Warning: Permanently added '10.128.0.51' (ED25519) to the list of known hosts. 2025/11/30 21:24:21 ignoring optional flag "type"="gce" 2025/11/30 21:24:22 parsed 1 programs [ 69.432687][ T1883] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2025/11/30 21:24:29 executed programs: 0 [ 76.330837][ T2386] loop0: detected capacity change from 0 to 512 [ 76.347911][ T2386] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 76.404949][ T2386] loop0: detected capacity change from 512 to 511 [ 76.416860][ T1934] EXT4-fs error (device loop0): htree_dirblock_to_tree:1080: inode #2: block 21: comm syz-executor: bad entry in directory: directory entry overrun - offset=1004, inode=0, rec_len=1000, size=1024 fake=0 [ 76.437973][ T1934] ================================================================== [ 76.446132][ T1934] BUG: KASAN: use-after-free in ext4_read_inline_data+0x18f/0x280 [ 76.453924][ T1934] Read of size 324 at addr ffff888128d35c05 by task syz-executor/1934 [ 76.462053][ T1934] [ 76.464400][ T1934] CPU: 1 UID: 0 PID: 1934 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(none) [ 76.464411][ T1934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 76.464419][ T1934] Call Trace: [ 76.464424][ T1934] [ 76.464428][ T1934] dump_stack_lvl+0xf4/0x170 [ 76.464441][ T1934] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.464449][ T1934] ? rcu_is_watching+0x1f/0xa0 [ 76.464456][ T1934] ? __virt_addr_valid+0x176/0x2b0 [ 76.464465][ T1934] ? lock_release+0x42/0x2f0 [ 76.464471][ T1934] ? lock_acquire+0x69/0x210 [ 76.464478][ T1934] ? __virt_addr_valid+0x262/0x2b0 [ 76.464484][ T1934] print_report+0xca/0x240 [ 76.464491][ T1934] ? ext4_read_inline_data+0x18f/0x280 [ 76.464498][ T1934] kasan_report+0x118/0x150 [ 76.464507][ T1934] ? ext4_read_inline_data+0x18f/0x280 [ 76.464515][ T1934] kasan_check_range+0x2b0/0x2c0 [ 76.464522][ T1934] ? ext4_read_inline_data+0x18f/0x280 [ 76.464527][ T1934] __asan_memcpy+0x29/0x70 [ 76.464534][ T1934] ext4_read_inline_data+0x18f/0x280 [ 76.464540][ T1934] ext4_inlinedir_to_tree+0x2d8/0xab0 [ 76.464548][ T1934] ? __pfx_ext4_inlinedir_to_tree+0x10/0x10 [ 76.464555][ T1934] ? __page_table_check_zero+0x84/0x290 [ 76.464570][ T1934] ext4_htree_fill_tree+0x3cb/0xef0 [ 76.464580][ T1934] ? __pfx_ext4_htree_fill_tree+0x10/0x10 [ 76.464587][ T1934] ? __pfx_css_rstat_updated+0x10/0x10 [ 76.464596][ T1934] ? inode_query_iversion+0xbe/0x130 [ 76.464603][ T1934] ? __lock_acquire+0x74/0x4c0 [ 76.464611][ T1934] ext4_readdir+0x233a/0x2d10 [ 76.464622][ T1934] ? handle_mm_fault+0x1d0b/0x2310 [ 76.464629][ T1934] ? __pfx_ext4_readdir+0x10/0x10 [ 76.464635][ T1934] ? rwsem_read_trylock+0x18e/0x210 [ 76.464641][ T1934] ? __pfx_rwsem_read_trylock+0x10/0x10 [ 76.464648][ T1934] ? iterate_dir+0xb5/0x4c0 [ 76.464655][ T1934] ? down_read_killable+0x120/0x1a0 [ 76.464662][ T1934] iterate_dir+0x1aa/0x4c0 [ 76.464669][ T1934] __se_sys_getdents64+0xd3/0x1b0 [ 76.464676][ T1934] ? __pfx___se_sys_getdents64+0x10/0x10 [ 76.464682][ T1934] ? exc_page_fault+0x62/0xa0 [ 76.464688][ T1934] ? __pfx_filldir64+0x10/0x10 [ 76.464694][ T1934] ? do_user_addr_fault+0x378/0xc30 [ 76.464704][ T1934] do_syscall_64+0x8f/0x250 [ 76.464712][ T1934] ? fpregs_assert_state_consistent+0x48/0x60 [ 76.464720][ T1934] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.464727][ T1934] RIP: 0033:0x7f8cfe14c013 [ 76.464743][ T1934] Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 52 43 f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8 [ 76.464749][ T1934] RSP: 002b:00007fff665ab1a8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 76.464758][ T1934] RAX: ffffffffffffffda RBX: 0000555564681520 RCX: 00007f8cfe14c013 [ 76.464761][ T1934] RDX: 0000000000008000 RSI: 0000555564681520 RDI: 0000000000000006 [ 76.464764][ T1934] RBP: 00005555646814f4 R08: 0000000000000000 R09: 0000000000000000 [ 76.464767][ T1934] R10: 0000000000001000 R11: 0000000000000293 R12: ffffffffffffffa8 [ 76.464769][ T1934] R13: 0000000000000016 R14: 00005555646814f0 R15: 00007fff665ae540 [ 76.464773][ T1934] [ 76.464775][ T1934] [ 76.768539][ T1934] The buggy address belongs to the physical page: [ 76.774938][ T1934] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x33 pfn:0x128d35 [ 76.784013][ T1934] flags: 0x200000000000000(node=0|zone=2) [ 76.789712][ T1934] raw: 0200000000000000 ffffea0004a34b08 ffffea0004a34d88 0000000000000000 [ 76.798280][ T1934] raw: 0000000000000033 0000000000000000 00000000ffffffff 0000000000000000 [ 76.806830][ T1934] page dumped because: kasan: bad access detected [ 76.813394][ T1934] page_owner tracks the page as freed [ 76.818731][ T1934] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1918, tgid 1918 (modprobe), ts 70330876565, free_ts 70339193561 [ 76.836401][ T1934] post_alloc_hook+0x15a/0x190 [ 76.841149][ T1934] get_page_from_freelist+0x29f0/0x2bb0 [ 76.846835][ T1934] __alloc_frozen_pages_noprof+0x26b/0x460 [ 76.852611][ T1934] alloc_pages_mpol+0xcb/0x270 [ 76.857355][ T1934] vma_alloc_folio_noprof+0x288/0x400 [ 76.862696][ T1934] folio_prealloc+0x24/0xf0 [ 76.867172][ T1934] handle_mm_fault+0xff1/0x2310 [ 76.871989][ T1934] do_user_addr_fault+0x31a/0xc30 [ 76.876982][ T1934] exc_page_fault+0x62/0xa0 [ 76.881458][ T1934] asm_exc_page_fault+0x26/0x30 [ 76.886468][ T1934] page last free pid 1918 tgid 1918 stack trace: [ 76.892769][ T1934] free_unref_folios+0xcdd/0x12b0 [ 76.897765][ T1934] folios_put_refs+0x319/0x400 [ 76.902591][ T1934] free_pages_and_swap_cache+0x35f/0x3c0 [ 76.908203][ T1934] tlb_flush_mmu+0x2ba/0x500 [ 76.912772][ T1934] tlb_finish_mmu+0xaa/0x190 [ 76.917417][ T1934] exit_mmap+0x37a/0x840 [ 76.921630][ T1934] __mmput+0x62/0x290 [ 76.925595][ T1934] exit_mm+0x11b/0x1b0 [ 76.929648][ T1934] do_exit+0x506/0x1d50 [ 76.933771][ T1934] do_group_exit+0x1b1/0x280 [ 76.938331][ T1934] __x64_sys_exit_group+0x3f/0x40 [ 76.943326][ T1934] x64_sys_call+0x21f7/0x2200 [ 76.948007][ T1934] do_syscall_64+0x8f/0x250 [ 76.952498][ T1934] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.958461][ T1934] [ 76.960774][ T1934] Memory state around the buggy address: [ 76.966382][ T1934] ffff888128d35b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.974595][ T1934] ffff888128d35b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.982897][ T1934] >ffff888128d35c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 76.990935][ T1934] ^ [ 76.995431][ T1934] ffff888128d35c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 77.003480][ T1934] ffff888128d35d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 77.011670][ T1934] ================================================================== [ 77.019965][ T1934] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.027696][ T1934] Kernel Offset: disabled [ 77.032008][ T1934] Rebooting in 86400 seconds..