Warning: Permanently added '10.128.1.187' (ED25519) to the list of known hosts. 2024/10/20 11:41:50 ignoring optional flag "sandboxArg"="0" 2024/10/20 11:41:50 ignoring optional flag "type"="gce" 2024/10/20 11:41:51 parsed 1 programs [ 58.424466][ T1824] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 60.012895][ T1957] modprobe (1957) used greatest stack depth: 21808 bytes left 2024/10/20 11:41:56 executed programs: 0 [ 67.371748][ T2805] loop0: detected capacity change from 0 to 512 [ 67.393849][ T2805] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 67.446040][ T2805] loop0: detected capacity change from 512 to 511 [ 67.458053][ T2351] EXT4-fs error (device loop0): htree_dirblock_to_tree:1112: inode #2: block 21: comm syz-executor: bad entry in directory: directory entry overrun - offset=1004, inode=0, rec_len=1000, size=1024 fake=0 [ 67.479279][ T2351] EXT4-fs error (device loop0): ext4_inlinedir_to_tree:1404: inode #12: block 10: comm syz-executor: path /0/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=384 fake=0 [ 67.501806][ T2351] EXT4-fs error (device loop0): empty_inline_dir:1850: inode #12: block 10: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=60 fake=0 [ 67.521674][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.535936][ T2351] EXT4-fs error (device loop0): ext4_inlinedir_to_tree:1404: inode #12: block 10: comm syz-executor: path /0/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=384 fake=0 [ 67.558295][ T2351] EXT4-fs error (device loop0): empty_inline_dir:1850: inode #12: block 10: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=60 fake=0 [ 67.578022][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.592059][ T2351] EXT4-fs error (device loop0): ext4_inlinedir_to_tree:1404: inode #12: block 10: comm syz-executor: path /0/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=384 fake=0 [ 67.614822][ T2351] EXT4-fs error (device loop0): empty_inline_dir:1850: inode #12: block 10: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=60 fake=0 [ 67.634400][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.648587][ T2351] EXT4-fs error (device loop0): ext4_inlinedir_to_tree:1404: inode #12: block 10: comm syz-executor: path /0/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=384 fake=0 [ 67.670880][ T2351] EXT4-fs error (device loop0): empty_inline_dir:1850: inode #12: block 10: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=60 fake=0 [ 67.690732][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.704801][ T2351] EXT4-fs error (device loop0): ext4_inlinedir_to_tree:1404: inode #12: block 10: comm syz-executor: path /0/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=4, inode=0, rec_len=0, size=384 fake=0 [ 67.727304][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.741968][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.756839][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.771443][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.786316][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.801046][ T2351] EXT4-fs warning (device loop0): empty_inline_dir:1857: bad inline directory (dir #12) - inode 0, rec_len 0, name_len 0inline size 60 [ 67.873257][ T2351] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. 2024/10/20 11:42:04 executed programs: 5 [ 71.770119][ T3264] loop0: detected capacity change from 0 to 512 [ 71.780608][ T3264] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 71.835976][ T3264] loop0: detected capacity change from 512 to 511 [ 71.848441][ T2810] EXT4-fs error (device loop0): htree_dirblock_to_tree:1112: inode #2: block 21: comm syz-executor: bad entry in directory: directory entry overrun - offset=1004, inode=0, rec_len=1000, size=1024 fake=0 [ 71.869049][ T2810] ================================================================== [ 71.877115][ T2810] BUG: KASAN: use-after-free in ext4_inlinedir_to_tree+0x47e/0x1010 [ 71.885075][ T2810] Read of size 324 at addr ffff888127c84c05 by task syz-executor/2810 [ 71.893202][ T2810] [ 71.895518][ T2810] CPU: 0 UID: 0 PID: 2810 Comm: syz-executor Not tainted 6.12.0-rc3-syzkaller #0 [ 71.904601][ T2810] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 71.914640][ T2810] Call Trace: [ 71.917915][ T2810] [ 71.920824][ T2810] dump_stack_lvl+0x108/0x280 [ 71.925477][ T2810] ? __pfx_dump_stack_lvl+0x10/0x10 [ 71.930647][ T2810] ? __pfx__printk+0x10/0x10 [ 71.935466][ T2810] ? lock_acquire+0xc2/0x3a0 [ 71.940027][ T2810] ? __pfx_lock_acquire+0x10/0x10 [ 71.945067][ T2810] ? __virt_addr_valid+0x141/0x270 [ 71.950170][ T2810] ? __virt_addr_valid+0x229/0x270 [ 71.955254][ T2810] print_report+0x169/0x550 [ 71.959744][ T2810] ? __virt_addr_valid+0x141/0x270 [ 71.964827][ T2810] ? __virt_addr_valid+0x229/0x270 [ 71.969909][ T2810] ? ext4_inlinedir_to_tree+0x47e/0x1010 [ 71.975511][ T2810] kasan_report+0x143/0x180 [ 71.979986][ T2810] ? ext4_inlinedir_to_tree+0x47e/0x1010 [ 71.985672][ T2810] kasan_check_range+0x282/0x290 [ 71.990596][ T2810] ? ext4_inlinedir_to_tree+0x47e/0x1010 [ 71.996373][ T2810] __asan_memcpy+0x29/0x70 [ 72.000761][ T2810] ext4_inlinedir_to_tree+0x47e/0x1010 [ 72.006197][ T2810] ? __pfx_lock_release+0x10/0x10 [ 72.011199][ T2810] ? __pfx_ext4_inlinedir_to_tree+0x10/0x10 [ 72.017062][ T2810] ? post_alloc_hook+0x120/0x130 [ 72.021970][ T2810] ? get_page_from_freelist+0x39f2/0x3c30 [ 72.027664][ T2810] ext4_htree_fill_tree+0x4db/0x1240 [ 72.032923][ T2810] ? __pfx_register_lock_class+0x10/0x10 [ 72.038608][ T2810] ? __pfx_ext4_htree_fill_tree+0x10/0x10 [ 72.044296][ T2810] ? inode_query_iversion+0xd3/0x170 [ 72.049569][ T2810] ext4_readdir+0x253c/0x2fe0 [ 72.054245][ T2810] ? rcu_is_watching+0x1f/0xa0 [ 72.059098][ T2810] ? fdget_pos+0x1ba/0x270 [ 72.063508][ T2810] ? __pfx___mutex_lock+0x10/0x10 [ 72.068523][ T2810] ? __pfx_ext4_readdir+0x10/0x10 [ 72.073522][ T2810] ? __pfx_down_read_killable+0x10/0x10 [ 72.079053][ T2810] ? reacquire_held_locks+0x3a3/0x5b0 [ 72.084392][ T2810] ? exc_page_fault+0x410/0x780 [ 72.089213][ T2810] ? __pfx_reacquire_held_locks+0x10/0x10 [ 72.094990][ T2810] iterate_dir+0x18e/0x4a0 [ 72.099381][ T2810] __se_sys_getdents64+0x1b3/0x3e0 [ 72.104552][ T2810] ? __pfx___se_sys_getdents64+0x10/0x10 [ 72.110152][ T2810] ? __up_read+0x28b/0x370 [ 72.114542][ T2810] ? __pfx_filldir64+0x10/0x10 [ 72.119280][ T2810] do_syscall_64+0x8d/0x170 [ 72.123758][ T2810] ? clear_bhb_loop+0x55/0xb0 [ 72.128404][ T2810] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.134352][ T2810] RIP: 0033:0x7ff22988c013 [ 72.138762][ T2810] Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 52 43 f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8 [ 72.158451][ T2810] RSP: 002b:00007fffc264a4f8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 72.166848][ T2810] RAX: ffffffffffffffda RBX: 0000555591fb1520 RCX: 00007ff22988c013 [ 72.174793][ T2810] RDX: 0000000000008000 RSI: 0000555591fb1520 RDI: 0000000000000006 [ 72.182845][ T2810] RBP: 0000555591fb14f4 R08: 0000000000000000 R09: 0000000000000000 [ 72.190806][ T2810] R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffa8 [ 72.198749][ T2810] R13: 0000000000000016 R14: 0000555591fb14f0 R15: 00007fffc264d890 [ 72.206703][ T2810] [ 72.209786][ T2810] [ 72.212086][ T2810] The buggy address belongs to the physical page: [ 72.218475][ T2810] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7ff46ff37 pfn:0x127c84 [ 72.227992][ T2810] flags: 0x200000000000000(node=0|zone=2) [ 72.233688][ T2810] raw: 0200000000000000 ffffea000495f788 ffffea0004a30348 0000000000000000 [ 72.242258][ T2810] raw: 00000007ff46ff37 0000000000000000 00000000ffffffff 0000000000000000 [ 72.250834][ T2810] page dumped because: kasan: bad access detected [ 72.257248][ T2810] page_owner tracks the page as freed [ 72.262590][ T2810] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 3251, tgid 3251 (modprobe), ts 71655636040, free_ts 71657089299 [ 72.280882][ T2810] post_alloc_hook+0x10f/0x130 [ 72.285633][ T2810] get_page_from_freelist+0x39f2/0x3c30 [ 72.291156][ T2810] __alloc_pages_noprof+0x256/0x650 [ 72.296583][ T2810] alloc_pages_mpol_noprof+0x143/0x330 [ 72.302016][ T2810] folio_alloc_mpol_noprof+0x14/0x100 [ 72.307356][ T2810] vma_alloc_folio_noprof+0x2a6/0x390 [ 72.312696][ T2810] folio_prealloc+0x26/0xf0 [ 72.317170][ T2810] do_wp_page+0xb64/0x3520 [ 72.321556][ T2810] handle_mm_fault+0x16e1/0x3620 [ 72.326459][ T2810] exc_page_fault+0x3fa/0x780 [ 72.331105][ T2810] asm_exc_page_fault+0x26/0x30 [ 72.335923][ T2810] page last free pid 3251 tgid 3251 stack trace: [ 72.342219][ T2810] free_unref_folios+0xb78/0x1330 [ 72.347212][ T2810] folios_put_refs+0x48e/0x570 [ 72.351960][ T2810] free_pages_and_swap_cache+0x27a/0x4e0 [ 72.357583][ T2810] tlb_flush_mmu+0x2ad/0x4e0 [ 72.362153][ T2810] tlb_finish_mmu+0xb6/0x1c0 [ 72.366722][ T2810] exit_mmap+0x3b7/0x910 [ 72.370932][ T2810] __mmput+0x61/0x250 [ 72.374889][ T2810] exit_mm+0x114/0x1b0 [ 72.378930][ T2810] do_exit+0x7dd/0x2550 [ 72.383055][ T2810] do_group_exit+0x1ba/0x280 [ 72.387621][ T2810] __x64_sys_exit_group+0x3f/0x40 [ 72.392619][ T2810] x64_sys_call+0x2634/0x2640 [ 72.397263][ T2810] do_syscall_64+0x8d/0x170 [ 72.401747][ T2810] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.407616][ T2810] [ 72.409914][ T2810] Memory state around the buggy address: [ 72.415520][ T2810] ffff888127c84b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 72.423553][ T2810] ffff888127c84b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 72.431586][ T2810] >ffff888127c84c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 72.439613][ T2810] ^ [ 72.443651][ T2810] ffff888127c84c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 72.451682][ T2810] ffff888127c84d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 72.459709][ T2810] ================================================================== [ 72.468016][ T2810] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.475567][ T2810] Kernel Offset: disabled [ 72.479885][ T2810] Rebooting in 86400 seconds..