Warning: Permanently added '10.128.0.2' (ED25519) to the list of known hosts. 2024/09/21 15:13:11 ignoring optional flag "sandboxArg"="0" 2024/09/21 15:13:11 parsed 1 programs [ 58.117582][ T1484] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2024/09/21 15:13:14 executed programs: 0 [ 70.242989][ T4185] loop3: detected capacity change from 0 to 128 [ 70.284227][ T4185] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 70.294988][ T4185] ext4 filesystem being mounted at /root/syzkaller-testdir3752347993/syzkaller.KKmlCe/0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038 (0x7fffffff) [ 70.365775][ T4185] EXT4-fs warning (device loop3): dx_probe:891: inode #2: comm syz-executor.3: dx entry: limit 0 != root limit 124 [ 70.378122][ T4185] EXT4-fs warning (device loop3): dx_probe:965: inode #2: comm syz-executor.3: Corrupt directory, running e2fsck is recommended [ 70.391936][ T4185] ================================================================== [ 70.400004][ T4185] BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ee/0x920 [ 70.408088][ T4185] Read of size 2 at addr ffff88810f4b2003 by task syz-executor.3/4185 [ 70.416237][ T4185] [ 70.418571][ T4185] CPU: 1 PID: 4185 Comm: syz-executor.3 Not tainted 5.15.167-syzkaller #0 [ 70.427062][ T4185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 70.437147][ T4185] Call Trace: [ 70.440431][ T4185] [ 70.443358][ T4185] dump_stack_lvl+0x41/0x5e [ 70.447860][ T4185] print_address_description.constprop.0.cold+0x6c/0x309 [ 70.454997][ T4185] ? __ext4_check_dir_entry+0x5ee/0x920 [ 70.460540][ T4185] ? __ext4_check_dir_entry+0x5ee/0x920 [ 70.466091][ T4185] kasan_report.cold+0x83/0xdf [ 70.470858][ T4185] ? __ext4_check_dir_entry+0x5ee/0x920 [ 70.476405][ T4185] __ext4_check_dir_entry+0x5ee/0x920 [ 70.481791][ T4185] ext4_readdir+0xd2c/0x2780 [ 70.486382][ T4185] ? __ext4_check_dir_entry+0x920/0x920 [ 70.492013][ T4185] ? down_read_killable+0x157/0x330 [ 70.497299][ T4185] ? fsnotify_perm.part.0+0x118/0x4c0 [ 70.502670][ T4185] iterate_dir+0x48a/0x6d0 [ 70.507093][ T4185] __x64_sys_getdents64+0x122/0x220 [ 70.512378][ T4185] ? __ia32_sys_getdents+0x220/0x220 [ 70.518451][ T4185] ? compat_fillonedir+0x300/0x300 [ 70.523570][ T4185] ? vtime_user_exit+0xde/0x180 [ 70.528422][ T4185] do_syscall_64+0x33/0x80 [ 70.532834][ T4185] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 70.538746][ T4185] RIP: 0033:0x7fd6447aaee9 [ 70.543184][ T4185] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 70.563222][ T4185] RSP: 002b:00007fd64432d0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 70.571632][ T4185] RAX: ffffffffffffffda RBX: 00007fd6448e1fa0 RCX: 00007fd6447aaee9 [ 70.579609][ T4185] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000008 [ 70.587582][ T4185] RBP: 00007fd6447f747f R08: 0000000000000000 R09: 0000000000000000 [ 70.595673][ T4185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 70.603826][ T4185] R13: 0000000000000006 R14: 00007fd6448e1fa0 R15: 00007ffd848d3d38 [ 70.611805][ T4185] [ 70.614878][ T4185] [ 70.617200][ T4185] Allocated by task 4060: [ 70.621539][ T4185] kasan_save_stack+0x1b/0x40 [ 70.626218][ T4185] __kasan_slab_alloc+0x61/0x80 [ 70.631294][ T4185] kmem_cache_alloc+0x211/0x310 [ 70.636401][ T4185] vm_area_dup+0x73/0x280 [ 70.640812][ T4185] __split_vma+0x88/0x490 [ 70.645136][ T4185] __do_munmap+0x996/0x10c0 [ 70.649633][ T4185] mmap_region+0x1ae/0x1050 [ 70.654149][ T4185] do_mmap+0x5ca/0xd80 [ 70.658301][ T4185] vm_mmap_pgoff+0x160/0x200 [ 70.662881][ T4185] ksys_mmap_pgoff+0x396/0x570 [ 70.667638][ T4185] do_syscall_64+0x33/0x80 [ 70.672168][ T4185] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 70.678584][ T4185] [ 70.680991][ T4185] Freed by task 4060: [ 70.684989][ T4185] kasan_save_stack+0x1b/0x40 [ 70.689964][ T4185] kasan_set_track+0x1c/0x30 [ 70.694555][ T4185] kasan_set_free_info+0x20/0x30 [ 70.699494][ T4185] __kasan_slab_free+0xe0/0x110 [ 70.704420][ T4185] kmem_cache_free+0x7e/0x450 [ 70.709190][ T4185] remove_vma+0xeb/0x120 [ 70.710552][ T4246] loop4: detected capacity change from 0 to 128 [ 70.713533][ T4185] __do_munmap+0x53f/0x10c0 [ 70.713548][ T4185] mmap_region+0x1ae/0x1050 [ 70.713553][ T4185] do_mmap+0x5ca/0xd80 [ 70.713558][ T4185] vm_mmap_pgoff+0x160/0x200 [ 70.713564][ T4185] ksys_mmap_pgoff+0x396/0x570 [ 70.742234][ T4185] do_syscall_64+0x33/0x80 [ 70.746735][ T4185] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 70.752715][ T4185] [ 70.755033][ T4185] The buggy address belongs to the object at ffff88810f4b2000 [ 70.755033][ T4185] which belongs to the cache vm_area_struct of size 192 [ 70.769349][ T4185] The buggy address is located 3 bytes inside of [ 70.769349][ T4185] 192-byte region [ffff88810f4b2000, ffff88810f4b20c0) [ 70.782444][ T4185] The buggy address belongs to the page: [ 70.788070][ T4185] page:ffffea00043d2c80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f4b2 [ 70.798318][ T4185] memcg:ffff8881127a4b01 [ 70.802554][ T4185] flags: 0x200000000000200(slab|node=0|zone=2) [ 70.808710][ T4185] raw: 0200000000000200 dead000000000100 dead000000000122 ffff888100137a00 [ 70.817302][ T4185] raw: 0000000000000000 0000000000100010 00000001ffffffff ffff8881127a4b01 [ 70.825879][ T4185] page dumped because: kasan: bad access detected [ 70.832397][ T4185] page_owner tracks the page as allocated [ 70.838203][ T4185] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 895, ts 36856934910, free_ts 36855801170 [ 70.854387][ T4185] get_page_from_freelist+0x166f/0x2910 [ 70.859938][ T4185] __alloc_pages+0x2b3/0x590 [ 70.864565][ T4185] allocate_slab+0x2eb/0x430 [ 70.869159][ T4185] ___slab_alloc+0xb1c/0xf80 [ 70.873745][ T4185] kmem_cache_alloc+0x2d7/0x310 [ 70.878601][ T4185] vm_area_alloc+0x17/0xf0 [ 70.883021][ T4185] __install_special_mapping+0x26/0x3c0 [ 70.888583][ T4185] map_vdso+0x131/0x390 [ 70.892782][ T4185] load_elf_binary+0x1b53/0x3eb0 [ 70.897716][ T4185] bprm_execve+0x62a/0x1330 [ 70.902273][ T4185] kernel_execve+0x2dc/0x400 [ 70.906858][ T4185] call_usermodehelper_exec_async+0x2c1/0x500 [ 70.912923][ T4185] ret_from_fork+0x1f/0x30 [ 70.917337][ T4185] page last free stack trace: [ 70.922003][ T4185] free_pcp_prepare+0x34e/0x730 [ 70.926941][ T4185] free_unref_page+0x19/0x3b0 [ 70.931678][ T4185] tlb_finish_mmu+0x1ef/0x6c0 [ 70.936407][ T4185] exit_mmap+0x185/0x4e0 [ 70.940663][ T4185] mmput+0x90/0x390 [ 70.944468][ T4185] do_exit+0x87f/0x21d0 [ 70.948708][ T4185] do_group_exit+0xe7/0x290 [ 70.953214][ T4185] __x64_sys_exit_group+0x35/0x40 [ 70.958239][ T4185] do_syscall_64+0x33/0x80 [ 70.958520][ T4272] loop1: detected capacity change from 0 to 128 [ 70.962652][ T4185] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 70.962669][ T4185] [ 70.962672][ T4185] Memory state around the buggy address: [ 70.962676][ T4185] ffff88810f4b1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.962680][ T4185] ffff88810f4b1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.962684][ T4185] >ffff88810f4b2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.962687][ T4185] ^ [ 70.962691][ T4185] ffff88810f4b2080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 70.962695][ T4185] ffff88810f4b2100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.962698][ T4185] ================================================================== [ 71.035487][ T4185] Disabling lock debugging due to kernel taint [ 71.036400][ T4279] loop0: detected capacity change from 0 to 128 [ 71.041690][ T4185] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 71.055366][ T4185] Kernel Offset: disabled [ 71.059687][ T4185] Rebooting in 86400 seconds..