Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts. executing program [ 37.124505][ T6163] loop0: detected capacity change from 0 to 1024 [ 37.140755][ T6163] hfsplus: request for non-existent node 65030 in B*Tree [ 37.142317][ T6163] hfsplus: request for non-existent node 65030 in B*Tree [ 37.144185][ T6163] ================================================================== [ 37.145904][ T6163] BUG: KASAN: use-after-free in hfsplus_bnode_dump+0x3f0/0xa50 [ 37.147472][ T6163] Read of size 2 at addr ffff00000000103e by task syz-executor572/6163 [ 37.149312][ T6163] [ 37.149752][ T6163] CPU: 1 PID: 6163 Comm: syz-executor572 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 [ 37.151860][ T6163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 37.154067][ T6163] Call trace: [ 37.154852][ T6163] dump_backtrace+0x1b8/0x1e4 [ 37.155838][ T6163] show_stack+0x2c/0x3c [ 37.156795][ T6163] dump_stack_lvl+0xd0/0x124 [ 37.157832][ T6163] print_report+0x174/0x514 [ 37.158884][ T6163] kasan_report+0xd8/0x138 [ 37.159827][ T6163] kasan_check_range+0x254/0x294 [ 37.160859][ T6163] __asan_memcpy+0x3c/0x84 [ 37.161882][ T6163] hfsplus_bnode_dump+0x3f0/0xa50 [ 37.162890][ T6163] hfsplus_brec_remove+0x3d0/0x4a4 [ 37.163955][ T6163] __hfsplus_delete_attr+0x1dc/0x3e4 [ 37.165060][ T6163] hfsplus_delete_all_attrs+0x214/0x348 [ 37.166269][ T6163] hfsplus_delete_cat+0x990/0xd58 [ 37.167374][ T6163] hfsplus_unlink+0x2d0/0x690 [ 37.168429][ T6163] hfsplus_rename+0xd0/0x1b0 [ 37.169402][ T6163] vfs_rename+0x9bc/0xc84 [ 37.170254][ T6163] do_renameat2+0x9c8/0xe40 [ 37.171275][ T6163] __arm64_sys_renameat2+0xe0/0xfc [ 37.172373][ T6163] invoke_syscall+0x98/0x2b8 [ 37.173282][ T6163] el0_svc_common+0x130/0x23c [ 37.174253][ T6163] do_el0_svc+0x48/0x58 [ 37.175200][ T6163] el0_svc+0x54/0x158 [ 37.176110][ T6163] el0t_64_sync_handler+0x84/0xfc [ 37.177131][ T6163] el0t_64_sync+0x190/0x194 [ 37.178081][ T6163] [ 37.178585][ T6163] The buggy address belongs to the physical page: [ 37.179922][ T6163] page:0000000036163a36 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x40001 [ 37.182095][ T6163] flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff) [ 37.183587][ T6163] page_type: 0xffffffff() [ 37.184476][ T6163] raw: 01ffc00000000000 fffffc0000000048 fffffc0000000048 0000000000000000 [ 37.186268][ T6163] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 37.188013][ T6163] page dumped because: kasan: bad access detected [ 37.189369][ T6163] [ 37.189839][ T6163] Memory state around the buggy address: [ 37.191038][ T6163] ffff000000000f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.192642][ T6163] ffff000000000f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.194414][ T6163] >ffff000000001000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.196152][ T6163] ^ [ 37.197523][ T6163] ffff000000001080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.199148][ T6163] ffff000000001100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.200947][ T6163] ================================================================== [ 37.203065][ T6163] Disabling lock debugging due to kernel taint [ 37.204424][ T6163] Unable to handle kernel paging request at virtual address ffff600665335a7f [ 37.206281][ T6163] KASAN: probably wild-memory-access in range [0xffff0033299ad3f8-0xffff0033299ad3ff] [ 37.208290][ T6163] Mem abort info: [ 37.209072][ T6163] ESR = 0x0000000096000005 [ 37.210032][ T6163] EC = 0x25: DABT (current EL), IL = 32 bits [ 37.211342][ T6163] SET = 0, FnV = 0 [ 37.212073][ T6163] EA = 0, S1PTW = 0 [ 37.212875][ T6163] FSC = 0x05: level 1 translation fault [ 37.214115][ T6163] Data abort info: [ 37.214937][ T6163] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 37.216256][ T6163] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 37.217473][ T6163] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 37.218765][ T6163] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001adbb8000 [ 37.220354][ T6163] [ffff600665335a7f] pgd=0000000234192003, p4d=0000000234192003, pud=0000000000000000 [ 37.222269][ T6163] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 37.223762][ T6163] Modules linked in: [ 37.224577][ T6163] CPU: 1 PID: 6163 Comm: syz-executor572 Tainted: G B 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 [ 37.227032][ T6163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 37.229093][ T6163] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 37.230774][ T6163] pc : kasan_check_range+0x64/0x294 [ 37.231884][ T6163] lr : __asan_memcpy+0x3c/0x84 [ 37.232893][ T6163] sp : ffff800097867100 [ 37.233822][ T6163] x29: ffff800097867100 x28: 0000000000000002 x27: fffffbffff000000 [ 37.235535][ T6163] x26: 0000000000000000 x25: ffff0000cca66b18 x24: ffff0000cca66aba [ 37.237190][ T6163] x23: 00000000ffffeffe x22: ffff800081153fbc x21: ffff8000978671f0 [ 37.238880][ T6163] x20: ffff0033299ad3fe x19: 0000000000000002 x18: ffff8000978664c0 [ 37.240689][ T6163] x17: 0000000000000000 x16: ffff80008ac972c0 x15: 0000000000000001 [ 37.242430][ T6163] x14: 1fffe00665335a7f x13: 00000000000000ff x12: ffffffffffffffff [ 37.244165][ T6163] x11: ffff600665335a7f x10: 1fffe00665335a7f x9 : dfff800000000000 [ 37.245853][ T6163] x8 : ffff0033299ad3ff x7 : 0000000000000001 x6 : 0000000000000000 [ 37.247561][ T6163] x5 : ffff8000978671f2 x4 : ffff000000000042 x3 : ffff800081153fbc [ 37.249260][ T6163] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffff0033299ad3fe [ 37.250973][ T6163] Call trace: [ 37.251714][ T6163] kasan_check_range+0x64/0x294 [ 37.252736][ T6163] __asan_memcpy+0x3c/0x84 [ 37.253750][ T6163] hfsplus_bnode_dump+0x3f0/0xa50 [ 37.254852][ T6163] hfsplus_brec_remove+0x3d0/0x4a4 [ 37.255974][ T6163] __hfsplus_delete_attr+0x1dc/0x3e4 [ 37.257112][ T6163] hfsplus_delete_all_attrs+0x214/0x348 [ 37.258378][ T6163] hfsplus_delete_cat+0x990/0xd58 [ 37.259480][ T6163] hfsplus_unlink+0x2d0/0x690 [ 37.260509][ T6163] hfsplus_rename+0xd0/0x1b0 [ 37.261452][ T6163] vfs_rename+0x9bc/0xc84 [ 37.262306][ T6163] do_renameat2+0x9c8/0xe40 [ 37.263235][ T6163] __arm64_sys_renameat2+0xe0/0xfc [ 37.264337][ T6163] invoke_syscall+0x98/0x2b8 [ 37.265319][ T6163] el0_svc_common+0x130/0x23c [ 37.266363][ T6163] do_el0_svc+0x48/0x58 [ 37.267281][ T6163] el0_svc+0x54/0x158 [ 37.268149][ T6163] el0t_64_sync_handler+0x84/0xfc [ 37.269222][ T6163] el0t_64_sync+0x190/0x194 [ 37.270205][ T6163] Code: 5400014c b4000b8f aa2a03ec 8b0e018c (3940016d) [ 37.271753][ T6163] ---[ end trace 0000000000000000 ]--- [ 37.570048][ T6163] Kernel panic - not syncing: Oops: Fatal exception [ 37.571484][ T6163] SMP: stopping secondary CPUs [ 37.572513][ T6163] Kernel Offset: disabled [ 37.573428][ T6163] CPU features: 0x0,00000020,7002004a,21017203 [ 37.574699][ T6163] Memory Limit: none [ 37.855716][ T6163] Rebooting in 86400 seconds..