Warning: Permanently added '10.128.0.246' (ED25519) to the list of known hosts. 2024/09/03 07:21:41 ignoring optional flag "sandboxArg"="0" 2024/09/03 07:21:41 parsed 1 programs 2024/09/03 07:21:43 executed programs: 0 [ 57.798219][ T2591] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 59.330934][ T2596] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 59.344569][ T2596] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 59.354992][ T2596] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 59.364741][ T2596] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 65.565036][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.573103][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.590374][ T1235] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.598322][ T1235] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2024/09/03 07:21:51 executed programs: 1 [ 65.672804][ T3310] jffs2: notice: (3310) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 65.711851][ T3314] jffs2: notice: (3314) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 65.744129][ T3317] jffs2: notice: (3317) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 65.760540][ T3311] ================================================================== [ 65.760554][ T3311] BUG: KASAN: slab-use-after-free in __mutex_lock+0x11b/0x1990 [ 65.760589][ T3311] Read of size 8 at addr ffff888102ff8130 by task jffs2_gcd_mtd0/3311 [ 65.760603][ T3311] [ 65.760619][ T3311] CPU: 1 UID: 0 PID: 3311 Comm: jffs2_gcd_mtd0 Not tainted 6.11.0-rc6-syzkaller #0 [ 65.760638][ T3311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 65.760652][ T3311] Call Trace: [ 65.760660][ T3311] [ 65.760671][ T3311] dump_stack_lvl+0x231/0x330 [ 65.760693][ T3311] ? __pfx_dump_stack_lvl+0x10/0x10 [ 65.760710][ T3311] ? __pfx__printk+0x10/0x10 [ 65.760727][ T3311] ? lock_acquire+0xc2/0x3a0 [ 65.760744][ T3311] ? __pfx_lock_acquire+0x10/0x10 [ 65.760758][ T3311] ? _printk+0xd5/0x120 [ 65.760776][ T3311] ? __virt_addr_valid+0x169/0x380 [ 65.760797][ T3311] print_report+0x169/0x550 [ 65.760812][ T3311] ? __virt_addr_valid+0x169/0x380 [ 65.760831][ T3311] ? __virt_addr_valid+0x2c1/0x380 [ 65.760851][ T3311] ? __phys_addr+0x90/0x130 [ 65.760869][ T3311] ? __mutex_lock+0x11b/0x1990 [ 65.806624][ T3315] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cb: 0000 [#1] PREEMPT SMP KASAN PTI [ 65.809362][ T3311] kasan_report+0x143/0x180 [ 65.812294][ T3315] KASAN: null-ptr-deref in range [0x0000000000000658-0x000000000000065f] [ 65.816944][ T3311] ? __mutex_lock+0x11b/0x1990 [ 65.822106][ T3315] CPU: 0 UID: 0 PID: 3315 Comm: jffs2_gcd_mtd0 Not tainted 6.11.0-rc6-syzkaller #0 [ 65.826663][ T3311] ? jffs2_garbage_collect_pass+0xae/0x2080 [ 65.831216][ T3315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 65.836207][ T3311] __mutex_lock+0x11b/0x1990 [ 65.840330][ T3315] RIP: 0010:mtd_erase+0x9d/0x860 [ 65.845409][ T3311] ? __lock_acquire+0x61d/0xc60 [ 65.849876][ T3315] Code: f1 f1 00 00 00 f3 4b 89 04 3e 43 c7 44 3e 08 f3 f3 f3 f3 e8 b5 d1 60 fe 4d 89 ec 49 8d 9c 24 30 06 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 74 e2 9f fe 48 8b 1b 48 85 db 74 [ 65.854951][ T3311] ? __pfx___mutex_lock+0x10/0x10 [ 65.860030][ T3315] RSP: 0018:ffffc900003f7820 EFLAGS: 00010202 [ 65.864501][ T3311] ? __lock_acquire+0x61d/0xc60 [ 65.869230][ T3315] [ 65.881771][ T3311] ? __set_current_blocked+0x310/0x380 [ 65.886243][ T3315] RAX: 00000000000000cb RBX: 000000000000065b RCX: ffff88811e279c80 [ 65.894884][ T3311] jffs2_garbage_collect_pass+0xae/0x2080 [ 65.899617][ T3315] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811a6554b0 [ 65.908861][ T3311] ? _raw_spin_unlock_irq+0x29/0x50 [ 65.914715][ T3315] RBP: ffffc900003f7950 R08: ffffffff86b3a873 R09: 1ffffffff0d6750e [ 65.924739][ T3311] ? __set_current_blocked+0x310/0x380 [ 65.929295][ T3315] R10: dffffc0000000000 R11: fffffbfff0d6750f R12: 000000000000002b [ 65.934203][ T3311] ? __pfx___set_current_blocked+0x10/0x10 [ 65.939025][ T3315] R13: ffff88811a654e80 R14: 1ffff9200007ef14 R15: dffffc0000000000 [ 65.958603][ T3311] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10 [ 65.963597][ T3315] FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 65.969628][ T3311] ? schedule_timeout+0x21a/0x2e0 [ 65.974446][ T3315] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.976746][ T3311] ? sigprocmask+0x228/0x280 [ 65.982170][ T3315] CR2: 000055557207c818 CR3: 0000000115c34000 CR4: 00000000003506f0 [ 65.990120][ T3311] ? __pfx_sigprocmask+0x10/0x10 [ 65.995812][ T3315] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 66.005232][ T3311] ? do_raw_spin_unlock+0x13c/0x8b0 [ 66.010403][ T3315] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 66.018345][ T3311] jffs2_garbage_collect_thread+0x5c0/0x650 [ 66.023770][ T3315] Call Trace: [ 66.031712][ T3311] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.037482][ T3315] [ 66.045420][ T3311] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 66.051632][ T3315] ? __die_body+0x88/0xe0 [ 66.060527][ T3311] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.065520][ T3315] ? die_addr+0x108/0x140 [ 66.072071][ T3311] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 66.076628][ T3315] ? exc_general_protection+0x326/0x4d0 [ 66.084572][ T3311] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.089478][ T3315] ? asm_exc_general_protection+0x26/0x30 [ 66.097412][ T3311] ? __kthread_parkme+0x126/0x170 [ 66.102664][ T3315] ? mtd_erase+0x9d/0x860 [ 66.110602][ T3311] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.116462][ T3315] ? __pfx_mtd_erase+0x10/0x10 [ 66.119710][ T3311] kthread+0x290/0x300 [ 66.126097][ T3315] jffs2_erase_pending_blocks+0xd4a/0x2710 [ 66.129003][ T3311] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.134866][ T3315] ? __pfx_jffs2_erase_pending_blocks+0x10/0x10 [ 66.139154][ T3311] ? __pfx_kthread+0x10/0x10 [ 66.145449][ T3315] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 66.149741][ T3311] ret_from_fork+0x4b/0x80 [ 66.155597][ T3315] ? do_raw_spin_unlock+0x13c/0x8b0 [ 66.161193][ T3311] ? __pfx_kthread+0x10/0x10 [ 66.167486][ T3315] jffs2_garbage_collect_pass+0x6b3/0x2080 [ 66.173166][ T3311] ret_from_fork_asm+0x1a/0x30 [ 66.178155][ T3315] ? _raw_spin_unlock_irq+0x29/0x50 [ 66.182449][ T3311] [ 66.188821][ T3315] ? __set_current_blocked+0x310/0x380 [ 66.193552][ T3311] [ 66.193557][ T3311] Allocated by task 3310: [ 66.197583][ T3315] ? __pfx___set_current_blocked+0x10/0x10 [ 66.203351][ T3311] kasan_save_track+0x3f/0x80 [ 66.209728][ T3315] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10 [ 66.215929][ T3311] __kasan_kmalloc+0x98/0xb0 [ 66.220484][ T3315] ? schedule_timeout+0x21a/0x2e0 [ 66.226425][ T3311] __kmalloc_cache_noprof+0x19e/0x360 [ 66.230809][ T3315] ? sigprocmask+0x228/0x280 [ 66.235969][ T3311] jffs2_init_fs_context+0x4f/0xc0 [ 66.240524][ T3315] ? __pfx_sigprocmask+0x10/0x10 [ 66.246292][ T3311] alloc_fs_context+0x685/0x800 [ 66.251020][ T3315] ? do_raw_spin_unlock+0x13c/0x8b0 [ 66.256178][ T3311] do_new_mount+0x160/0xb40 [ 66.259175][ T3315] jffs2_garbage_collect_thread+0x5c0/0x650 [ 66.264594][ T3311] __se_sys_mount+0x2c5/0x3b0 [ 66.266896][ T3315] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.271183][ T3311] do_syscall_64+0x8d/0x190 [ 66.276957][ T3315] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 66.281598][ T3311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.287801][ T3315] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.292354][ T3311] [ 66.292359][ T3311] Freed by task 2596: [ 66.297348][ T3315] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 66.302681][ T3311] kasan_save_track+0x3f/0x80 [ 66.307242][ T3315] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.312404][ T3311] kasan_save_free_info+0x40/0x50 [ 66.317399][ T3315] ? __kthread_parkme+0x126/0x170 [ 66.322213][ T3311] poison_slab_object+0xe0/0x150 [ 66.327375][ T3315] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.331843][ T3311] __kasan_slab_free+0x37/0x60 [ 66.337699][ T3315] kthread+0x290/0x300 [ 66.342337][ T3311] kfree+0x12f/0x310 [ 66.348713][ T3315] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.353183][ T3311] deactivate_locked_super+0xca/0x450 [ 66.359039][ T3315] ? __pfx_kthread+0x10/0x10 [ 66.364894][ T3311] cleanup_mnt+0x352/0x3e0 [ 66.371187][ T3315] ret_from_fork+0x4b/0x80 [ 66.373488][ T3311] task_work_run+0x24f/0x300 [ 66.377436][ T3315] ? __pfx_kthread+0x10/0x10 [ 66.383293][ T3311] syscall_exit_to_user_mode+0xc5/0x200 [ 66.387935][ T3315] ret_from_fork_asm+0x1a/0x30 [ 66.394223][ T3311] do_syscall_64+0x9a/0x190 [ 66.399213][ T3315] [ 66.404194][ T3311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.409097][ T3315] Modules linked in: [ 66.415473][ T3311] [ 66.415479][ T3311] The buggy address belongs to the object at ffff888102ff8000 [ 66.415479][ T3311] which belongs to the cache kmalloc-4k of size 4096 [ 66.420524][ T3315] ---[ end trace 0000000000000000 ]--- [ 66.424241][ T3311] The buggy address is located 304 bytes inside of [ 66.424241][ T3311] freed 4096-byte region [ffff888102ff8000, ffff888102ff9000) [ 66.428372][ T3315] RIP: 0010:mtd_erase+0x9d/0x860 [ 66.434476][ T3311] [ 66.434482][ T3311] The buggy address belongs to the physical page: [ 66.439831][ T3315] Code: f1 f1 00 00 00 f3 4b 89 04 3e 43 c7 44 3e 08 f3 f3 f3 f3 e8 b5 d1 60 fe 4d 89 ec 49 8d 9c 24 30 06 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 74 e2 9f fe 48 8b 1b 48 85 db 74 [ 66.444373][ T3311] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ff8 [ 66.448778][ T3315] RSP: 0018:ffffc900003f7820 EFLAGS: 00010202 [ 66.453148][ T3311] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 66.458040][ T3315] [ 66.462255][ T3311] flags: 0x200000000000040(head|node=0|zone=2) [ 66.467781][ T3315] RAX: 00000000000000cb RBX: 000000000000065b RCX: ffff88811e279c80 [ 66.472496][ T3311] page_type: 0xfdffffff(slab) [ 66.472512][ T3311] raw: 0200000000000040 ffff888100042140 dead000000000100 dead000000000122 [ 66.472526][ T3311] raw: 0000000000000000 0000000000040004 00000001fdffffff 0000000000000000 [ 66.472540][ T3311] head: 0200000000000040 ffff888100042140 dead000000000100 dead000000000122 [ 66.472554][ T3311] head: 0000000000000000 0000000000040004 00000001fdffffff 0000000000000000 [ 66.472566][ T3311] head: 0200000000000003 ffffea00040bfe01 ffffffffffffffff 0000000000000000 [ 66.472580][ T3311] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 66.472589][ T3311] page dumped because: kasan: bad access detected [ 66.472603][ T3311] page_owner tracks the page as allocated [ 66.472608][ T3311] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4967115351, free_ts 0 [ 66.472637][ T3311] post_alloc_hook+0x10f/0x130 [ 66.472663][ T3311] get_page_from_freelist+0x37f4/0x3920 [ 66.472685][ T3311] __alloc_pages_noprof+0x256/0x670 [ 66.472705][ T3311] alloc_slab_page+0x5f/0x120 [ 66.472723][ T3311] allocate_slab+0x5d/0x290 [ 66.472740][ T3311] ___slab_alloc+0xa7f/0x11d0 [ 66.472756][ T3311] __kmalloc_cache_noprof+0x1fc/0x360 [ 66.472770][ T3311] kobject_uevent_env+0x275/0x870 [ 66.477555][ T3315] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811a6554b0 [ 66.480316][ T3311] driver_register+0x2d6/0x320 [ 66.486190][ T3315] RBP: ffffc900003f7950 R08: ffffffff86b3a873 R09: 1ffffffff0d6750e [ 66.490036][ T3311] do_one_initcall+0x211/0x6e0 [ 66.492332][ T3315] R10: dffffc0000000000 R11: fffffbfff0d6750f R12: 000000000000002b [ 66.506383][ T3311] do_initcall_level+0x15a/0x280 [ 66.506402][ T3311] do_initcalls+0x3f/0x80 [ 66.511825][ T3315] R13: ffff88811a654e80 R14: 1ffff9200007ef14 R15: dffffc0000000000 [ 66.525751][ T3311] kernel_init_freeable+0x3f2/0x580 [ 66.525768][ T3311] kernel_init+0x1d/0x2b0 [ 66.525782][ T3311] ret_from_fork+0x4b/0x80 [ 66.530686][ T3315] FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 66.532981][ T3311] ret_from_fork_asm+0x1a/0x30 [ 66.539371][ T3315] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 66.558928][ T3311] page_owner free stack trace missing [ 66.558936][ T3311] [ 66.558939][ T3311] Memory state around the buggy address: [ 66.558948][ T3311] ffff888102ff8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.567770][ T3315] CR2: 000055557207c818 CR3: 0000000115c34000 CR4: 00000000003506f0 [ 66.573796][ T3311] ffff888102ff8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.573806][ T3311] >ffff888102ff8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.573812][ T3311] ^ [ 66.573820][ T3311] ffff888102ff8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.573829][ T3311] ffff888102ff8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.573836][ T3311] ================================================================== [ 66.574064][ T3311] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 66.582717][ T3311] Kernel Offset: disabled