Warning: Permanently added '10.128.0.185' (ED25519) to the list of known hosts. 2023/12/31 22:09:13 ignoring optional flag "sandboxArg"="0" 2023/12/31 22:09:14 parsed 1 programs 2023/12/31 22:09:14 executed programs: 0 [ 44.559945][ T1047] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.795894][ T1506] loop0: detected capacity change from 0 to 512 [ 46.804168][ T1506] EXT4-fs (loop0): Ignoring removed bh option [ 46.810299][ T1506] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 46.820838][ T1506] EXT4-fs (loop0): 1 truncate cleaned up [ 46.826731][ T1506] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,resgid=0x000000000000ee00,bh,noload,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 46.848631][ T1506] ================================================================== [ 46.856917][ T1506] BUG: KASAN: slab-out-of-bounds in ext4_search_dir+0x1df/0x260 [ 46.864787][ T1506] Read of size 1 at addr ffff88811c1ef3ed by task syz-executor.0/1506 [ 46.872988][ T1506] [ 46.875382][ T1506] CPU: 1 PID: 1506 Comm: syz-executor.0 Not tainted 5.15.145-syzkaller #0 [ 46.883953][ T1506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 46.894077][ T1506] Call Trace: [ 46.897343][ T1506] [ 46.900247][ T1506] dump_stack_lvl+0x41/0x5e [ 46.904856][ T1506] print_address_description.constprop.0.cold+0x6c/0x309 [ 46.912367][ T1506] ? ext4_search_dir+0x1df/0x260 [ 46.917272][ T1506] ? ext4_search_dir+0x1df/0x260 [ 46.922192][ T1506] kasan_report.cold+0x83/0xdf [ 46.926920][ T1506] ? ext4_search_dir+0x1df/0x260 [ 46.931840][ T1506] ext4_search_dir+0x1df/0x260 [ 46.936659][ T1506] ext4_find_inline_entry+0x355/0x440 [ 46.942113][ T1506] ? tomoyo_path_number_perm+0x1d8/0x420 [ 46.947714][ T1506] ? ext4_try_create_inline_dir+0x290/0x290 [ 46.953749][ T1506] ? lock_downgrade+0x4f0/0x4f0 [ 46.958680][ T1506] __ext4_find_entry+0x84a/0xce0 [ 46.963595][ T1506] ? find_held_lock+0x2d/0x110 [ 46.968501][ T1506] ? ext4_dx_find_entry+0x570/0x570 [ 46.974365][ T1506] ? d_alloc_parallel+0x638/0x1010 [ 46.979445][ T1506] ext4_lookup+0x156/0x570 [ 46.983916][ T1506] ? userns_owner+0x30/0x30 [ 46.988563][ T1506] ? ext4_resetent+0x280/0x280 [ 46.993294][ T1506] ? apparmor_capget+0x6b0/0x6b0 [ 46.998217][ T1506] ? tomoyo_path_mknod+0xb5/0x130 [ 47.003475][ T1506] ? from_kgid+0x7f/0xc0 [ 47.007886][ T1506] ? ext4_resetent+0x280/0x280 [ 47.012733][ T1506] lookup_open.isra.0+0x808/0x1680 [ 47.018313][ T1506] ? vfs_tmpfile+0x2d0/0x2d0 [ 47.023109][ T1506] path_openat+0x800/0x24d0 [ 47.027761][ T1506] ? slabinfo_write+0x1/0x10 [ 47.032578][ T1506] ? __x64_sys_open+0xfd/0x1a0 [ 47.037418][ T1506] ? do_syscall_64+0x35/0x80 [ 47.042522][ T1506] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.048554][ T1506] ? path_lookupat+0x6b0/0x6b0 [ 47.053369][ T1506] ? futex_wait_restart+0x210/0x210 [ 47.058884][ T1506] ? stack_trace_save+0x8c/0xc0 [ 47.063701][ T1506] ? filter_irq_stacks+0x90/0x90 [ 47.068602][ T1506] ? kasan_save_stack+0x1b/0x40 [ 47.073424][ T1506] do_filp_open+0x199/0x3d0 [ 47.077909][ T1506] ? may_open_dev+0xd0/0xd0 [ 47.082656][ T1506] ? do_raw_spin_lock+0x120/0x2b0 [ 47.087647][ T1506] ? rwlock_bug.part.0+0x90/0x90 [ 47.092637][ T1506] ? lock_acquire+0x11a/0x230 [ 47.097280][ T1506] ? _raw_spin_unlock+0x1a/0x20 [ 47.102094][ T1506] ? alloc_fd+0x17c/0x4e0 [ 47.106388][ T1506] ? getname_flags.part.0+0x89/0x440 [ 47.111636][ T1506] do_sys_openat2+0x11e/0x400 [ 47.116282][ T1506] ? build_open_flags+0x490/0x490 [ 47.121269][ T1506] ? lock_downgrade+0x4f0/0x4f0 [ 47.126106][ T1506] __x64_sys_open+0xfd/0x1a0 [ 47.130855][ T1506] ? do_sys_open+0xe0/0xe0 [ 47.135319][ T1506] ? vtime_user_exit+0xde/0x180 [ 47.140327][ T1506] ? trace_user_exit.constprop.0+0x25/0xb0 [ 47.146278][ T1506] do_syscall_64+0x35/0x80 [ 47.150747][ T1506] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.156609][ T1506] RIP: 0033:0x7fb3c163fb29 [ 47.160998][ T1506] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 47.181009][ T1506] RSP: 002b:00007fb3c11c20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 47.189581][ T1506] RAX: ffffffffffffffda RBX: 00007fb3c175ef80 RCX: 00007fb3c163fb29 [ 47.197532][ T1506] RDX: 0000000000000000 RSI: 0000000000141042 RDI: 0000000020000100 [ 47.205743][ T1506] RBP: 00007fb3c168b47a R08: 0000000000000000 R09: 0000000000000000 [ 47.214119][ T1506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.222243][ T1506] R13: 0000000000000006 R14: 00007fb3c175ef80 R15: 00007fff1e6e0f58 [ 47.230320][ T1506] [ 47.233466][ T1506] [ 47.235945][ T1506] Allocated by task 1378: [ 47.240242][ T1506] kasan_save_stack+0x1b/0x40 [ 47.244981][ T1506] __kasan_slab_alloc+0x61/0x80 [ 47.250076][ T1506] kmem_cache_alloc+0x211/0x310 [ 47.255025][ T1506] vm_area_alloc+0x17/0xf0 [ 47.259618][ T1506] mmap_region+0x618/0x1050 [ 47.264209][ T1506] do_mmap+0x5ca/0xd80 [ 47.268427][ T1506] vm_mmap_pgoff+0x160/0x200 [ 47.273263][ T1506] ksys_mmap_pgoff+0x396/0x570 [ 47.278001][ T1506] do_syscall_64+0x35/0x80 [ 47.282389][ T1506] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.288337][ T1506] [ 47.290807][ T1506] Freed by task 1378: [ 47.294954][ T1506] kasan_save_stack+0x1b/0x40 [ 47.299631][ T1506] kasan_set_track+0x1c/0x30 [ 47.304226][ T1506] kasan_set_free_info+0x20/0x30 [ 47.309136][ T1506] __kasan_slab_free+0xe0/0x110 [ 47.313963][ T1506] kmem_cache_free+0x7e/0x450 [ 47.318621][ T1506] remove_vma+0xeb/0x120 [ 47.322915][ T1506] exit_mmap+0x1e0/0x4e0 [ 47.327138][ T1506] mmput+0x90/0x390 [ 47.331013][ T1506] do_exit+0x87f/0x21d0 [ 47.335328][ T1506] do_group_exit+0xe7/0x290 [ 47.341113][ T1506] __x64_sys_exit_group+0x35/0x40 [ 47.346111][ T1506] do_syscall_64+0x35/0x80 [ 47.350579][ T1506] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.357418][ T1506] [ 47.359726][ T1506] The buggy address belongs to the object at ffff88811c1ef300 [ 47.359726][ T1506] which belongs to the cache vm_area_struct of size 192 [ 47.374393][ T1506] The buggy address is located 45 bytes to the right of [ 47.374393][ T1506] 192-byte region [ffff88811c1ef300, ffff88811c1ef3c0) [ 47.388206][ T1506] The buggy address belongs to the page: [ 47.393822][ T1506] page:ffffea0004707bc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11c1ef [ 47.404217][ T1506] memcg:ffff88810ae96f01 [ 47.408459][ T1506] flags: 0x200000000000200(slab|node=0|zone=2) [ 47.414777][ T1506] raw: 0200000000000200 0000000000000000 dead000000000122 ffff888100137a00 [ 47.424555][ T1506] raw: 0000000000000000 0000000000100010 00000001ffffffff ffff88810ae96f01 [ 47.433563][ T1506] page dumped because: kasan: bad access detected [ 47.440330][ T1506] page_owner tracks the page as allocated [ 47.446366][ T1506] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 1378, ts 46158788083, free_ts 46157062745 [ 47.462841][ T1506] get_page_from_freelist+0x166f/0x2910 [ 47.468379][ T1506] __alloc_pages+0x2b3/0x590 [ 47.472937][ T1506] allocate_slab+0x2eb/0x430 [ 47.477512][ T1506] ___slab_alloc+0xb1c/0xf80 [ 47.482177][ T1506] kmem_cache_alloc+0x2d7/0x310 [ 47.487003][ T1506] vm_area_dup+0x73/0x280 [ 47.491309][ T1506] __split_vma+0x88/0x490 [ 47.495703][ T1506] __do_munmap+0xa44/0x10c0 [ 47.500446][ T1506] mmap_region+0x1ae/0x1050 [ 47.505010][ T1506] do_mmap+0x5ca/0xd80 [ 47.509137][ T1506] vm_mmap_pgoff+0x160/0x200 [ 47.513875][ T1506] ksys_mmap_pgoff+0x396/0x570 [ 47.518696][ T1506] do_syscall_64+0x35/0x80 [ 47.523703][ T1506] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.529831][ T1506] page last free stack trace: [ 47.534472][ T1506] free_pcp_prepare+0x34e/0x730 [ 47.539296][ T1506] free_unref_page+0x19/0x3b0 [ 47.544474][ T1506] tlb_finish_mmu+0x1ef/0x6c0 [ 47.549202][ T1506] exit_mmap+0x185/0x4e0 [ 47.553495][ T1506] mmput+0x90/0x390 [ 47.557277][ T1506] do_exit+0x87f/0x21d0 [ 47.561397][ T1506] do_group_exit+0xe7/0x290 [ 47.565866][ T1506] __x64_sys_exit_group+0x35/0x40 [ 47.570969][ T1506] do_syscall_64+0x35/0x80 [ 47.575371][ T1506] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.581352][ T1506] [ 47.583647][ T1506] Memory state around the buggy address: [ 47.589327][ T1506] ffff88811c1ef280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 47.597356][ T1506] ffff88811c1ef300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.605560][ T1506] >ffff88811c1ef380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 47.613592][ T1506] ^ [ 47.621183][ T1506] ffff88811c1ef400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.629294][ T1506] ffff88811c1ef480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 47.637493][ T1506] ================================================================== [ 47.645563][ T1506] Disabling lock debugging due to kernel taint [ 47.651825][ T1506] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 47.659496][ T1506] Kernel Offset: disabled [ 47.663796][ T1506] Rebooting in 86400 seconds..