audit: type=1804 audit(1568062957.533:46): pid=8024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir483033782/syzkaller.hg82A9/5/file0/file0" dev="loop4" ino=3 res=1 ------------[ cut here ]------------ kernel BUG at fs/buffer.c:553! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8024 Comm: syz-executor.4 Not tainted 4.19.71 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mark_buffer_dirty_inode fs/buffer.c:553 [inline] RIP: 0010:mark_buffer_dirty_inode+0x30f/0x410 fs/buffer.c:544 Code: 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 4d 4c 89 63 58 4c 89 ef e8 7b 05 3b 05 e9 ee fd ff ff e8 91 7f b2 ff <0f> 0b 4c 89 ff e8 07 13 e9 ff e9 d3 fd ff ff e8 fd 12 e9 ff e9 5b RSP: 0018:ffff888052ec75c0 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffff8880775f1000 RCX: ffffc9000e8b4000 RDX: 0000000000040000 RSI: ffffffff81b8e6ff RDI: ffff888077768ee0 RBP: ffff888052ec7600 R08: ffff888079c6a4c0 R09: ffffed1015d24733 R10: ffffed1015d24732 R11: ffff8880ae923993 R12: ffff888077768d80 kobject: 'loop0' (0000000087ee8ae5): kobject_uevent_env R13: 0000000000000000 R14: ffff88807744ba98 R15: ffff8880533d5040 FS: 00007f16bd5a8700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000978e9000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 kobject: 'loop0' (0000000087ee8ae5): fill_kobj_path: path = '/devices/virtual/block/loop0' DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: fat16_ent_put+0xd2/0x110 fs/fat/fatent.c:182 fat_free_clusters+0x3de/0x990 fs/fat/fatent.c:594 kobject: 'loop2' (000000003283b891): kobject_uevent_env fat_free fs/fat/file.c:384 [inline] fat_truncate_blocks+0x763/0xc10 fs/fat/file.c:402 fat_setattr+0x806/0xc80 fs/fat/file.c:546 notify_change+0xad7/0xfb0 fs/attr.c:334 do_truncate+0x158/0x220 fs/open.c:63 handle_truncate fs/namei.c:3008 [inline] do_last fs/namei.c:3424 [inline] path_openat+0x2c27/0x45e0 fs/namei.c:3534 do_filp_open+0x1a1/0x280 fs/namei.c:3564 do_sys_open+0x3fe/0x550 fs/open.c:1088 ksys_open include/linux/syscalls.h:1276 [inline] __do_sys_creat fs/open.c:1146 [inline] __se_sys_creat fs/open.c:1144 [inline] __x64_sys_creat+0x61/0x80 fs/open.c:1144 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f16bd5a7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00000000004598e9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000080 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f16bd5a86d4 R13: 00000000004bff1d R14: 00000000004d1e60 R15: 00000000ffffffff Modules linked in: kobject: 'loop2' (000000003283b891): fill_kobj_path: path = '/devices/virtual/block/loop2' ---[ end trace 34d718768526cc06 ]--- RIP: 0010:mark_buffer_dirty_inode fs/buffer.c:553 [inline] RIP: 0010:mark_buffer_dirty_inode+0x30f/0x410 fs/buffer.c:544 Code: 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 4d 4c 89 63 58 4c 89 ef e8 7b 05 3b 05 e9 ee fd ff ff e8 91 7f b2 ff <0f> 0b 4c 89 ff e8 07 13 e9 ff e9 d3 fd ff ff e8 fd 12 e9 ff e9 5b kobject: 'loop3' (00000000acc4b078): kobject_uevent_env RSP: 0018:ffff888052ec75c0 EFLAGS: 00010246 kobject: 'loop3' (00000000acc4b078): fill_kobj_path: path = '/devices/virtual/block/loop3' RAX: 0000000000040000 RBX: ffff8880775f1000 RCX: ffffc9000e8b4000 audit: type=1800 audit(1568062958.073:47): pid=8046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="sda1" ino=16555 res=0 RDX: 0000000000040000 RSI: ffffffff81b8e6ff RDI: ffff888077768ee0 kobject: 'loop5' (000000003c0552b3): kobject_uevent_env RBP: ffff888052ec7600 R08: ffff888079c6a4c0 R09: ffffed1015d24733 kobject: 'loop5' (000000003c0552b3): fill_kobj_path: path = '/devices/virtual/block/loop5' R10: ffffed1015d24732 R11: ffff8880ae923993 R12: ffff888077768d80 R13: 0000000000000000 R14: ffff88807744ba98 R15: ffff8880533d5040 FS: 00007f16bd5a8700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffddf804c20 CR3: 00000000978e9000 CR4: 00000000001406f0 kobject: 'loop1' (000000000594d278): kobject_uevent_env DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 kobject: 'loop1' (000000000594d278): fill_kobj_path: path = '/devices/virtual/block/loop1' DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 kobject: 'loop2' (000000003283b891): kobject_uevent_env