./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor665113050 <...> Warning: Permanently added '10.128.1.62' (ECDSA) to the list of known hosts. execve("./syz-executor665113050", ["./syz-executor665113050"], 0x7ffe12878bf0 /* 10 vars */) = 0 brk(NULL) = 0x5555574a5000 brk(0x5555574a5c40) = 0x5555574a5c40 arch_prctl(ARCH_SET_FS, 0x5555574a5300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor665113050", 4096) = 27 brk(0x5555574c6c40) = 0x5555574c6c40 brk(0x5555574c7000) = 0x5555574c7000 mprotect(0x7f15a0e32000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 ftruncate(3, 135266304) = 0 pwrite64(3, "\x96\x26\x7e\xf7\x32\x60\xfc\xee\xeb\x07\x19\x31\x33\x38\x51\x24\x0f\x0c\xfe\x4a\x9b\xcf\xfc\xc0\xfe\x06\x8a\x16\x8f\xb0\xe2\xb5\x99\x6a\x8f\xd1\x8d\xc6\x3d\xee\x79\x6d\xb9\x9a\x00\x06\x57\xc5\x87\xbf\x7a\xbe\x78\x95\x17\x12\xb3\x82\x64\x9d", 60, 4) = 60 pwrite64(3, "\x3c\x17\x7f\x52\x16\xfa\x70\x33\x4e\x8d\xac\x8e\xb3\x3b\xab\xdc\x52\xdb\x8a\x85\x5c\x4a\x39\xde\x6c\x89\xcf\x7a\x7b\x64\xa8\x1d\x63\x22\x86\x58\x77\x9d\xa0\x09\xbb\x42\xc5\xb7\x7f\x3c\x1a\xd1\x18\xa2\xf1\xfd\xde\x59\x9a\xec\xef\xe1\x99\x04\x53\x9e\xcf\x75\x5c\xd3\xba\x46\x53\x89\x9b\x0e\xe8\xd1\xbb\x70\xe2\x15\xb0\x8f\x31\xd2\x53\xaa\x9c\xd6\x47\xef\x13\x9a\xc0\x32\xb3\x11\xb0\xc8\xaf\x5a\xe4\x71"..., 122, 64) = 122 pwrite64(3, "\x7e\x32\xd3\x17\x72\xce\xa3\x71\x7c\x3a\x04\xb4\xfc\x4b\x66", 15, 186) = 15 pwrite64(3, "\xe2\xe1\xf5\xe0\x95\x21\xe9\x3c\x02\x00\x18\x00\x0c\x00\x24", 15, 1024) = 15 pwrite64(3, "\x06\x00\x00\x00\x00\x45\x42\x3f\x62\xba\xe6\xa3\x60\xf5\x17\xe4\x76\x06\x63\xdb\x33\x1e\xca\xfd\x0a\x59\x41\xc4\x0f\xca\xa2\xac\x40\x98\xae\xf0\xeb\x87\x24\x83\x4f\x3d\x66\x34\x8c\xbe\x08\xde\xe4\x10\xe3\x28\x1c\x00\xa8\x6a\x73\x62\x7e\x22\xdb\x7b\x6e\xdc\xc5\xd0\x59\xea\x3d\x39\x41\x97\x6b\xb0\x31\x42\x36\xae\x62\x4f\xc8\x36\xca\xb9\xa4\xc5\xdd\x24\x83\x33\x4a\xc9\x76\xac\xb5\x8e\x1f\x7b\xe5\x92"..., 181, 1152) = 181 pwrite64(3, "\x4a\x64\x80\xb1\x76\xcd\xf2\x09\xa5\xbd\x67\x01\xd5\x6a\x6c\x71\x60\xa8\x05\xf1\x6a\x4d\xe7\x3b\x89\xa0\xdd\x26\x87\xb6\xa6\x63\xef\xf9\xf9\x40\x7e\xd5\x69\xf2\x38\x94\xab\x02\x95\x34\xd0\xe6\x52\xd0\x40\xa3\xfd\xa3\x65\xc1\x73\x25\xe9\xf3\x89\x1c\x46\x07\xd0\xbc\x6a\x62\x80\x9c\x0c\x1b\xab\x0d\x03\x08\xd2\x76\x57\x40\x90\xec\x1f\x90\x59\x3b\x19\xa5\x77\x6d\x6f\xc4\x19\xb9\xe7\x6e\xe9\x8f\x59\x12"..., 172, 2047) = 172 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 mkdir("./file0", 0777) = 0 mount("/dev/loop0", "./file0", "erofs", 0, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 5 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 close(3) = 0 syzkaller login: [ 37.408870][ T3601] loop0: detected capacity change from 0 to 264192 [ 37.417770][ T3601] erofs: (device loop0): mounted with root inode @ nid 36. [ 37.428917][ T3601] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN [ 37.440651][ T3601] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 37.449067][ T3601] CPU: 1 PID: 3601 Comm: syz-executor665 Not tainted 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0 [ 37.459485][ T3601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 37.469525][ T3601] RIP: 0010:erofs_bread+0x34/0x6f0 [ 37.474621][ T3601] Code: 54 49 89 f4 55 89 d5 53 48 89 fb 48 83 ec 08 e8 02 2f c4 fd 49 8d 7c 24 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 36 06 00 00 48 89 da 4d 8b 64 24 30 48 b8 00 00 [ 37.494210][ T3601] RSP: 0018:ffffc90003e8f608 EFLAGS: 00010216 [ 37.500254][ T3601] RAX: dffffc0000000000 RBX: ffffc90003e8f750 RCX: 0000000000000000 [ 37.508218][ T3601] RDX: 0000000000000006 RSI: ffffffff83b86d7e RDI: 0000000000000030 [ 37.516184][ T3601] RBP: 000000007ec94954 R08: 0000000000000005 R09: 0000000000000000 [ 37.524133][ T3601] R10: 0000000000000a62 R11: 0000000000000000 R12: 0000000000000000 [ 37.532086][ T3601] R13: 032487ec94954840 R14: 0000000000000001 R15: dffffc0000000000 [ 37.540039][ T3601] FS: 00005555574a5300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 37.548945][ T3601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.555509][ T3601] CR2: 00007f2ea2b7b260 CR3: 00000000203d8000 CR4: 0000000000350ee0 [ 37.563463][ T3601] Call Trace: [ 37.566738][ T3601] [ 37.569649][ T3601] z_erofs_do_read_page+0x593/0x3bb0 [ 37.574925][ T3601] ? z_erofs_rcu_callback+0x160/0x160 [ 37.580287][ T3601] ? PageHeadHuge+0x19e/0x200 [ 37.584946][ T3601] z_erofs_pcluster_readmore+0x378/0x830 [ 37.590561][ T3601] z_erofs_read_folio+0x248/0x6e0 [ 37.595568][ T3601] ? z_erofs_readahead+0xe20/0xe20 [ 37.600658][ T3601] ? rcu_read_lock_sched_held+0xd/0x70 [ 37.606096][ T3601] ? lock_acquire+0x4fc/0x630 [ 37.610755][ T3601] ? folio_flags.constprop.0+0x53/0x150 [ 37.616282][ T3601] ? folio_add_lru+0x377/0x680 [ 37.621025][ T3601] ? z_erofs_readahead+0xe20/0xe20 [ 37.626121][ T3601] filemap_read_folio+0xdb/0x2c0 [ 37.631037][ T3601] ? __folio_lock_killable+0x20/0x20 [ 37.636313][ T3601] ? folio_alloc+0x3f/0x70 [ 37.640713][ T3601] ? filemap_alloc_folio+0x108/0x3a0 [ 37.645979][ T3601] ? __d_alloc+0x32/0x980 [ 37.650290][ T3601] ? d_alloc+0x4a/0x230 [ 37.654443][ T3601] ? __lookup_hash+0xc8/0x180 [ 37.659098][ T3601] do_read_cache_folio+0x1df/0x510 [ 37.664379][ T3601] ? z_erofs_readahead+0xe20/0xe20 [ 37.669470][ T3601] erofs_bread+0x150/0x6f0 [ 37.673867][ T3601] erofs_namei+0x1f9/0xc40 [ 37.678259][ T3601] ? lock_acquire+0x4fc/0x630 [ 37.682914][ T3601] ? erofs_fiemap+0xa0/0xa0 [ 37.687390][ T3601] ? rcu_read_lock_sched_held+0xd/0x70 [ 37.692824][ T3601] ? rcu_read_lock_sched_held+0xd/0x70 [ 37.698258][ T3601] ? rcu_read_lock_sched_held+0xd/0x70 [ 37.703691][ T3601] ? lock_release+0x5cb/0x810 [ 37.708349][ T3601] ? d_alloc+0x1b7/0x230 [ 37.712575][ T3601] erofs_lookup+0x312/0x4f0 [ 37.717052][ T3601] ? rwlock_bug.part.0+0x90/0x90 [ 37.721985][ T3601] ? erofs_namei+0xc40/0xc40 [ 37.726551][ T3601] ? do_raw_spin_unlock+0x171/0x230 [ 37.731726][ T3601] ? _raw_spin_unlock+0x24/0x40 [ 37.736556][ T3601] ? d_alloc+0x1bc/0x230 [ 37.740780][ T3601] __lookup_hash+0x117/0x180 [ 37.745349][ T3601] filename_create+0x1d6/0x4a0 [ 37.750092][ T3601] ? filename_parentat+0x5a0/0x5a0 [ 37.755180][ T3601] ? lock_downgrade+0x6e0/0x6e0 [ 37.760031][ T3601] ? kmem_cache_alloc+0x43/0x3c0 [ 37.764951][ T3601] ? lock_downgrade+0x6e0/0x6e0 [ 37.769780][ T3601] ? __virt_addr_valid+0x5d/0x2d0 [ 37.774779][ T3601] ? __phys_addr+0xc4/0x140 [ 37.779260][ T3601] do_mkdirat+0x99/0x310 [ 37.783483][ T3601] ? __ia32_sys_mknod+0xa0/0xa0 [ 37.788312][ T3601] ? getname_flags.part.0+0x1dd/0x4f0 [ 37.793660][ T3601] __x64_sys_mkdirat+0x115/0x170 [ 37.798573][ T3601] do_syscall_64+0x35/0xb0 [ 37.802973][ T3601] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 37.808851][ T3601] RIP: 0033:0x7f15a0dc6039 [ 37.813242][ T3601] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 37.832846][ T3601] RSP: 002b:00007ffc02ea30e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 37.841235][ T3601] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f15a0dc6039 [ 37.849198][ T3601] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000005 [ 37.857150][ T3601] RBP: 00007f15a0d85830 R08: 00005555574a52c0 R09: 0000000000000000 [ 37.865116][ T3601] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15a0d858c0 [ 37.873064][ T3601] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 37.881035][ T3601] [ 37.884047][ T3601] Modules linked in: [ 37.888074][ T3601] ---[ end trace 0000000000000000 ]--- [ 37.893612][ T3601] RIP: 0010:erofs_bread+0x34/0x6f0 [ 37.898768][ T3601] Code: 54 49 89 f4 55 89 d5 53 48 89 fb 48 83 ec 08 e8 02 2f c4 fd 49 8d 7c 24 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 36 06 00 00 48 89 da 4d 8b 64 24 30 48 b8 00 00 [ 37.918486][ T3601] RSP: 0018:ffffc90003e8f608 EFLAGS: 00010216 [ 37.924593][ T3601] RAX: dffffc0000000000 RBX: ffffc90003e8f750 RCX: 0000000000000000 [ 37.932580][ T3601] RDX: 0000000000000006 RSI: ffffffff83b86d7e RDI: 0000000000000030 [ 37.940530][ T3601] RBP: 000000007ec94954 R08: 0000000000000005 R09: 0000000000000000 [ 37.948522][ T3601] R10: 0000000000000a62 R11: 0000000000000000 R12: 0000000000000000 [ 37.956544][ T3601] R13: 032487ec94954840 R14: 0000000000000001 R15: dffffc0000000000 [ 37.964546][ T3601] FS: 00005555574a5300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 37.973586][ T3601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.980148][ T3601] CR2: 00007f2ea2b7b260 CR3: 00000000203d8000 CR4: 0000000000350ee0 [ 37.988196][ T3601] Kernel panic - not syncing: Fatal exception [ 37.994737][ T3601] Kernel Offset: disabled [ 37.999070][ T3601] Rebooting in 86400 seconds..