][ T6038] ret_from_fork_asm+0x1a/0x30
[ 127.520617][ T6038]
[ 127.520620][ T6038]
[ 127.520623][ T6038] Allocated by task 6037:
[ 127.520636][ T6038] kasan_save_track+0x3e/0x80
[ 127.520648][ T6038] __kasan_kmalloc+0x93/0xb0
[ 127.520660][ T6038] __kmalloc_cache_noprof+0x3d0/0x670
[ 127.520673][ T6038] jffs2_init_fs_context+0x4f/0xc0
[ 127.520683][ T6038] alloc_fs_context+0x99e/0xd00
[ 127.520695][ T6038] do_new_mount+0x177/0xb00
[ 127.520705][ T6038] __se_sys_mount+0x31d/0x420
[ 127.520714][ T6038] do_syscall_64+0x166/0x520
[ 127.520724][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 127.520733][ T6038]
[ 127.520735][ T6038] Freed by task 6037:
[ 127.520739][ T6038] kasan_save_track+0x3e/0x80
[ 127.520750][ T6038] kasan_save_free_info+0x40/0x50
[ 127.520760][ T6038] __kasan_slab_free+0x5c/0x80
[ 127.520771][ T6038] kfree+0x1c5/0x6d0
[ 127.520781][ T6038] deactivate_locked_super+0xbe/0x110
[ 127.520790][ T6038] cleanup_mnt+0x204/0x2a0
[ 127.520801][ T6038] task_work_run+0x1d9/0x260
[ 127.520811][ T6038] exit_to_user_mode_loop+0x204/0x770
[ 127.520819][ T6038] do_syscall_64+0x328/0x520
[ 127.520828][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 127.520837][ T6038]
[*] Phase 1 iteration 1: mounting mtd0 read-only...
[+] mount successful.
[+] fspick successful (fd=3).
[+] fsconfig RECONFIGURE successful: GC thread spawned while SB_RDONLY is set.
[+] close fspick fd successful.
[ 127.520839][ T6038] The buggy address belongs to the object at ffff8880338f2000
[ 127.520839][ T6038] which belongs to the cache kmalloc-4k of size 4096
[ 127.520847][ T6038] The buggy address is located 296 bytes inside of
[ 127.520847][ T6038] freed 4096-byte region [ffff8880338f2000, ffff8880338f3000)
[ 127.520857][ T6038]
[ 127.520860][ T6038] The buggy address belongs to the physical page:
[ 127.520874][ T6038] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x338f0
[ 127.520886][ T6038] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 127.520894][ T6038] flags: 0x80000000000040(head|node=0|zone=1)
[ 127.520908][ T6038] page_type: f5(slab)
[ 127.520917][ T6038] raw: 0080000000000040 ffff88813ff11140 dead000000000100 dead000000000122
[ 127.520925][ T6038] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 127.520933][ T6038] head: 0080000000000040 ffff88813ff11140 dead000000000100 dead000000000122
[ 127.520941][ T6038] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 127.520949][ T6038] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 127.520956][ T6038] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 127.520963][ T6038] page dumped because: kasan: bad access detected
[ 127.520971][ T6038] page_owner tracks the page as allocated
[ 127.520974][ T6038] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4983, tgid 4983 (udevadm), ts 29338936076
[ 127.520990][ T6038] post_alloc_hook+0x1f9/0x250
[ 127.521001][ T6038] get_page_from_freelist+0x258b/0x2600
[ 127.521014][ T6038] __alloc_frozen_pages_noprof+0x225/0x440
[ 127.521026][ T6038] allocate_slab+0x7d/0x5e0
[ 127.521035][ T6038] refill_objects+0x2d8/0x350
[ 127.521044][ T6038] __pcs_replace_empty_main+0x339/0x690
[ 127.521052][ T6038] __kmalloc_cache_noprof+0x46a/0x670
[ 127.521064][ T6038] kobject_uevent_env+0x28c/0x9e0
[ 127.521071][ T6038] kobject_synth_uevent+0x442/0x940
[ 127.521079][ T6038] store_uevent+0x16/0x30
[ 127.521090][ T6038] module_attr_store+0x65/0x90
[ 127.521102][ T6038] kernfs_fop_write_iter+0x3a5/0x540
[ 127.521113][ T6038] vfs_write+0x61e/0xbb0
[ 127.521123][ T6038] ksys_write+0x156/0x270
[ 127.521135][ T6038] do_syscall_64+0x166/0x520
[ 127.521144][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 127.521152][ T6038] page last free pid 4983 tgid 4983 ts 29334581343 stack trace:
[ 127.521159][ T6038] __free_frozen_pages+0xf8a/0x1060
[ 127.521170][ T6038] __slab_free+0x26e/0x2c0
[ 127.521181][ T6038] qlist_free_all+0x99/0x100
[ 127.521191][ T6038] kasan_quarantine_reduce+0x148/0x160
[ 127.521202][ T6038] __kasan_slab_alloc+0x22/0x80
[ 127.521214][ T6038] kmem_cache_alloc_noprof+0x35b/0x680
[ 127.521224][ T6038] do_getname+0x2e/0x250
[ 127.521233][ T6038] do_sys_openat2+0xce/0x200
[ 127.521241][ T6038] __x64_sys_openat+0x138/0x170
[ 127.521249][ T6038] do_syscall_64+0x166/0x520
[ 127.521258][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 127.521266][ T6038]
[ 127.521269][ T6038] Memory state around the buggy address:
[ 127.521273][ T6038] ffff8880338f2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 127.521279][ T6038] ffff8880338f2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 127.521285][ T6038] >ffff8880338f2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 127.521290][ T6038] ^
[ 127.521295][ T6038] ffff8880338f2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 127.521300][ T6038] ffff8880338f2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 127.521305][ T6038] ==================================================================
[ 127.521315][ T6038] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 128.232069][ T6038] CPU: 0 UID: 0 PID: 6038 Comm: jffs2_gcd_mtd0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 128.242478][ T6038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 128.252539][ T6038] Call Trace:
[ 128.255826][ T6038]
[ 128.258760][ T6038] vpanic+0x56d/0xa60
[ 128.262828][ T6038] ? __pfx_vpanic+0x10/0x10
[ 128.267331][ T6038] panic+0xc5/0xd0
[ 128.271089][ T6038] ? __pfx_panic+0x10/0x10
[ 128.275673][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.281927][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.288166][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.294401][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.300635][ T6038] check_panic_on_warn+0x89/0xb0
[ 128.305564][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.311802][ T6038] end_report+0x73/0x170
[ 128.316036][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.322276][ T6038] kasan_report+0x128/0x150
[ 128.326783][ T6038] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.333023][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 128.338910][ T6038] __kasan_check_byte+0x2a/0x40
[ 128.343762][ T6038] lock_acquire+0x7d/0x350
[ 128.348279][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 128.354431][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 128.360411][ T6038] mutex_lock_interruptible_nested+0x55/0x1c0
[ 128.366589][ T6038] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 128.372600][ T6038] jffs2_garbage_collect_pass+0xb0/0x2170
[ 128.378487][ T6038] ? reacquire_held_locks+0x117/0x1a0
[ 128.383850][ T6038] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 128.389482][ T6038] ? rt_spin_unlock+0x159/0x200
[ 128.394329][ T6038] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 128.400586][ T6038] ? rt_spin_unlock+0x165/0x200
[ 128.405434][ T6038] ? sigprocmask+0x24c/0x2a0
[ 128.410102][ T6038] ? __pfx_sigprocmask+0x10/0x10
[ 128.415082][ T6038] ? rt_spin_unlock+0x159/0x200
[ 128.419941][ T6038] jffs2_garbage_collect_thread+0x693/0x720
[ 128.425920][ T6038] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 128.432333][ T6038] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 128.438218][ T6038] ? __kthread_parkme+0x71/0x1f0
[ 128.443315][ T6038] ? __kthread_parkme+0x199/0x1f0
[ 128.448333][ T6038] kthread+0x38b/0x470
[ 128.452412][ T6038] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 128.458844][ T6038] ? __pfx_kthread+0x10/0x10
[ 128.463426][ T6038] ret_from_fork+0x514/0xb70
[ 128.468008][ T6038] ? __pfx_ret_from_fork+0x10/0x10
[ 128.473204][ T6038] ? __switch_to+0xc78/0x1410
[ 128.477961][ T6038] ? __pfx_kthread+0x10/0x10
[ 128.482542][ T6038] ret_from_fork_asm+0x1a/0x30
[ 128.487474][ T6038]
[ 128.490833][ T6038] Kernel Offset: disabled
[ 128.495245][ T6038] Rebooting in 86400 seconds..