Warning: Permanently added '[localhost]:7609' (ED25519) to the list of known hosts. executing program [ 63.088705][ T5303] loop0: detected capacity change from 0 to 512 [ 63.116868][ T5303] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2240: inode #15: comm syz-executor253: corrupted in-inode xattr: bad e_name length [ 63.123086][ T5303] EXT4-fs error (device loop0): ext4_orphan_get:1394: comm syz-executor253: couldn't read orphan inode 15 (err -117) [ 63.128843][ T5303] EXT4-fs (loop0): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 63.138441][ T5303] ================================================================== [ 63.140970][ T5303] BUG: KASAN: slab-use-after-free in ext4_insert_dentry+0x36a/0x6d0 [ 63.143658][ T5303] Write of size 251 at addr ffff8880444bff14 by task syz-executor253/5303 [ 63.147284][ T5303] [ 63.147994][ T5303] CPU: 0 UID: 0 PID: 5303 Comm: syz-executor253 Not tainted 6.14.0-rc1-syzkaller-00081-gbb066fe812d6 #0 [ 63.148007][ T5303] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 63.148013][ T5303] Call Trace: [ 63.148020][ T5303] [ 63.148025][ T5303] dump_stack_lvl+0x241/0x360 [ 63.148043][ T5303] ? __pfx_dump_stack_lvl+0x10/0x10 [ 63.148052][ T5303] ? __pfx__printk+0x10/0x10 [ 63.148067][ T5303] ? _printk+0xd5/0x120 [ 63.148080][ T5303] ? __virt_addr_valid+0x183/0x530 [ 63.148095][ T5303] ? __virt_addr_valid+0x183/0x530 [ 63.148109][ T5303] print_report+0x169/0x550 [ 63.148119][ T5303] ? __virt_addr_valid+0x183/0x530 [ 63.148126][ T5303] ? __virt_addr_valid+0x183/0x530 [ 63.148138][ T5303] ? __virt_addr_valid+0x45f/0x530 [ 63.148150][ T5303] ? __phys_addr+0xba/0x170 [ 63.148163][ T5303] ? ext4_insert_dentry+0x36a/0x6d0 [ 63.148176][ T5303] kasan_report+0x143/0x180 [ 63.148191][ T5303] ? ext4_insert_dentry+0x36a/0x6d0 [ 63.148213][ T5303] kasan_check_range+0x282/0x290 [ 63.148221][ T5303] ? ext4_insert_dentry+0x36a/0x6d0 [ 63.148229][ T5303] __asan_memcpy+0x40/0x70 [ 63.148240][ T5303] ext4_insert_dentry+0x36a/0x6d0 [ 63.148253][ T5303] add_dirent_to_buf+0x315/0x660 [ 63.148268][ T5303] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 63.148282][ T5303] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 63.148295][ T5303] ? ext4_handle_dirty_dirblock+0xc0/0x350 [ 63.148306][ T5303] make_indexed_dir+0xd0e/0x1350 [ 63.148324][ T5303] ? __pfx_make_indexed_dir+0x10/0x10 [ 63.148337][ T5303] ? add_dirent_to_buf+0x2a7/0x660 [ 63.148350][ T5303] ? add_dirent_to_buf+0x2c5/0x660 [ 63.148365][ T5303] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 63.148378][ T5303] ? __ext4_read_dirblock+0x486/0x790 [ 63.148393][ T5303] ext4_add_entry+0xbcd/0xe00 [ 63.148407][ T5303] ? __pfx_ext4_add_entry+0x10/0x10 [ 63.148425][ T5303] ext4_add_nondir+0x8d/0x290 [ 63.148438][ T5303] ? ext4_symlink+0x70e/0xc90 [ 63.148453][ T5303] ext4_symlink+0x9b1/0xc90 [ 63.148468][ T5303] ? __pfx_ext4_symlink+0x10/0x10 [ 63.148485][ T5303] ? inode_permission+0xff/0x460 [ 63.148495][ T5303] ? bpf_lsm_inode_symlink+0x9/0x10 [ 63.148509][ T5303] ? security_inode_symlink+0xbe/0x330 [ 63.148574][ T5303] vfs_symlink+0x137/0x2e0 [ 63.148588][ T5303] do_symlinkat+0x222/0x3a0 [ 63.148604][ T5303] ? __pfx_do_symlinkat+0x10/0x10 [ 63.148617][ T5303] ? strncpy_from_user+0x146/0x270 [ 63.148628][ T5303] ? getname_flags+0x1e3/0x540 [ 63.148637][ T5303] __x64_sys_symlink+0x7a/0x90 [ 63.148650][ T5303] do_syscall_64+0xf3/0x230 [ 63.148695][ T5303] ? clear_bhb_loop+0x35/0x90 [ 63.148710][ T5303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.148723][ T5303] RIP: 0033:0x7f2e443f4199 [ 63.148734][ T5303] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.148742][ T5303] RSP: 002b:00007ffd965d7858 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 63.148756][ T5303] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f2e443f4199 [ 63.148763][ T5303] RDX: 0000000000000000 RSI: 0000200000000cc0 RDI: 0000200000000dc0 [ 63.148770][ T5303] RBP: 0000200000000180 R08: 00007ffd965d7890 R09: 00007ffd965d7890 [ 63.148776][ T5303] R10: 00007ffd965d7890 R11: 0000000000000246 R12: 0000000000000004 [ 63.148782][ T5303] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffd965d78b0 [ 63.148793][ T5303] [ 63.148797][ T5303] [ 63.268395][ T5303] The buggy address belongs to the physical page: [ 63.270637][ T5303] page: refcount:3 mapcount:0 mapping:ffff888031cdcd78 index:0x3f pfn:0x444bf [ 63.273909][ T5303] memcg:ffff88801c6b6000 [ 63.275549][ T5303] aops:def_blk_aops ino:700000 dentry name(?):"" [ 63.278060][ T5303] flags: 0x4fff10000004014(referenced|dirty|private|node=1|zone=1|lastcpupid=0x7ff) [ 63.281677][ T5303] raw: 04fff10000004014 0000000000000000 dead000000000122 ffff888031cdcd78 [ 63.284828][ T5303] raw: 000000000000003f ffff888044ecfcb0 00000003ffffffff ffff88801c6b6000 [ 63.288061][ T5303] page dumped because: kasan: bad access detected [ 63.290340][ T5303] page_owner tracks the page as allocated [ 63.292435][ T5303] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x148c40(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL), pid 5303, tgid 5303 (syz-executor253), ts 63138039218, free_ts 63122419967 [ 63.299393][ T5303] post_alloc_hook+0x1f4/0x240 [ 63.301229][ T5303] get_page_from_freelist+0x365c/0x37a0 [ 63.303346][ T5303] __alloc_frozen_pages_noprof+0x292/0x710 [ 63.305658][ T5303] alloc_pages_mpol+0x311/0x660 [ 63.307586][ T5303] alloc_pages_noprof+0x121/0x190 [ 63.309529][ T5303] folio_alloc_noprof+0x1e/0x30 [ 63.311253][ T5303] filemap_alloc_folio_noprof+0xe1/0x540 [ 63.313260][ T5303] __filemap_get_folio+0x438/0xae0 [ 63.315055][ T5303] bdev_getblk+0x1d4/0x670 [ 63.316789][ T5303] ext4_getblk+0x31b/0x880 [ 63.318521][ T5303] ext4_bread+0x2e/0x180 [ 63.320367][ T5303] ext4_append+0x327/0x5c0 [ 63.322209][ T5303] make_indexed_dir+0x430/0x1350 [ 63.324459][ T5303] ext4_add_entry+0xbcd/0xe00 [ 63.326233][ T5303] ext4_add_nondir+0x8d/0x290 [ 63.327996][ T5303] ext4_symlink+0x9b1/0xc90 [ 63.329759][ T5303] page last free pid 16 tgid 16 stack trace: [ 63.332084][ T5303] free_frozen_pages+0xe0d/0x10e0 [ 63.333986][ T5303] rcu_core+0xaaa/0x17a0 [ 63.335630][ T5303] handle_softirqs+0x2d4/0x9b0 [ 63.337504][ T5303] run_ksoftirqd+0xca/0x130 [ 63.339317][ T5303] smpboot_thread_fn+0x544/0xa30 [ 63.341049][ T5303] kthread+0x7a9/0x920 [ 63.342586][ T5303] ret_from_fork+0x4b/0x80 [ 63.344269][ T5303] ret_from_fork_asm+0x1a/0x30 [ 63.346175][ T5303] [ 63.347114][ T5303] Memory state around the buggy address: [ 63.349142][ T5303] ffff8880444bff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.352426][ T5303] ffff8880444bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.355535][ T5303] >ffff8880444c0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.358669][ T5303] ^ [ 63.360287][ T5303] ffff8880444c0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.363432][ T5303] ffff8880444c0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.366312][ T5303] ================================================================== [ 63.373244][ T5303] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 63.375981][ T5303] CPU: 0 UID: 0 PID: 5303 Comm: syz-executor253 Not tainted 6.14.0-rc1-syzkaller-00081-gbb066fe812d6 #0 [ 63.379971][ T5303] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 63.383880][ T5303] Call Trace: [ 63.385154][ T5303] [ 63.386517][ T5303] dump_stack_lvl+0x241/0x360 [ 63.388359][ T5303] ? __pfx_dump_stack_lvl+0x10/0x10 [ 63.390344][ T5303] ? __pfx__printk+0x10/0x10 [ 63.392108][ T5303] ? preempt_schedule+0xe1/0xf0 [ 63.393917][ T5303] ? vscnprintf+0x5d/0x90 [ 63.395524][ T5303] panic+0x349/0x880 [ 63.397068][ T5303] ? check_panic_on_warn+0x21/0xb0 [ 63.398852][ T5303] ? __pfx_panic+0x10/0x10 [ 63.400569][ T5303] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 63.402736][ T5303] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 63.404987][ T5303] ? print_report+0x502/0x550 [ 63.406749][ T5303] check_panic_on_warn+0x86/0xb0 [ 63.408545][ T5303] ? ext4_insert_dentry+0x36a/0x6d0 [ 63.410369][ T5303] end_report+0x77/0x160 [ 63.411896][ T5303] kasan_report+0x154/0x180 [ 63.413528][ T5303] ? ext4_insert_dentry+0x36a/0x6d0 [ 63.415492][ T5303] kasan_check_range+0x282/0x290 [ 63.417335][ T5303] ? ext4_insert_dentry+0x36a/0x6d0 [ 63.419027][ T5303] __asan_memcpy+0x40/0x70 [ 63.420618][ T5303] ext4_insert_dentry+0x36a/0x6d0 [ 63.422253][ T5303] add_dirent_to_buf+0x315/0x660 [ 63.424073][ T5303] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 63.426162][ T5303] ? __ext4_handle_dirty_metadata+0x30d/0x820 [ 63.428374][ T5303] ? ext4_handle_dirty_dirblock+0xc0/0x350 [ 63.430558][ T5303] make_indexed_dir+0xd0e/0x1350 [ 63.432355][ T5303] ? __pfx_make_indexed_dir+0x10/0x10 [ 63.434205][ T5303] ? add_dirent_to_buf+0x2a7/0x660 [ 63.436170][ T5303] ? add_dirent_to_buf+0x2c5/0x660 [ 63.438133][ T5303] ? __pfx_add_dirent_to_buf+0x10/0x10 [ 63.440238][ T5303] ? __ext4_read_dirblock+0x486/0x790 [ 63.442030][ T5303] ext4_add_entry+0xbcd/0xe00 [ 63.443679][ T5303] ? __pfx_ext4_add_entry+0x10/0x10 [ 63.445424][ T5303] ext4_add_nondir+0x8d/0x290 [ 63.447023][ T5303] ? ext4_symlink+0x70e/0xc90 [ 63.448698][ T5303] ext4_symlink+0x9b1/0xc90 [ 63.450233][ T5303] ? __pfx_ext4_symlink+0x10/0x10 [ 63.451881][ T5303] ? inode_permission+0xff/0x460 [ 63.453601][ T5303] ? bpf_lsm_inode_symlink+0x9/0x10 [ 63.455366][ T5303] ? security_inode_symlink+0xbe/0x330 [ 63.457232][ T5303] vfs_symlink+0x137/0x2e0 [ 63.458778][ T5303] do_symlinkat+0x222/0x3a0 [ 63.460410][ T5303] ? __pfx_do_symlinkat+0x10/0x10 [ 63.462255][ T5303] ? strncpy_from_user+0x146/0x270 [ 63.464129][ T5303] ? getname_flags+0x1e3/0x540 [ 63.465933][ T5303] __x64_sys_symlink+0x7a/0x90 [ 63.467656][ T5303] do_syscall_64+0xf3/0x230 [ 63.469312][ T5303] ? clear_bhb_loop+0x35/0x90 [ 63.470993][ T5303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.473073][ T5303] RIP: 0033:0x7f2e443f4199 [ 63.474637][ T5303] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.481637][ T5303] RSP: 002b:00007ffd965d7858 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 63.484582][ T5303] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f2e443f4199 [ 63.487308][ T5303] RDX: 0000000000000000 RSI: 0000200000000cc0 RDI: 0000200000000dc0 [ 63.490075][ T5303] RBP: 0000200000000180 R08: 00007ffd965d7890 R09: 00007ffd965d7890 [ 63.492819][ T5303] R10: 00007ffd965d7890 R11: 0000000000000246 R12: 0000000000000004 [ 63.495640][ T5303] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007ffd965d78b0 [ 63.498548][ T5303] [ 63.499958][ T5303] Kernel Offset: disabled [ 63.501569][ T5303] Rebooting in 86400 seconds.. VM DIAGNOSIS: 17:41:51 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000020 RBX=ffffffff9a746080 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc9000d14eef0 R8 =ffffffff8576c52b R9 =1ffff11006801046 R10=dffffc0000000000 R11=ffffffff8576c4e0 R12=dffffc0000000000 R13=0000000000000020 R14=0000000000000020 R15=00000000000003f8 RIP=ffffffff8576c55e RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555578710380 ffffffff 00c00000 GS =0000 ffff88801fc00000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055cc9f73e5e8 CR3=0000000043322000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000440401 Opmask01=0000000000000001 Opmask02=00000000fff7ffff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd965d7860 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 65723d73726f7272 6500747865003036 36396f7369007265 6c6c616b7a797300 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 40571856574a5757 4000515d40001513 131c4a564c005740 4949444e5f5c5600 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000