BUG: stack guard page was hit at ffffc90006437ff8 (stack is ffffc90006438000..ffffc9000643ffff) kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 12356 Comm: syz-executor.5 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kasan_check_range+0x6/0x2f0 mm/kasan/generic.c:185 Code: 48 89 c7 e8 9c 53 ef 02 31 c0 5d c3 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 41 57 <41> 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 09 02 00 00 48 89 fb 48 RSP: 0018:ffffc90006438000 EFLAGS: 00010246 RAX: ffffffff8226355a RBX: ffffc900064380a0 RCX: ffffffff8226356b RDX: 0000000000000001 RSI: 0000000000000038 RDI: ffffc900064380a0 RBP: ffffc90006438008 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000002 R11: ffff88811b6cbb40 R12: 0000000000000004 R13: ffffffff86f25400 R14: 0000000000000000 R15: 0000000000000038 FS: 00007f21eb3ab700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90006437ff8 CR3: 00000001129b4000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: memset+0x23/0x40 mm/kasan/shadow.c:44 avc_has_perm_noaudit+0x9b/0x4d0 security/selinux/avc.c:1152 cred_has_capability+0x1b5/0x420 security/selinux/hooks.c:1627 selinux_capable+0x39/0x50 security/selinux/hooks.c:2145 security_capable+0x69/0xd0 security/security.c:748 ns_capable_common kernel/capability.c:375 [inline] ns_capable kernel/capability.c:396 [inline] capable_wrt_inode_uidgid+0x95/0x1e0 kernel/capability.c:506 generic_permission+0x149/0x590 fs/namei.c:363 do_inode_permission fs/namei.c:408 [inline] inode_permission+0x87/0x520 fs/namei.c:466 xattr_permission+0xfb/0x380 fs/xattr.c:134 __vfs_getxattr+0xb7/0x6a0 fs/xattr.c:373 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 incfs_getxattr fs/incfs/vfs.c:1668 [inline] incfs_handler_getxattr+0xfa/0x2e0 fs/incfs/vfs.c:164 __vfs_getxattr+0x5a4/0x6a0 fs/xattr.c:399 vfs_getxattr+0x54/0x60 fs/xattr.c:406 read_size_attr fs/incfs/vfs.c:293 [inline] fetch_regular_inode+0x155/0x300 fs/incfs/vfs.c:374 dir_lookup+0x673/0x6e0 fs/incfs/vfs.c:1008 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_one_len+0x17f/0x2c0 fs/namei.c:2642 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967 __lookup_slow+0x2b3/0x400 fs/namei.c:1628 lookup_slow fs/namei.c:1645 [inline] walk_component+0x516/0x790 fs/namei.c:1940 link_path_walk+0x5e7/0xbf0 fs/namei.c:2259 path_parentat fs/namei.c:2465 [inline] filename_parentat+0x223/0x850 fs/namei.c:2487 filename_create+0xf2/0x770 fs/namei.c:3525 user_path_create fs/namei.c:3600 [inline] do_mkdirat+0xbc/0x330 fs/namei.c:3740 __do_sys_mkdir fs/namei.c:3764 [inline] __se_sys_mkdir fs/namei.c:3762 [inline] __x64_sys_mkdir+0x60/0x70 fs/namei.c:3762 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f21ec235049 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f21eb3ab168 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00007f21ec347f60 RCX: 00007f21ec235049 RDX: 0000000000000000 RSI: 0000000000000022 RDI: 00000000200000c0 RBP: 00007f21ec28f08d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffffb0ccd0f R14: 00007f21eb3ab300 R15: 0000000000022000 Modules linked in: ---[ end trace 7787ac131946e837 ]--- RIP: 0010:kasan_check_range+0x6/0x2f0 mm/kasan/generic.c:185 Code: 48 89 c7 e8 9c 53 ef 02 31 c0 5d c3 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 41 57 <41> 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 09 02 00 00 48 89 fb 48 RSP: 0018:ffffc90006438000 EFLAGS: 00010246 RAX: ffffffff8226355a RBX: ffffc900064380a0 RCX: ffffffff8226356b RDX: 0000000000000001 RSI: 0000000000000038 RDI: ffffc900064380a0 RBP: ffffc90006438008 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000002 R11: ffff88811b6cbb40 R12: 0000000000000004 R13: ffffffff86f25400 R14: 0000000000000000 R15: 0000000000000038 FS: 00007f21eb3ab700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90006437ff8 CR3: 00000001129b4000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 48 89 c7 mov %rax,%rdi 3: e8 9c 53 ef 02 callq 0x2ef53a4 8: 31 c0 xor %eax,%eax a: 5d pop %rbp b: c3 retq c: 0f 0b ud2 e: eb 02 jmp 0x12 10: 0f 0b ud2 12: b8 ea ff ff ff mov $0xffffffea,%eax 17: 5d pop %rbp 18: c3 retq 19: cc int3 1a: cc int3 1b: cc int3 1c: cc int3 1d: cc int3 1e: cc int3 1f: cc int3 20: cc int3 21: cc int3 22: cc int3 23: cc int3 24: 55 push %rbp 25: 48 89 e5 mov %rsp,%rbp 28: 41 57 push %r15 * 2a: 41 56 push %r14 <-- trapping instruction 2c: 41 55 push %r13 2e: 41 54 push %r12 30: 53 push %rbx 31: b0 01 mov $0x1,%al 33: 48 85 f6 test %rsi,%rsi 36: 0f 84 09 02 00 00 je 0x245 3c: 48 89 fb mov %rdi,%rbx 3f: 48 rex.W