Warning: Permanently added '10.128.1.106' (ED25519) to the list of known hosts. 2025/01/17 16:27:46 ignoring optional flag "sandboxArg"="0" 2025/01/17 16:27:46 ignoring optional flag "type"="gce" 2025/01/17 16:27:46 parsed 1 programs [ 57.289897][ T1528] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2025/01/17 16:27:50 executed programs: 0 [ 70.911245][ T4289] loop3: detected capacity change from 0 to 128 [ 70.971886][ T4289] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 70.982697][ T4289] ext4 filesystem being mounted at /root/syzkaller-testdir2430698621/syzkaller.U72ovZ/0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 71.034068][ T4309] loop4: detected capacity change from 0 to 128 [ 71.058895][ T4289] EXT4-fs warning (device loop3): dx_probe:891: inode #2: comm syz-executor.3: dx entry: limit 0 != root limit 124 [ 71.071064][ T4289] EXT4-fs warning (device loop3): dx_probe:965: inode #2: comm syz-executor.3: Corrupt directory, running e2fsck is recommended 2025/01/17 16:28:00 executed programs: 5 [ 71.116315][ T4289] EXT4-fs error (device loop3): ext4_readdir:258: inode #2: block 63: comm syz-executor.3: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=1023, inode=846288947, rec_len=2, size=1024 fake=0 [ 71.150638][ T2056] EXT4-fs warning (device loop3): dx_probe:891: inode #2: comm syz-executor.3: dx entry: limit 0 != root limit 124 [ 71.163033][ T2056] EXT4-fs warning (device loop3): dx_probe:965: inode #2: comm syz-executor.3: Corrupt directory, running e2fsck is recommended [ 71.168983][ T4309] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 71.186907][ T4309] ext4 filesystem being mounted at /root/syzkaller-testdir3776961183/syzkaller.flX7B8/0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 71.203897][ T2056] EXT4-fs error (device loop3): ext4_readdir:258: inode #2: block 4: comm syz-executor.3: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 71.246881][ T4328] loop1: detected capacity change from 0 to 128 [ 71.262685][ T2056] EXT4-fs warning (device loop3): dx_probe:891: inode #2: comm syz-executor.3: dx entry: limit 0 != root limit 124 [ 71.274968][ T2056] EXT4-fs warning (device loop3): dx_probe:965: inode #2: comm syz-executor.3: Corrupt directory, running e2fsck is recommended [ 71.289686][ T4309] EXT4-fs warning (device loop4): dx_probe:891: inode #2: comm syz-executor.4: dx entry: limit 0 != root limit 124 [ 71.302068][ T4309] EXT4-fs warning (device loop4): dx_probe:965: inode #2: comm syz-executor.4: Corrupt directory, running e2fsck is recommended [ 71.329577][ T4335] loop0: detected capacity change from 0 to 128 [ 71.331937][ T4337] loop2: detected capacity change from 0 to 128 [ 71.339803][ T4309] EXT4-fs error (device loop4): ext4_readdir:258: inode #2: block 63: comm syz-executor.4: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=1023, inode=51, rec_len=0, size=1024 fake=0 [ 71.349894][ T4328] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 71.374443][ T4328] ext4 filesystem being mounted at /root/syzkaller-testdir530542162/syzkaller.43y7ys/0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 71.380382][ T2063] EXT4-fs warning (device loop4): dx_probe:891: inode #2: comm syz-executor.4: dx entry: limit 0 != root limit 124 [ 71.423498][ T2063] EXT4-fs warning (device loop4): dx_probe:965: inode #2: comm syz-executor.4: Corrupt directory, running e2fsck is recommended [ 71.430774][ T4328] EXT4-fs warning (device loop1): dx_probe:891: inode #2: comm syz-executor.1: dx entry: limit 0 != root limit 124 [ 71.437349][ T2063] EXT4-fs error (device loop4): ext4_readdir:258: inode #2: block 4: comm syz-executor.4: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 71.449324][ T4328] EXT4-fs warning (device loop1): dx_probe:965: inode #2: comm syz-executor.1: Corrupt directory, running e2fsck is recommended [ 71.470802][ T2063] EXT4-fs warning (device loop4): dx_probe:891: inode #2: comm syz-executor.4: dx entry: limit 0 != root limit 124 [ 71.483725][ T4328] ================================================================== [ 71.495461][ T2063] EXT4-fs warning (device loop4): dx_probe:965: inode #2: comm syz-executor.4: Corrupt directory, running e2fsck is recommended [ 71.503275][ T4328] BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ee/0x920 [ 71.503310][ T4328] Read of size 2 at addr ffff88810fb68003 by task syz-executor.1/4328 [ 71.532484][ T4328] [ 71.534821][ T4328] CPU: 1 PID: 4328 Comm: syz-executor.1 Not tainted 5.15.176-syzkaller #0 [ 71.543322][ T4328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 71.553391][ T4328] Call Trace: [ 71.556940][ T4328] [ 71.559888][ T4328] dump_stack_lvl+0x41/0x5e [ 71.564633][ T4328] print_address_description.constprop.0.cold+0x6c/0x309 [ 71.571773][ T4328] ? __ext4_check_dir_entry+0x5ee/0x920 [ 71.577330][ T4328] ? __ext4_check_dir_entry+0x5ee/0x920 [ 71.582900][ T4328] kasan_report.cold+0x83/0xdf [ 71.587992][ T4328] ? __ext4_check_dir_entry+0x5ee/0x920 [ 71.593725][ T4328] __ext4_check_dir_entry+0x5ee/0x920 [ 71.599532][ T4328] ext4_readdir+0xd2c/0x2780 [ 71.604138][ T4328] ? __ext4_check_dir_entry+0x920/0x920 [ 71.609702][ T4328] ? down_read_killable+0x157/0x330 [ 71.615023][ T4328] ? fsnotify_perm.part.0+0x118/0x4c0 [ 71.620522][ T4328] iterate_dir+0x48a/0x6d0 [ 71.622623][ T4337] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 71.624946][ T4328] __x64_sys_getdents64+0x122/0x220 [ 71.624963][ T4328] ? __ia32_sys_getdents+0x220/0x220 [ 71.624969][ T4328] ? compat_fillonedir+0x300/0x300 [ 71.624975][ T4328] ? vtime_user_exit+0xde/0x180 [ 71.635593][ T4337] ext4 filesystem being mounted at /root/syzkaller-testdir1723613487/syzkaller.edtwRg/0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 71.640737][ T4328] do_syscall_64+0x33/0x80 [ 71.640749][ T4328] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 71.640770][ T4328] RIP: 0033:0x7f58222c4ee9 [ 71.640783][ T4328] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 71.640789][ T4328] RSP: 002b:00007f5821e470c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 71.663397][ T4335] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 71.692382][ T4328] RAX: ffffffffffffffda RBX: 00007f58223fbfa0 RCX: 00007f58222c4ee9 [ 71.692396][ T4328] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000008 [ 71.692400][ T4328] RBP: 00007f582231147f R08: 0000000000000000 R09: 0000000000000000 [ 71.692403][ T4328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 71.692407][ T4328] R13: 0000000000000006 R14: 00007f58223fbfa0 R15: 00007ffd7cadff28 [ 71.692413][ T4328] [ 71.692417][ T4328] [ 71.692420][ T4328] Allocated by task 4178: [ 71.692436][ T4328] kasan_save_stack+0x1b/0x40 [ 71.692450][ T4328] __kasan_slab_alloc+0x61/0x80 [ 71.692456][ T4328] kmem_cache_alloc+0x211/0x310 [ 71.692460][ T4328] getname_flags.part.0+0x4a/0x440 [ 71.692470][ T4328] user_path_at_empty+0x1e/0x50 [ 71.696978][ T4335] ext4 filesystem being mounted at /root/syzkaller-testdir4252820543/syzkaller.ep1ohy/0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 71.702775][ T4328] vfs_statx+0xd6/0x2e0 [ 71.702784][ T4328] __do_sys_newfstatat+0x7d/0xd0 [ 71.702789][ T4328] do_syscall_64+0x33/0x80 [ 71.702796][ T4328] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 71.702805][ T4328] [ 71.702807][ T4328] Freed by task 4178: [ 71.702811][ T4328] kasan_save_stack+0x1b/0x40 [ 71.702817][ T4328] kasan_set_track+0x1c/0x30 [ 71.702822][ T4328] kasan_set_free_info+0x20/0x30 [ 71.730927][ T4337] EXT4-fs warning (device loop2): dx_probe:891: inode #2: comm syz-executor.2: dx entry: limit 0 != root limit 124 [ 71.735875][ T4328] __kasan_slab_free+0xe0/0x110 [ 71.735891][ T4328] kmem_cache_free+0x7e/0x450 [ 71.735897][ T4328] user_path_at_empty+0x40/0x50 [ 71.735906][ T4328] vfs_statx+0xd6/0x2e0 [ 71.735914][ T4328] __do_sys_newfstatat+0x7d/0xd0 [ 71.746518][ T4337] EXT4-fs warning (device loop2): dx_probe:965: inode #2: comm syz-executor.2: Corrupt directory, running e2fsck is recommended [ 71.754438][ T4328] do_syscall_64+0x33/0x80 [ 71.754448][ T4328] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 71.754457][ T4328] [ 71.754460][ T4328] The buggy address belongs to the object at ffff88810fb68000 [ 71.754460][ T4328] which belongs to the cache names_cache of size 4096 [ 71.754466][ T4328] The buggy address is located 3 bytes inside of [ 71.754466][ T4328] 4096-byte region [ffff88810fb68000, ffff88810fb69000) [ 71.763687][ T4337] EXT4-fs error (device loop2): ext4_readdir:258: inode #2: block 63: comm syz-executor.2: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=1023, inode=51, rec_len=0, size=1024 fake=0 [ 71.770675][ T4328] The buggy address belongs to the page: [ 71.770685][ T4328] page:ffffea00043eda00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fb68 [ 71.770721][ T4328] head:ffffea00043eda00 order:3 compound_mapcount:0 compound_pincount:0 [ 71.770726][ T4328] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 71.770739][ T4328] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881001403c0 [ 71.770748][ T4328] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 71.770752][ T4328] page dumped because: kasan: bad access detected [ 71.770757][ T4328] page_owner tracks the page as allocated [ 71.806471][ T4335] EXT4-fs warning (device loop0): dx_probe:891: inode #2: comm syz-executor: dx entry: limit 0 != root limit 124 [ 71.810936][ T4328] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2363, ts 62066944917, free_ts 62048400347 [ 71.810951][ T4328] get_page_from_freelist+0x1319/0x2e50 [ 71.810967][ T4328] __alloc_pages+0x2b3/0x590 [ 71.810973][ T4328] allocate_slab+0x2eb/0x430 [ 71.810979][ T4328] ___slab_alloc+0xb1c/0xf80 [ 71.816250][ T4335] EXT4-fs warning (device loop0): dx_probe:965: inode #2: comm syz-executor: Corrupt directory, running e2fsck is recommended [ 71.821197][ T4328] kmem_cache_alloc+0x2d7/0x310 [ 71.821204][ T4328] getname_flags.part.0+0x4a/0x440 [ 71.821211][ T4328] do_sys_openat2+0xd2/0x400 [ 71.821216][ T4328] __x64_sys_openat+0x11b/0x1d0 [ 71.821221][ T4328] do_syscall_64+0x33/0x80 [ 71.821229][ T4328] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 71.821237][ T4328] page last free stack trace: [ 71.821240][ T4328] free_pcp_prepare+0x34e/0x730 [ 71.821247][ T4328] free_unref_page+0x19/0x3b0 [ 71.821252][ T4328] qlist_free_all+0x68/0x110 [ 71.821260][ T4328] kasan_quarantine_reduce+0x180/0x1f0 [ 71.859651][ T2054] EXT4-fs warning (device loop2): dx_probe:891: inode #2: comm syz-executor.2: dx entry: limit 0 != root limit 124 [ 71.861686][ T4328] __kasan_slab_alloc+0x73/0x80 [ 71.861703][ T4328] kmem_cache_alloc+0x211/0x310 [ 71.866713][ T2054] EXT4-fs warning (device loop2): dx_probe:965: inode #2: comm syz-executor.2: Corrupt directory, running e2fsck is recommended [ 71.871279][ T4328] getname_flags.part.0+0x4a/0x440 [ 71.871290][ T4328] user_path_at_empty+0x1e/0x50 [ 71.871295][ T4328] vfs_statx+0xd6/0x2e0 [ 71.871302][ T4328] __do_sys_newfstatat+0x7d/0xd0 [ 71.871308][ T4328] do_syscall_64+0x33/0x80 [ 71.871316][ T4328] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 71.871327][ T4328] [ 71.878204][ T2054] EXT4-fs error (device loop2): ext4_readdir:258: inode #2: block 4: comm syz-executor.2: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 71.879707][ T4328] Memory state around the buggy address: [ 71.879713][ T4328] ffff88810fb67f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.879719][ T4328] ffff88810fb67f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.879723][ T4328] >ffff88810fb68000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.879726][ T4328] ^ [ 71.879729][ T4328] ffff88810fb68080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.884528][ T2054] EXT4-fs warning (device loop2): dx_probe:891: inode #2: comm syz-executor.2: dx entry: limit 0 != root limit 124 [ 71.888365][ T4328] ffff88810fb68100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.888370][ T4328] ================================================================== [ 71.888383][ T4328] Disabling lock debugging due to kernel taint [ 71.888545][ T4328] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 71.893085][ T2054] EXT4-fs warning (device loop2): dx_probe:965: inode #2: comm syz-executor.2: Corrupt directory, running e2fsck is recommended [ 71.898340][ T4328] Kernel Offset: disabled [ 72.375676][ T4328] Rebooting in 86400 seconds..