Warning: Permanently added '10.128.10.53' (ED25519) to the list of known hosts. 2024/05/16 00:46:27 ignoring optional flag "sandboxArg"="0" 2024/05/16 00:46:27 parsed 1 programs [ 45.408828][ T29] kauditd_printk_skb: 78 callbacks suppressed [ 45.408838][ T29] audit: type=1400 audit(1715820387.676:154): avc: denied { mounton } for pid=342 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 2024/05/16 00:46:27 executed programs: 0 [ 45.439661][ T29] audit: type=1400 audit(1715820387.676:155): avc: denied { mount } for pid=342 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 45.463055][ T29] audit: type=1400 audit(1715820387.676:156): avc: denied { setattr } for pid=342 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 45.481646][ T342] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.486366][ T29] audit: type=1400 audit(1715820387.676:157): avc: denied { read write } for pid=342 comm="syz-executor" name="swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.521264][ T29] audit: type=1400 audit(1715820387.676:158): avc: denied { open } for pid=342 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.547553][ T29] audit: type=1400 audit(1715820387.706:159): avc: denied { unlink } for pid=342 comm="syz-executor" name="swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.573865][ T29] audit: type=1400 audit(1715820387.706:160): avc: denied { relabelto } for pid=343 comm="mkswap" name="swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.609332][ T347] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.616620][ T347] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.623944][ T347] device bridge_slave_0 entered promiscuous mode [ 45.630907][ T347] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.638084][ T347] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.645269][ T347] device bridge_slave_1 entered promiscuous mode [ 45.685590][ T347] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.692552][ T347] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.699780][ T347] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.706544][ T347] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.724521][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.731795][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.739294][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.746764][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.763352][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.771458][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.778609][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.785790][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.794568][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.801602][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.808941][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.816981][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.826649][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 45.836781][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 45.844660][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 45.851861][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 45.860204][ T347] device veth0_vlan entered promiscuous mode [ 45.869729][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.878668][ T347] device veth1_macvtap entered promiscuous mode [ 45.887195][ T298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.896715][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.918104][ T352] loop0: detected capacity change from 0 to 512 [ 45.925109][ T29] audit: type=1400 audit(1715820388.196:161): avc: denied { mounton } for pid=351 comm="syz-executor.0" path="/root/syzkaller-testdir1564446766/syzkaller.tsWUUs/0/file1" dev="sda1" ino=1939 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 45.964995][ T352] EXT4-fs (loop0): 1 orphan inode deleted [ 45.970637][ T352] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 45.981768][ T29] audit: type=1400 audit(1715820388.246:162): avc: denied { mount } for pid=351 comm="syz-executor.0" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 45.981857][ T352] ext4 filesystem being mounted at /root/syzkaller-testdir1564446766/syzkaller.tsWUUs/0/file1 supports timestamps until 2038 (0x7fffffff) [ 46.023297][ T29] audit: type=1400 audit(1715820388.286:163): avc: denied { write } for pid=351 comm="syz-executor.0" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 46.028323][ T351] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:475: comm syz-executor.0: Invalid block bitmap block 0 in block_group 0 [ 46.059479][ T351] EXT4-fs error (device loop0): ext4_discard_preallocations:5100: comm syz-executor.0: Error -117 reading block bitmap for 0 [ 46.075628][ T112] ================================================================== [ 46.083763][ T112] BUG: KASAN: use-after-free in ext4_find_extent+0xb6a/0xc30 [ 46.091319][ T112] Read of size 4 at addr ffff888124126078 by task kworker/u4:2/112 [ 46.099119][ T112] [ 46.101299][ T112] CPU: 0 PID: 112 Comm: kworker/u4:2 Not tainted 5.15.149-syzkaller #0 [ 46.109365][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 46.119558][ T112] Workqueue: writeback wb_workfn (flush-7:0) [ 46.125443][ T112] Call Trace: [ 46.128646][ T112] [ 46.131810][ T112] dump_stack_lvl+0x38/0x49 [ 46.136147][ T112] print_address_description.constprop.0+0x24/0x160 [ 46.142735][ T112] ? ext4_find_extent+0xb6a/0xc30 [ 46.147694][ T112] kasan_report.cold+0x82/0xdb [ 46.152297][ T112] ? ext4_find_extent+0xb6a/0xc30 [ 46.157152][ T112] __asan_report_load4_noabort+0x14/0x20 [ 46.162717][ T112] ext4_find_extent+0xb6a/0xc30 [ 46.167481][ T112] ? create_prof_cpu_mask+0x20/0x20 [ 46.172604][ T112] ext4_ext_map_blocks+0x18f/0x5100 [ 46.177991][ T112] ? _raw_spin_lock_irqsave+0x8c/0x120 [ 46.183382][ T112] ? _raw_write_lock_irqsave+0xe0/0xe0 [ 46.188681][ T112] ? stack_trace_save+0x8f/0xc0 [ 46.193352][ T112] ? _raw_spin_unlock_irqrestore+0x4d/0x80 [ 46.199077][ T112] ? ext4_ext_release+0x10/0x10 [ 46.203771][ T112] ? kasan_save_stack+0x26/0x50 [ 46.208458][ T112] ? kmem_cache_alloc+0x197/0x480 [ 46.213310][ T112] ? ext4_alloc_io_end_vec+0x25/0x1c0 [ 46.218954][ T112] ? ext4_writepages+0x11fd/0x2a80 [ 46.224071][ T112] ? do_writepages+0x18c/0x770 [ 46.228703][ T112] ? __writeback_single_inode+0x6e/0x730 [ 46.234150][ T112] ? writeback_sb_inodes+0x4ab/0xe80 [ 46.239345][ T112] ? wb_writeback+0x20c/0x6b0 [ 46.243872][ T112] ? wb_workfn+0x247/0xe20 [ 46.248123][ T112] ? process_one_work+0x62c/0xec0 [ 46.253145][ T112] ? worker_thread+0x48e/0xdb0 [ 46.257752][ T112] ? kthread+0x324/0x3e0 [ 46.261920][ T112] ? ret_from_fork+0x1f/0x30 [ 46.266342][ T112] ? __kasan_init_slab_obj+0x25/0x30 [ 46.271460][ T112] ? setup_object.isra.0+0x1f/0xd0 [ 46.276406][ T112] ? down_write+0x11f/0x2a0 [ 46.280746][ T112] ? down_write_killable+0x2c0/0x2c0 [ 46.285953][ T112] ? _raw_read_unlock+0x25/0x50 [ 46.290642][ T112] ? ext4_es_lookup_extent+0x3a4/0x9b0 [ 46.296110][ T112] ext4_map_blocks+0x593/0x1450 [ 46.300893][ T112] ? mpage_process_page_bufs+0x5c0/0x5c0 [ 46.306367][ T112] ? ext4_release_io_end+0x22c/0x330 [ 46.311574][ T112] ? ext4_issue_zeroout+0x1d0/0x1d0 [ 46.316606][ T112] ? __kasan_slab_alloc+0x94/0xc0 [ 46.321664][ T112] ? ext4_alloc_io_end_vec+0x25/0x1c0 [ 46.327028][ T112] ? ext4_alloc_io_end_vec+0xae/0x1c0 [ 46.332422][ T112] ext4_writepages+0x135a/0x2a80 [ 46.337290][ T112] ? __kasan_check_read+0x11/0x20 [ 46.342216][ T112] ? __ext4_mark_inode_dirty+0x660/0x660 [ 46.347930][ T112] ? copy_page_from_iter_atomic+0x593/0x1080 [ 46.353996][ T112] ? __kasan_check_write+0x14/0x20 [ 46.359097][ T112] ? shmem_write_end+0x116/0x390 [ 46.363873][ T112] ? current_time+0x6e/0x1f0 [ 46.368418][ T112] ? generic_perform_write+0x30d/0x4c0 [ 46.373858][ T112] ? trace_event_raw_event_file_check_and_advance_wb_err+0x4d0/0x4d0 [ 46.381999][ T112] do_writepages+0x18c/0x770 [ 46.386416][ T112] ? writeback_set_ratelimit+0x130/0x130 [ 46.391980][ T112] ? __update_load_avg_cfs_rq+0xb8/0x390 [ 46.397444][ T112] ? __kasan_check_write+0x14/0x20 [ 46.402388][ T112] ? _raw_spin_lock+0x86/0x110 [ 46.406986][ T112] __writeback_single_inode+0x6e/0x730 [ 46.412368][ T112] ? redirty_tail_locked+0xe9/0x1b0 [ 46.417412][ T112] writeback_sb_inodes+0x4ab/0xe80 [ 46.422437][ T112] ? sync_inode_metadata+0xc0/0xc0 [ 46.427388][ T112] ? wb_io_lists_populated+0x1b/0xd0 [ 46.432876][ T112] ? queue_io+0x284/0x350 [ 46.437037][ T112] wb_writeback+0x20c/0x6b0 [ 46.441360][ T112] ? __writeback_inodes_wb+0x200/0x200 [ 46.446682][ T112] ? _raw_read_lock_irq+0x50/0x50 [ 46.451687][ T112] ? wait_for_completion_interruptible+0x300/0x300 [ 46.458370][ T112] wb_workfn+0x247/0xe20 [ 46.462451][ T112] ? inode_wait_for_writeback+0x30/0x30 [ 46.467918][ T112] ? __kasan_slab_free+0x11c/0x150 [ 46.473209][ T112] ? slab_free_freelist_hook+0x94/0x1a0 [ 46.478677][ T112] ? __kasan_check_write+0x14/0x20 [ 46.483777][ T112] ? __kasan_check_read+0x11/0x20 [ 46.488774][ T112] ? read_word_at_a_time+0x12/0x20 [ 46.493714][ T112] ? strscpy+0x94/0x280 [ 46.497795][ T112] process_one_work+0x62c/0xec0 [ 46.502490][ T112] ? mutex_unlock+0x7e/0x240 [ 46.507278][ T112] worker_thread+0x48e/0xdb0 [ 46.511711][ T112] ? rescuer_thread+0xc30/0xc30 [ 46.516386][ T112] kthread+0x324/0x3e0 [ 46.520293][ T112] ? set_kthread_struct+0x100/0x100 [ 46.525330][ T112] ret_from_fork+0x1f/0x30 [ 46.529694][ T112] [ 46.532557][ T112] [ 46.534724][ T112] The buggy address belongs to the page: [ 46.540375][ T112] page:ffffea0004904980 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x124126 [ 46.550747][ T112] flags: 0x4000000000000000(zone=1) [ 46.555934][ T112] raw: 4000000000000000 ffffea00049049c8 ffffea0004904948 0000000000000000 [ 46.564442][ T112] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 46.572854][ T112] page dumped because: kasan: bad access detected [ 46.579199][ T112] page_owner info is not present (never set?) [ 46.585387][ T112] [ 46.587521][ T112] Memory state around the buggy address: [ 46.593232][ T112] ffff888124125f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.601068][ T112] ffff888124125f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.609047][ T112] >ffff888124126000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.616955][ T112] ^ [ 46.624765][ T112] ffff888124126080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.632925][ T112] ffff888124126100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.641769][ T112] ================================================================== [ 46.649843][ T112] Disabling lock debugging due to kernel taint [ 46.658393][ T112] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 46.664447][ T112] CPU: 1 PID: 112 Comm: kworker/u4:2 Tainted: G B 5.15.149-syzkaller #0 [ 46.673900][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 46.683803][ T112] Workqueue: writeback wb_workfn (flush-7:0) [ 46.689871][ T112] RIP: 0010:ext4_writepages+0x1f2f/0x2a80 [ 46.695432][ T112] Code: ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 ca ee ff ff 48 8b bd f0 fd ff ff e8 66 b9 d0 ff e9 b9 ee ff ff <0f> 0b 8b 85 1c fd ff ff 31 db 89 85 c8 fd ff ff e9 70 fb ff ff 89 [ 46.715391][ T112] RSP: 0018:ffffc90000557448 EFLAGS: 00010246 [ 46.721281][ T112] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff0b2049c [ 46.729301][ T112] RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001 [ 46.737382][ T112] RBP: ffffc90000557798 R08: 0000000000000001 R09: ffff88812159ea4f [ 46.745283][ T112] R10: ffffed10242b3d49 R11: 0000000000000000 R12: ffff88812159ea88 [ 46.753177][ T112] R13: dffffc0000000000 R14: ffffc90000557770 R15: ffff88812159eab0 [ 46.761078][ T112] FS: 0000000000000000(0000) GS:ffff8881f7500000(0000) knlGS:0000000000000000 [ 46.770270][ T112] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.776701][ T112] CR2: 000055555748b818 CR3: 000000000500f000 CR4: 00000000003506a0 [ 46.784590][ T112] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 46.792572][ T112] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 46.800470][ T112] Call Trace: [ 46.803618][ T112] [ 46.806377][ T112] ? show_regs.part.0+0x1e/0x20 [ 46.811060][ T112] ? __die+0x5d/0x9e [ 46.814790][ T112] ? die+0x2b/0x50 [ 46.818348][ T112] ? do_trap+0x1a8/0x280 [ 46.822696][ T112] ? do_error_trap+0x8a/0xe0 [ 46.827200][ T112] ? ext4_writepages+0x1f2f/0x2a80 [ 46.832324][ T112] ? handle_invalid_op+0x31/0x40 [ 46.837098][ T112] ? ext4_writepages+0x1f2f/0x2a80 [ 46.842392][ T112] ? exc_invalid_op+0x30/0x50 [ 46.846915][ T112] ? asm_exc_invalid_op+0x1b/0x20 [ 46.851858][ T112] ? ext4_writepages+0x1f2f/0x2a80 [ 46.856976][ T112] ? ext4_writepages+0x135a/0x2a80 [ 46.861937][ T112] ? __kasan_check_read+0x11/0x20 [ 46.866875][ T112] ? __ext4_mark_inode_dirty+0x660/0x660 [ 46.872770][ T112] ? copy_page_from_iter_atomic+0x593/0x1080 [ 46.878959][ T112] ? __kasan_check_write+0x14/0x20 [ 46.884019][ T112] ? shmem_write_end+0x116/0x390 [ 46.888786][ T112] ? current_time+0x6e/0x1f0 [ 46.893215][ T112] ? generic_perform_write+0x30d/0x4c0 [ 46.898785][ T112] ? trace_event_raw_event_file_check_and_advance_wb_err+0x4d0/0x4d0 [ 46.906937][ T112] do_writepages+0x18c/0x770 [ 46.911364][ T112] ? writeback_set_ratelimit+0x130/0x130 [ 46.917016][ T112] ? __update_load_avg_cfs_rq+0xb8/0x390 [ 46.922560][ T112] ? __kasan_check_write+0x14/0x20 [ 46.927702][ T112] ? _raw_spin_lock+0x86/0x110 [ 46.932302][ T112] __writeback_single_inode+0x6e/0x730 [ 46.937598][ T112] ? redirty_tail_locked+0xe9/0x1b0 [ 46.942631][ T112] writeback_sb_inodes+0x4ab/0xe80 [ 46.947942][ T112] ? sync_inode_metadata+0xc0/0xc0 [ 46.953480][ T112] ? wb_io_lists_populated+0x1b/0xd0 [ 46.958663][ T112] ? queue_io+0x284/0x350 [ 46.962776][ T112] wb_writeback+0x20c/0x6b0 [ 46.967464][ T112] ? __writeback_inodes_wb+0x200/0x200 [ 46.973017][ T112] ? _raw_read_lock_irq+0x50/0x50 [ 46.977867][ T112] ? wait_for_completion_interruptible+0x300/0x300 [ 46.984297][ T112] wb_workfn+0x247/0xe20 [ 46.988390][ T112] ? inode_wait_for_writeback+0x30/0x30 [ 46.993750][ T112] ? __kasan_slab_free+0x11c/0x150 [ 46.998706][ T112] ? slab_free_freelist_hook+0x94/0x1a0 [ 47.004085][ T112] ? __kasan_check_write+0x14/0x20 [ 47.009727][ T112] ? __kasan_check_read+0x11/0x20 [ 47.014934][ T112] ? read_word_at_a_time+0x12/0x20 [ 47.020190][ T112] ? strscpy+0x94/0x280 [ 47.024150][ T112] process_one_work+0x62c/0xec0 [ 47.028821][ T112] ? mutex_unlock+0x7e/0x240 [ 47.033330][ T112] worker_thread+0x48e/0xdb0 [ 47.037843][ T112] ? rescuer_thread+0xc30/0xc30 [ 47.042616][ T112] kthread+0x324/0x3e0 [ 47.046526][ T112] ? set_kthread_struct+0x100/0x100 [ 47.051555][ T112] ret_from_fork+0x1f/0x30 [ 47.055898][ T112] [ 47.058857][ T112] Modules linked in: [ 47.065513][ T112] ---[ end trace 9f1802ae8f79009a ]--- [ 47.070897][ T112] RIP: 0010:ext4_writepages+0x1f2f/0x2a80 [ 47.076613][ T112] Code: ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 ca ee ff ff 48 8b bd f0 fd ff ff e8 66 b9 d0 ff e9 b9 ee ff ff <0f> 0b 8b 85 1c fd ff ff 31 db 89 85 c8 fd ff ff e9 70 fb ff ff 89 [ 47.096702][ T112] RSP: 0018:ffffc90000557448 EFLAGS: 00010246 [ 47.102578][ T112] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffffffff0b2049c [ 47.110606][ T112] RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001 [ 47.118439][ T112] RBP: ffffc90000557798 R08: 0000000000000001 R09: ffff88812159ea4f [ 47.126315][ T112] R10: ffffed10242b3d49 R11: 0000000000000000 R12: ffff88812159ea88 [ 47.134348][ T112] R13: dffffc0000000000 R14: ffffc90000557770 R15: ffff88812159eab0 [ 47.142211][ T112] FS: 0000000000000000(0000) GS:ffff8881f7400000(0000) knlGS:0000000000000000 [ 47.151026][ T112] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.157877][ T112] CR2: 0000560c55c70508 CR3: 000000010b73f000 CR4: 00000000003506b0 [ 47.165759][ T112] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.173511][ T112] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.181318][ T112] Kernel panic - not syncing: Fatal exception [ 47.187444][ T112] Kernel Offset: disabled [ 47.191574][ T112] Rebooting in 86400 seconds..