./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor953105695

<...>
forked to background, child pid 4645
[   29.804207][ T4646] 8021q: adding VLAN 0 to HW filter on device bond0
[   29.814294][ T4646] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: [   30.080164][ T4731] ssh-keygen (4731) used greatest stack depth: 16320 bytes left
OK

syzkaller
Warning: Permanently added '10.128.1.88' (ECDSA) to the list of known hosts.
execve("./syz-executor953105695", ["./syz-executor953105695"], 0x7fff9b0b3d80 /* 10 vars */) = 0
brk(NULL)                               = 0x555556f35000
brk(0x555556f35c40)                     = 0x555556f35c40
arch_prctl(ARCH_SET_FS, 0x555556f35300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor953105695", 4096) = 27
brk(0x555556f56c40)                     = 0x555556f56c40
brk(0x555556f57000)                     = 0x555556f57000
mprotect(0x7f4718877000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0)            = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f47103be000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
munmap(0x7f47103be000, 262144)          = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 4
ioctl(4, LOOP_SET_FD, 3)                = 0
close(3)                                = 0
mkdir("./file0", 0777)                  = 0
syzkaller login: [   55.008855][ T5067] loop0: detected capacity change from 0 to 512
[   55.019696][ T5067] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
[   55.027540][ T5067] UDF-fs: Scanning with blocksize 512 failed
[   55.034284][ T5067] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
[   55.041754][ T5067] UDF-fs: Scanning with blocksize 1024 failed
[   55.048128][ T5067] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
mount("/dev/loop0", "./file0", "udf", MS_POSIXACL|MS_KERNMOUNT, "uid=00000000000000000000,utf8,umask=00000000000000000000002,iocharset=maccroatian,noadinicb,") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0")                        = 0
ioctl(4, LOOP_CLR_FD)                   = 0
close(4)                                = 0
[   55.055543][ T5067] UDF-fs: Scanning with blocksize 2048 failed
[   55.062095][ T5067] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256
[   55.073940][ T5067] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[   55.099995][ T5067] ==================================================================
[   55.108068][ T5067] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x62d/0x7e0
[   55.115623][ T5067] Write of size 4 at addr ffff88802b2f3ff0 by task syz-executor953/5067
[   55.123942][ T5067] 
[   55.126249][ T5067] CPU: 0 PID: 5067 Comm: syz-executor953 Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0
[   55.136285][ T5067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   55.146495][ T5067] Call Trace:
[   55.149758][ T5067]  <TASK>
[   55.152672][ T5067]  dump_stack_lvl+0x1b1/0x290
[   55.157334][ T5067]  ? nf_tcp_handle_invalid+0x630/0x630
[   55.162774][ T5067]  ? __wake_up_klogd+0xcd/0x100
[   55.167608][ T5067]  ? panic+0x710/0x710
[   55.171658][ T5067]  ? _printk+0xc0/0x100
[   55.175796][ T5067]  print_address_description+0x74/0x340
[   55.181325][ T5067]  print_report+0x107/0x1f0
[   55.185813][ T5067]  ? _raw_spin_lock+0x40/0x40
[   55.190469][ T5067]  ? udf_current_aext+0x5d0/0xa80
[   55.195484][ T5067]  ? __virt_addr_valid+0x21b/0x2d0
[   55.200587][ T5067]  ? __phys_addr+0xb5/0x160
[   55.205090][ T5067]  ? udf_write_aext+0x62d/0x7e0
[   55.209937][ T5067]  kasan_report+0xcd/0x100
[   55.214353][ T5067]  ? udf_write_aext+0x62d/0x7e0
[   55.219207][ T5067]  udf_write_aext+0x62d/0x7e0
[   55.223882][ T5067]  udf_add_entry+0x1712/0x3300
[   55.228636][ T5067]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   55.234609][ T5067]  ? __mark_inode_dirty+0x593/0x600
[   55.239800][ T5067]  ? udf_add_nondir+0x580/0x580
[   55.244899][ T5067]  ? udf_new_inode+0xb04/0xf30
[   55.249660][ T5067]  ? d_alloc+0x193/0x1d0
[   55.253898][ T5067]  udf_mkdir+0x13c/0x980
[   55.258134][ T5067]  ? udf_symlink+0x1680/0x1680
[   55.262888][ T5067]  ? from_kgid+0x193/0x6b0
[   55.267299][ T5067]  ? make_kgid+0x710/0x710
[   55.271712][ T5067]  ? __lookup_hash+0x123/0x240
[   55.276471][ T5067]  ? apparmor_path_mkdir+0x461/0x520
[   55.281745][ T5067]  ? generic_permission+0x229/0x500
[   55.286936][ T5067]  ? inode_permission+0xf5/0x450
[   55.291861][ T5067]  ? bpf_lsm_inode_mkdir+0x5/0x10
[   55.296875][ T5067]  ? security_inode_mkdir+0xdd/0x120
[   55.302151][ T5067]  vfs_mkdir+0x3b3/0x590
[   55.306386][ T5067]  do_mkdirat+0x25b/0x530
[   55.310704][ T5067]  ? 0xffffffff81000000
[   55.314843][ T5067]  ? __check_object_size+0x15a/0x210
[   55.320119][ T5067]  ? vfs_mkdir+0x590/0x590
[   55.324526][ T5067]  ? getname_flags+0x1ea/0x4e0
[   55.329278][ T5067]  __x64_sys_mkdir+0x6a/0x80
[   55.333859][ T5067]  do_syscall_64+0x3d/0xb0
[   55.338265][ T5067]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.344144][ T5067] RIP: 0033:0x7f4718809ea7
[   55.348544][ T5067] Code: ff ff ff ff c3 66 0f 1f 44 00 00 48 c7 c0 c0 ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   55.368132][ T5067] RSP: 002b:00007ffec5191788 EFLAGS: 00000286 ORIG_RAX: 0000000000000053
[   55.376529][ T5067] RAX: ffffffffffffffda RBX: 0000555556f352c0 RCX: 00007f4718809ea7
[   55.384487][ T5067] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000000020000040
[   55.392444][ T5067] RBP: 00007ffec5191820 R08: 0000000000000000 R09: 0000000000000000
[   55.400399][ T5067] R10: 0000000000000000 R11: 0000000000000286 R12: 00000000ffffffff
[   55.408354][ T5067] R13: 0000000020000040 R14: 00000000200002c0 R15: 0000000000000000
[   55.416320][ T5067]  </TASK>
[   55.419323][ T5067] 
[   55.421630][ T5067] Allocated by task 4780:
[   55.425938][ T5067]  kasan_set_track+0x3d/0x60
[   55.430516][ T5067]  __kasan_kmalloc+0x97/0xb0
[   55.435094][ T5067]  __kmalloc+0xaf/0x190
[   55.439232][ T5067]  tomoyo_realpath_from_path+0xcd/0x5f0
[   55.444934][ T5067]  tomoyo_path_perm+0x22e/0x670
[   55.449864][ T5067]  tomoyo_path_unlink+0xcc/0x100
[   55.454787][ T5067]  security_path_unlink+0xc3/0x140
[   55.459888][ T5067]  do_unlinkat+0x3be/0x930
[   55.464287][ T5067]  __x64_sys_unlink+0x45/0x50
[   55.468953][ T5067]  do_syscall_64+0x3d/0xb0
[   55.473354][ T5067]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.479227][ T5067] 
[   55.481541][ T5067] The buggy address belongs to the object at ffff88802b2f2000
[   55.481541][ T5067]  which belongs to the cache kmalloc-4k of size 4096
[   55.495574][ T5067] The buggy address is located 4080 bytes to the right of
[   55.495574][ T5067]  4096-byte region [ffff88802b2f2000, ffff88802b2f3000)
[   55.509522][ T5067] 
[   55.511830][ T5067] The buggy address belongs to the physical page:
[   55.518222][ T5067] page:ffffea0000acbc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b2f0
[   55.528373][ T5067] head:ffffea0000acbc00 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
[   55.538414][ T5067] anon flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   55.546814][ T5067] raw: 00fff00000010200 ffff888012842140 0000000000000000 dead000000000001
[   55.555382][ T5067] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
[   55.563945][ T5067] page dumped because: kasan: bad access detected
[   55.570343][ T5067] page_owner tracks the page as allocated
[   55.576036][ T5067] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4447, tgid 4447 (udevadm), ts 18001070343, free_ts 17994899218
[   55.596155][ T5067]  get_page_from_freelist+0x742/0x7c0
[   55.601516][ T5067]  __alloc_pages+0x259/0x560
[   55.606101][ T5067]  alloc_slab_page+0xbd/0x190
[   55.610762][ T5067]  allocate_slab+0x5e/0x3c0
[   55.615252][ T5067]  ___slab_alloc+0x782/0xe20
[   55.619829][ T5067]  __kmem_cache_alloc_node+0x25b/0x340
[   55.625269][ T5067]  __kmalloc+0x9e/0x190
[   55.629416][ T5067]  tomoyo_realpath_from_path+0xcd/0x5f0
[   55.634948][ T5067]  tomoyo_check_open_permission+0x1f3/0x480
[   55.640839][ T5067]  security_file_open+0x50/0x560
[   55.645774][ T5067]  do_dentry_open+0x306/0x11b0
[   55.650523][ T5067]  path_openat+0x25ba/0x2dd0
[   55.655105][ T5067]  do_filp_open+0x264/0x4f0
[   55.659596][ T5067]  do_sys_openat2+0x124/0x4e0
[   55.664260][ T5067]  __x64_sys_openat+0x243/0x290
[   55.669102][ T5067]  do_syscall_64+0x3d/0xb0
[   55.673505][ T5067] page last free stack trace:
[   55.678159][ T5067]  free_pcp_prepare+0x751/0x780
[   55.683001][ T5067]  free_unref_page+0x19/0x4c0
[   55.687663][ T5067]  __unfreeze_partials+0x1a5/0x1e0
[   55.692764][ T5067]  put_cpu_partial+0x106/0x170
[   55.697514][ T5067]  qlist_free_all+0x2b/0x70
[   55.702005][ T5067]  kasan_quarantine_reduce+0x156/0x170
[   55.707448][ T5067]  __kasan_slab_alloc+0x1f/0x70
[   55.712285][ T5067]  __kmem_cache_alloc_node+0x1e0/0x340
[   55.717744][ T5067]  kmalloc_trace+0x26/0x60
[   55.722154][ T5067]  kernfs_fop_open+0x3f8/0xc80
[   55.726919][ T5067]  do_dentry_open+0x85f/0x11b0
[   55.731674][ T5067]  path_openat+0x25ba/0x2dd0
[   55.736252][ T5067]  do_filp_open+0x264/0x4f0
[   55.740805][ T5067]  do_sys_openat2+0x124/0x4e0
[   55.745468][ T5067]  __x64_sys_openat+0x243/0x290
[   55.750301][ T5067]  do_syscall_64+0x3d/0xb0
[   55.754702][ T5067] 
[   55.757011][ T5067] Memory state around the buggy address:
[   55.762623][ T5067]  ffff88802b2f3e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.770667][ T5067]  ffff88802b2f3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.778710][ T5067] >ffff88802b2f3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.786759][ T5067]                                                              ^
[   55.794549][ T5067]  ffff88802b2f4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   55.802596][ T5067]  ffff88802b2f4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   55.810635][ T5067] ==================================================================
[   55.819041][ T5067] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   55.826235][ T5067] CPU: 1 PID: 5067 Comm: syz-executor953 Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0
[   55.836282][ T5067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   55.846320][ T5067] Call Trace:
[   55.849587][ T5067]  <TASK>
[   55.852506][ T5067]  dump_stack_lvl+0x1b1/0x290
[   55.857176][ T5067]  ? nf_tcp_handle_invalid+0x630/0x630
[   55.862620][ T5067]  ? panic+0x710/0x710
[   55.866677][ T5067]  ? lock_release+0x81/0x820
[   55.871261][ T5067]  ? vscnprintf+0x59/0x80
[   55.875580][ T5067]  panic+0x2d6/0x710
[   55.879472][ T5067]  ? check_panic_on_warn+0x1d/0xa0
[   55.884570][ T5067]  ? memcpy_page_flushcache+0x100/0x100
[   55.890105][ T5067]  ? _raw_spin_unlock_irqrestore+0x110/0x120
[   55.896069][ T5067]  ? _raw_spin_unlock+0x40/0x40
[   55.900906][ T5067]  ? print_report+0x1b4/0x1f0
[   55.905574][ T5067]  check_panic_on_warn+0x80/0xa0
[   55.910498][ T5067]  ? udf_write_aext+0x62d/0x7e0
[   55.915340][ T5067]  end_report+0x47/0x90
[   55.919483][ T5067]  kasan_report+0xda/0x100
[   55.923893][ T5067]  ? udf_write_aext+0x62d/0x7e0
[   55.928733][ T5067]  udf_write_aext+0x62d/0x7e0
[   55.933396][ T5067]  udf_add_entry+0x1712/0x3300
[   55.938147][ T5067]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
[   55.944120][ T5067]  ? __mark_inode_dirty+0x593/0x600
[   55.949307][ T5067]  ? udf_add_nondir+0x580/0x580
[   55.954145][ T5067]  ? udf_new_inode+0xb04/0xf30
[   55.958899][ T5067]  ? d_alloc+0x193/0x1d0
[   55.963131][ T5067]  udf_mkdir+0x13c/0x980
[   55.967363][ T5067]  ? udf_symlink+0x1680/0x1680
[   55.972110][ T5067]  ? from_kgid+0x193/0x6b0
[   55.976513][ T5067]  ? make_kgid+0x710/0x710
[   55.980932][ T5067]  ? __lookup_hash+0x123/0x240
[   55.985705][ T5067]  ? apparmor_path_mkdir+0x461/0x520
[   55.990986][ T5067]  ? generic_permission+0x229/0x500
[   55.996179][ T5067]  ? inode_permission+0xf5/0x450
[   56.001110][ T5067]  ? bpf_lsm_inode_mkdir+0x5/0x10
[   56.006124][ T5067]  ? security_inode_mkdir+0xdd/0x120
[   56.011405][ T5067]  vfs_mkdir+0x3b3/0x590
[   56.015643][ T5067]  do_mkdirat+0x25b/0x530
[   56.019965][ T5067]  ? 0xffffffff81000000
[   56.024104][ T5067]  ? __check_object_size+0x15a/0x210
[   56.029384][ T5067]  ? vfs_mkdir+0x590/0x590
[   56.033796][ T5067]  ? getname_flags+0x1ea/0x4e0
[   56.038552][ T5067]  __x64_sys_mkdir+0x6a/0x80
[   56.043134][ T5067]  do_syscall_64+0x3d/0xb0
[   56.047549][ T5067]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   56.053439][ T5067] RIP: 0033:0x7f4718809ea7
[   56.057844][ T5067] Code: ff ff ff ff c3 66 0f 1f 44 00 00 48 c7 c0 c0 ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   56.077441][ T5067] RSP: 002b:00007ffec5191788 EFLAGS: 00000286 ORIG_RAX: 0000000000000053
[   56.085844][ T5067] RAX: ffffffffffffffda RBX: 0000555556f352c0 RCX: 00007f4718809ea7
[   56.093800][ T5067] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000000020000040
[   56.101757][ T5067] RBP: 00007ffec5191820 R08: 0000000000000000 R09: 0000000000000000
[   56.109712][ T5067] R10: 0000000000000000 R11: 0000000000000286 R12: 00000000ffffffff
[   56.117679][ T5067] R13: 0000000020000040 R14: 00000000200002c0 R15: 0000000000000000
[   56.125660][ T5067]  </TASK>
[   56.128817][ T5067] Kernel Offset: disabled
[   56.133137][ T5067] Rebooting in 86400 seconds..