./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3798224806 <...> Warning: Permanently added '10.128.1.116' (ED25519) to the list of known hosts. execve("./syz-executor3798224806", ["./syz-executor3798224806"], 0x7ffc39614aa0 /* 10 vars */) = 0 brk(NULL) = 0x555556220000 brk(0x555556220e00) = 0x555556220e00 arch_prctl(ARCH_SET_FS, 0x555556220480) = 0 set_tid_address(0x555556220750) = 5031 set_robust_list(0x555556220760, 24) = 0 rseq(0x555556220da0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3798224806", 4096) = 28 getrandom("\x06\xc4\xb2\x6a\xf1\x8b\xc1\x61", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556220e00 brk(0x555556241e00) = 0x555556241e00 brk(0x555556242000) = 0x555556242000 mprotect(0x7f4bdc5c2000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f4bdc51a250, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4bdc5222a0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f4bdc51a250, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4bdc5222a0}, NULL, 8) = 0 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4bd4110000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f4bd4110000, 262144) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file2", 0777) = 0 [ 50.412167][ T5031] syz-executor379[5031]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 50.428722][ T5031] loop0: detected capacity change from 0 to 512 [ 50.446629][ T5031] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. mount("/dev/loop0", "./file2", "ext4", MS_NOSUID|MS_SILENT|MS_LAZYTIME, ",errors=continue") = 0 openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 chdir("./file2") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 [ 50.459233][ T5031] ext4 filesystem being mounted at /root/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.476468][ T5031] EXT4-fs error (device loop0): ext4_do_update_inode:5097: inode #2: comm syz-executor379: corrupted inode contents [ 50.489099][ T5031] EXT4-fs error (device loop0): ext4_dirty_inode:5956: inode #2: comm syz-executor379: mark_inode_dirty error mkdir("./file2", 0777) = -1 EUCLEAN (Structure needs cleaning) --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- mkdir("./file1", 000) = 0 creat("./bus", 0522) = 4 mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000 chdir(0x20000080) = 0 memfd_create("syzkaller", 0) = 6 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4bcbd50000 write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536) = 65536 munmap(0x7f4bcbd50000, 65536) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) ioctl(7, LOOP_CLR_FD) = 0 ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) close(7) = 0 close(6) = 0 open(0x20000300, O_RDONLY) = 6 ioctl(6, FS_IOC_SETFLAGS, 0x200001c0) = -1 EOPNOTSUPP (Operation not supported) [ 50.501371][ T5031] EXT4-fs error (device loop0): ext4_do_update_inode:5097: inode #2: comm syz-executor379: corrupted inode contents [ 50.513878][ T5031] EXT4-fs error (device loop0): __ext4_ext_dirty:202: inode #2: comm syz-executor379: mark_inode_dirty error [ 50.543630][ T5031] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN [ 50.555476][ T5031] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 50.563888][ T5031] CPU: 1 PID: 5031 Comm: syz-executor379 Not tainted 6.6.0-rc1-syzkaller-00125-ge42bebf6db29 #0 [ 50.574470][ T5031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 [ 50.584516][ T5031] RIP: 0010:utf8nlookup+0x39/0xaa0 [ 50.589624][ T5031] Code: 89 c4 48 89 4c 24 08 48 89 14 24 89 f5 49 89 fd 49 be 00 00 00 00 00 fc ff df e8 22 a5 ea fe 49 8d 5d 18 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 c8 93 44 ff 48 8b 1b 48 83 c3 30 [ 50.609323][ T5031] RSP: 0018:ffffc90003e0f800 EFLAGS: 00010206 [ 50.615385][ T5031] RAX: 0000000000000003 RBX: 0000000000000018 RCX: ffff88801be79dc0 [ 50.623390][ T5031] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 50.631381][ T5031] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 50.639348][ T5031] R10: ffffc90003e0f998 R11: fffff520007c1f36 R12: 0000000000000005 [ 50.647308][ T5031] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8880792de070 [ 50.655267][ T5031] FS: 0000555556220480(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 50.664184][ T5031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.670753][ T5031] CR2: 00007fa9b1ff3870 CR3: 000000002a7f4000 CR4: 00000000003506e0 [ 50.678739][ T5031] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.686786][ T5031] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.694832][ T5031] Call Trace: [ 50.698099][ T5031] [ 50.701021][ T5031] ? __die_body+0x8b/0xe0 [ 50.705352][ T5031] ? die_addr+0xc9/0x100 [ 50.709603][ T5031] ? exc_general_protection+0x3c2/0x5b0 [ 50.715168][ T5031] ? stack_trace_save+0x117/0x1c0 [ 50.720195][ T5031] ? asm_exc_general_protection+0x26/0x30 [ 50.725914][ T5031] ? utf8nlookup+0x39/0xaa0 [ 50.730407][ T5031] ? ext4_fname_setup_ci_filename+0x12d/0x430 [ 50.736464][ T5031] ? ext4_fname_prepare_lookup+0x2f7/0x4e0 [ 50.742259][ T5031] ? ext4_lookup+0x121/0x750 [ 50.746838][ T5031] ? lookup_one_qstr_excl+0x11b/0x250 [ 50.752203][ T5031] ? filename_create+0x297/0x530 [ 50.757132][ T5031] utf8byte+0x334/0x1350 [ 50.761397][ T5031] ? utf8ncursor+0x172/0x210 [ 50.765975][ T5031] utf8_casefold+0x125/0x220 [ 50.770555][ T5031] ? utf8_strncasecmp_folded+0x250/0x250 [ 50.776190][ T5031] ext4_fname_setup_ci_filename+0x1b0/0x430 [ 50.782080][ T5031] ext4_fname_prepare_lookup+0x2f7/0x4e0 [ 50.787709][ T5031] ? ext4_fname_free_filename+0xb0/0xb0 [ 50.793245][ T5031] ? rcu_is_watching+0x15/0xb0 [ 50.798085][ T5031] ? lock_release+0xbf/0x9d0 [ 50.802670][ T5031] ext4_lookup+0x121/0x750 [ 50.807078][ T5031] ? __lock_acquire+0x7f70/0x7f70 [ 50.812095][ T5031] ? ext4_add_entry+0x1000/0x1000 [ 50.817115][ T5031] ? _raw_spin_unlock+0x28/0x40 [ 50.821951][ T5031] ? d_alloc+0x198/0x1d0 [ 50.826178][ T5031] lookup_one_qstr_excl+0x11b/0x250 [ 50.831391][ T5031] filename_create+0x297/0x530 [ 50.836144][ T5031] ? kern_path_create+0x180/0x180 [ 50.841158][ T5031] do_mkdirat+0xb7/0x520 [ 50.845390][ T5031] ? vfs_mkdir+0x450/0x450 [ 50.849805][ T5031] ? getname_flags+0x1f0/0x4e0 [ 50.854651][ T5031] __x64_sys_mkdir+0x6e/0x80 [ 50.859235][ T5031] do_syscall_64+0x41/0xc0 [ 50.863644][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.869530][ T5031] RIP: 0033:0x7f4bdc54d557 [ 50.873933][ T5031] Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 50.893544][ T5031] RSP: 002b:00007fffbf49c838 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 [ 50.901942][ T5031] RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f4bdc54d557 [ 50.909899][ T5031] RDX: 0000000000000040 RSI: 00000000000001ff RDI: 0000000020000540 [ 50.917856][ T5031] RBP: 00007fffbf49c8d0 R08: 00000000000000fd R09: 0000000000000000 [ 50.925811][ T5031] R10: 0000000000000249 R11: 0000000000000286 R12: 0000000020000540 [ 50.933768][ T5031] R13: 00000000200000c0 R14: 0000000000000000 R15: 0000000000000000 [ 50.941731][ T5031] [ 50.944765][ T5031] Modules linked in: [ 50.949789][ T5031] ---[ end trace 0000000000000000 ]--- [ 50.957299][ T5031] RIP: 0010:utf8nlookup+0x39/0xaa0 [ 50.962399][ T5031] Code: 89 c4 48 89 4c 24 08 48 89 14 24 89 f5 49 89 fd 49 be 00 00 00 00 00 fc ff df e8 22 a5 ea fe 49 8d 5d 18 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 c8 93 44 ff 48 8b 1b 48 83 c3 30 [ 50.982765][ T5031] RSP: 0018:ffffc90003e0f800 EFLAGS: 00010206 [ 50.989002][ T5031] RAX: 0000000000000003 RBX: 0000000000000018 RCX: ffff88801be79dc0 [ 50.997470][ T5031] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 51.005821][ T5031] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 51.013826][ T5031] R10: ffffc90003e0f998 R11: fffff520007c1f36 R12: 0000000000000005 [ 51.021780][ T5031] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8880792de070 [ 51.029766][ T5031] FS: 0000555556220480(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 51.038809][ T5031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.045409][ T5031] CR2: 00005650cf4460b8 CR3: 000000002a7f4000 CR4: 00000000003506f0 [ 51.053459][ T5031] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.061448][ T5031] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.069471][ T5031] Kernel panic - not syncing: Fatal exception [ 51.075627][ T5031] Kernel Offset: disabled [ 51.080213][ T5031] Rebooting in 86400 seconds..