./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3968356033
<...>
Warning: Permanently added '10.128.1.20' (ED25519) to the list of known hosts.
execve("./syz-executor3968356033", ["./syz-executor3968356033"], 0x7ffdad824db0 /* 10 vars */) = 0
brk(NULL) = 0x55556bcac000
brk(0x55556bcace00) = 0x55556bcace00
arch_prctl(ARCH_SET_FS, 0x55556bcac480) = 0
set_tid_address(0x55556bcac750) = 5071
set_robust_list(0x55556bcac760, 24) = 0
rseq(0x55556bcacda0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3968356033", 4096) = 28
getrandom("\x05\xeb\x16\x30\x25\x97\x71\xe3", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55556bcace00
brk(0x55556bccde00) = 0x55556bccde00
brk(0x55556bcce000) = 0x55556bcce000
mprotect(0x7f8311a8a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5071}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5071}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0
close(5) = 0
sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5071}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0
close(5) = 0
sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5071}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5071}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0
close(5) = 0
sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5071}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0
close(5) = 0
sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5071}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
close(3) = 0
close(4) = 0
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7f83119dfa50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f83119e7c10}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7f83119dfa50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f83119e7c10}, NULL, 8) = 0
mkdir("./syzkaller.hP21w0", 0700) = 0
chmod("./syzkaller.hP21w0", 0777) = 0
chdir("./syzkaller.hP21w0") = 0
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8309400000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
munmap(0x7f8309400000, 138412032) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
close(4) = 0
mkdir("./file0", 0777) = 0
[ 60.264142][ T5071] loop0: detected capacity change from 0 to 512
[ 60.317243][ T5071] EXT4-fs: Ignoring removed mblk_io_submit option
[ 60.329186][ T5071] EXT4-fs error (device loop0): ext4_xattr_ibody_find:2250: inode #12: comm syz-executor396: corrupted in-inode xattr: invalid ea_ino
[ 60.343667][ T5071] EXT4-fs error (device loop0): ext4_orphan_get:1399: comm syz-executor396: couldn't read orphan inode 12 (err -117)
mount("/dev/loop0", "./file0", "ext4", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS|MS_NOSYMFOLLOW|MS_NOATIME|MS_POSIXACL|MS_RELATIME|MS_I_VERSION|MS_STRICTATIME|0x200, "inode_readahead_blks=0x0000000000200000,mblk_io_submit,grpjquota=,resuid=0x0000000000000000,prjquota"...) = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0") = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
mkdir("./file0", 0777) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
mkdir("./file1", 000) = 0
creat("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 4
[ 60.356714][ T5071] EXT4-fs (loop0): mounted filesystem 00000005-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
mknod("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 0
link("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0
rename("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = -1 EUCLEAN (Structure needs cleaning)
open(".", O_RDONLY) = 5
lseek(5, 2047, SEEK_SET) = 2047
[ 60.422130][ T5071] EXT4-fs error (device loop0): make_indexed_dir:2282: inode #2: block 255: comm syz-executor396: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5120, rec_len=0, size=993 fake=0
[ 60.454376][ T5071] EXT4-fs warning (device loop0): dx_probe:832: inode #2: comm syz-executor396: Unrecognised inode hash code 49
[ 60.466530][ T5071] EXT4-fs warning (device loop0): dx_probe:965: inode #2: comm syz-executor396: Corrupt directory, running e2fsck is recommended
[ 60.480004][ T5071] ==================================================================
[ 60.488075][ T5071] BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x6fd/0x880
[ 60.495990][ T5071] Read of size 2 at addr ffff8880683ae003 by task syz-executor396/5071
[ 60.504238][ T5071]
[ 60.506555][ T5071] CPU: 0 PID: 5071 Comm: syz-executor396 Not tainted 6.9.0-rc7-syzkaller-00117-g448b3fe5a0ea #0
[ 60.516943][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 60.526985][ T5071] Call Trace:
[ 60.530246][ T5071]
[ 60.533159][ T5071] dump_stack_lvl+0x241/0x360
[ 60.537841][ T5071] ? __pfx_dump_stack_lvl+0x10/0x10
[ 60.543032][ T5071] ? __pfx__printk+0x10/0x10
[ 60.547605][ T5071] ? _printk+0xd5/0x120
[ 60.551797][ T5071] ? __virt_addr_valid+0x183/0x520
[ 60.556934][ T5071] ? __virt_addr_valid+0x183/0x520
[ 60.562041][ T5071] print_report+0x169/0x550
[ 60.566534][ T5071] ? __virt_addr_valid+0x183/0x520
[ 60.571627][ T5071] ? __virt_addr_valid+0x183/0x520
[ 60.576738][ T5071] ? __virt_addr_valid+0x44e/0x520
[ 60.581845][ T5071] ? __phys_addr+0xba/0x170
[ 60.586345][ T5071] ? __ext4_check_dir_entry+0x6fd/0x880
[ 60.591896][ T5071] kasan_report+0x143/0x180
[ 60.596402][ T5071] ? __ext4_check_dir_entry+0x6fd/0x880
[ 60.601944][ T5071] __ext4_check_dir_entry+0x6fd/0x880
[ 60.607310][ T5071] ? __pfx_ext4_dirblock_csum_verify+0x10/0x10
[ 60.613450][ T5071] ext4_readdir+0x145d/0x3800
[ 60.618132][ T5071] ? __pfx_ext4_readdir+0x10/0x10
[ 60.623144][ T5071] ? trace_contention_end+0x3c/0x120
[ 60.628419][ T5071] ? iterate_dir+0x436/0x6f0
[ 60.632995][ T5071] ? __pfx_down_read_killable+0x10/0x10
[ 60.638530][ T5071] ? __fdget_pos+0x259/0x320
[ 60.643107][ T5071] ? __pfx___mutex_lock+0x10/0x10
[ 60.648120][ T5071] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 60.654086][ T5071] ? bpf_lsm_file_permission+0x9/0x10
[ 60.659448][ T5071] iterate_dir+0x539/0x6f0
[ 60.663857][ T5071] __se_sys_getdents64+0x20d/0x4f0
[ 60.668982][ T5071] ? _raw_spin_unlock_irq+0x2e/0x50
[ 60.674184][ T5071] ? __pfx___se_sys_getdents64+0x10/0x10
[ 60.679812][ T5071] ? __pfx_filldir64+0x10/0x10
[ 60.684572][ T5071] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 60.690894][ T5071] ? do_syscall_64+0x102/0x240
[ 60.695655][ T5071] do_syscall_64+0xf5/0x240
[ 60.700150][ T5071] ? clear_bhb_loop+0x35/0x90
[ 60.704820][ T5071] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 60.710703][ T5071] RIP: 0033:0x7f8311a13ed9
[ 60.715104][ T5071] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 60.734699][ T5071] RSP: 002b:00007ffd43d6adc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 60.743101][ T5071] RAX: ffffffffffffffda RBX: 00007ffd43d6ae10 RCX: 00007f8311a13ed9
[ 60.751059][ T5071] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000005
[ 60.759016][ T5071] RBP: 00007ffd43d6ae18 R08: 000055556bcad0c0 R09: 000055556bcad0c0
[ 60.766972][ T5071] R10: 000055556bcad0c0 R11: 0000000000000246 R12: 00007f8311a906a0
[ 60.774928][ T5071] R13: 00007ffd43d6ae10 R14: 0000000000000004 R15: 0000000000000003
[ 60.782891][ T5071]
[ 60.785895][ T5071]
[ 60.788201][ T5071] The buggy address belongs to the physical page:
[ 60.794592][ T5071] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x683ae
[ 60.803337][ T5071] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 60.810429][ T5071] page_type: 0xffffffff()
[ 60.814743][ T5071] raw: 00fff00000000000 ffffea0001a0ebc8 ffff8880b9444570 0000000000000000
[ 60.823321][ T5071] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 60.831884][ T5071] page dumped because: kasan: bad access detected
[ 60.838276][ T5071] page_owner tracks the page as freed
[ 60.843620][ T5071] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5065, tgid -1706810074 (sftp-server), ts 5065, free_ts 54138803695
[ 60.862183][ T5071] post_alloc_hook+0x1ea/0x210
[ 60.866938][ T5071] get_page_from_freelist+0x3410/0x35b0
[ 60.872470][ T5071] __alloc_pages+0x256/0x6c0
[ 60.877048][ T5071] alloc_pages_mpol+0x3e8/0x680
[ 60.881885][ T5071] vma_alloc_folio+0xf3/0x1f0
[ 60.886548][ T5071] folio_prealloc+0x31/0x170
[ 60.891123][ T5071] __handle_mm_fault+0x3a03/0x7250
[ 60.896224][ T5071] handle_mm_fault+0x27f/0x770
[ 60.900976][ T5071] exc_page_fault+0x446/0x8a0
[ 60.905641][ T5071] asm_exc_page_fault+0x26/0x30
[ 60.910477][ T5071] page last free pid 5065 tgid 5065 stack trace:
[ 60.916784][ T5071] free_unref_page_prepare+0x97b/0xaa0
[ 60.922230][ T5071] free_unref_folios+0x1f2/0xc10
[ 60.927175][ T5071] folios_put_refs+0x93a/0xa60
[ 60.931962][ T5071] free_pages_and_swap_cache+0x2ea/0x690
[ 60.937592][ T5071] tlb_flush_mmu+0x3a3/0x680
[ 60.942172][ T5071] tlb_finish_mmu+0xd4/0x200
[ 60.946749][ T5071] exit_mmap+0x4bb/0xd60
[ 60.950976][ T5071] __mmput+0x115/0x3c0
[ 60.955029][ T5071] exit_mm+0x220/0x310
[ 60.959085][ T5071] do_exit+0x99e/0x27e0
[ 60.963227][ T5071] do_group_exit+0x207/0x2c0
[ 60.967805][ T5071] __x64_sys_exit_group+0x3f/0x40
[ 60.972819][ T5071] do_syscall_64+0xf5/0x240
[ 60.977311][ T5071] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 60.983198][ T5071]
[ 60.985521][ T5071] Memory state around the buggy address:
[ 60.991150][ T5071] ffff8880683adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 60.999196][ T5071] ffff8880683adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 61.007239][ T5071] >ffff8880683ae000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.015281][ T5071] ^
[ 61.019327][ T5071] ffff8880683ae080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.027376][ T5071] ffff8880683ae100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.035415][ T5071] ==================================================================
[ 61.044177][ T5071] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 61.051390][ T5071] CPU: 1 PID: 5071 Comm: syz-executor396 Not tainted 6.9.0-rc7-syzkaller-00117-g448b3fe5a0ea #0
[ 61.061802][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 61.071842][ T5071] Call Trace:
[ 61.075105][ T5071]
[ 61.078015][ T5071] dump_stack_lvl+0x241/0x360
[ 61.082677][ T5071] ? __pfx_dump_stack_lvl+0x10/0x10
[ 61.087856][ T5071] ? __pfx__printk+0x10/0x10
[ 61.092424][ T5071] ? preempt_schedule+0xe1/0xf0
[ 61.097256][ T5071] ? vscnprintf+0x5d/0x90
[ 61.101564][ T5071] panic+0x349/0x860
[ 61.105439][ T5071] ? check_panic_on_warn+0x21/0xb0
[ 61.110528][ T5071] ? __pfx_panic+0x10/0x10
[ 61.114954][ T5071] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 61.120915][ T5071] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 61.127223][ T5071] ? print_report+0x502/0x550
[ 61.131879][ T5071] check_panic_on_warn+0x86/0xb0
[ 61.136796][ T5071] ? __ext4_check_dir_entry+0x6fd/0x880
[ 61.142321][ T5071] end_report+0x77/0x160
[ 61.146540][ T5071] kasan_report+0x154/0x180
[ 61.151024][ T5071] ? __ext4_check_dir_entry+0x6fd/0x880
[ 61.156548][ T5071] __ext4_check_dir_entry+0x6fd/0x880
[ 61.161898][ T5071] ? __pfx_ext4_dirblock_csum_verify+0x10/0x10
[ 61.168029][ T5071] ext4_readdir+0x145d/0x3800
[ 61.172693][ T5071] ? __pfx_ext4_readdir+0x10/0x10
[ 61.177697][ T5071] ? trace_contention_end+0x3c/0x120
[ 61.182964][ T5071] ? iterate_dir+0x436/0x6f0
[ 61.187529][ T5071] ? __pfx_down_read_killable+0x10/0x10
[ 61.193051][ T5071] ? __fdget_pos+0x259/0x320
[ 61.197622][ T5071] ? __pfx___mutex_lock+0x10/0x10
[ 61.202624][ T5071] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 61.208580][ T5071] ? bpf_lsm_file_permission+0x9/0x10
[ 61.213931][ T5071] iterate_dir+0x539/0x6f0
[ 61.218323][ T5071] __se_sys_getdents64+0x20d/0x4f0
[ 61.223410][ T5071] ? _raw_spin_unlock_irq+0x2e/0x50
[ 61.228587][ T5071] ? __pfx___se_sys_getdents64+0x10/0x10
[ 61.234213][ T5071] ? __pfx_filldir64+0x10/0x10
[ 61.238953][ T5071] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 61.245271][ T5071] ? do_syscall_64+0x102/0x240
[ 61.250065][ T5071] do_syscall_64+0xf5/0x240
[ 61.254560][ T5071] ? clear_bhb_loop+0x35/0x90
[ 61.259230][ T5071] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 61.265116][ T5071] RIP: 0033:0x7f8311a13ed9
[ 61.269515][ T5071] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 61.289117][ T5071] RSP: 002b:00007ffd43d6adc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 61.297529][ T5071] RAX: ffffffffffffffda RBX: 00007ffd43d6ae10 RCX: 00007f8311a13ed9
[ 61.305489][ T5071] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000005
[ 61.313442][ T5071] RBP: 00007ffd43d6ae18 R08: 000055556bcad0c0 R09: 000055556bcad0c0
[ 61.321391][ T5071] R10: 000055556bcad0c0 R11: 0000000000000246 R12: 00007f8311a906a0
[ 61.329340][ T5071] R13: 00007ffd43d6ae10 R14: 0000000000000004 R15: 0000000000000003
[ 61.337294][ T5071]
[ 61.340615][ T5071] Kernel Offset: disabled
[ 61.344925][ T5071] Rebooting in 86400 seconds..