./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor265754427 <...> Warning: Permanently added '10.128.1.116' (ED25519) to the list of known hosts. execve("./syz-executor265754427", ["./syz-executor265754427"], 0x7ffc28cea6c0 /* 10 vars */) = 0 brk(NULL) = 0x555556dc3000 brk(0x555556dc3e00) = 0x555556dc3e00 arch_prctl(ARCH_SET_FS, 0x555556dc3480) = 0 set_tid_address(0x555556dc3750) = 5019 set_robust_list(0x555556dc3760, 24) = 0 rseq(0x555556dc3da0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor265754427", 4096) = 27 getrandom("\xe8\xb0\x6e\xaa\xbf\x74\xf0\x8c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556dc3e00 brk(0x555556de4e00) = 0x555556de4e00 brk(0x555556de5000) = 0x555556de5000 mprotect(0x7f649c2b2000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f649c1e8a50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f649c1f24e0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f649c1e8a50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f649c1f24e0}, NULL, 8) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556dc3750) = 5021 ./strace-static-x86_64: Process 5021 attached [pid 5021] set_robust_list(0x555556dc3760, 24) = 0 [pid 5021] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5021] setpgid(0, 0) = 0 [pid 5021] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5021] write(3, "1000", 4) = 4 [pid 5021] close(3) = 0 [pid 5021] memfd_create("syzkaller", 0) = 3 [pid 5021] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6493ddf000 [pid 5021] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5021] munmap(0x7f6493ddf000, 262144) = 0 [pid 5021] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5021] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5021] close(3) = 0 [pid 5021] mkdir("./file1", 0777) = 0 [ 46.049869][ T5021] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5021 'syz-executor265' [ 46.067536][ T5021] loop0: detected capacity change from 0 to 512 [pid 5021] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "errors=remount-ro,sysvgroups,dioread_lock,grpquota,noauto_da_alloc,resgid=0x0000000000000000,barrier"...) = 0 [pid 5021] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5021] chdir("./file1") = 0 [pid 5021] ioctl(4, LOOP_CLR_FD) = 0 [pid 5021] close(4) = 0 [pid 5021] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5021] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1< [ 46.249754][ T5021] dump_stack_lvl+0xd9/0x1b0 [ 46.254356][ T5021] print_report+0xc4/0x620 [ 46.258803][ T5021] ? __virt_addr_valid+0x5e/0x2d0 [ 46.263824][ T5021] ? __phys_addr+0xc6/0x140 [ 46.268339][ T5021] kasan_report+0xda/0x110 [ 46.272783][ T5021] ? ext4_find_extent+0xbe8/0xce0 [ 46.277814][ T5021] ? ext4_find_extent+0xbe8/0xce0 [ 46.282879][ T5021] ext4_find_extent+0xbe8/0xce0 [ 46.287744][ T5021] ext4_ext_map_blocks+0x26b/0x5b00 [ 46.292981][ T5021] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 46.299074][ T5021] ? print_usage_bug.part.0+0x670/0x670 [ 46.304628][ T5021] ? print_usage_bug.part.0+0x670/0x670 [ 46.310178][ T5021] ? ext4_ext_release+0x10/0x10 [ 46.315031][ T5021] ? lock_sync+0x190/0x190 [ 46.319449][ T5021] ? preempt_count_sub+0x150/0x150 [ 46.324559][ T5021] ? percpu_counter_add_batch+0x112/0x1f0 [ 46.330276][ T5021] ? lockdep_hardirqs_on+0x7d/0x100 [ 46.335471][ T5021] ? down_write_killable_nested+0x250/0x250 [ 46.341361][ T5021] ? ext4_es_lookup_extent+0xc7/0xbf0 [ 46.346732][ T5021] ext4_map_blocks+0x619/0x1770 [ 46.351586][ T5021] ? ext4_issue_zeroout+0x1f0/0x1f0 [ 46.356785][ T5021] ? find_held_lock+0x2d/0x110 [ 46.361546][ T5021] _ext4_get_block+0x24d/0x5a0 [ 46.366308][ T5021] ? ext4_map_blocks+0x1770/0x1770 [ 46.371423][ T5021] ? do_raw_spin_unlock+0x173/0x230 [ 46.376619][ T5021] ? _raw_spin_unlock+0x28/0x40 [ 46.381470][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 46.386405][ T5021] __block_write_begin_int+0x3c0/0x1470 [ 46.391957][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 46.396894][ T5021] ? invalidate_bh_lrus_cpu+0x170/0x170 [ 46.402444][ T5021] ? preempt_count_sub+0x150/0x150 [ 46.407592][ T5021] ? ext4_journal_check_start+0x1b0/0x2a0 [ 46.413311][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 46.418245][ T5021] block_page_mkwrite+0x3d9/0x4d0 [ 46.423279][ T5021] ext4_page_mkwrite+0xcff/0x1760 [ 46.428312][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 46.433245][ T5021] ? ext4_change_inode_journal_flag+0xa00/0xa00 [ 46.439484][ T5021] ? reacquire_held_locks+0x4b0/0x4b0 [ 46.444850][ T5021] ? vm_normal_page+0x10e/0x270 [ 46.449699][ T5021] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 46.455675][ T5021] do_page_mkwrite+0x1a1/0x680 [ 46.460435][ T5021] do_wp_page+0x3a0/0x3710 [ 46.464850][ T5021] ? lock_sync+0x190/0x190 [ 46.469262][ T5021] ? finish_mkwrite_fault+0x250/0x250 [ 46.474661][ T5021] ? do_raw_spin_lock+0x12e/0x2b0 [ 46.479698][ T5021] ? spin_bug+0x1d0/0x1d0 [ 46.484029][ T5021] __handle_mm_fault+0x1af7/0x3b80 [ 46.489145][ T5021] ? vm_iomap_memory+0x170/0x170 [ 46.494092][ T5021] ? find_vma+0x10e/0x1b0 [ 46.498415][ T5021] ? vma_link+0x290/0x290 [ 46.502759][ T5021] handle_mm_fault+0x2ab/0x9d0 [ 46.507524][ T5021] ? access_error+0x156/0x2d0 [ 46.512193][ T5021] ? lock_mm_and_find_vma+0xc2/0x780 [ 46.517476][ T5021] do_user_addr_fault+0x446/0xfc0 [ 46.522497][ T5021] ? rcu_is_watching+0x12/0xb0 [ 46.527266][ T5021] exc_page_fault+0x5c/0xd0 [ 46.531781][ T5021] asm_exc_page_fault+0x26/0x30 [ 46.536635][ T5021] RIP: 0033:0x7f649c1eb318 [ 46.541040][ T5021] Code: 73 00 e9 e3 f7 ff ff 66 c7 04 25 00 01 00 20 2e 00 e9 05 f8 ff ff b8 00 36 00 20 48 8d 35 a8 c4 09 00 b9 25 00 00 00 48 89 c7 48 a5 0f b6 06 88 07 e9 15 f8 ff ff 50 b9 00 36 00 20 ba ac 04 [ 46.560650][ T5021] RSP: 002b:00007ffe22348910 EFLAGS: 00010246 [ 46.566736][ T5021] RAX: 0000000020003600 RBX: 0000000000000000 RCX: 0000000000000025 [ 46.574709][ T5021] RDX: 61981921d9549e4b RSI: 00007f649c2877b8 RDI: 0000000020003600 [ 46.582678][ T5021] RBP: 0000000000000000 R08: 00007ffe22348940 R09: 00007ffe22348940 [ 46.590643][ T5021] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe22348940 [ 46.598621][ T5021] R13: 00007ffe22348bc8 R14: 431bde82d7b634db R15: 00007f649c26803b [ 46.606595][ T5021] [ 46.609605][ T5021] [ 46.611944][ T5021] The buggy address belongs to the physical page: [ 46.618348][ T5021] page:ffffea0001cfe000 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73f80 [ 46.628487][ T5021] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 46.635581][ T5021] page_type: 0xffffffff() [ 46.639902][ T5021] raw: 00fff00000000000 ffffea0001cfe048 ffffea0001cfdfc8 0000000000000000 [ 46.648478][ T5021] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 46.657043][ T5021] page dumped because: kasan: bad access detected [ 46.663440][ T5021] page_owner tracks the page as freed [ 46.668791][ T5021] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5002, tgid 5002 (sshd), ts 39289875338, free_ts 39354485911 [ 46.686761][ T5021] post_alloc_hook+0x2d2/0x350 [ 46.691545][ T5021] get_page_from_freelist+0x10a9/0x31e0 [ 46.697101][ T5021] __alloc_pages+0x1d0/0x4a0 [ 46.701691][ T5021] __folio_alloc+0x16/0x40 [ 46.706103][ T5021] vma_alloc_folio+0x156/0x890 [ 46.710861][ T5021] __handle_mm_fault+0x12a8/0x3b80 [ 46.715972][ T5021] handle_mm_fault+0x2ab/0x9d0 [ 46.720734][ T5021] do_user_addr_fault+0x2e7/0xfc0 [ 46.725761][ T5021] exc_page_fault+0x5c/0xd0 [ 46.730260][ T5021] asm_exc_page_fault+0x26/0x30 [ 46.735105][ T5021] page last free stack trace: [ 46.739760][ T5021] free_unref_page_prepare+0x508/0xb90 [ 46.745215][ T5021] free_unref_page_list+0xe6/0xb30 [ 46.750327][ T5021] release_pages+0x32a/0x14e0 [ 46.754996][ T5021] tlb_batch_pages_flush+0x9a/0x190 [ 46.760188][ T5021] tlb_finish_mmu+0x14b/0x7e0 [ 46.764868][ T5021] unmap_region+0x244/0x2e0 [ 46.769375][ T5021] do_vmi_align_munmap+0xe8e/0x1720 [ 46.774566][ T5021] do_vmi_munmap+0x20e/0x450 [ 46.779149][ T5021] __vm_munmap+0x144/0x390 [ 46.783581][ T5021] __x64_sys_munmap+0x62/0x80 [ 46.788278][ T5021] do_syscall_64+0x38/0xb0 [ 46.792696][ T5021] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 46.798584][ T5021] [ 46.800897][ T5021] Memory state around the buggy address: [ 46.806509][ T5021] ffff888073f7ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.814564][ T5021] ffff888073f7ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.822621][ T5021] >ffff888073f80000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.830683][ T5021] ^ [ 46.838428][ T5021] ffff888073f80080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.846504][ T5021] ffff888073f80100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.854549][ T5021] ================================================================== [ 46.863089][ T5021] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 46.870321][ T5021] CPU: 0 PID: 5021 Comm: syz-executor265 Not tainted 6.5.0-rc3-syzkaller-00123-g57012c57536f #0 [ 46.880850][ T5021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 46.890904][ T5021] Call Trace: [ 46.894173][ T5021] [ 46.897090][ T5021] dump_stack_lvl+0xd9/0x1b0 [ 46.901680][ T5021] panic+0x6a4/0x750 [ 46.905571][ T5021] ? panic_smp_self_stop+0xa0/0xa0 [ 46.910700][ T5021] ? preempt_schedule_thunk+0x1a/0x30 [ 46.916071][ T5021] ? preempt_schedule_common+0x45/0xc0 [ 46.921528][ T5021] check_panic_on_warn+0xab/0xb0 [ 46.926463][ T5021] end_report+0x108/0x150 [ 46.930792][ T5021] kasan_report+0xea/0x110 [ 46.935201][ T5021] ? ext4_find_extent+0xbe8/0xce0 [ 46.940229][ T5021] ? ext4_find_extent+0xbe8/0xce0 [ 46.945260][ T5021] ext4_find_extent+0xbe8/0xce0 [ 46.950113][ T5021] ext4_ext_map_blocks+0x26b/0x5b00 [ 46.955315][ T5021] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 46.961294][ T5021] ? print_usage_bug.part.0+0x670/0x670 [ 46.966840][ T5021] ? print_usage_bug.part.0+0x670/0x670 [ 46.972382][ T5021] ? ext4_ext_release+0x10/0x10 [ 46.977234][ T5021] ? lock_sync+0x190/0x190 [ 46.981647][ T5021] ? preempt_count_sub+0x150/0x150 [ 46.986755][ T5021] ? percpu_counter_add_batch+0x112/0x1f0 [ 46.992473][ T5021] ? lockdep_hardirqs_on+0x7d/0x100 [ 46.997665][ T5021] ? down_write_killable_nested+0x250/0x250 [ 47.003556][ T5021] ? ext4_es_lookup_extent+0xc7/0xbf0 [ 47.008926][ T5021] ext4_map_blocks+0x619/0x1770 [ 47.013780][ T5021] ? ext4_issue_zeroout+0x1f0/0x1f0 [ 47.018974][ T5021] ? find_held_lock+0x2d/0x110 [ 47.023731][ T5021] _ext4_get_block+0x24d/0x5a0 [ 47.028492][ T5021] ? ext4_map_blocks+0x1770/0x1770 [ 47.033596][ T5021] ? do_raw_spin_unlock+0x173/0x230 [ 47.038797][ T5021] ? _raw_spin_unlock+0x28/0x40 [ 47.043639][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 47.048566][ T5021] __block_write_begin_int+0x3c0/0x1470 [ 47.054111][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 47.059044][ T5021] ? invalidate_bh_lrus_cpu+0x170/0x170 [ 47.064589][ T5021] ? preempt_count_sub+0x150/0x150 [ 47.069693][ T5021] ? ext4_journal_check_start+0x1b0/0x2a0 [ 47.075409][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 47.080342][ T5021] block_page_mkwrite+0x3d9/0x4d0 [ 47.085374][ T5021] ext4_page_mkwrite+0xcff/0x1760 [ 47.090395][ T5021] ? _ext4_get_block+0x5a0/0x5a0 [ 47.095322][ T5021] ? ext4_change_inode_journal_flag+0xa00/0xa00 [ 47.101558][ T5021] ? reacquire_held_locks+0x4b0/0x4b0 [ 47.106925][ T5021] ? vm_normal_page+0x10e/0x270 [ 47.111778][ T5021] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 47.117751][ T5021] do_page_mkwrite+0x1a1/0x680 [ 47.122517][ T5021] do_wp_page+0x3a0/0x3710 [ 47.126931][ T5021] ? lock_sync+0x190/0x190 [ 47.131338][ T5021] ? finish_mkwrite_fault+0x250/0x250 [ 47.136707][ T5021] ? do_raw_spin_lock+0x12e/0x2b0 [ 47.141730][ T5021] ? spin_bug+0x1d0/0x1d0 [ 47.146065][ T5021] __handle_mm_fault+0x1af7/0x3b80 [ 47.151173][ T5021] ? vm_iomap_memory+0x170/0x170 [ 47.156108][ T5021] ? find_vma+0x10e/0x1b0 [ 47.160429][ T5021] ? vma_link+0x290/0x290 [ 47.164745][ T5021] handle_mm_fault+0x2ab/0x9d0 [ 47.169506][ T5021] ? access_error+0x156/0x2d0 [ 47.174171][ T5021] ? lock_mm_and_find_vma+0xc2/0x780 [ 47.179449][ T5021] do_user_addr_fault+0x446/0xfc0 [ 47.184463][ T5021] ? rcu_is_watching+0x12/0xb0 [ 47.189258][ T5021] exc_page_fault+0x5c/0xd0 [ 47.193755][ T5021] asm_exc_page_fault+0x26/0x30 [ 47.198598][ T5021] RIP: 0033:0x7f649c1eb318 [ 47.203003][ T5021] Code: 73 00 e9 e3 f7 ff ff 66 c7 04 25 00 01 00 20 2e 00 e9 05 f8 ff ff b8 00 36 00 20 48 8d 35 a8 c4 09 00 b9 25 00 00 00 48 89 c7 48 a5 0f b6 06 88 07 e9 15 f8 ff ff 50 b9 00 36 00 20 ba ac 04 [ 47.222608][ T5021] RSP: 002b:00007ffe22348910 EFLAGS: 00010246 [ 47.228665][ T5021] RAX: 0000000020003600 RBX: 0000000000000000 RCX: 0000000000000025 [ 47.236657][ T5021] RDX: 61981921d9549e4b RSI: 00007f649c2877b8 RDI: 0000000020003600 [ 47.244619][ T5021] RBP: 0000000000000000 R08: 00007ffe22348940 R09: 00007ffe22348940 [ 47.252581][ T5021] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe22348940 [ 47.260540][ T5021] R13: 00007ffe22348bc8 R14: 431bde82d7b634db R15: 00007f649c26803b [ 47.268511][ T5021] [ 47.272366][ T5021] Kernel Offset: disabled [ 47.276673][ T5021] Rebooting in 86400 seconds..