Extracting prog: 2m41.892753334s
Minimizing prog: 4m43.230626108s
Simplifying prog options: 0s
Extracting C: 1m22.866998635s
Simplifying C: 9m34.420630983s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
detailed listing:
executing program 0:
r0 = syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f00000000c0)='./file1\x00', 0x800081, &(0x7f0000000080)=ANY=[], 0x0, 0x6e7, &(0x7f00000009c0)="$eJzs3U1sHGf9B/Dvrtcbbyq5bpu0+f+FVKsRETSQ2FlKgoREQAjlUKFIXHo1iZNYcdLIdlESIeIChSOcUA49FKFw6AlxQCrigChnJCTuEddI3CMOLJrZWXt3/bZO4jgNn480O8/MPC+/+fnZ2d2xrQ3wP+vcOxlfTS3njr99s9i+f6+9eP9e+1qvnORAknrS6K5Su57UPk3Oprvk/4qdVXe19Z6bA+O89eCTD4/d/bhdlDudoq9Gr359sN1WOhtGWLdaLZlOMlatd6mxVX8XNunvzq66rq3FXSTsaC9xsN86G6zupvkIz1vgWXcnGRvfZP9UcjDJRPU+INXVoV6+yn6G7eoqBwAAAM+mHT+dv/gwD3Mzk08nHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+1LrfGVirlnqvPJ1a7/v/m9W+QrO5z/Fu70s7HP/g0lMKBAAAAAAAAAD21OsP8zA3M9nb7tTK3/m/UW4cKh9fyHtZznyWciI3M5eVrGQps8n4ZF9HzZtzKytLs+stb1zutvxVipadTudO1fJUkqkNLU89rTMGAAAAAAAAgOfSj3Muk/sdBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9KslY91VuRzqladSbySZSNIs6q0mf+qVP8v+vN8BAAAAwN5rVevJ2n+6hU6t/Mz/avm5fyLv5XpWspCVLGY+F8t7Ad1P/fW/r7YX799rXyuWjR1/81+7iqPsMclY3t9i5Jmixj8Pr7U4l+/kezme6ZzPUhbyg8xlJfOZTqs4icyllqlW9+7FVC/OzeM9O7B1fji214e2j5SxtnIpC2VsJ3Khme5tk/IcijGP9I32h2YyNOL7RXZq36iMmKOLfT+vX1b3ZSqdF0fsY29MlWc+vpaRmSL3VTZe2j73u5wnwyPNpr52D+rQ+ijF5vBIvZx/fzc5P1iti1z/bDDnT9oub6UNZ+JU6tXsS14dzPmNz999ub9p7ySuX71yafn4Hp7SnhrvFYYz0e7LxGvbz77ki//4y/kri0UmVkfPxPjwjonHOI8nqFllo7wUpZ5RrpbfLktzeaNvCr6bi5nP6cxkNmcyk6/lVNoDM+zwQF4b7WuDOSmfa/WN17fWNsEf/UJfpZ/vUPnpKvLyUl9e+690U+Wxas/ZX2SmL0svbz/7hl8FRpl/jf+vCsUYP1l7xXkWDGSiujb3ontl+0z8ulM8Li9ev7p0Ze7GiOMdq9ZF2j4YvDb/5kmcz6Mr5ktxxW2UW2VOWr35Uhx7ZS3awXw1q9+4dNvVNxw7vHZsKpNZyHe3fKY2q/dwG3vqHntt02Pt8tiRvmMD73LybhbLdyFDpp9OVgEY2cE3DzZbD1p/a33U+mnrSuvtiW8dOHPgc82M/7Xxx7Hf1X9b/3rtzXyUH2VyvyMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDnwfKt21fnFhfnl/aw0HzEsVLfsc69F0brMFPJ9mPVqkJzr7Px7Bda2aOef59kmzrNxx6i9hjzeXW0ysVEfiLZ6H1xWrmnM7aL5o1eq83rNLI8sdVP8MD6syBTV+cW/90ZqNNK31MGeM6dXLl24+TyrdtfXrg2d3n+8vz1U2dOnznd/ursV05eWlicn+k+7neUwF5YvnV7bPTaw1+JDQAAAAAAAAAAAOyH6q//Vx75nxkaO9RpLi1vPrK/JQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGc+6djK+mltmZEzPF9v177cVi6ZXXazaS1JPUfpjUPk3Oprtkqq+72lbjvPXgkw+P3f24vd5Xo1e/vl270axWS6aTjFXrnR3YpJuN/V3o62/1kcKrrZ1hkbCjvcTBfvtvAAAA//+VWPpl")
getdents64(r0, &(0x7f0000000900)=""/189, 0xbd)

program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=57.382837204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus
detailed listing:
executing program 0:
syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f00000000c0)='./file1\x00', 0x800081, &(0x7f0000000080)=ANY=[], 0x0, 0x6e7, &(0x7f00000009c0)="$eJzs3U1sHGf9B/Dvrtcbbyq5bpu0+f+FVKsRETSQ2FlKgoREQAjlUKFIXHo1iZNYcdLIdlESIeIChSOcUA49FKFw6AlxQCrigChnJCTuEddI3CMOLJrZWXt3/bZO4jgNn480O8/MPC+/+fnZ2d2xrQ3wP+vcOxlfTS3njr99s9i+f6+9eP9e+1qvnORAknrS6K5Su57UPk3Oprvk/4qdVXe19Z6bA+O89eCTD4/d/bhdlDudoq9Gr359sN1WOhtGWLdaLZlOMlatd6mxVX8XNunvzq66rq3FXSTsaC9xsN86G6zupvkIz1vgWXcnGRvfZP9UcjDJRPU+INXVoV6+yn6G7eoqBwAAAM+mHT+dv/gwD3Mzk08nHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+1LrfGVirlnqvPJ1a7/v/m9W+QrO5z/Fu70s7HP/g0lMKBAAAAAAAAAD21OsP8zA3M9nb7tTK3/m/UW4cKh9fyHtZznyWciI3M5eVrGQps8n4ZF9HzZtzKytLs+stb1zutvxVipadTudO1fJUkqkNLU89rTMGAAAAAAAAgOfSj3Muk/sdBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9KslY91VuRzqladSbySZSNIs6q0mf+qVP8v+vN8BAAAAwN5rVevJ2n+6hU6t/Mz/avm5fyLv5XpWspCVLGY+F8t7Ad1P/fW/r7YX799rXyuWjR1/81+7iqPsMclY3t9i5Jmixj8Pr7U4l+/kezme6ZzPUhbyg8xlJfOZTqs4icyllqlW9+7FVC/OzeM9O7B1fji214e2j5SxtnIpC2VsJ3Khme5tk/IcijGP9I32h2YyNOL7RXZq36iMmKOLfT+vX1b3ZSqdF0fsY29MlWc+vpaRmSL3VTZe2j73u5wnwyPNpr52D+rQ+ijF5vBIvZx/fzc5P1iti1z/bDDnT9oub6UNZ+JU6tXsS14dzPmNz999ub9p7ySuX71yafn4Hp7SnhrvFYYz0e7LxGvbz77ki//4y/kri0UmVkfPxPjwjonHOI8nqFllo7wUpZ5RrpbfLktzeaNvCr6bi5nP6cxkNmcyk6/lVNoDM+zwQF4b7WuDOSmfa/WN17fWNsEf/UJfpZ/vUPnpKvLyUl9e+690U+Wxas/ZX2SmL0svbz/7hl8FRpl/jf+vCsUYP1l7xXkWDGSiujb3ontl+0z8ulM8Li9ev7p0Ze7GiOMdq9ZF2j4YvDb/5kmcz6Mr5ktxxW2UW2VOWr35Uhx7ZS3awXw1q9+4dNvVNxw7vHZsKpNZyHe3fKY2q/dwG3vqHntt02Pt8tiRvmMD73LybhbLdyFDpp9OVgEY2cE3DzZbD1p/a33U+mnrSuvtiW8dOHPgc82M/7Xxx7Hf1X9b/3rtzXyUH2VyvyMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDnwfKt21fnFhfnl/aw0HzEsVLfsc69F0brMFPJ9mPVqkJzr7Px7Bda2aOef59kmzrNxx6i9hjzeXW0ysVEfiLZ6H1xWrmnM7aL5o1eq83rNLI8sdVP8MD6syBTV+cW/90ZqNNK31MGeM6dXLl24+TyrdtfXrg2d3n+8vz1U2dOnznd/ursV05eWlicn+k+7neUwF5YvnV7bPTaw1+JDQAAAAAAAAAAAOyH6q//Vx75nxkaO9RpLi1vPrK/JQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGc+6djK+mltmZEzPF9v177cVi6ZXXazaS1JPUfpjUPk3Oprtkqq+72lbjvPXgkw+P3f24vd5Xo1e/vl270axWS6aTjFXrnR3YpJuN/V3o62/1kcKrrZ1hkbCjvcTBfvtvAAAA//+VWPpl")

program did not crash
testing program (duration=57.382837204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getdents64
detailed listing:
executing program 0:
getdents64(0xffffffffffffffff, &(0x7f0000000900)=""/189, 0xbd)

program did not crash
testing program (duration=57.382837204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
detailed listing:
executing program 0:
r0 = syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f00000000c0)='./file1\x00', 0x800081, &(0x7f0000000080)=ANY=[], 0x0, 0x6e7, &(0x7f00000009c0)="$eJzs3U1sHGf9B/Dvrtcbbyq5bpu0+f+FVKsRETSQ2FlKgoREQAjlUKFIXHo1iZNYcdLIdlESIeIChSOcUA49FKFw6AlxQCrigChnJCTuEddI3CMOLJrZWXt3/bZO4jgNn480O8/MPC+/+fnZ2d2xrQ3wP+vcOxlfTS3njr99s9i+f6+9eP9e+1qvnORAknrS6K5Su57UPk3Oprvk/4qdVXe19Z6bA+O89eCTD4/d/bhdlDudoq9Gr359sN1WOhtGWLdaLZlOMlatd6mxVX8XNunvzq66rq3FXSTsaC9xsN86G6zupvkIz1vgWXcnGRvfZP9UcjDJRPU+INXVoV6+yn6G7eoqBwAAAM+mHT+dv/gwD3Mzk08nHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+1LrfGVirlnqvPJ1a7/v/m9W+QrO5z/Fu70s7HP/g0lMKBAAAAAAAAAD21OsP8zA3M9nb7tTK3/m/UW4cKh9fyHtZznyWciI3M5eVrGQps8n4ZF9HzZtzKytLs+stb1zutvxVipadTudO1fJUkqkNLU89rTMGAAAAAAAAgOfSj3Muk/sdBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9KslY91VuRzqladSbySZSNIs6q0mf+qVP8v+vN8BAAAAwN5rVevJ2n+6hU6t/Mz/avm5fyLv5XpWspCVLGY+F8t7Ad1P/fW/r7YX799rXyuWjR1/81+7iqPsMclY3t9i5Jmixj8Pr7U4l+/kezme6ZzPUhbyg8xlJfOZTqs4icyllqlW9+7FVC/OzeM9O7B1fji214e2j5SxtnIpC2VsJ3Khme5tk/IcijGP9I32h2YyNOL7RXZq36iMmKOLfT+vX1b3ZSqdF0fsY29MlWc+vpaRmSL3VTZe2j73u5wnwyPNpr52D+rQ+ijF5vBIvZx/fzc5P1iti1z/bDDnT9oub6UNZ+JU6tXsS14dzPmNz999ub9p7ySuX71yafn4Hp7SnhrvFYYz0e7LxGvbz77ki//4y/kri0UmVkfPxPjwjonHOI8nqFllo7wUpZ5RrpbfLktzeaNvCr6bi5nP6cxkNmcyk6/lVNoDM+zwQF4b7WuDOSmfa/WN17fWNsEf/UJfpZ/vUPnpKvLyUl9e+690U+Wxas/ZX2SmL0svbz/7hl8FRpl/jf+vCsUYP1l7xXkWDGSiujb3ontl+0z8ulM8Li9ev7p0Ze7GiOMdq9ZF2j4YvDb/5kmcz6Mr5ktxxW2UW2VOWr35Uhx7ZS3awXw1q9+4dNvVNxw7vHZsKpNZyHe3fKY2q/dwG3vqHntt02Pt8tiRvmMD73LybhbLdyFDpp9OVgEY2cE3DzZbD1p/a33U+mnrSuvtiW8dOHPgc82M/7Xxx7Hf1X9b/3rtzXyUH2VyvyMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDnwfKt21fnFhfnl/aw0HzEsVLfsc69F0brMFPJ9mPVqkJzr7Px7Bda2aOef59kmzrNxx6i9hjzeXW0ysVEfiLZ6H1xWrmnM7aL5o1eq83rNLI8sdVP8MD6syBTV+cW/90ZqNNK31MGeM6dXLl24+TyrdtfXrg2d3n+8vz1U2dOnznd/ursV05eWlicn+k+7neUwF5YvnV7bPTaw1+JDQAAAAAAAAAAAOyH6q//Vx75nxkaO9RpLi1vPrK/JQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGc+6djK+mltmZEzPF9v177cVi6ZXXazaS1JPUfpjUPk3Oprtkqq+72lbjvPXgkw+P3f24vd5Xo1e/vl270axWS6aTjFXrnR3YpJuN/V3o62/1kcKrrZ1hkbCjvcTBfvtvAAAA//+VWPpl")
getdents64(r0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=57.382837204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
simplifying C reproducer
testing compiled C program (duration=57.382837204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=57.382837204s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=57.382837204s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=57.382837204s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=57.382837204s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=57.382837204s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=57.382837204s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
reproducing took 18m22.411040712s
repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 1024
==================================================================
BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x680/0x1270 fs/hfsplus/unicode.c:179
Read of size 2 at addr ffff888144ba740c by task syz-executor122/5821

CPU: 0 UID: 0 PID: 5821 Comm: syz-executor122 Not tainted 6.15.0-rc5-syzkaller-00275-gbec6f00f120e #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xb4/0x290 mm/kasan/report.c:521
 kasan_report+0x118/0x150 mm/kasan/report.c:634
 hfsplus_uni2asc+0x680/0x1270 fs/hfsplus/unicode.c:179
 hfsplus_readdir+0x709/0xd60 fs/hfsplus/dir.c:207
 iterate_dir+0x5af/0x770 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:403 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:389
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce31b6c649
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff9498bcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007fff9498bec8 RCX: 00007fce31b6c649
RDX: 00000000000000bd RSI: 0000200000000900 RDI: 0000000000000003
RBP: 00007fce31be0610 R08: 00000000000006e1 R09: 00007fff9498bec8
R10: 00007fff9498bbb0 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff9498beb8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Allocated by task 5821:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4327 [inline]
 __kmalloc_noprof+0x27a/0x4f0 mm/slub.c:4339
 kmalloc_noprof include/linux/slab.h:909 [inline]
 hfsplus_find_init+0x8c/0x1d0 fs/hfsplus/bfind.c:21
 hfsplus_readdir+0x1d4/0xd60 fs/hfsplus/dir.c:144
 iterate_dir+0x5af/0x770 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:403 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:389
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888144ba7000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 0 bytes to the right of
 allocated 1036-byte region [ffff888144ba7000, ffff888144ba740c)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x144ba0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000040 ffff88801a042000 0000000000000000 dead000000000001
raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000040 ffff88801a042000 0000000000000000 dead000000000001
head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000003 ffffea000512e801 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 14134617612, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1718
 prep_new_page mm/page_alloc.c:1726 [inline]
 get_page_from_freelist+0x21ce/0x22b0 mm/page_alloc.c:3688
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4970
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2301
 alloc_slab_page mm/slub.c:2450 [inline]
 allocate_slab+0x8a/0x3b0 mm/slub.c:2618
 new_slab mm/slub.c:2672 [inline]
 ___slab_alloc+0xbfc/0x1480 mm/slub.c:3858
 __slab_alloc mm/slub.c:3948 [inline]
 __slab_alloc_node mm/slub.c:4023 [inline]
 slab_alloc_node mm/slub.c:4184 [inline]
 __kmalloc_cache_noprof+0x296/0x3d0 mm/slub.c:4353
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 faux_device_create_with_groups+0x5d/0x1e0 drivers/base/faux.c:123
 fixed_mdio_bus_init+0x1e/0x220 drivers/net/phy/fixed_phy.c:340
 do_one_initcall+0x236/0x820 init/main.c:1257
 do_initcall_level+0x137/0x1f0 init/main.c:1319
 do_initcalls+0x69/0xd0 init/main.c:1335
 kernel_init_freeable+0x3d9/0x570 init/main.c:1567
 kernel_init+0x1d/0x1d0 init/main.c:1457
 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888144ba7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888144ba7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888144ba7400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                      ^
 ffff888144ba7480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888144ba7500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 1024
==================================================================
BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x680/0x1270 fs/hfsplus/unicode.c:179
Read of size 2 at addr ffff888144ba740c by task syz-executor122/5821

CPU: 0 UID: 0 PID: 5821 Comm: syz-executor122 Not tainted 6.15.0-rc5-syzkaller-00275-gbec6f00f120e #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xb4/0x290 mm/kasan/report.c:521
 kasan_report+0x118/0x150 mm/kasan/report.c:634
 hfsplus_uni2asc+0x680/0x1270 fs/hfsplus/unicode.c:179
 hfsplus_readdir+0x709/0xd60 fs/hfsplus/dir.c:207
 iterate_dir+0x5af/0x770 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:403 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:389
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce31b6c649
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff9498bcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007fff9498bec8 RCX: 00007fce31b6c649
RDX: 00000000000000bd RSI: 0000200000000900 RDI: 0000000000000003
RBP: 00007fce31be0610 R08: 00000000000006e1 R09: 00007fff9498bec8
R10: 00007fff9498bbb0 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff9498beb8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Allocated by task 5821:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4327 [inline]
 __kmalloc_noprof+0x27a/0x4f0 mm/slub.c:4339
 kmalloc_noprof include/linux/slab.h:909 [inline]
 hfsplus_find_init+0x8c/0x1d0 fs/hfsplus/bfind.c:21
 hfsplus_readdir+0x1d4/0xd60 fs/hfsplus/dir.c:144
 iterate_dir+0x5af/0x770 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:403 [inline]
 __se_sys_getdents64+0xe4/0x260 fs/readdir.c:389
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888144ba7000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 0 bytes to the right of
 allocated 1036-byte region [ffff888144ba7000, ffff888144ba740c)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x144ba0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000040 ffff88801a042000 0000000000000000 dead000000000001
raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000040 ffff88801a042000 0000000000000000 dead000000000001
head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000003 ffffea000512e801 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 14134617612, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1718
 prep_new_page mm/page_alloc.c:1726 [inline]
 get_page_from_freelist+0x21ce/0x22b0 mm/page_alloc.c:3688
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4970
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2301
 alloc_slab_page mm/slub.c:2450 [inline]
 allocate_slab+0x8a/0x3b0 mm/slub.c:2618
 new_slab mm/slub.c:2672 [inline]
 ___slab_alloc+0xbfc/0x1480 mm/slub.c:3858
 __slab_alloc mm/slub.c:3948 [inline]
 __slab_alloc_node mm/slub.c:4023 [inline]
 slab_alloc_node mm/slub.c:4184 [inline]
 __kmalloc_cache_noprof+0x296/0x3d0 mm/slub.c:4353
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 faux_device_create_with_groups+0x5d/0x1e0 drivers/base/faux.c:123
 fixed_mdio_bus_init+0x1e/0x220 drivers/net/phy/fixed_phy.c:340
 do_one_initcall+0x236/0x820 init/main.c:1257
 do_initcall_level+0x137/0x1f0 init/main.c:1319
 do_initcalls+0x69/0xd0 init/main.c:1335
 kernel_init_freeable+0x3d9/0x570 init/main.c:1567
 kernel_init+0x1d/0x1d0 init/main.c:1457
 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888144ba7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888144ba7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888144ba7400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                      ^
 ffff888144ba7480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888144ba7500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================