Warning: Permanently added '10.128.1.189' (ED25519) to the list of known hosts. 2024/07/30 01:28:31 ignoring optional flag "sandboxArg"="0" 2024/07/30 01:28:31 parsed 1 programs 2024/07/30 01:28:33 executed programs: 0 [ 60.128057][ T2598] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 61.662014][ T2603] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 61.671878][ T2603] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 61.685193][ T2603] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 61.695014][ T2603] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.893097][ T1233] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.901122][ T1233] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.914990][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.922855][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2024/07/30 01:28:41 executed programs: 1 [ 67.995963][ T3325] jffs2: notice: (3325) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 68.032374][ T3328] jffs2: notice: (3328) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 68.065681][ T3331] jffs2: notice: (3331) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 68.082126][ T3326] ================================================================== [ 68.082143][ T3326] BUG: KASAN: slab-use-after-free in __mutex_lock+0x11b/0x1990 [ 68.082170][ T3326] Read of size 8 at addr ffff88812560a130 by task jffs2_gcd_mtd0/3326 [ 68.082185][ T3326] [ 68.082203][ T3326] CPU: 0 UID: 0 PID: 3326 Comm: jffs2_gcd_mtd0 Not tainted 6.11.0-rc1-syzkaller #0 [ 68.082223][ T3326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 68.082236][ T3326] Call Trace: [ 68.082243][ T3326] [ 68.082250][ T3326] dump_stack_lvl+0x231/0x330 [ 68.082272][ T3326] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.082291][ T3326] ? __pfx__printk+0x10/0x10 [ 68.082310][ T3326] ? lock_acquire+0xc2/0x3a0 [ 68.082326][ T3326] ? __pfx_lock_acquire+0x10/0x10 [ 68.158266][ T3326] ? _printk+0xd5/0x120 [ 68.162429][ T3326] ? __virt_addr_valid+0x169/0x380 [ 68.167622][ T3326] print_report+0x169/0x550 [ 68.172107][ T3326] ? __virt_addr_valid+0x169/0x380 [ 68.177217][ T3326] ? __virt_addr_valid+0x2c1/0x380 [ 68.182340][ T3326] ? __phys_addr+0x90/0x130 [ 68.186827][ T3326] ? __mutex_lock+0x11b/0x1990 [ 68.191661][ T3326] kasan_report+0x143/0x180 [ 68.196146][ T3326] ? __mutex_lock+0x11b/0x1990 [ 68.200889][ T3326] ? jffs2_garbage_collect_pass+0xae/0x2080 [ 68.206764][ T3326] __mutex_lock+0x11b/0x1990 [ 68.211506][ T3326] ? __lock_acquire+0x61d/0xc60 [ 68.216333][ T3326] ? __pfx___mutex_lock+0x10/0x10 [ 68.221333][ T3326] ? __lock_acquire+0x61d/0xc60 [ 68.226161][ T3326] ? __set_current_blocked+0x310/0x380 [ 68.231690][ T3326] jffs2_garbage_collect_pass+0xae/0x2080 [ 68.237477][ T3326] ? _raw_spin_unlock_irq+0x29/0x50 [ 68.242652][ T3326] ? __set_current_blocked+0x310/0x380 [ 68.248091][ T3326] ? __pfx___set_current_blocked+0x10/0x10 [ 68.253966][ T3326] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10 [ 68.260194][ T3326] ? schedule_timeout+0x21a/0x2e0 [ 68.265200][ T3326] ? sigprocmask+0x228/0x280 [ 68.269771][ T3326] ? __pfx_sigprocmask+0x10/0x10 [ 68.274712][ T3326] ? do_raw_spin_unlock+0x13c/0x8b0 [ 68.279985][ T3326] jffs2_garbage_collect_thread+0x5c0/0x650 [ 68.285878][ T3326] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 68.292298][ T3326] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 68.298264][ T3326] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 68.304577][ T3326] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 68.310458][ T3326] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 68.316941][ T3326] ? __kthread_parkme+0x126/0x170 [ 68.321948][ T3326] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 68.328348][ T3326] kthread+0x290/0x300 [ 68.332481][ T3326] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 68.338876][ T3326] ? __pfx_kthread+0x10/0x10 [ 68.343441][ T3326] ret_from_fork+0x4b/0x80 [ 68.348389][ T3326] ? __pfx_kthread+0x10/0x10 [ 68.353076][ T3326] ret_from_fork_asm+0x1a/0x30 [ 68.357853][ T3326] [ 68.360887][ T3326] [ 68.363191][ T3326] Allocated by task 3325: [ 68.367584][ T3326] kasan_save_track+0x3f/0x80 [ 68.372243][ T3326] __kasan_kmalloc+0x98/0xb0 [ 68.376813][ T3326] __kmalloc_cache_noprof+0x19e/0x360 [ 68.382163][ T3326] jffs2_init_fs_context+0x4f/0xc0 [ 68.387440][ T3326] alloc_fs_context+0x685/0x800 [ 68.392269][ T3326] do_new_mount+0x160/0xb40 [ 68.396753][ T3326] __se_sys_mount+0x2c5/0x3b0 [ 68.401415][ T3326] do_syscall_64+0x8d/0x190 [ 68.405910][ T3326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.411877][ T3326] [ 68.414177][ T3326] Freed by task 2603: [ 68.418166][ T3326] kasan_save_track+0x3f/0x80 [ 68.423186][ T3326] kasan_save_free_info+0x40/0x50 [ 68.428464][ T3326] poison_slab_object+0xe0/0x150 [ 68.433378][ T3326] __kasan_slab_free+0x37/0x60 [ 68.438123][ T3326] kfree+0x12f/0x310 [ 68.442010][ T3326] deactivate_locked_super+0xca/0x450 [ 68.447379][ T3326] cleanup_mnt+0x352/0x3e0 [ 68.451774][ T3326] task_work_run+0x24f/0x300 [ 68.456338][ T3326] syscall_exit_to_user_mode+0xc5/0x200 [ 68.461863][ T3326] do_syscall_64+0x9a/0x190 [ 68.466347][ T3326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.472216][ T3326] [ 68.474516][ T3326] The buggy address belongs to the object at ffff88812560a000 [ 68.474516][ T3326] which belongs to the cache kmalloc-4k of size 4096 [ 68.488650][ T3326] The buggy address is located 304 bytes inside of [ 68.488650][ T3326] freed 4096-byte region [ffff88812560a000, ffff88812560b000) [ 68.502514][ T3326] [ 68.504818][ T3326] The buggy address belongs to the physical page: [ 68.511215][ T3326] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x125608 [ 68.520042][ T3326] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 68.528520][ T3326] flags: 0x200000000000040(head|node=0|zone=2) [ 68.534647][ T3326] page_type: 0xfdffffff(slab) [ 68.539323][ T3326] raw: 0200000000000040 ffff888100042140 ffffea00040ac400 dead000000000002 [ 68.547882][ T3326] raw: 0000000000000000 0000000000040004 00000001fdffffff 0000000000000000 [ 68.556436][ T3326] head: 0200000000000040 ffff888100042140 ffffea00040ac400 dead000000000002 [ 68.565087][ T3326] head: 0000000000000000 0000000000040004 00000001fdffffff 0000000000000000 [ 68.573734][ T3326] head: 0200000000000003 ffffea0004958201 ffffffffffffffff 0000000000000000 [ 68.582379][ T3326] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 68.591093][ T3326] page dumped because: kasan: bad access detected [ 68.597484][ T3326] page_owner tracks the page as allocated [ 68.603167][ T3326] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2865, tgid 2865 (modprobe), ts 63205122446, free_ts 63004620837 [ 68.624763][ T3326] post_alloc_hook+0x10f/0x130 [ 68.629512][ T3326] get_page_from_freelist+0x37f4/0x3920 [ 68.635038][ T3326] __alloc_pages_noprof+0x256/0x670 [ 68.640216][ T3326] alloc_slab_page+0x5f/0x120 [ 68.644870][ T3326] allocate_slab+0x5d/0x290 [ 68.649351][ T3326] ___slab_alloc+0xa7f/0x11d0 [ 68.654001][ T3326] __kmalloc_noprof+0x25a/0x440 [ 68.658827][ T3326] tomoyo_realpath_from_path+0xcf/0x5e0 [ 68.664359][ T3326] tomoyo_path_perm+0x29f/0x970 [ 68.669210][ T3326] security_inode_getattr+0xd8/0x130 [ 68.674471][ T3326] vfs_fstat+0x4c/0xb40 [ 68.678603][ T3326] __se_sys_newfstatat+0xd1/0x760 [ 68.683602][ T3326] do_syscall_64+0x8d/0x190 [ 68.688080][ T3326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.693950][ T3326] page last free pid 2845 tgid 2845 stack trace: [ 68.700249][ T3326] free_unref_page+0xbae/0xcf0 [ 68.704991][ T3326] __put_partials+0x18e/0x1d0 [ 68.709816][ T3326] put_cpu_partial+0x151/0x1b0 [ 68.714556][ T3326] __slab_free+0x2b8/0x3a0 [ 68.718957][ T3326] qlist_free_all+0x9e/0x140 [ 68.723525][ T3326] kasan_quarantine_reduce+0x14f/0x170 [ 68.728968][ T3326] __kasan_slab_alloc+0x23/0x80 [ 68.733795][ T3326] __kmalloc_noprof+0x182/0x440 [ 68.738623][ T3326] load_elf_binary+0x2ee/0x2680 [ 68.743450][ T3326] bprm_execve+0x769/0x1590 [ 68.747933][ T3326] kernel_execve+0x6c9/0x7e0 [ 68.752500][ T3326] call_usermodehelper_exec_async+0x232/0x380 [ 68.758548][ T3326] ret_from_fork+0x4b/0x80 [ 68.762940][ T3326] ret_from_fork_asm+0x1a/0x30 [ 68.767687][ T3326] [ 68.769989][ T3326] Memory state around the buggy address: [ 68.775591][ T3326] ffff88812560a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.783627][ T3326] ffff88812560a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.791662][ T3326] >ffff88812560a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.799702][ T3326] ^ [ 68.805317][ T3326] ffff88812560a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.813351][ T3326] ffff88812560a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.821384][ T3326] ================================================================== [ 68.830151][ T3326] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 68.837626][ T3326] Kernel Offset: disabled [ 68.841999][ T3326] Rebooting in 86400 seconds..