Warning: Permanently added '10.128.10.11' (ED25519) to the list of known hosts. 2025/03/06 07:43:54 ignoring optional flag "sandboxArg"="0" 2025/03/06 07:43:55 parsed 1 programs [ 66.149393][ T2750] swapon: swapfile has holes 2025/03/06 07:44:02 executed programs: 0 [ 69.490123][ T3236] EXT4-fs error (device loop3): ext4_xattr_inode_iget:389: comm syz.3.19: inode #1: comm syz.3.19: iget: illegal inode # [ 69.521604][ T3236] EXT4-fs error (device loop3): ext4_xattr_inode_iget:394: comm syz.3.19: error while reading EA inode 1 err=-117 [ 69.553510][ T3236] EXT4-fs (loop3): 1 orphan inode deleted [ 69.559240][ T3236] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 69.582340][ T3236] ================================================================== [ 69.590417][ T3236] BUG: KASAN: use-after-free in add_dirent_to_buf+0x2a1/0x650 [ 69.597856][ T3236] Write of size 251 at addr ffff8881d4bddf14 by task syz.3.19/3236 [ 69.605721][ T3236] [ 69.608034][ T3236] CPU: 1 PID: 3236 Comm: syz.3.19 Not tainted 5.8.0-rc4-syzkaller #0 [ 69.616070][ T3236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 69.626198][ T3236] Call Trace: [ 69.629483][ T3236] dump_stack+0x7c/0xb0 [ 69.633624][ T3236] ? add_dirent_to_buf+0x2a1/0x650 [ 69.638724][ T3236] print_address_description.constprop.8.cold.10+0x9/0x456 [ 69.645904][ T3236] ? __ext4_handle_dirty_metadata+0x1a0/0x660 [ 69.651957][ T3236] ? add_dirent_to_buf+0x2a1/0x650 [ 69.657049][ T3236] ? add_dirent_to_buf+0x2a1/0x650 [ 69.662143][ T3236] kasan_report.cold.11+0x1f/0x37 [ 69.667149][ T3236] ? add_dirent_to_buf+0x2a1/0x650 [ 69.672240][ T3236] check_memory_region+0x1c1/0x1e0 [ 69.677327][ T3236] memcpy+0x38/0x60 [ 69.681119][ T3236] add_dirent_to_buf+0x2a1/0x650 [ 69.686232][ T3236] ? ext4_rename_dir_finish+0x410/0x410 [ 69.691763][ T3236] ? ext4_insert_dentry+0x490/0x490 [ 69.696941][ T3236] ? ext4_rename_dir_prepare+0x410/0x410 [ 69.702553][ T3236] ? __ext4_handle_dirty_metadata+0x1a0/0x660 [ 69.708599][ T3236] ? ext4_append+0x1f7/0x330 [ 69.713170][ T3236] make_indexed_dir+0x98d/0xc90 [ 69.718008][ T3236] ? ext4_dx_add_entry+0x16a0/0x16a0 [ 69.723271][ T3236] ? add_dirent_to_buf+0x1fe/0x650 [ 69.728361][ T3236] ? __ext4_read_dirblock+0x289/0xc40 [ 69.733716][ T3236] ? ext4_free_inode+0x1150/0x1150 [ 69.738895][ T3236] ext4_add_entry+0x8f2/0xb50 [ 69.743777][ T3236] ? make_indexed_dir+0xc90/0xc90 [ 69.748780][ T3236] ? do_raw_spin_lock+0x121/0x2d0 [ 69.754046][ T3236] ? do_raw_spin_unlock+0x172/0x260 [ 69.759221][ T3236] ext4_add_nondir+0x8a/0x220 [ 69.763877][ T3236] ext4_symlink+0x70d/0xca0 [ 69.768360][ T3236] ? smack_file_send_sigiotask+0x360/0x360 [ 69.774145][ T3236] ? ext4_orphan_del+0x870/0x870 [ 69.779064][ T3236] ? from_kgid+0x7e/0xc0 [ 69.783284][ T3236] vfs_symlink+0x2d6/0x4c0 [ 69.787680][ T3236] do_symlinkat+0x176/0x1b0 [ 69.792254][ T3236] ? __ia32_sys_unlink+0x40/0x40 [ 69.797170][ T3236] do_syscall_64+0x4a/0x90 [ 69.801567][ T3236] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 69.807452][ T3236] RIP: 0033:0x7f857348d169 [ 69.811849][ T3236] Code: Bad RIP value. [ 69.815894][ T3236] RSP: 002b:00007f8572eff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 69.824281][ T3236] RAX: ffffffffffffffda RBX: 00007f85736a5fa0 RCX: 00007f857348d169 [ 69.832241][ T3236] RDX: 0000000000000000 RSI: 0000400000000cc0 RDI: 0000400000000dc0 [ 69.840203][ T3236] RBP: 00007f857350e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 69.848157][ T3236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.856121][ T3236] R13: 0000000000000000 R14: 00007f85736a5fa0 R15: 00007ffc7f810ab8 [ 69.864077][ T3236] [ 69.866387][ T3236] The buggy address belongs to the page: [ 69.872010][ T3236] page:ffffea000752f740 refcount:3 mapcount:0 mapping:000000007786cc22 index:0x3f [ 69.881205][ T3236] mapping->a_ops:def_blk_aops [ 69.885867][ T3236] flags: 0x10000000000202a(referenced|dirty|active|private) [ 69.893134][ T3236] raw: 010000000000202a dead000000000100 dead000000000122 ffff8881ede26e20 [ 69.901699][ T3236] raw: 000000000000003f ffff8881d81c8d98 00000003ffffffff ffff8881ddcdc000 [ 69.910258][ T3236] page dumped because: kasan: bad access detected [ 69.916746][ T3236] page->mem_cgroup:ffff8881ddcdc000 [ 69.921926][ T3236] page_owner tracks the page as allocated [ 69.927626][ T3236] page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE) [ 69.940627][ T3236] prep_new_page+0x21e/0x320 [ 69.945207][ T3236] get_page_from_freelist+0x110e/0x4610 [ 69.950730][ T3236] __alloc_pages_nodemask+0x278/0x710 [ 69.956083][ T3236] pagecache_get_page+0x15e/0x510 [ 69.961089][ T3236] __getblk_gfp+0x1dd/0x800 [ 69.965575][ T3236] ext4_getblk+0x123/0x3b0 [ 69.969976][ T3236] ext4_bread+0x5a/0x280 [ 69.974204][ T3236] ext4_append+0x132/0x330 [ 69.978602][ T3236] make_indexed_dir+0x265/0xc90 [ 69.983432][ T3236] ext4_add_entry+0x8f2/0xb50 [ 69.988091][ T3236] ext4_add_nondir+0x8a/0x220 [ 69.992751][ T3236] ext4_symlink+0x70d/0xca0 [ 69.997232][ T3236] vfs_symlink+0x2d6/0x4c0 [ 70.001628][ T3236] do_symlinkat+0x176/0x1b0 [ 70.006121][ T3236] do_syscall_64+0x4a/0x90 [ 70.010519][ T3236] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 70.016386][ T3236] page last free stack trace: [ 70.021052][ T3236] free_pcp_prepare+0x3d8/0x4c0 [ 70.025883][ T3236] free_unref_page_list+0xd4/0x4f0 [ 70.030978][ T3236] release_pages+0x980/0x1200 [ 70.035634][ T3236] tlb_flush_mmu+0xc1/0x540 [ 70.040118][ T3236] tlb_finish_mmu+0x84/0x370 [ 70.044696][ T3236] exit_mmap+0x26d/0x450 [ 70.048929][ T3236] mmput+0xcd/0x3a0 [ 70.052728][ T3236] do_exit+0x8c6/0x28e0 [ 70.056949][ T3236] do_group_exit+0xeb/0x2d0 [ 70.061446][ T3236] __x64_sys_exit_group+0x35/0x40 [ 70.066457][ T3236] do_syscall_64+0x4a/0x90 [ 70.070862][ T3236] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 70.076730][ T3236] [ 70.079039][ T3236] Memory state around the buggy address: [ 70.084737][ T3236] ffff8881d4bddf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.092781][ T3236] ffff8881d4bddf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.100834][ T3236] >ffff8881d4bde000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.108874][ T3236] ^ [ 70.112922][ T3236] ffff8881d4bde080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.120959][ T3236] ffff8881d4bde100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.129069][ T3236] ================================================================== [ 70.137111][ T3236] Disabling lock debugging due to kernel taint [ 70.143352][ T3236] Kernel panic - not syncing: panic_on_warn set ... [ 70.150174][ T3236] Kernel Offset: disabled [ 70.154474][ T3236] Rebooting in 86400 seconds..