Warning: Permanently added '10.128.10.9' (ED25519) to the list of known hosts. 2026/07/21 15:28:49 parsed 1 programs 2026/07/21 15:28:49 serving rpc on tcp://42645 Setting up swapspace version 1, size = 127995904 bytes [ 49.274428][ T1941] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2026/07/21 15:28:55 executed programs: 0 [ 59.707509][ T2942] syz.3.17[2942]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 59.720145][ T2942] loop3: detected capacity change from 0 to 512 [ 59.730756][ T2942] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 59.744307][ T2942] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 59.756842][ T2942] EXT4-fs (loop3): 1 truncate cleaned up [ 59.762821][ T2942] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.788345][ T2942] ================================================================== [ 59.796438][ T2942] BUG: KASAN: slab-use-after-free in ext4_read_inline_data+0x17f/0x260 [ 59.804872][ T2942] Read of size 68 at addr ffff888112de0c80 by task syz.3.17/2942 [ 59.812788][ T2942] [ 59.815143][ T2942] CPU: 1 PID: 2942 Comm: syz.3.17 Not tainted syzkaller #0 [ 59.822494][ T2942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 59.832623][ T2942] Call Trace: [ 59.835894][ T2942] [ 59.838830][ T2942] dump_stack_lvl+0x12a/0x1b0 [ 59.843682][ T2942] ? __lock_acquire+0xba0/0xba0 [ 59.848535][ T2942] ? show_regs_print_info+0x10/0x10 [ 59.853928][ T2942] ? load_image+0x5a0/0x5a0 [ 59.858448][ T2942] ? __virt_addr_valid+0x137/0x270 [ 59.863563][ T2942] ? __virt_addr_valid+0x137/0x270 [ 59.868760][ T2942] ? __virt_addr_valid+0x137/0x270 [ 59.874123][ T2942] print_report+0xa8/0x210 [ 59.878708][ T2942] ? ext4_read_inline_data+0x17f/0x260 [ 59.884426][ T2942] kasan_report+0x117/0x150 [ 59.889099][ T2942] ? ext4_read_inline_data+0x17f/0x260 [ 59.894830][ T2942] kasan_check_range+0x241/0x290 [ 59.900281][ T2942] ? ext4_read_inline_data+0x17f/0x260 [ 59.906336][ T2942] __asan_memcpy+0x29/0x70 [ 59.910897][ T2942] ext4_read_inline_data+0x17f/0x260 [ 59.916166][ T2942] ext4_convert_inline_data_nolock+0x11f/0x630 [ 59.922406][ T2942] ? ext4_add_dirent_to_inline+0x310/0x310 [ 59.928286][ T2942] ext4_try_add_inline_entry+0x5bb/0x950 [ 59.933912][ T2942] ? write_boundary_block+0x70/0x70 [ 59.939286][ T2942] ? ext4_get_group_desc+0xd3/0x2b0 [ 59.945198][ T2942] ? ext4_da_write_inline_data_begin+0xbf0/0xbf0 [ 59.951565][ T2942] ? __lock_acquire+0x5cd/0xba0 [ 59.957904][ T2942] ext4_add_entry+0x34a/0x2940 [ 59.963699][ T2942] ? mark_buffer_dirty+0x95/0x2d0 [ 59.968879][ T2942] ? ext4_mark_iloc_dirty+0x558/0x1640 [ 59.974532][ T2942] ? __lock_acquire+0xac1/0xba0 [ 59.979465][ T2942] ? __ext4_journal_get_create_access+0x3e0/0x3e0 [ 59.985963][ T2942] ? do_raw_spin_unlock+0x121/0x230 [ 59.991420][ T2942] ? ext4_inc_count+0x140/0x140 [ 59.996376][ T2942] ? ext4_mark_iloc_dirty+0x101c/0x1640 [ 60.001990][ T2942] ? ext4_mark_iloc_dirty+0x558/0x1640 [ 60.007620][ T2942] ? __ext4_mark_inode_dirty+0x34a/0x4d0 [ 60.013424][ T2942] ext4_mkdir+0x3fe/0x8d0 [ 60.017932][ T2942] ? ext4_symlink+0x730/0x730 [ 60.022601][ T2942] ? HAS_UNMAPPED_ID+0xd0/0x130 [ 60.027583][ T2942] ? inode_permission+0x50/0x350 [ 60.033847][ T2942] vfs_mkdir+0x210/0x380 [ 60.038267][ T2942] do_mkdirat+0x19a/0x3b0 [ 60.042837][ T2942] ? vfs_mkdir+0x380/0x380 [ 60.047412][ T2942] ? getname_flags+0x115/0x440 [ 60.052156][ T2942] __x64_sys_mkdirat+0x84/0x90 [ 60.057257][ T2942] do_syscall_64+0x55/0xb0 [ 60.061652][ T2942] ? clear_bhb_loop+0x40/0x90 [ 60.066307][ T2942] ? clear_bhb_loop+0x40/0x90 [ 60.071077][ T2942] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 60.077204][ T2942] RIP: 0033:0x7f300b78bcc7 [ 60.081592][ T2942] Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 60.102108][ T2942] RSP: 002b:00007f300b5eee58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 60.110513][ T2942] RAX: ffffffffffffffda RBX: 00007f300b5eeee0 RCX: 00007f300b78bcc7 [ 60.118558][ T2942] RDX: 00000000000001ff RSI: 0000200000000080 RDI: 00000000ffffff9c [ 60.126948][ T2942] RBP: 0000200000000140 R08: 0000200000000080 R09: 0000000000000000 [ 60.134895][ T2942] R10: 0000200000000140 R11: 0000000000000246 R12: 0000200000000080 [ 60.142942][ T2942] R13: 00007f300b5eeea0 R14: 0000000000000000 R15: 0000000000000000 [ 60.150992][ T2942] [ 60.154102][ T2942] [ 60.156760][ T2942] Allocated by task 2606: [ 60.161326][ T2942] kasan_set_track+0x4e/0x70 [ 60.166073][ T2942] __kasan_kmalloc+0x8f/0xa0 [ 60.170859][ T2942] __kmalloc+0xa7/0x1c0 [ 60.175508][ T2942] tomoyo_realpath_from_path+0xf3/0x550 [ 60.181406][ T2942] tomoyo_condition+0x166f/0x2600 [ 60.186603][ T2942] tomoyo_check_acl+0x14f/0x360 [ 60.191433][ T2942] tomoyo_execute_permission+0x11b/0x3a0 [ 60.197127][ T2942] tomoyo_find_next_domain+0x2f7/0x1970 [ 60.202670][ T2942] tomoyo_bprm_check_security+0xfe/0x130 [ 60.208286][ T2942] security_bprm_check+0x27/0x70 [ 60.213288][ T2942] bprm_execve+0x717/0x1160 [ 60.217851][ T2942] kernel_execve+0x50b/0x610 [ 60.222434][ T2942] call_usermodehelper_exec_async+0x1d8/0x2e0 [ 60.228844][ T2942] ret_from_fork+0x2f/0x60 [ 60.233251][ T2942] ret_from_fork_asm+0x11/0x20 [ 60.238297][ T2942] [ 60.240793][ T2942] Freed by task 2606: [ 60.244845][ T2942] kasan_set_track+0x4e/0x70 [ 60.249513][ T2942] kasan_save_free_info+0x28/0x40 [ 60.254683][ T2942] ____kasan_slab_free+0x126/0x1f0 [ 60.259875][ T2942] slab_free_freelist_hook+0x130/0x1a0 [ 60.265496][ T2942] __kmem_cache_free+0xba/0x1f0 [ 60.270494][ T2942] tomoyo_realpath_from_path+0x51e/0x550 [ 60.276288][ T2942] tomoyo_condition+0x166f/0x2600 [ 60.281895][ T2942] tomoyo_check_acl+0x14f/0x360 [ 60.286766][ T2942] tomoyo_execute_permission+0x11b/0x3a0 [ 60.292479][ T2942] tomoyo_find_next_domain+0x2f7/0x1970 [ 60.298032][ T2942] tomoyo_bprm_check_security+0xfe/0x130 [ 60.303852][ T2942] security_bprm_check+0x27/0x70 [ 60.308763][ T2942] bprm_execve+0x717/0x1160 [ 60.313505][ T2942] kernel_execve+0x50b/0x610 [ 60.318065][ T2942] call_usermodehelper_exec_async+0x1d8/0x2e0 [ 60.324258][ T2942] ret_from_fork+0x2f/0x60 [ 60.328932][ T2942] ret_from_fork_asm+0x11/0x20 [ 60.333772][ T2942] [ 60.336084][ T2942] The buggy address belongs to the object at ffff888112de0000 [ 60.336084][ T2942] which belongs to the cache kmalloc-4k of size 4096 [ 60.350111][ T2942] The buggy address is located 3200 bytes inside of [ 60.350111][ T2942] freed 4096-byte region [ffff888112de0000, ffff888112de1000) [ 60.364415][ T2942] [ 60.366804][ T2942] The buggy address belongs to the physical page: [ 60.373581][ T2942] page:ffffea00044b7800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112de0 [ 60.383804][ T2942] head:ffffea00044b7800 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 60.392717][ T2942] flags: 0x200000000000840(slab|head|node=0|zone=2) [ 60.399297][ T2942] page_type: 0xffffffff() [ 60.403669][ T2942] raw: 0200000000000840 ffff888100042140 ffffea00044d2e00 dead000000000002 [ 60.412436][ T2942] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 60.421189][ T2942] page dumped because: kasan: bad access detected [ 60.427954][ T2942] page_owner tracks the page as allocated [ 60.433746][ T2942] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 895, tgid 895 (modprobe), ts 27763269849, free_ts 20500985805 [ 60.454296][ T2942] post_alloc_hook+0x24d/0x290 [ 60.459130][ T2942] get_page_from_freelist+0x2120/0x2290 [ 60.464648][ T2942] __alloc_pages+0x1f0/0x430 [ 60.469329][ T2942] alloc_slab_page+0x5d/0x180 [ 60.473991][ T2942] new_slab+0x70/0x250 [ 60.478064][ T2942] ___slab_alloc+0xa32/0xee0 [ 60.482812][ T2942] __kmem_cache_alloc_node+0x118/0x230 [ 60.488248][ T2942] __kmalloc+0x97/0x1c0 [ 60.492377][ T2942] tomoyo_realpath_from_path+0xf3/0x550 [ 60.498054][ T2942] tomoyo_path_perm+0x243/0x520 [ 60.502898][ T2942] security_inode_getattr+0x7f/0xf0 [ 60.508092][ T2942] __se_sys_newfstat+0x10f/0x400 [ 60.513016][ T2942] do_syscall_64+0x55/0xb0 [ 60.517497][ T2942] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 60.523460][ T2942] page last free stack trace: [ 60.528149][ T2942] free_unref_page_prepare+0x79d/0x8f0 [ 60.533603][ T2942] free_unref_page+0x32/0x230 [ 60.538267][ T2942] __unfreeze_partials+0x1a4/0x1e0 [ 60.543367][ T2942] put_cpu_partial+0x14c/0x1b0 [ 60.548133][ T2942] __slab_free+0x293/0x370 [ 60.552532][ T2942] qlist_free_all+0x75/0xd0 [ 60.557114][ T2942] kasan_quarantine_reduce+0x143/0x160 [ 60.562646][ T2942] __kasan_slab_alloc+0x22/0x80 [ 60.567472][ T2942] slab_post_alloc_hook+0x66/0x430 [ 60.572933][ T2942] kmem_cache_alloc+0x174/0x280 [ 60.577790][ T2942] alloc_buffer_head+0x23/0x1f0 [ 60.583053][ T2942] folio_alloc_buffers+0x2a1/0x690 [ 60.588134][ T2942] folio_create_empty_buffers+0x2c/0x530 [ 60.593790][ T2942] __block_write_begin_int+0x197/0x1200 [ 60.599571][ T2942] ext4_da_write_begin+0x44e/0x720 [ 60.604916][ T2942] generic_perform_write+0x2dc/0x510 [ 60.610357][ T2942] [ 60.612656][ T2942] Memory state around the buggy address: [ 60.618340][ T2942] ffff888112de0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.626633][ T2942] ffff888112de0c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.634948][ T2942] >ffff888112de0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.643785][ T2942] ^ [ 60.647858][ T2942] ffff888112de0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.655905][ T2942] ffff888112de0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.664236][ T2942] ================================================================== [ 60.672533][ T2942] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 60.680253][ T2942] Kernel Offset: disabled [ 60.684772][ T2942] Rebooting in 86400 seconds..