./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor329769431
<...>
Warning: Permanently added '10.128.0.10' (ECDSA) to the list of known hosts.
execve("./syz-executor329769431", ["./syz-executor329769431"], 0x7ffcda8507b0 /* 10 vars */) = 0
brk(NULL) = 0x555556f74000
brk(0x555556f74c40) = 0x555556f74c40
arch_prctl(ARCH_SET_FS, 0x555556f74300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor329769431", 4096) = 27
brk(0x555556f95c40) = 0x555556f95c40
brk(0x555556f96000) = 0x555556f96000
mprotect(0x7fa8ed37f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa8e4e00000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7fa8e4e00000, 524288) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
mount("/dev/loop0", "./file0", "hfsplus", MS_POSIXACL, "") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
syzkaller login: [ 53.080261][ T3631] loop0: detected capacity change from 0 to 1024
[ 53.101270][ T3631] hfsplus: request for non-existent node 184549376 in B*Tree
[ 53.108768][ T3631] hfsplus: request for non-existent node 184549376 in B*Tree
[ 53.117344][ T3631] ==================================================================
[ 53.125414][ T3631] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0xc9/0x200
[ 53.133232][ T3631] Read of size 8 at addr ffff888012bf6bc0 by task syz-executor329/3631
[ 53.141443][ T3631]
[ 53.143747][ T3631] CPU: 0 PID: 3631 Comm: syz-executor329 Not tainted 6.1.0-rc6-syzkaller-00176-g08ad43d554ba #0
[ 53.154128][ T3631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 53.164161][ T3631] Call Trace:
[ 53.167420][ T3631]
[ 53.170338][ T3631] dump_stack_lvl+0x1b1/0x28e
[ 53.175026][ T3631] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 53.180475][ T3631] ? __wake_up_klogd+0xcd/0x100
[ 53.185318][ T3631] ? panic+0x710/0x710
[ 53.189379][ T3631] ? _printk+0xc0/0x100
[ 53.193520][ T3631] ? _raw_spin_lock_irqsave+0x8e/0x100
[ 53.198974][ T3631] print_address_description+0x74/0x340
[ 53.204506][ T3631] print_report+0x107/0x1f0
[ 53.208996][ T3631] ? __virt_addr_valid+0x21b/0x2d0
[ 53.214096][ T3631] ? __phys_addr+0xb5/0x160
[ 53.218588][ T3631] ? hfsplus_bnode_read+0xc9/0x200
[ 53.223700][ T3631] kasan_report+0xcd/0x100
[ 53.228107][ T3631] ? hfsplus_bnode_read+0xc9/0x200
[ 53.233214][ T3631] hfsplus_bnode_read+0xc9/0x200
[ 53.238147][ T3631] hfsplus_bnode_dump+0x29a/0x530
[ 53.243167][ T3631] ? hfsplus_bnode_move+0x930/0x930
[ 53.248360][ T3631] ? hfsplus_bnode_write_u16+0x96/0xf0
[ 53.253817][ T3631] ? wbc_attach_and_unlock_inode+0x1a0/0x540
[ 53.259788][ T3631] ? hfsplus_bnode_move+0x2e6/0x930
[ 53.264983][ T3631] ? __mark_inode_dirty+0x24a/0x600
[ 53.270171][ T3631] ? hfs_find_rec_by_key+0x1f0/0x1f0
[ 53.275461][ T3631] hfsplus_brec_remove+0x430/0x4f0
[ 53.280579][ T3631] __hfsplus_delete_attr+0x219/0x3d0
[ 53.285863][ T3631] ? hfsplus_delete_attr+0x2d0/0x2d0
[ 53.291142][ T3631] ? __kmalloc+0xcc/0x1a0
[ 53.295465][ T3631] ? mutex_lock_nested+0x17/0x20
[ 53.300394][ T3631] hfsplus_delete_all_attrs+0x292/0x430
[ 53.305936][ T3631] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 53.311913][ T3631] ? __hfsplus_delete_attr+0x3d0/0x3d0
[ 53.317370][ T3631] ? trace_writeback_dirty_inode_enqueue+0xdb/0x2b0
[ 53.323964][ T3631] hfsplus_delete_cat+0xa64/0xe90
[ 53.328988][ T3631] ? hfsplus_mark_inode_dirty+0x30/0x30
[ 53.334524][ T3631] ? mutex_lock_io_nested+0x60/0x60
[ 53.339715][ T3631] ? read_lock_is_recursive+0x10/0x10
[ 53.345077][ T3631] ? __might_sleep+0xc0/0xc0
[ 53.349657][ T3631] hfsplus_unlink+0x342/0x7d0
[ 53.354324][ T3631] ? read_lock_is_recursive+0x10/0x10
[ 53.359691][ T3631] ? hfsplus_link+0x820/0x820
[ 53.364362][ T3631] ? down_write+0x1a5/0x270
[ 53.368852][ T3631] ? HAS_UNMAPPED_ID+0x1ed/0x240
[ 53.373782][ T3631] ? down_read_killable+0x80/0x80
[ 53.378798][ T3631] ? may_delete+0x557/0x6f0
[ 53.383294][ T3631] ? bpf_lsm_inode_unlink+0x5/0x10
[ 53.388394][ T3631] ? security_inode_unlink+0xfa/0x130
[ 53.393759][ T3631] vfs_unlink+0x357/0x5f0
[ 53.398078][ T3631] do_unlinkat+0x484/0x940
[ 53.402483][ T3631] ? try_break_deleg+0x120/0x120
[ 53.407407][ T3631] ? __check_object_size+0x15a/0x210
[ 53.412689][ T3631] ? strncpy_from_user+0x1d6/0x330
[ 53.417795][ T3631] __x64_sys_unlink+0x45/0x50
[ 53.422462][ T3631] do_syscall_64+0x3d/0xb0
[ 53.426867][ T3631] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.432748][ T3631] RIP: 0033:0x7fa8ed312769
[ 53.437151][ T3631] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 53.456742][ T3631] RSP: 002b:00007ffffef8b858 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 53.465140][ T3631] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8ed312769
[ 53.473098][ T3631] RDX: 00007fa8ed2d0de3 RSI: 0000000000000000 RDI: 0000000020000140
[ 53.481052][ T3631] RBP: 00007fa8ed2d2000 R08: 00000000000005f0 R09: 0000000000000000
[ 53.489007][ T3631] R10: 00007ffffef8b720 R11: 0000000000000246 R12: 00007fa8ed2d2090
[ 53.496967][ T3631] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 53.504927][ T3631]
[ 53.507934][ T3631]
[ 53.510248][ T3631] Allocated by task 3631:
[ 53.514563][ T3631] kasan_set_track+0x3d/0x60
[ 53.519138][ T3631] __kasan_kmalloc+0x97/0xb0
[ 53.523714][ T3631] __kmalloc+0xaf/0x1a0
[ 53.527856][ T3631] __hfs_bnode_create+0xec/0x7f0
[ 53.532792][ T3631] hfsplus_bnode_find+0x23d/0xd80
[ 53.537811][ T3631] hfsplus_brec_find+0x145/0x520
[ 53.542738][ T3631] hfsplus_delete_all_attrs+0x269/0x430
[ 53.548274][ T3631] hfsplus_delete_cat+0xa64/0xe90
[ 53.553293][ T3631] hfsplus_unlink+0x342/0x7d0
[ 53.557964][ T3631] vfs_unlink+0x357/0x5f0
[ 53.562287][ T3631] do_unlinkat+0x484/0x940
[ 53.566694][ T3631] __x64_sys_unlink+0x45/0x50
[ 53.571359][ T3631] do_syscall_64+0x3d/0xb0
[ 53.575764][ T3631] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.581645][ T3631]
[ 53.583956][ T3631] Last potentially related work creation:
[ 53.589652][ T3631] kasan_save_stack+0x2b/0x50
[ 53.594323][ T3631] __kasan_record_aux_stack+0xb0/0xc0
[ 53.599682][ T3631] insert_work+0x54/0x3e0
[ 53.603998][ T3631] __queue_work+0xaaa/0xd60
[ 53.608488][ T3631] queue_work_on+0x11b/0x200
[ 53.613062][ T3631] netdevice_event+0x887/0x9c0
[ 53.617815][ T3631] raw_notifier_call_chain+0xe7/0x170
[ 53.623173][ T3631] __dev_notify_flags+0x2ef/0x5d0
[ 53.628186][ T3631] dev_change_flags+0xe3/0x190
[ 53.632955][ T3631] devinet_ioctl+0x8cb/0x1a70
[ 53.637631][ T3631] inet_ioctl+0x314/0x3f0
[ 53.641948][ T3631] sock_ioctl+0x53c/0x8d0
[ 53.646263][ T3631] __se_sys_ioctl+0xfb/0x170
[ 53.650843][ T3631] do_syscall_64+0x3d/0xb0
[ 53.655245][ T3631] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.661122][ T3631]
[ 53.663433][ T3631] The buggy address belongs to the object at ffff888012bf6b00
[ 53.663433][ T3631] which belongs to the cache kmalloc-192 of size 192
[ 53.677474][ T3631] The buggy address is located 0 bytes to the right of
[ 53.677474][ T3631] 192-byte region [ffff888012bf6b00, ffff888012bf6bc0)
[ 53.691085][ T3631]
[ 53.693398][ T3631] The buggy address belongs to the physical page:
[ 53.699809][ T3631] page:ffffea00004afd80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12bf6
[ 53.709946][ T3631] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 53.717481][ T3631] raw: 00fff00000000200 ffffea00008eda00 dead000000000005 ffff888012841a00
[ 53.726053][ T3631] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 53.734618][ T3631] page dumped because: kasan: bad access detected
[ 53.741009][ T3631] page_owner tracks the page as allocated
[ 53.746704][ T3631] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 1841523347, free_ts 0
[ 53.763270][ T3631] get_page_from_freelist+0x742/0x7c0
[ 53.768638][ T3631] __alloc_pages+0x259/0x560
[ 53.773219][ T3631] alloc_page_interleave+0x22/0x1c0
[ 53.778407][ T3631] alloc_slab_page+0x70/0xf0
[ 53.782984][ T3631] allocate_slab+0x5e/0x4b0
[ 53.787477][ T3631] ___slab_alloc+0x782/0xe20
[ 53.792057][ T3631] __kmem_cache_alloc_node+0x252/0x310
[ 53.797504][ T3631] kmalloc_trace+0x26/0x60
[ 53.801910][ T3631] kset_create_and_add+0x55/0x280
[ 53.806919][ T3631] devices_init+0x1a/0xc6
[ 53.811235][ T3631] driver_init+0x1b/0x4d
[ 53.815462][ T3631] do_basic_setup+0x16/0x81
[ 53.819965][ T3631] kernel_init_freeable+0x428/0x5d5
[ 53.825154][ T3631] kernel_init+0x19/0x2b0
[ 53.829470][ T3631] ret_from_fork+0x1f/0x30
[ 53.833877][ T3631] page_owner free stack trace missing
[ 53.839228][ T3631]
[ 53.841537][ T3631] Memory state around the buggy address:
[ 53.847147][ T3631] ffff888012bf6a80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 53.855188][ T3631] ffff888012bf6b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 53.863231][ T3631] >ffff888012bf6b80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 53.871272][ T3631] ^
[ 53.877404][ T3631] ffff888012bf6c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 53.885448][ T3631] ffff888012bf6c80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 53.893503][ T3631] ==================================================================
[ 53.901903][ T3631] Kernel panic - not syncing: panic_on_warn set ...
[ 53.908496][ T3631] CPU: 1 PID: 3631 Comm: syz-executor329 Not tainted 6.1.0-rc6-syzkaller-00176-g08ad43d554ba #0
[ 53.918901][ T3631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 53.928949][ T3631] Call Trace:
[ 53.932220][ T3631]
[ 53.935141][ T3631] dump_stack_lvl+0x1b1/0x28e
[ 53.939809][ T3631] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 53.945262][ T3631] ? panic+0x710/0x710
[ 53.949345][ T3631] ? preempt_schedule_common+0xb7/0xe0
[ 53.954794][ T3631] ? vscnprintf+0x59/0x80
[ 53.959113][ T3631] panic+0x2d6/0x710
[ 53.962998][ T3631] ? memcpy_page_flushcache+0xfc/0xfc
[ 53.968358][ T3631] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 53.974334][ T3631] ? print_report+0x1b4/0x1f0
[ 53.979001][ T3631] ? hfsplus_bnode_read+0xc9/0x200
[ 53.984106][ T3631] end_report+0x91/0xa0
[ 53.988250][ T3631] kasan_report+0xda/0x100
[ 53.992658][ T3631] ? hfsplus_bnode_read+0xc9/0x200
[ 53.997766][ T3631] hfsplus_bnode_read+0xc9/0x200
[ 54.002699][ T3631] hfsplus_bnode_dump+0x29a/0x530
[ 54.007718][ T3631] ? hfsplus_bnode_move+0x930/0x930
[ 54.012912][ T3631] ? hfsplus_bnode_write_u16+0x96/0xf0
[ 54.018363][ T3631] ? wbc_attach_and_unlock_inode+0x1a0/0x540
[ 54.024334][ T3631] ? hfsplus_bnode_move+0x2e6/0x930
[ 54.029523][ T3631] ? __mark_inode_dirty+0x24a/0x600
[ 54.034719][ T3631] ? hfs_find_rec_by_key+0x1f0/0x1f0
[ 54.039994][ T3631] hfsplus_brec_remove+0x430/0x4f0
[ 54.045099][ T3631] __hfsplus_delete_attr+0x219/0x3d0
[ 54.050381][ T3631] ? hfsplus_delete_attr+0x2d0/0x2d0
[ 54.055657][ T3631] ? __kmalloc+0xcc/0x1a0
[ 54.059979][ T3631] ? mutex_lock_nested+0x17/0x20
[ 54.064905][ T3631] hfsplus_delete_all_attrs+0x292/0x430
[ 54.070442][ T3631] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 54.076413][ T3631] ? __hfsplus_delete_attr+0x3d0/0x3d0
[ 54.081864][ T3631] ? trace_writeback_dirty_inode_enqueue+0xdb/0x2b0
[ 54.088445][ T3631] hfsplus_delete_cat+0xa64/0xe90
[ 54.093463][ T3631] ? hfsplus_mark_inode_dirty+0x30/0x30
[ 54.099002][ T3631] ? mutex_lock_io_nested+0x60/0x60
[ 54.104190][ T3631] ? read_lock_is_recursive+0x10/0x10
[ 54.109552][ T3631] ? __might_sleep+0xc0/0xc0
[ 54.114134][ T3631] hfsplus_unlink+0x342/0x7d0
[ 54.118802][ T3631] ? read_lock_is_recursive+0x10/0x10
[ 54.124161][ T3631] ? hfsplus_link+0x820/0x820
[ 54.128825][ T3631] ? down_write+0x1a5/0x270
[ 54.133316][ T3631] ? HAS_UNMAPPED_ID+0x1ed/0x240
[ 54.138244][ T3631] ? down_read_killable+0x80/0x80
[ 54.143263][ T3631] ? may_delete+0x557/0x6f0
[ 54.147759][ T3631] ? bpf_lsm_inode_unlink+0x5/0x10
[ 54.152857][ T3631] ? security_inode_unlink+0xfa/0x130
[ 54.158222][ T3631] vfs_unlink+0x357/0x5f0
[ 54.162544][ T3631] do_unlinkat+0x484/0x940
[ 54.166951][ T3631] ? try_break_deleg+0x120/0x120
[ 54.171875][ T3631] ? __check_object_size+0x15a/0x210
[ 54.177152][ T3631] ? strncpy_from_user+0x1d6/0x330
[ 54.182283][ T3631] __x64_sys_unlink+0x45/0x50
[ 54.186948][ T3631] do_syscall_64+0x3d/0xb0
[ 54.191352][ T3631] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.197256][ T3631] RIP: 0033:0x7fa8ed312769
[ 54.201659][ T3631] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.221251][ T3631] RSP: 002b:00007ffffef8b858 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 54.229649][ T3631] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8ed312769
[ 54.237607][ T3631] RDX: 00007fa8ed2d0de3 RSI: 0000000000000000 RDI: 0000000020000140
[ 54.245567][ T3631] RBP: 00007fa8ed2d2000 R08: 00000000000005f0 R09: 0000000000000000
[ 54.253529][ T3631] R10: 00007ffffef8b720 R11: 0000000000000246 R12: 00007fa8ed2d2090
[ 54.261485][ T3631] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 54.269446][ T3631]
[ 54.272597][ T3631] Kernel Offset: disabled
[ 54.276915][ T3631] Rebooting in 86400 seconds..