./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor140367935
<...>
Warning: Permanently added '10.128.10.25' (ED25519) to the list of known hosts.
execve("./syz-executor140367935", ["./syz-executor140367935"], 0x7ffca4ebbdc0 /* 10 vars */) = 0
brk(NULL) = 0x55558e55e000
brk(0x55558e55ee00) = 0x55558e55ee00
arch_prctl(ARCH_SET_FS, 0x55558e55e480) = 0
set_tid_address(0x55558e55e750) = 5818
set_robust_list(0x55558e55e760, 24) = 0
rseq(0x55558e55eda0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor140367935", 4096) = 27
getrandom("\xb8\xeb\xce\x4d\x28\x5c\x0c\x10", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55558e55ee00
brk(0x55558e57fe00) = 0x55558e57fe00
brk(0x55558e580000) = 0x55558e580000
mprotect(0x7f5da6ba2000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7f5da6af3a50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f5da6afc0e0}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7f5da6af3a50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f5da6afc0e0}, NULL, 8) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5820 attached
, child_tidptr=0x55558e55e750) = 5820
[pid 5820] set_robust_list(0x55558e55e760, 24) = 0
[pid 5820] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5820] setpgid(0, 0) = 0
[pid 5820] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5820] write(3, "1000", 4) = 4
[pid 5820] close(3) = 0
[pid 5820] write(1, "executing program\n", 18executing program
) = 18
[pid 5820] memfd_create("syzkaller", 0) = 3
[pid 5820] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5d9e600000
[pid 5820] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5820] munmap(0x7f5d9e600000, 138412032) = 0
[pid 5820] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5820] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5820] close(3) = 0
[pid 5820] close(4) = 0
[pid 5820] mkdir("./file0", 0777) = 0
[pid 5820] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID|MS_NODEV|MS_I_VERSION|MS_LAZYTIME, "errors=remount-ro,") = 0
[pid 5820] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5820] chdir("./file0") = 0
[pid 5820] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 62.228585][ T5820] loop0: detected capacity change from 0 to 32768
[pid 5820] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[pid 5820] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 5820] sync() = 0
[pid 5820] open(".", O_RDONLY) = 4
[pid 5820] lseek(4, 63651, SEEK_SET) = 63651
[ 62.895284][ T5820] ==================================================================
[ 62.903369][ T5820] BUG: KASAN: slab-use-after-free in jfs_readdir+0x1361/0x3c50
[ 62.910968][ T5820] Read of size 8 at addr ffff88807510a128 by task syz-executor140/5820
[ 62.919233][ T5820]
[ 62.921565][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: syz-executor140 Not tainted 6.13.0-rc5-syzkaller-00006-g56e6a3499e14 #0
[ 62.932654][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 62.942874][ T5820] Call Trace:
[ 62.946142][ T5820]
[ 62.949066][ T5820] dump_stack_lvl+0x241/0x360
[ 62.953735][ T5820] ? __pfx_dump_stack_lvl+0x10/0x10
[ 62.959009][ T5820] ? __pfx__printk+0x10/0x10
[ 62.963585][ T5820] ? _printk+0xd5/0x120
[ 62.967735][ T5820] ? __virt_addr_valid+0x183/0x530
[ 62.972852][ T5820] ? __virt_addr_valid+0x183/0x530
[ 62.977949][ T5820] print_report+0x169/0x550
[ 62.982449][ T5820] ? __virt_addr_valid+0x183/0x530
[ 62.987543][ T5820] ? __virt_addr_valid+0x183/0x530
[ 62.992727][ T5820] ? __virt_addr_valid+0x45f/0x530
[ 62.997825][ T5820] ? __phys_addr+0xba/0x170
[ 63.002332][ T5820] ? jfs_readdir+0x1361/0x3c50
[ 63.007085][ T5820] kasan_report+0x143/0x180
[ 63.011590][ T5820] ? jfs_readdir+0x1361/0x3c50
[ 63.016351][ T5820] jfs_readdir+0x1361/0x3c50
[ 63.021045][ T5820] ? __pfx_jfs_readdir+0x10/0x10
[ 63.025996][ T5820] ? __pfx_lock_acquire+0x10/0x10
[ 63.031123][ T5820] ? down_write+0x18c/0x220
[ 63.035643][ T5820] ? __pfx_down_write+0x10/0x10
[ 63.040494][ T5820] ? __pfx_jfs_readdir+0x10/0x10
[ 63.045429][ T5820] wrap_directory_iterator+0x91/0xd0
[ 63.050710][ T5820] iterate_dir+0x571/0x800
[ 63.055119][ T5820] __se_sys_getdents+0x1fd/0x4e0
[ 63.060117][ T5820] ? _raw_spin_unlock_irq+0x2e/0x50
[ 63.065395][ T5820] ? __pfx___se_sys_getdents+0x10/0x10
[ 63.070850][ T5820] ? __pfx_filldir+0x10/0x10
[ 63.075436][ T5820] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 63.081755][ T5820] ? do_syscall_64+0x100/0x230
[ 63.086523][ T5820] do_syscall_64+0xf3/0x230
[ 63.091018][ T5820] ? clear_bhb_loop+0x35/0x90
[ 63.095717][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.101613][ T5820] RIP: 0033:0x7f5da6b29199
[ 63.106055][ T5820] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 63.125739][ T5820] RSP: 002b:00007ffef1871898 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
[ 63.134148][ T5820] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5da6b29199
[ 63.142112][ T5820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[ 63.150072][ T5820] RBP: 0000000000000000 R08: 00007ffef18718d0 R09: 00007ffef18718d0
[ 63.158051][ T5820] R10: 00007ffef18718d0 R11: 0000000000000246 R12: 00007ffef18718d0
[ 63.166017][ T5820] R13: 00007ffef1871b58 R14: 431bde82d7b634db R15: 00007f5da6b7203b
[ 63.174110][ T5820]
[ 63.177139][ T5820]
[ 63.179453][ T5820] Allocated by task 5820:
[ 63.183776][ T5820] kasan_save_track+0x3f/0x80
[ 63.188459][ T5820] __kasan_slab_alloc+0x66/0x80
[ 63.193305][ T5820] kmem_cache_alloc_noprof+0x1d9/0x380
[ 63.198759][ T5820] mempool_alloc_noprof+0x197/0x5a0
[ 63.203945][ T5820] __get_metapage+0x5f4/0xdc0
[ 63.208618][ T5820] dtSplitRoot+0x2af/0x1930
[ 63.213127][ T5820] dtInsert+0x12cd/0x6c10
[ 63.217462][ T5820] jfs_mkdir+0x7fb/0xba0
[ 63.222142][ T5820] vfs_mkdir+0x2f9/0x4f0
[ 63.226383][ T5820] do_mkdirat+0x264/0x3a0
[ 63.230711][ T5820] __x64_sys_mkdir+0x6c/0x80
[ 63.235299][ T5820] do_syscall_64+0xf3/0x230
[ 63.239802][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.245692][ T5820]
[ 63.248003][ T5820] Freed by task 5820:
[ 63.251972][ T5820] kasan_save_track+0x3f/0x80
[ 63.256644][ T5820] kasan_save_free_info+0x40/0x50
[ 63.261679][ T5820] __kasan_slab_free+0x59/0x70
[ 63.266433][ T5820] kmem_cache_free+0x195/0x410
[ 63.271185][ T5820] release_metapage+0x831/0xa90
[ 63.276027][ T5820] jfs_readdir+0x102d/0x3c50
[ 63.280607][ T5820] wrap_directory_iterator+0x91/0xd0
[ 63.285884][ T5820] iterate_dir+0x571/0x800
[ 63.290292][ T5820] __se_sys_getdents+0x1fd/0x4e0
[ 63.295220][ T5820] do_syscall_64+0xf3/0x230
[ 63.299718][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.305603][ T5820]
[ 63.307916][ T5820] The buggy address belongs to the object at ffff88807510a0f8
[ 63.307916][ T5820] which belongs to the cache jfs_mp of size 184
[ 63.321530][ T5820] The buggy address is located 48 bytes inside of
[ 63.321530][ T5820] freed 184-byte region [ffff88807510a0f8, ffff88807510a1b0)
[ 63.335226][ T5820]
[ 63.337538][ T5820] The buggy address belongs to the physical page:
[ 63.343941][ T5820] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7510a
[ 63.352804][ T5820] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 63.359908][ T5820] page_type: f5(slab)
[ 63.363884][ T5820] raw: 00fff00000000000 ffff8881476dc8c0 dead000000000122 0000000000000000
[ 63.372463][ T5820] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000
[ 63.381060][ T5820] page dumped because: kasan: bad access detected
[ 63.387464][ T5820] page_owner tracks the page as allocated
[ 63.393168][ T5820] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5820, tgid 5820 (syz-executor140), ts 62287500316, free_ts 55275390556
[ 63.413051][ T5820] post_alloc_hook+0x1f3/0x230
[ 63.417823][ T5820] get_page_from_freelist+0x3651/0x37a0
[ 63.423365][ T5820] __alloc_pages_noprof+0x292/0x710
[ 63.428554][ T5820] alloc_pages_mpol_noprof+0x3e8/0x680
[ 63.434018][ T5820] alloc_slab_page+0x6a/0x110
[ 63.438689][ T5820] allocate_slab+0x5a/0x2b0
[ 63.443192][ T5820] ___slab_alloc+0xc27/0x14a0
[ 63.447868][ T5820] __slab_alloc+0x58/0xa0
[ 63.452196][ T5820] kmem_cache_alloc_noprof+0x268/0x380
[ 63.457648][ T5820] mempool_alloc_noprof+0x197/0x5a0
[ 63.462834][ T5820] __get_metapage+0x5f4/0xdc0
[ 63.467514][ T5820] ea_get+0xb6f/0x12e0
[ 63.471568][ T5820] __jfs_setxattr+0x4ba/0x1190
[ 63.476325][ T5820] jfs_initxattrs+0x128/0x1d0
[ 63.480990][ T5820] security_inode_init_security+0x29c/0x480
[ 63.486882][ T5820] jfs_init_security+0xa9/0x110
[ 63.491719][ T5820] page last free pid 5809 tgid 5809 stack trace:
[ 63.498050][ T5820] free_unref_page+0xd2c/0x1000
[ 63.502901][ T5820] __folio_put+0x2b3/0x360
[ 63.507314][ T5820] pipe_read+0x6ed/0x13e0
[ 63.511634][ T5820] vfs_read+0x991/0xb70
[ 63.515778][ T5820] ksys_read+0x18f/0x2b0
[ 63.520006][ T5820] do_syscall_64+0xf3/0x230
[ 63.524503][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.530404][ T5820]
[ 63.532729][ T5820] Memory state around the buggy address:
[ 63.538366][ T5820] ffff88807510a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.546432][ T5820] ffff88807510a080: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa
[ 63.554494][ T5820] >ffff88807510a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.562548][ T5820] ^
[ 63.567906][ T5820] ffff88807510a180: fb fb fb fb fb fb fc fc fc fc fc fc fc fc 00 00
[ 63.575955][ T5820] ffff88807510a200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 63.584052][ T5820] ==================================================================
[ 63.592795][ T5820] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 63.599995][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: syz-executor140 Not tainted 6.13.0-rc5-syzkaller-00006-g56e6a3499e14 #0
[ 63.611091][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 63.621134][ T5820] Call Trace:
[ 63.624403][ T5820]
[ 63.627321][ T5820] dump_stack_lvl+0x241/0x360
[ 63.631996][ T5820] ? __pfx_dump_stack_lvl+0x10/0x10
[ 63.637192][ T5820] ? __pfx__printk+0x10/0x10
[ 63.641776][ T5820] ? preempt_schedule+0xe1/0xf0
[ 63.646618][ T5820] ? vscnprintf+0x5d/0x90
[ 63.650935][ T5820] panic+0x349/0x880
[ 63.654821][ T5820] ? check_panic_on_warn+0x21/0xb0
[ 63.659921][ T5820] ? __pfx_panic+0x10/0x10
[ 63.664329][ T5820] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 63.670302][ T5820] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 63.676620][ T5820] ? print_report+0x502/0x550
[ 63.681292][ T5820] check_panic_on_warn+0x86/0xb0
[ 63.686227][ T5820] ? jfs_readdir+0x1361/0x3c50
[ 63.690989][ T5820] end_report+0x77/0x160
[ 63.695227][ T5820] kasan_report+0x154/0x180
[ 63.699724][ T5820] ? jfs_readdir+0x1361/0x3c50
[ 63.704481][ T5820] jfs_readdir+0x1361/0x3c50
[ 63.709075][ T5820] ? __pfx_jfs_readdir+0x10/0x10
[ 63.714004][ T5820] ? __pfx_lock_acquire+0x10/0x10
[ 63.719114][ T5820] ? down_write+0x18c/0x220
[ 63.723606][ T5820] ? __pfx_down_write+0x10/0x10
[ 63.728449][ T5820] ? __pfx_jfs_readdir+0x10/0x10
[ 63.733376][ T5820] wrap_directory_iterator+0x91/0xd0
[ 63.738656][ T5820] iterate_dir+0x571/0x800
[ 63.743093][ T5820] __se_sys_getdents+0x1fd/0x4e0
[ 63.748036][ T5820] ? _raw_spin_unlock_irq+0x2e/0x50
[ 63.753228][ T5820] ? __pfx___se_sys_getdents+0x10/0x10
[ 63.758679][ T5820] ? __pfx_filldir+0x10/0x10
[ 63.763261][ T5820] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 63.769609][ T5820] ? do_syscall_64+0x100/0x230
[ 63.774545][ T5820] do_syscall_64+0xf3/0x230
[ 63.779043][ T5820] ? clear_bhb_loop+0x35/0x90
[ 63.783731][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 63.789617][ T5820] RIP: 0033:0x7f5da6b29199
[ 63.794024][ T5820] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 63.813622][ T5820] RSP: 002b:00007ffef1871898 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
[ 63.822028][ T5820] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5da6b29199
[ 63.829991][ T5820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[ 63.837949][ T5820] RBP: 0000000000000000 R08: 00007ffef18718d0 R09: 00007ffef18718d0
[ 63.845997][ T5820] R10: 00007ffef18718d0 R11: 0000000000000246 R12: 00007ffef18718d0
[ 63.853958][ T5820] R13: 00007ffef1871b58 R14: 431bde82d7b634db R15: 00007f5da6b7203b
[ 63.861924][ T5820]
[ 63.865207][ T5820] Kernel Offset: disabled
[ 63.869525][ T5820] Rebooting in 86400 seconds..