./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2522734297

<...>
Warning: Permanently added '10.128.1.103' (ED25519) to the list of known hosts.
execve("./syz-executor2522734297", ["./syz-executor2522734297"], 0x7fffb3f795c0 /* 10 vars */) = 0
brk(NULL)                               = 0x55556ec40000
brk(0x55556ec40d00)                     = 0x55556ec40d00
arch_prctl(ARCH_SET_FS, 0x55556ec40380) = 0
set_tid_address(0x55556ec40650)         = 5830
set_robust_list(0x55556ec40660, 24)     = 0
rseq(0x55556ec40ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2522734297", 4096) = 28
getrandom("\xc9\x8f\x8e\x4b\xee\xcd\xc6\xd6", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55556ec40d00
brk(0x55556ec61d00)                     = 0x55556ec61d00
brk(0x55556ec62000)                     = 0x55556ec62000
mprotect(0x7fa48cb5e000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5832 attached
 <unfinished ...>
[pid  5832] set_robust_list(0x55556ec40660, 24) = 0
[pid  5830] <... clone resumed>, child_tidptr=0x55556ec40650) = 5832
[pid  5832] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5832] setpgid(0, 0)               = 0
[pid  5832] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5832] write(3, "1000", 4)         = 4
[pid  5832] close(3)                    = 0
[pid  5832] write(1, "executing program\n", 18executing program
) = 18
[pid  5832] memfd_create("syzkaller", 0) = 3
[pid  5832] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa484600000
[pid  5832] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768
[pid  5832] munmap(0x7fa484600000, 138412032) = 0
[pid  5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5832] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5832] close(3)                    = 0
[pid  5832] close(4)                    = 0
[pid  5832] mkdir("./file1", 0777)      = 0
[pid  5832] mount("/dev/loop0", "./file1", "hfs", 0, "") = 0
[pid  5832] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[   58.862182][ T5832] loop0: detected capacity change from 0 to 64
[pid  5832] chdir("./file1")            = 0
[pid  5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid  5832] unlinkat(AT_FDCWD, "./file1", 0) = 0
[pid  5832] mkdirat(AT_FDCWD, "./file1", 000) = 0
[   58.952666][ T5832] ==================================================================
[   58.960758][ T5832] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x314/0x450
[   58.968748][ T5832] Write of size 94 at addr ffff888029128400 by task syz-executor252/5832
[   58.977136][ T5832] 
[   58.979498][ T5832] CPU: 1 UID: 0 PID: 5832 Comm: syz-executor252 Not tainted 6.12.0-rc7-syzkaller-00189-ge8bdb3c8be08 #0
[   58.990581][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
[   59.000625][ T5832] Call Trace:
[   59.003891][ T5832]  <TASK>
[   59.006815][ T5832]  dump_stack_lvl+0x241/0x360
[   59.011486][ T5832]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.016667][ T5832]  ? __pfx__printk+0x10/0x10
[   59.021440][ T5832]  ? _printk+0xd5/0x120
[   59.025602][ T5832]  ? __virt_addr_valid+0x183/0x530
[   59.030696][ T5832]  ? __virt_addr_valid+0x183/0x530
[   59.035788][ T5832]  print_report+0x169/0x550
[   59.040275][ T5832]  ? __virt_addr_valid+0x183/0x530
[   59.045372][ T5832]  ? __virt_addr_valid+0x183/0x530
[   59.050484][ T5832]  ? __virt_addr_valid+0x45f/0x530
[   59.055572][ T5832]  ? __phys_addr+0xba/0x170
[   59.060070][ T5832]  ? hfs_bnode_read_key+0x314/0x450
[   59.065249][ T5832]  kasan_report+0x143/0x180
[   59.069739][ T5832]  ? hfs_bnode_read_key+0x314/0x450
[   59.074920][ T5832]  kasan_check_range+0x282/0x290
[   59.079838][ T5832]  ? hfs_bnode_read_key+0x314/0x450
[   59.085016][ T5832]  __asan_memcpy+0x40/0x70
[   59.089414][ T5832]  hfs_bnode_read_key+0x314/0x450
[   59.094417][ T5832]  hfs_brec_insert+0x7f3/0xbd0
[   59.099183][ T5832]  ? __pfx_hfs_brec_insert+0x10/0x10
[   59.104471][ T5832]  hfs_cat_create+0x41d/0xa50
[   59.109144][ T5832]  ? __pfx_hfs_cat_create+0x10/0x10
[   59.114327][ T5832]  ? _raw_spin_unlock+0x28/0x50
[   59.119155][ T5832]  ? hfs_new_inode+0x86e/0xaf0
[   59.123904][ T5832]  hfs_mkdir+0x6c/0xe0
[   59.127955][ T5832]  vfs_mkdir+0x2f9/0x4f0
[   59.132179][ T5832]  do_mkdirat+0x264/0x3a0
[   59.136505][ T5832]  ? __might_fault+0xaa/0x120
[   59.141164][ T5832]  ? __pfx_do_mkdirat+0x10/0x10
[   59.145998][ T5832]  ? strncpy_from_user+0x13a/0x260
[   59.151088][ T5832]  ? getname_flags+0x1e3/0x540
[   59.155827][ T5832]  __x64_sys_mkdir+0x6c/0x80
[   59.160399][ T5832]  do_syscall_64+0xf3/0x230
[   59.164884][ T5832]  ? clear_bhb_loop+0x35/0x90
[   59.169547][ T5832]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.175419][ T5832] RIP: 0033:0x7fa48caeaa99
[   59.179818][ T5832] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   59.199427][ T5832] RSP: 002b:00007ffecef57088 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
[   59.207848][ T5832] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007fa48caeaa99
[   59.215811][ T5832] RDX: 00007fa48caeaa99 RSI: 0000000000000000 RDI: 00000000200004c0
[   59.223776][ T5832] RBP: 00007fa48cb5e5f0 R08: 000055556ec414c0 R09: 000055556ec414c0
[   59.231736][ T5832] R10: 000055556ec414c0 R11: 0000000000000246 R12: 00007ffecef570b0
[   59.239725][ T5832] R13: 00007ffecef572d8 R14: 431bde82d7b634db R15: 00007fa48cb3303b
[   59.247693][ T5832]  </TASK>
[   59.250702][ T5832] 
[   59.253014][ T5832] Allocated by task 5832:
[   59.257323][ T5832]  kasan_save_track+0x3f/0x80
[   59.261997][ T5832]  __kasan_kmalloc+0x98/0xb0
[   59.266582][ T5832]  __kmalloc_noprof+0x1fc/0x400
[   59.271443][ T5832]  hfs_find_init+0x90/0x1f0
[   59.275936][ T5832]  hfs_cat_create+0x182/0xa50
[   59.280603][ T5832]  hfs_mkdir+0x6c/0xe0
[   59.284659][ T5832]  vfs_mkdir+0x2f9/0x4f0
[   59.288891][ T5832]  do_mkdirat+0x264/0x3a0
[   59.293209][ T5832]  __x64_sys_mkdir+0x6c/0x80
[   59.297787][ T5832]  do_syscall_64+0xf3/0x230
[   59.302283][ T5832]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.308168][ T5832] 
[   59.310487][ T5832] The buggy address belongs to the object at ffff888029128400
[   59.310487][ T5832]  which belongs to the cache kmalloc-96 of size 96
[   59.324353][ T5832] The buggy address is located 0 bytes inside of
[   59.324353][ T5832]  allocated 78-byte region [ffff888029128400, ffff88802912844e)
[   59.338229][ T5832] 
[   59.340555][ T5832] The buggy address belongs to the physical page:
[   59.346959][ T5832] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29128
[   59.355715][ T5832] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   59.362820][ T5832] page_type: f5(slab)
[   59.366797][ T5832] raw: 00fff00000000000 ffff88801ac41280 ffffea00007feb00 0000000000000004
[   59.375369][ T5832] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[   59.383940][ T5832] page dumped because: kasan: bad access detected
[   59.390352][ T5832] page_owner tracks the page as allocated
[   59.396083][ T5832] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 8508816809, free_ts 8471545284
[   59.414392][ T5832]  post_alloc_hook+0x1f3/0x230
[   59.419156][ T5832]  get_page_from_freelist+0x363e/0x3790
[   59.424700][ T5832]  __alloc_pages_noprof+0x292/0x710
[   59.429894][ T5832]  alloc_pages_mpol_noprof+0x3e8/0x680
[   59.435355][ T5832]  alloc_slab_page+0x6a/0x140
[   59.440026][ T5832]  allocate_slab+0x5a/0x2f0
[   59.444528][ T5832]  ___slab_alloc+0xcd1/0x14b0
[   59.449196][ T5832]  __slab_alloc+0x58/0xa0
[   59.453515][ T5832]  __kmalloc_cache_noprof+0x1d5/0x2c0
[   59.458874][ T5832]  usb_hub_create_port_device+0xc8/0xc10
[   59.464501][ T5832]  hub_probe+0x2503/0x3640
[   59.468906][ T5832]  usb_probe_interface+0x645/0xbb0
[   59.474006][ T5832]  really_probe+0x2b8/0xad0
[   59.478501][ T5832]  __driver_probe_device+0x1a2/0x390
[   59.483781][ T5832]  driver_probe_device+0x50/0x430
[   59.488798][ T5832]  __device_attach_driver+0x2d6/0x530
[   59.494168][ T5832] page last free pid 46 tgid 46 stack trace:
[   59.500133][ T5832]  free_unref_page+0xded/0x1130
[   59.504989][ T5832]  vfree+0x186/0x2e0
[   59.508895][ T5832]  delayed_vfree_work+0x56/0x80
[   59.513777][ T5832]  process_scheduled_works+0xa63/0x1850
[   59.519326][ T5832]  worker_thread+0x870/0xd30
[   59.523913][ T5832]  kthread+0x2f0/0x390
[   59.527971][ T5832]  ret_from_fork+0x4b/0x80
[   59.532381][ T5832]  ret_from_fork_asm+0x1a/0x30
[   59.537141][ T5832] 
[   59.539458][ T5832] Memory state around the buggy address:
[   59.545098][ T5832]  ffff888029128300: 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc fc
[   59.553147][ T5832]  ffff888029128380: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   59.561201][ T5832] >ffff888029128400: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc
[   59.569250][ T5832]                                               ^
[   59.575657][ T5832]  ffff888029128480: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   59.583710][ T5832]  ffff888029128500: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
[   59.591758][ T5832] ==================================================================
[   59.600910][ T5832] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   59.608121][ T5832] CPU: 0 UID: 0 PID: 5832 Comm: syz-executor252 Not tainted 6.12.0-rc7-syzkaller-00189-ge8bdb3c8be08 #0
[   59.619224][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
[   59.629274][ T5832] Call Trace:
[   59.632549][ T5832]  <TASK>
[   59.635472][ T5832]  dump_stack_lvl+0x241/0x360
[   59.640154][ T5832]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.645350][ T5832]  ? __pfx__printk+0x10/0x10
[   59.649933][ T5832]  ? preempt_schedule+0xe1/0xf0
[   59.654778][ T5832]  ? vscnprintf+0x5d/0x90
[   59.659111][ T5832]  panic+0x349/0x880
[   59.663002][ T5832]  ? check_panic_on_warn+0x21/0xb0
[   59.668107][ T5832]  ? __pfx_panic+0x10/0x10
[   59.672521][ T5832]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   59.678496][ T5832]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   59.684816][ T5832]  ? print_report+0x502/0x550
[   59.689493][ T5832]  check_panic_on_warn+0x86/0xb0
[   59.694424][ T5832]  ? hfs_bnode_read_key+0x314/0x450
[   59.699618][ T5832]  end_report+0x77/0x160
[   59.703858][ T5832]  kasan_report+0x154/0x180
[   59.708385][ T5832]  ? hfs_bnode_read_key+0x314/0x450
[   59.713760][ T5832]  kasan_check_range+0x282/0x290
[   59.718697][ T5832]  ? hfs_bnode_read_key+0x314/0x450
[   59.723888][ T5832]  __asan_memcpy+0x40/0x70
[   59.728305][ T5832]  hfs_bnode_read_key+0x314/0x450
[   59.733323][ T5832]  hfs_brec_insert+0x7f3/0xbd0
[   59.738084][ T5832]  ? __pfx_hfs_brec_insert+0x10/0x10
[   59.743367][ T5832]  hfs_cat_create+0x41d/0xa50
[   59.748042][ T5832]  ? __pfx_hfs_cat_create+0x10/0x10
[   59.753242][ T5832]  ? _raw_spin_unlock+0x28/0x50
[   59.758087][ T5832]  ? hfs_new_inode+0x86e/0xaf0
[   59.762854][ T5832]  hfs_mkdir+0x6c/0xe0
[   59.766915][ T5832]  vfs_mkdir+0x2f9/0x4f0
[   59.771161][ T5832]  do_mkdirat+0x264/0x3a0
[   59.775483][ T5832]  ? __might_fault+0xaa/0x120
[   59.780155][ T5832]  ? __pfx_do_mkdirat+0x10/0x10
[   59.785005][ T5832]  ? strncpy_from_user+0x13a/0x260
[   59.790111][ T5832]  ? getname_flags+0x1e3/0x540
[   59.794865][ T5832]  __x64_sys_mkdir+0x6c/0x80
[   59.799450][ T5832]  do_syscall_64+0xf3/0x230
[   59.803949][ T5832]  ? clear_bhb_loop+0x35/0x90
[   59.808621][ T5832]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.814506][ T5832] RIP: 0033:0x7fa48caeaa99
[   59.818911][ T5832] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   59.838511][ T5832] RSP: 002b:00007ffecef57088 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
[   59.846919][ T5832] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007fa48caeaa99
[   59.854884][ T5832] RDX: 00007fa48caeaa99 RSI: 0000000000000000 RDI: 00000000200004c0
[   59.862847][ T5832] RBP: 00007fa48cb5e5f0 R08: 000055556ec414c0 R09: 000055556ec414c0
[   59.870806][ T5832] R10: 000055556ec414c0 R11: 0000000000000246 R12: 00007ffecef570b0
[   59.878781][ T5832] R13: 00007ffecef572d8 R14: 431bde82d7b634db R15: 00007fa48cb3303b
[   59.886746][ T5832]  </TASK>
[   59.889968][ T5832] Kernel Offset: disabled
[   59.894280][ T5832] Rebooting in 86400 seconds..