Warning: Permanently added '10.128.0.145' (ED25519) to the list of known hosts. executing program [ 45.837726][ T4016] loop0: detected capacity change from 0 to 1024 [ 45.932340][ T4016] ================================================================== [ 45.934509][ T4016] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x120/0x24c [ 45.936710][ T4016] Write of size 3970 at addr ffff0000db0f4800 by task syz-executor642/4016 [ 45.938799][ T4016] [ 45.939424][ T4016] CPU: 1 PID: 4016 Comm: syz-executor642 Not tainted 5.15.167-syzkaller #0 [ 45.941722][ T4016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 45.944225][ T4016] Call trace: [ 45.945124][ T4016] dump_backtrace+0x0/0x530 [ 45.946295][ T4016] show_stack+0x2c/0x3c [ 45.947341][ T4016] dump_stack_lvl+0x108/0x170 [ 45.948547][ T4016] print_address_description+0x7c/0x3f0 [ 45.950013][ T4016] kasan_report+0x174/0x1e4 [ 45.951217][ T4016] kasan_check_range+0x274/0x2b4 [ 45.952387][ T4016] memcpy+0xb4/0xe8 [ 45.953451][ T4016] hfsplus_bnode_read+0x120/0x24c [ 45.954836][ T4016] hfsplus_bnode_read_key+0x170/0x278 [ 45.956276][ T4016] hfsplus_brec_insert+0x520/0xaa0 [ 45.957504][ T4016] hfsplus_create_attr+0x3b0/0x568 [ 45.958906][ T4016] __hfsplus_setxattr+0x9a8/0x1df0 [ 45.960274][ T4016] hfsplus_setxattr+0xb4/0xec [ 45.961533][ T4016] hfsplus_security_setxattr+0x54/0x6c [ 45.963116][ T4016] __vfs_setxattr+0x388/0x3a4 [ 45.964329][ T4016] __vfs_setxattr_noperm+0x110/0x528 [ 45.965762][ T4016] __vfs_setxattr_locked+0x1ec/0x218 [ 45.967114][ T4016] vfs_setxattr+0x1a8/0x344 [ 45.968311][ T4016] setxattr+0x250/0x2b4 [ 45.969440][ T4016] path_setxattr+0x17c/0x258 [ 45.970668][ T4016] __arm64_sys_setxattr+0xbc/0xd8 [ 45.971994][ T4016] invoke_syscall+0x98/0x2b8 [ 45.973230][ T4016] el0_svc_common+0x138/0x258 [ 45.974348][ T4016] do_el0_svc+0x58/0x14c [ 45.975490][ T4016] el0_svc+0x7c/0x1f0 [ 45.976517][ T4016] el0t_64_sync_handler+0x84/0xe4 [ 45.977795][ T4016] el0t_64_sync+0x1a0/0x1a4 [ 45.979023][ T4016] [ 45.979572][ T4016] Allocated by task 4016: [ 45.980712][ T4016] ____kasan_kmalloc+0xbc/0xfc [ 45.982015][ T4016] __kasan_kmalloc+0x10/0x1c [ 45.983236][ T4016] __kmalloc+0x29c/0x4c8 [ 45.984387][ T4016] hfsplus_find_init+0x84/0x1bc [ 45.985637][ T4016] hfsplus_create_attr+0x14c/0x568 [ 45.986956][ T4016] __hfsplus_setxattr+0x9a8/0x1df0 [ 45.988232][ T4016] hfsplus_setxattr+0xb4/0xec [ 45.989443][ T4016] hfsplus_security_setxattr+0x54/0x6c [ 45.990838][ T4016] __vfs_setxattr+0x388/0x3a4 [ 45.992142][ T4016] __vfs_setxattr_noperm+0x110/0x528 [ 45.993521][ T4016] __vfs_setxattr_locked+0x1ec/0x218 [ 45.994962][ T4016] vfs_setxattr+0x1a8/0x344 [ 45.996168][ T4016] setxattr+0x250/0x2b4 [ 45.997289][ T4016] path_setxattr+0x17c/0x258 [ 45.998409][ T4016] __arm64_sys_setxattr+0xbc/0xd8 [ 45.999839][ T4016] invoke_syscall+0x98/0x2b8 [ 46.001100][ T4016] el0_svc_common+0x138/0x258 [ 46.002343][ T4016] do_el0_svc+0x58/0x14c [ 46.003448][ T4016] el0_svc+0x7c/0x1f0 [ 46.004373][ T4016] el0t_64_sync_handler+0x84/0xe4 [ 46.005716][ T4016] el0t_64_sync+0x1a0/0x1a4 [ 46.006945][ T4016] [ 46.007521][ T4016] The buggy address belongs to the object at ffff0000db0f4800 [ 46.007521][ T4016] which belongs to the cache kmalloc-1k of size 1024 [ 46.011183][ T4016] The buggy address is located 0 bytes inside of [ 46.011183][ T4016] 1024-byte region [ffff0000db0f4800, ffff0000db0f4c00) [ 46.014591][ T4016] The buggy address belongs to the page: [ 46.016188][ T4016] page:00000000857a2989 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b0f0 [ 46.018775][ T4016] head:00000000857a2989 order:3 compound_mapcount:0 compound_pincount:0 [ 46.020924][ T4016] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 46.023158][ T4016] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002780 [ 46.025365][ T4016] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 46.027699][ T4016] page dumped because: kasan: bad access detected [ 46.029369][ T4016] [ 46.030007][ T4016] Memory state around the buggy address: [ 46.031507][ T4016] ffff0000db0f4900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.033713][ T4016] ffff0000db0f4980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.035813][ T4016] >ffff0000db0f4a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.037910][ T4016] ^ [ 46.039062][ T4016] ffff0000db0f4a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.041098][ T4016] ffff0000db0f4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.043264][ T4016] ================================================================== [ 46.045278][ T4016] Disabling lock debugging due to kernel taint executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 46.988112][ T4017] ------------[ cut here ]------------ [ 46.989671][ T4017] virt_to_phys used for non-linear address: 00000000a326d265 (0x30000000cc05) [ 46.992120][ T4017] WARNING: CPU: 0 PID: 4017 at arch/arm64/mm/physaddr.c:15 __virt_to_phys+0x114/0x15c [ 46.994567][ T4017] Modules linked in: [ 46.995556][ T4017] CPU: 0 PID: 4017 Comm: udevd Tainted: G B 5.15.167-syzkaller #0 [ 46.997931][ T4017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 executing program [ 47.000363][ T4017] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 47.002491][ T4017] pc : __virt_to_phys+0x114/0x15c [ 47.003788][ T4017] lr : __virt_to_phys+0x114/0x15c [ 47.005228][ T4017] sp : ffff80001d157370 [ 47.006338][ T4017] x29: ffff80001d157370 x28: 0000000000000001 x27: ffff80001d157b60 [ 47.008507][ T4017] x26: 0000000000000001 x25: ffff80001d1576f0 x24: 0000000000040000 [ 47.010667][ T4017] x23: fffffc0000000000 x22: ffff800017103000 x21: 0000600000000000 [ 47.012759][ T4017] x20: 000030000000cc05 x19: 000130000000cc05 x18: 0000000000000001 [ 47.014906][ T4017] x17: 0000000000000000 x16: ffff800011ac23e0 x15: 00000000ffffffff [ 47.017110][ T4017] x14: ffff0000c98fd1c0 x13: 0000000000000001 x12: 0000000000000001 [ 47.019394][ T4017] x11: 0000000000000000 x10: 0000000000000000 x9 : d715610507441d00 executing program executing program [ 47.021644][ T4017] x8 : d715610507441d00 x7 : 0000000000000001 x6 : 0000000000000001 [ 47.023848][ T4017] x5 : ffff80001d156ad8 x4 : ffff800014b9fae0 x3 : ffff800008557c4c [ 47.026065][ T4017] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000004b [ 47.028289][ T4017] Call trace: [ 47.029211][ T4017] __virt_to_phys+0x114/0x15c [ 47.030498][ T4017] qlist_free_all+0x60/0xa8 [ 47.031709][ T4017] kasan_quarantine_reduce+0x124/0x130 [ 47.033201][ T4017] __kasan_slab_alloc+0x34/0xcc executing program [ 47.034564][ T4017] slab_post_alloc_hook+0x74/0x3f4 [ 47.035979][ T4017] __kmalloc+0x208/0x4c8 [ 47.037096][ T4017] tomoyo_realpath_from_path+0xd0/0x508 [ 47.038605][ T4017] tomoyo_path_perm+0x208/0x568 [ 47.039956][ T4017] tomoyo_inode_getattr+0x28/0x38 [ 47.041271][ T4017] security_inode_getattr+0xd8/0x124 [ 47.042660][ T4017] vfs_statx+0x16c/0x378 [ 47.043745][ T4017] __arm64_sys_newfstatat+0x110/0x194 [ 47.045172][ T4017] invoke_syscall+0x98/0x2b8 [ 47.046401][ T4017] el0_svc_common+0x138/0x258 [ 47.047681][ T4017] do_el0_svc+0x58/0x14c [ 47.048880][ T4017] el0_svc+0x7c/0x1f0 [ 47.049941][ T4017] el0t_64_sync_handler+0x84/0xe4 [ 47.051347][ T4017] el0t_64_sync+0x1a0/0x1a4 [ 47.052588][ T4017] irq event stamp: 8102 [ 47.053690][ T4017] hardirqs last enabled at (8101): [] _raw_write_unlock_irq+0x9c/0x134 [ 47.056438][ T4017] hardirqs last disabled at (8102): [] __schedule+0x308/0x1e48 [ 47.058961][ T4017] softirqs last enabled at (8090): [] local_bh_enable+0x10/0x34 [ 47.061589][ T4017] softirqs last disabled at (8088): [] local_bh_disable+0x10/0x34 [ 47.064101][ T4017] ---[ end trace c153e0b2130c15a0 ]--- executing program executing program executing program [ 47.067238][ T4017] Unable to handle kernel paging request at virtual address fffffec005670308 [ 47.069911][ T4017] Mem abort info: [ 47.070899][ T4017] ESR = 0x0000000096000004 [ 47.072084][ T4017] EC = 0x25: DABT (current EL), IL = 32 bits [ 47.073723][ T4017] SET = 0, FnV = 0 [ 47.074698][ T4017] EA = 0, S1PTW = 0 [ 47.077108][ T4017] FSC = 0x04: level 0 translation fault [ 47.078585][ T4017] Data abort info: [ 47.079598][ T4017] ISV = 0, ISS = 0x00000004 [ 47.080881][ T4017] CM = 0, WnR = 0 [ 47.081825][ T4017] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001ae2ee000 [ 47.083528][ T4017] [fffffec005670308] pgd=0000000000000000, p4d=0000000000000000 [ 47.088567][ T4017] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 47.090413][ T4017] Modules linked in: executing program [ 47.091421][ T4017] CPU: 1 PID: 4017 Comm: udevd Tainted: G B W 5.15.167-syzkaller #0 [ 47.093780][ T4017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 executing program [ 47.096556][ T4017] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 47.098736][ T4017] pc : qlist_free_all+0x70/0xa8 [ 47.099989][ T4017] lr : qlist_free_all+0x60/0xa8 [ 47.101347][ T4017] sp : ffff80001d1573a0 [ 47.102449][ T4017] x29: ffff80001d1573a0 x28: 0000000000000001 x27: ffff80001d157b60 [ 47.104568][ T4017] x26: 0000000000000001 x25: ffff80001d1576f0 x24: 0000000000040000 executing program [ 47.106747][ T4017] x23: fffffc0000000000 x22: ffff800014495000 x21: 000030000000cc05 [ 47.108934][ T4017] x20: 0000000000000000 x19: ffff80001d1573e0 x18: 0000000000000001 [ 47.111068][ T4017] x17: 0000000000000000 x16: ffff800011ac23e0 x15: 00000000ffffffff [ 47.113216][ T4017] x14: ffff0000c98fd1c0 x13: 0000000000000001 x12: 0000000000000001 [ 47.115365][ T4017] x11: 0000000000000000 x10: 0000000000000000 x9 : ffff0000c98fd1c0 [ 47.117481][ T4017] x8 : fffffec005670300 x7 : 0000000000000001 x6 : 0000000000000001 executing program [ 47.119495][ T4017] x5 : ffff80001d156ad8 x4 : ffff800014b9fae0 x3 : ffff800008557c4c [ 47.121769][ T4017] x2 : 0000000000000001 x1 : 0000600000000000 x0 : 0000b00199c0cc05 [ 47.123883][ T4017] Call trace: [ 47.124764][ T4017] qlist_free_all+0x70/0xa8 [ 47.125973][ T4017] kasan_quarantine_reduce+0x124/0x130 [ 47.127389][ T4017] __kasan_slab_alloc+0x34/0xcc [ 47.128679][ T4017] slab_post_alloc_hook+0x74/0x3f4 executing program [ 47.130005][ T4017] __kmalloc+0x208/0x4c8 [ 47.131045][ T4017] tomoyo_realpath_from_path+0xd0/0x508 [ 47.132568][ T4017] tomoyo_path_perm+0x208/0x568 [ 47.133785][ T4017] tomoyo_inode_getattr+0x28/0x38 [ 47.135066][ T4017] security_inode_getattr+0xd8/0x124 [ 47.136413][ T4017] vfs_statx+0x16c/0x378 [ 47.137560][ T4017] __arm64_sys_newfstatat+0x110/0x194 [ 47.138852][ T4017] invoke_syscall+0x98/0x2b8 executing program [ 47.140024][ T4017] el0_svc_common+0x138/0x258 [ 47.141247][ T4017] do_el0_svc+0x58/0x14c [ 47.142296][ T4017] el0_svc+0x7c/0x1f0 [ 47.143377][ T4017] el0t_64_sync_handler+0x84/0xe4 [ 47.144741][ T4017] el0t_64_sync+0x1a0/0x1a4 [ 47.145975][ T4017] Code: d346fc08 927acd08 cb181908 8b170108 (f9400509) [ 47.147876][ T4017] ---[ end trace c153e0b2130c15a1 ]--- executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 47.288645][ T4114] list_del corruption, ffff0000db0fb4a0->next is NULL [ 47.290703][ T4114] ------------[ cut here ]------------ [ 47.292123][ T4114] kernel BUG at lib/list_debug.c:50! [ 47.520910][ T4017] Kernel panic - not syncing: Oops: Fatal exception [ 47.522698][ T4017] SMP: stopping secondary CPUs [ 48.610667][ T4017] SMP: failed to stop secondary CPUs 0-1 [ 48.612076][ T4017] Kernel Offset: disabled [ 48.613125][ T4017] CPU features: 0x8,000081c1,21302e40 [ 48.614458][ T4017] Memory Limit: none [ 48.934602][ T4017] Rebooting in 86400 seconds..