./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2547720214

<...>
Warning: Permanently added '10.128.1.166' (ED25519) to the list of known hosts.
execve("./syz-executor2547720214", ["./syz-executor2547720214"], 0x7ffc0a0cc6b0 /* 10 vars */) = 0
brk(NULL)                               = 0x55555eb49000
brk(0x55555eb49d00)                     = 0x55555eb49d00
arch_prctl(ARCH_SET_FS, 0x55555eb49380) = 0
set_tid_address(0x55555eb49650)         = 5834
set_robust_list(0x55555eb49660, 24)     = 0
rseq(0x55555eb49ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2547720214", 4096) = 28
getrandom("\xe7\x7e\xe9\x55\x8f\xc4\x39\x11", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55555eb49d00
brk(0x55555eb6ad00)                     = 0x55555eb6ad00
brk(0x55555eb6b000)                     = 0x55555eb6b000
mprotect(0x7fe82a6d4000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
write(1, "executing program\n", 18executing program
)     = 18
memfd_create("syzkaller", 0)            = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe822200000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
munmap(0x7fe822200000, 138412032)       = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 4
ioctl(4, LOOP_SET_FD, 3)                = 0
close(3)                                = 0
close(4)                                = 0
mkdir("./file0", 0777)                  = 0
[   75.390751][ T5834] loop0: detected capacity change from 0 to 8192
[   75.446993][ T5834] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[   75.460538][ T5834] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal
[   75.470726][ T5834] REISERFS (device loop0): using ordered data mode
[   75.477833][ T5834] reiserfs: using flush barriers
[   75.483846][ T5834] REISERFS (device loop0): journal params: device ram0, size 127, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30
[   75.500526][ T5834] REISERFS (device loop0): checking transaction log (ram0)
[   75.518238][ T5834] ==================================================================
[   75.526358][ T5834] BUG: KASAN: use-after-free in reiserfs_read_locked_inode+0x20db/0x29b0
[   75.534814][ T5834] Read of size 4 at addr ffff88807559f000 by task syz-executor254/5834
[   75.543060][ T5834] 
[   75.545390][ T5834] CPU: 1 UID: 0 PID: 5834 Comm: syz-executor254 Not tainted 6.12.0-rc6-syzkaller #0
[   75.554749][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   75.564801][ T5834] Call Trace:
[   75.568092][ T5834]  <TASK>
[   75.571017][ T5834]  dump_stack_lvl+0x241/0x360
[   75.575704][ T5834]  ? __pfx_dump_stack_lvl+0x10/0x10
[   75.580899][ T5834]  ? __pfx__printk+0x10/0x10
[   75.585484][ T5834]  ? _printk+0xd5/0x120
[   75.589639][ T5834]  ? __virt_addr_valid+0x183/0x530
[   75.594753][ T5834]  ? __virt_addr_valid+0x183/0x530
[   75.599886][ T5834]  print_report+0x169/0x550
[   75.604394][ T5834]  ? __virt_addr_valid+0x183/0x530
[   75.609501][ T5834]  ? __virt_addr_valid+0x183/0x530
[   75.614621][ T5834]  ? __virt_addr_valid+0x45f/0x530
[   75.619778][ T5834]  ? __phys_addr+0xba/0x170
[   75.624306][ T5834]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   75.630397][ T5834]  kasan_report+0x143/0x180
[   75.634934][ T5834]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   75.641013][ T5834]  reiserfs_read_locked_inode+0x20db/0x29b0
[   75.646915][ T5834]  ? __pfx_lock_release+0x10/0x10
[   75.651970][ T5834]  ? __pfx_reiserfs_read_locked_inode+0x10/0x10
[   75.658220][ T5834]  ? _raw_spin_unlock+0x28/0x50
[   75.663071][ T5834]  ? __pfx_reiserfs_init_locked_inode+0x10/0x10
[   75.669324][ T5834]  reiserfs_fill_super+0x1361/0x2640
[   75.674645][ T5834]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   75.680302][ T5834]  ? do_raw_spin_lock+0x14f/0x370
[   75.685329][ T5834]  ? __pfx_snprintf+0x10/0x10
[   75.690020][ T5834]  ? set_blocksize+0x1f9/0x360
[   75.694792][ T5834]  ? sb_set_blocksize+0x98/0xf0
[   75.699644][ T5834]  ? setup_bdev_super+0x4e6/0x5d0
[   75.704678][ T5834]  mount_bdev+0x20a/0x2d0
[   75.709012][ T5834]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   75.714646][ T5834]  ? __pfx_mount_bdev+0x10/0x10
[   75.719499][ T5834]  ? vfs_parse_fs_string+0x190/0x230
[   75.724803][ T5834]  ? __pfx_vfs_parse_fs_string+0x10/0x10
[   75.730435][ T5834]  legacy_get_tree+0xee/0x190
[   75.735116][ T5834]  ? __pfx_get_super_block+0x10/0x10
[   75.740400][ T5834]  vfs_get_tree+0x90/0x2b0
[   75.744816][ T5834]  do_new_mount+0x2be/0xb40
[   75.749322][ T5834]  ? __pfx_do_new_mount+0x10/0x10
[   75.754348][ T5834]  __se_sys_mount+0x2d6/0x3c0
[   75.759026][ T5834]  ? __pfx___se_sys_mount+0x10/0x10
[   75.764225][ T5834]  ? do_syscall_64+0x100/0x230
[   75.768992][ T5834]  ? __x64_sys_mount+0x20/0xc0
[   75.773782][ T5834]  do_syscall_64+0xf3/0x230
[   75.778296][ T5834]  ? clear_bhb_loop+0x35/0x90
[   75.782973][ T5834]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.788875][ T5834] RIP: 0033:0x7fe82a6618ca
[   75.793292][ T5834] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   75.812901][ T5834] RSP: 002b:00007fff19593308 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   75.821317][ T5834] RAX: ffffffffffffffda RBX: 00007fff19593320 RCX: 00007fe82a6618ca
[   75.829283][ T5834] RDX: 0000000020001100 RSI: 0000000020001140 RDI: 00007fff19593320
[   75.837258][ T5834] RBP: 0000000000000004 R08: 00007fff19593360 R09: 00000000000010e2
[   75.845238][ T5834] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
[   75.853210][ T5834] R13: 00007fff19593360 R14: 0000000000000003 R15: 0000000000400000
[   75.861185][ T5834]  </TASK>
[   75.864202][ T5834] 
[   75.866537][ T5834] The buggy address belongs to the physical page:
[   75.872960][ T5834] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f1105660 pfn:0x7559f
[   75.882420][ T5834] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   75.889543][ T5834] raw: 00fff00000000000 ffffea0001fc9408 ffff8880b8744af0 0000000000000000
[   75.898144][ T5834] raw: 00000007f1105660 0000000000000000 00000000ffffffff 0000000000000000
[   75.906719][ T5834] page dumped because: kasan: bad access detected
[   75.913145][ T5834] page_owner tracks the page as freed
[   75.918548][ T5834] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5823, tgid 5823 (sshd), ts 68350578922, free_ts 68394795149
[   75.936521][ T5834]  post_alloc_hook+0x1f3/0x230
[   75.941297][ T5834]  get_page_from_freelist+0x3033/0x3180
[   75.946857][ T5834]  __alloc_pages_noprof+0x292/0x710
[   75.952088][ T5834]  alloc_pages_mpol_noprof+0x3e8/0x680
[   75.957563][ T5834]  vma_alloc_folio_noprof+0x12e/0x230
[   75.962946][ T5834]  folio_prealloc+0x31/0x170
[   75.967549][ T5834]  handle_pte_fault+0x24dd/0x6820
[   75.972606][ T5834]  handle_mm_fault+0x1053/0x1ad0
[   75.977549][ T5834]  exc_page_fault+0x459/0x8c0
[   75.982225][ T5834]  asm_exc_page_fault+0x26/0x30
[   75.987084][ T5834] page last free pid 5823 tgid 5823 stack trace:
[   75.993409][ T5834]  free_unref_folios+0xee2/0x18a0
[   75.998434][ T5834]  folios_put_refs+0x76c/0x860
[   76.003193][ T5834]  free_pages_and_swap_cache+0x2ea/0x690
[   76.009001][ T5834]  tlb_flush_mmu+0x3a3/0x680
[   76.013591][ T5834]  tlb_finish_mmu+0xd4/0x200
[   76.018186][ T5834]  vms_clear_ptes+0x437/0x530
[   76.022868][ T5834]  vms_complete_munmap_vmas+0x208/0x910
[   76.028430][ T5834]  do_vmi_align_munmap+0x613/0x730
[   76.033549][ T5834]  do_vmi_munmap+0x24e/0x2d0
[   76.038164][ T5834]  __vm_munmap+0x24c/0x480
[   76.042594][ T5834]  __x64_sys_munmap+0x60/0x70
[   76.047299][ T5834]  do_syscall_64+0xf3/0x230
[   76.051804][ T5834]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   76.057722][ T5834] 
[   76.060073][ T5834] Memory state around the buggy address:
[   76.065720][ T5834]  ffff88807559ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   76.073801][ T5834]  ffff88807559ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   76.081885][ T5834] >ffff88807559f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   76.089941][ T5834]                    ^
[   76.094004][ T5834]  ffff88807559f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   76.102150][ T5834]  ffff88807559f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   76.110209][ T5834] ==================================================================
[   76.118564][ T5834] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   76.125777][ T5834] CPU: 1 UID: 0 PID: 5834 Comm: syz-executor254 Not tainted 6.12.0-rc6-syzkaller #0
[   76.135170][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   76.145230][ T5834] Call Trace:
[   76.148516][ T5834]  <TASK>
[   76.151458][ T5834]  dump_stack_lvl+0x241/0x360
[   76.156150][ T5834]  ? __pfx_dump_stack_lvl+0x10/0x10
[   76.161465][ T5834]  ? __pfx__printk+0x10/0x10
[   76.166065][ T5834]  ? preempt_schedule+0xe1/0xf0
[   76.170925][ T5834]  ? vscnprintf+0x5d/0x90
[   76.175276][ T5834]  panic+0x349/0x880
[   76.179183][ T5834]  ? check_panic_on_warn+0x21/0xb0
[   76.184300][ T5834]  ? __pfx_panic+0x10/0x10
[   76.188741][ T5834]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   76.194728][ T5834]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   76.201060][ T5834]  ? print_report+0x502/0x550
[   76.205750][ T5834]  check_panic_on_warn+0x86/0xb0
[   76.210696][ T5834]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   76.216780][ T5834]  end_report+0x77/0x160
[   76.221037][ T5834]  kasan_report+0x154/0x180
[   76.225552][ T5834]  ? reiserfs_read_locked_inode+0x20db/0x29b0
[   76.231636][ T5834]  reiserfs_read_locked_inode+0x20db/0x29b0
[   76.237551][ T5834]  ? __pfx_lock_release+0x10/0x10
[   76.242608][ T5834]  ? __pfx_reiserfs_read_locked_inode+0x10/0x10
[   76.248870][ T5834]  ? _raw_spin_unlock+0x28/0x50
[   76.253722][ T5834]  ? __pfx_reiserfs_init_locked_inode+0x10/0x10
[   76.259989][ T5834]  reiserfs_fill_super+0x1361/0x2640
[   76.265286][ T5834]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   76.270929][ T5834]  ? do_raw_spin_lock+0x14f/0x370
[   76.275964][ T5834]  ? __pfx_snprintf+0x10/0x10
[   76.280653][ T5834]  ? set_blocksize+0x1f9/0x360
[   76.285424][ T5834]  ? sb_set_blocksize+0x98/0xf0
[   76.290277][ T5834]  ? setup_bdev_super+0x4e6/0x5d0
[   76.295309][ T5834]  mount_bdev+0x20a/0x2d0
[   76.299648][ T5834]  ? __pfx_reiserfs_fill_super+0x10/0x10
[   76.305287][ T5834]  ? __pfx_mount_bdev+0x10/0x10
[   76.310143][ T5834]  ? vfs_parse_fs_string+0x190/0x230
[   76.315444][ T5834]  ? __pfx_vfs_parse_fs_string+0x10/0x10
[   76.321088][ T5834]  legacy_get_tree+0xee/0x190
[   76.325781][ T5834]  ? __pfx_get_super_block+0x10/0x10
[   76.331077][ T5834]  vfs_get_tree+0x90/0x2b0
[   76.335515][ T5834]  do_new_mount+0x2be/0xb40
[   76.340033][ T5834]  ? __pfx_do_new_mount+0x10/0x10
[   76.345071][ T5834]  __se_sys_mount+0x2d6/0x3c0
[   76.349766][ T5834]  ? __pfx___se_sys_mount+0x10/0x10
[   76.354975][ T5834]  ? do_syscall_64+0x100/0x230
[   76.359752][ T5834]  ? __x64_sys_mount+0x20/0xc0
[   76.364530][ T5834]  do_syscall_64+0xf3/0x230
[   76.369047][ T5834]  ? clear_bhb_loop+0x35/0x90
[   76.373732][ T5834]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   76.379635][ T5834] RIP: 0033:0x7fe82a6618ca
[   76.384058][ T5834] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   76.403665][ T5834] RSP: 002b:00007fff19593308 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   76.412088][ T5834] RAX: ffffffffffffffda RBX: 00007fff19593320 RCX: 00007fe82a6618ca
[   76.420066][ T5834] RDX: 0000000020001100 RSI: 0000000020001140 RDI: 00007fff19593320
[   76.428065][ T5834] RBP: 0000000000000004 R08: 00007fff19593360 R09: 00000000000010e2
[   76.436039][ T5834] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
[   76.444009][ T5834] R13: 00007fff19593360 R14: 0000000000000003 R15: 0000000000400000
[   76.452002][ T5834]  </TASK>
[   76.455332][ T5834] Kernel Offset: disabled
[   76.459654][ T5834] Rebooting in 86400 seconds..