Warning: Permanently added '10.128.10.25' (ED25519) to the list of known hosts.
2024/03/11 21:30:40 ignoring optional flag "sandboxArg"="0"
2024/03/11 21:30:40 parsed 1 programs
[ 42.059742][ T30] audit: type=1400 audit(1710192640.711:157): avc: denied { mounton } for pid=340 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 42.084877][ T30] audit: type=1400 audit(1710192640.711:158): avc: denied { mount } for pid=340 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
2024/03/11 21:30:40 executed programs: 0
[ 42.149648][ T30] audit: type=1400 audit(1710192640.801:159): avc: denied { unlink } for pid=340 comm="syz-executor" name="swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 42.171986][ T340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 42.232397][ T346] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.239804][ T346] bridge0: port 1(bridge_slave_0) entered disabled state
[ 42.247024][ T346] device bridge_slave_0 entered promiscuous mode
[ 42.254204][ T346] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.261255][ T346] bridge0: port 2(bridge_slave_1) entered disabled state
[ 42.268468][ T346] device bridge_slave_1 entered promiscuous mode
[ 42.312914][ T30] audit: type=1400 audit(1710192640.961:160): avc: denied { write } for pid=346 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 42.324999][ T346] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.333373][ T30] audit: type=1400 audit(1710192640.971:161): avc: denied { read } for pid=346 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 42.340355][ T346] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 42.340500][ T346] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.374575][ T346] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 42.395004][ T302] bridge0: port 1(bridge_slave_0) entered disabled state
[ 42.402711][ T302] bridge0: port 2(bridge_slave_1) entered disabled state
[ 42.410142][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 42.417372][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 42.427449][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 42.435437][ T20] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.442298][ T20] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 42.460547][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 42.469107][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 42.477057][ T302] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.484261][ T302] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 42.491447][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 42.500035][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 42.511216][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 42.518971][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 42.526556][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 42.535235][ T346] device veth0_vlan entered promiscuous mode
[ 42.545336][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 42.554795][ T346] device veth1_macvtap entered promiscuous mode
[ 42.567268][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 42.575789][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 42.588124][ T30] audit: type=1400 audit(1710192641.231:162): avc: denied { mounton } for pid=346 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=362 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[ 42.624101][ T353] loop0: detected capacity change from 0 to 512
[ 42.631311][ T30] audit: type=1400 audit(1710192641.281:163): avc: denied { mounton } for pid=352 comm="syz-executor.0" path="/root/syzkaller-testdir1843095873/syzkaller.JxojJz/0/file1" dev="sda1" ino=1939 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 42.671758][ T353] EXT4-fs (loop0): 1 orphan inode deleted
[ 42.677377][ T353] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 42.688461][ T30] audit: type=1400 audit(1710192641.331:164): avc: denied { mount } for pid=352 comm="syz-executor.0" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[ 42.688503][ T353] ext4 filesystem being mounted at /root/syzkaller-testdir1843095873/syzkaller.JxojJz/0/file1 supports timestamps until 2038 (0x7fffffff)
[ 42.728081][ T30] audit: type=1400 audit(1710192641.381:165): avc: denied { write } for pid=352 comm="syz-executor.0" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 42.743855][ T352] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz-executor.0: Invalid block bitmap block 0 in block_group 0
[ 42.751981][ T30] audit: type=1400 audit(1710192641.381:166): avc: denied { add_name } for pid=352 comm="syz-executor.0" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 42.765773][ T352] EXT4-fs error (device loop0): ext4_discard_preallocations:5101: comm syz-executor.0: Error -117 reading block bitmap for 0
[ 42.803904][ T8] ==================================================================
[ 42.811839][ T8] BUG: KASAN: use-after-free in ext4_find_extent+0xbab/0xdb0
[ 42.819259][ T8] Read of size 4 at addr ffff888123b07088 by task kworker/u4:0/8
[ 42.826846][ T8]
[ 42.829029][ T8] CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.148-syzkaller-1069047-g993bed180178 #0
[ 42.839116][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
[ 42.849111][ T8] Workqueue: writeback wb_workfn (flush-7:0)
[ 42.855002][ T8] Call Trace:
[ 42.858305][ T8]
[ 42.861084][ T8] dump_stack_lvl+0x151/0x1b7
[ 42.865606][ T8] ? io_uring_drop_tctx_refs+0x190/0x190
[ 42.871068][ T8] ? __wake_up_klogd+0xd5/0x110
[ 42.875751][ T8] ? panic+0x751/0x751
[ 42.879743][ T8] print_address_description+0x87/0x3b0
[ 42.885125][ T8] kasan_report+0x179/0x1c0
[ 42.889499][ T8] ? __read_extent_tree_block+0x1e0/0x7b0
[ 42.895036][ T8] ? ext4_find_extent+0xbab/0xdb0
[ 42.899967][ T8] ? ext4_find_extent+0xbab/0xdb0
[ 42.904851][ T8] __asan_report_load4_noabort+0x14/0x20
[ 42.910332][ T8] ext4_find_extent+0xbab/0xdb0
[ 42.914982][ T8] ext4_ext_map_blocks+0x254/0x7250
[ 42.920020][ T8] ? __kasan_check_write+0x14/0x20
[ 42.925396][ T8] ? _raw_spin_lock_irqsave+0xf9/0x210
[ 42.930875][ T8] ? ret_from_fork+0x1f/0x30
[ 42.935300][ T8] ? uncharge_batch+0x4b0/0x4b0
[ 42.940164][ T8] ? stack_trace_snprint+0xf0/0xf0
[ 42.945254][ T8] ? _raw_spin_unlock_irqrestore+0x5c/0x80
[ 42.950837][ T8] ? __stack_depot_save+0x40d/0x470
[ 42.956046][ T8] ? ext4_ext_release+0x10/0x10
[ 42.960731][ T8] ? __kasan_slab_alloc+0xc3/0xe0
[ 42.967760][ T8] ? __kasan_slab_alloc+0xb1/0xe0
[ 42.972624][ T8] ? slab_post_alloc_hook+0x53/0x2c0
[ 42.977989][ T8] ? kmem_cache_alloc+0xf5/0x200
[ 42.982892][ T8] ? ext4_alloc_io_end_vec+0x2a/0x170
[ 42.988093][ T8] ? ext4_writepages+0x13b4/0x4000
[ 42.993247][ T8] ? do_writepages+0x40e/0x670
[ 42.997820][ T8] ? __writeback_single_inode+0xdf/0xa70
[ 43.003380][ T8] ? writeback_sb_inodes+0xb2a/0x1920
[ 43.008501][ T8] ? wb_writeback+0x3b9/0x9e0
[ 43.013526][ T8] ? wb_workfn+0x3d9/0x1110
[ 43.018041][ T8] ? process_one_work+0x6bb/0xc10
[ 43.023081][ T8] ? worker_thread+0xad5/0x12a0
[ 43.027844][ T8] ? kthread+0x421/0x510
[ 43.032096][ T8] ? ret_from_fork+0x1f/0x30
[ 43.036788][ T8] ? _raw_read_unlock+0x25/0x40
[ 43.041826][ T8] ? ext4_es_lookup_extent+0x33b/0x940
[ 43.047199][ T8] ext4_map_blocks+0xaa7/0x1e00
[ 43.051918][ T8] ? ext4_issue_zeroout+0x250/0x250
[ 43.057007][ T8] ? ext4_inode_journal_mode+0x1a5/0x470
[ 43.062743][ T8] ext4_writepages+0x1628/0x4000
[ 43.067513][ T8] ? ext4_readpage+0x230/0x230
[ 43.072136][ T8] ? __kasan_check_read+0x11/0x20
[ 43.077102][ T8] ? shmem_getpage_gfp+0x21cd/0x23c0
[ 43.082218][ T8] ? copy_page_from_iter_atomic+0x7fd/0x10e0
[ 43.088120][ T8] ? update_curr+0x31a/0x5d0
[ 43.092627][ T8] ? ext4_readpage+0x230/0x230
[ 43.097228][ T8] do_writepages+0x40e/0x670
[ 43.101743][ T8] ? __writepage+0x130/0x130
[ 43.106342][ T8] ? sched_group_set_idle+0x640/0x640
[ 43.112072][ T8] ? sched_clock_cpu+0x18/0x3b0
[ 43.116941][ T8] ? __kasan_check_write+0x14/0x20
[ 43.122581][ T8] ? _raw_spin_lock+0xa4/0x1b0
[ 43.127179][ T8] __writeback_single_inode+0xdf/0xa70
[ 43.132573][ T8] writeback_sb_inodes+0xb2a/0x1920
[ 43.137706][ T8] ? sched_task_on_rq+0x50/0x50
[ 43.142649][ T8] ? _raw_spin_lock+0xa4/0x1b0
[ 43.147709][ T8] ? queue_io+0x520/0x520
[ 43.151839][ T8] ? __writeback_inodes_wb+0x3f0/0x3f0
[ 43.157136][ T8] ? queue_io+0x3d0/0x520
[ 43.161386][ T8] wb_writeback+0x3b9/0x9e0
[ 43.165725][ T8] ? inode_cgwb_move_to_attached+0x3c0/0x3c0
[ 43.171632][ T8] ? set_worker_desc+0x158/0x1c0
[ 43.176411][ T8] ? __update_load_avg_cfs_rq+0xb1/0x2f0
[ 43.182067][ T8] ? __kasan_check_write+0x14/0x20
[ 43.186991][ T8] wb_workfn+0x3d9/0x1110
[ 43.191158][ T8] ? inode_wait_for_writeback+0x280/0x280
[ 43.196796][ T8] ? sched_clock+0x9/0x10
[ 43.200974][ T8] ? _raw_spin_unlock+0x4d/0x70
[ 43.205648][ T8] ? finish_task_switch+0x167/0x7b0
[ 43.210786][ T8] ? __kasan_check_read+0x11/0x20
[ 43.215628][ T8] ? read_word_at_a_time+0x12/0x20
[ 43.220752][ T8] ? strscpy+0x9c/0x260
[ 43.224838][ T8] process_one_work+0x6bb/0xc10
[ 43.229693][ T8] worker_thread+0xad5/0x12a0
[ 43.234206][ T8] kthread+0x421/0x510
[ 43.238112][ T8] ? worker_clr_flags+0x180/0x180
[ 43.243157][ T8] ? kthread_blkcg+0xd0/0xd0
[ 43.247583][ T8] ret_from_fork+0x1f/0x30
[ 43.251909][ T8]
[ 43.254775][ T8]
[ 43.257047][ T8] The buggy address belongs to the page:
[ 43.262502][ T8] page:ffffea00048ec1c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x123b07
[ 43.272573][ T8] flags: 0x4000000000000000(zone=1)
[ 43.277720][ T8] raw: 4000000000000000 ffffea00048ec208 ffffea00048ec188 0000000000000000
[ 43.286621][ T8] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 43.295196][ T8] page dumped because: kasan: bad access detected
[ 43.301709][ T8] page_owner info is not present (never set?)
[ 43.307855][ T8]
[ 43.309990][ T8] Memory state around the buggy address:
[ 43.315484][ T8] ffff888123b06f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 43.324427][ T8] ffff888123b07000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 43.333769][ T8] >ffff888123b07080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 43.341832][ T8] ^
[ 43.346247][ T8] ffff888123b07100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 43.354622][ T8] ffff888123b07180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 43.362491][ T8] ==================================================================
[ 43.370488][ T8] Disabling lock debugging due to kernel taint
[ 43.378550][ T8] ------------[ cut here ]------------
[ 43.383977][ T8] kernel BUG at fs/ext4/inode.c:2421!
[ 43.389284][ T8] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 43.395296][ T8] CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G B 5.15.148-syzkaller-1069047-g993bed180178 #0
[ 43.406679][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
[ 43.416688][ T8] Workqueue: writeback wb_workfn (flush-7:0)
[ 43.422508][ T8] RIP: 0010:ext4_writepages+0x3f4b/0x4000
[ 43.428279][ T8] Code: 00 74 08 48 89 df e8 f4 d7 c9 ff 48 8b 3b 48 8b 74 24 48 48 8b 54 24 28 44 89 e9 45 89 f8 e8 cc 2d 08 00 eb 58 e8 05 db 87 ff <0f> 0b e8 fe da 87 ff eb 3b e8 f7 da 87 ff eb 72 e8 f0 da 87 ff 31
[ 43.448813][ T8] RSP: 0018:ffffc90000087000 EFLAGS: 00010293
[ 43.454884][ T8] RAX: ffffffff81e8444b RBX: dffffc0000000000 RCX: ffff8881002613c0
[ 43.463028][ T8] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 43.471113][ T8] RBP: ffffc90000087410 R08: ffffffff81e81e0b R09: ffffed1021235ec0
[ 43.478925][ T8] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
[ 43.486910][ T8] R13: ffffc900000872e0 R14: 0000000000000000 R15: 0000000000000000
[ 43.494911][ T8] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[ 43.503846][ T8] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 43.511130][ T8] CR2: 0000555556885818 CR3: 000000011cfe5000 CR4: 00000000003506a0
[ 43.518958][ T8] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 43.527009][ T8] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 43.535277][ T8] Call Trace:
[ 43.538370][ T8]
[ 43.541149][ T8] ? __die_body+0x62/0xb0
[ 43.545339][ T8] ? die+0x88/0xb0
[ 43.548878][ T8] ? do_trap+0x103/0x330
[ 43.552959][ T8] ? ext4_writepages+0x3f4b/0x4000
[ 43.558081][ T8] ? handle_invalid_op+0x95/0xc0
[ 43.562940][ T8] ? ext4_writepages+0x3f4b/0x4000
[ 43.568934][ T8] ? exc_invalid_op+0x32/0x50
[ 43.573541][ T8] ? asm_exc_invalid_op+0x1b/0x20
[ 43.578381][ T8] ? ext4_writepages+0x190b/0x4000
[ 43.583338][ T8] ? ext4_writepages+0x3f4b/0x4000
[ 43.588286][ T8] ? ext4_writepages+0x3f4b/0x4000
[ 43.593323][ T8] ? ext4_readpage+0x230/0x230
[ 43.597917][ T8] ? __kasan_check_read+0x11/0x20
[ 43.603297][ T8] ? shmem_getpage_gfp+0x21cd/0x23c0
[ 43.608849][ T8] ? copy_page_from_iter_atomic+0x7fd/0x10e0
[ 43.614838][ T8] ? update_curr+0x31a/0x5d0
[ 43.619355][ T8] ? ext4_readpage+0x230/0x230
[ 43.623946][ T8] do_writepages+0x40e/0x670
[ 43.628823][ T8] ? __writepage+0x130/0x130
[ 43.633232][ T8] ? sched_group_set_idle+0x640/0x640
[ 43.638438][ T8] ? sched_clock_cpu+0x18/0x3b0
[ 43.643449][ T8] ? __kasan_check_write+0x14/0x20
[ 43.648386][ T8] ? _raw_spin_lock+0xa4/0x1b0
[ 43.653026][ T8] __writeback_single_inode+0xdf/0xa70
[ 43.658285][ T8] writeback_sb_inodes+0xb2a/0x1920
[ 43.663311][ T8] ? sched_task_on_rq+0x50/0x50
[ 43.668002][ T8] ? _raw_spin_lock+0xa4/0x1b0
[ 43.672637][ T8] ? queue_io+0x520/0x520
[ 43.676849][ T8] ? __writeback_inodes_wb+0x3f0/0x3f0
[ 43.682247][ T8] ? queue_io+0x3d0/0x520
[ 43.686407][ T8] wb_writeback+0x3b9/0x9e0
[ 43.690740][ T8] ? inode_cgwb_move_to_attached+0x3c0/0x3c0
[ 43.696723][ T8] ? set_worker_desc+0x158/0x1c0
[ 43.701498][ T8] ? __update_load_avg_cfs_rq+0xb1/0x2f0
[ 43.706981][ T8] ? __kasan_check_write+0x14/0x20
[ 43.712001][ T8] wb_workfn+0x3d9/0x1110
[ 43.716169][ T8] ? inode_wait_for_writeback+0x280/0x280
[ 43.721804][ T8] ? sched_clock+0x9/0x10
[ 43.725984][ T8] ? _raw_spin_unlock+0x4d/0x70
[ 43.730664][ T8] ? finish_task_switch+0x167/0x7b0
[ 43.736477][ T8] ? __kasan_check_read+0x11/0x20
[ 43.741423][ T8] ? read_word_at_a_time+0x12/0x20
[ 43.746455][ T8] ? strscpy+0x9c/0x260
[ 43.750475][ T8] process_one_work+0x6bb/0xc10
[ 43.755138][ T8] worker_thread+0xad5/0x12a0
[ 43.759743][ T8] kthread+0x421/0x510
[ 43.763655][ T8] ? worker_clr_flags+0x180/0x180
[ 43.768511][ T8] ? kthread_blkcg+0xd0/0xd0
[ 43.773014][ T8] ret_from_fork+0x1f/0x30
[ 43.777276][ T8]
[ 43.780306][ T8] Modules linked in:
[ 43.786115][ T8] ---[ end trace 80606b9fbeab51cd ]---
[ 43.791609][ T8] RIP: 0010:ext4_writepages+0x3f4b/0x4000
[ 43.797229][ T8] Code: 00 74 08 48 89 df e8 f4 d7 c9 ff 48 8b 3b 48 8b 74 24 48 48 8b 54 24 28 44 89 e9 45 89 f8 e8 cc 2d 08 00 eb 58 e8 05 db 87 ff <0f> 0b e8 fe da 87 ff eb 3b e8 f7 da 87 ff eb 72 e8 f0 da 87 ff 31
[ 43.817183][ T8] RSP: 0018:ffffc90000087000 EFLAGS: 00010293
[ 43.823171][ T8] RAX: ffffffff81e8444b RBX: dffffc0000000000 RCX: ffff8881002613c0
[ 43.831182][ T8] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 43.839306][ T8] RBP: ffffc90000087410 R08: ffffffff81e81e0b R09: ffffed1021235ec0
[ 43.847120][ T8] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
[ 43.855242][ T8] R13: ffffc900000872e0 R14: 0000000000000000 R15: 0000000000000000
[ 43.863121][ T8] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[ 43.872295][ T8] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 43.878653][ T8] CR2: 0000555556885818 CR3: 000000011cfe5000 CR4: 00000000003506a0
[ 43.886766][ T8] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 43.894563][ T8] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 43.903000][ T8] Kernel panic - not syncing: Fatal exception
[ 43.909184][ T8] Kernel Offset: disabled
[ 43.913321][ T8] Rebooting in 86400 seconds..