Warning: Permanently added '10.128.1.130' (ED25519) to the list of known hosts. 2023/12/10 18:47:34 ignoring optional flag "sandboxArg"="0" 2023/12/10 18:47:34 parsed 1 programs 2023/12/10 18:47:34 executed programs: 0 [ 45.367996][ T1503] loop0: detected capacity change from 0 to 2048 [ 45.383598][ T1503] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 45.399225][ T1503] ================================================================== [ 45.407299][ T1503] BUG: KASAN: use-after-free in ext4_read_inline_data+0x1e0/0x290 [ 45.415402][ T1503] Read of size 20 at addr ffff88811a3d01a3 by task syz-executor.0/1503 [ 45.423728][ T1503] [ 45.426217][ T1503] CPU: 1 PID: 1503 Comm: syz-executor.0 Not tainted 5.15.142-syzkaller #0 [ 45.434777][ T1503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 45.444836][ T1503] Call Trace: [ 45.448102][ T1503] [ 45.451100][ T1503] dump_stack_lvl+0x41/0x5e [ 45.455594][ T1503] print_address_description.constprop.0.cold+0x6c/0x309 [ 45.462599][ T1503] ? ext4_read_inline_data+0x1e0/0x290 [ 45.468126][ T1503] ? ext4_read_inline_data+0x1e0/0x290 [ 45.473573][ T1503] kasan_report.cold+0x83/0xdf [ 45.478325][ T1503] ? ext4_read_inline_data+0x1e0/0x290 [ 45.484353][ T1503] kasan_check_range+0x13d/0x180 [ 45.489555][ T1503] memcpy+0x20/0x60 [ 45.493693][ T1503] ext4_read_inline_data+0x1e0/0x290 [ 45.499473][ T1503] ext4_convert_inline_data_nolock+0xe2/0xbd0 [ 45.505619][ T1503] ? ext4_convert_inline_data+0x2ad/0x4e0 [ 45.511532][ T1503] ? ext4_prepare_inline_data+0x1b0/0x1b0 [ 45.518034][ T1503] ? down_write+0xc8/0x130 [ 45.522693][ T1503] ? down_write_killable_nested+0x160/0x160 [ 45.528869][ T1503] ? ext4_journal_check_start+0x46/0x1d0 [ 45.534826][ T1503] ? __ext4_journal_start_sb+0x226/0x2e0 [ 45.540535][ T1503] ext4_convert_inline_data+0x419/0x4e0 [ 45.546162][ T1503] ? ext4_inline_data_truncate+0xa00/0xa00 [ 45.552115][ T1503] ? down_write_killable_nested+0x160/0x160 [ 45.558032][ T1503] ? lock_acquire+0x11a/0x230 [ 45.563039][ T1503] ? aa_path_link+0x2e0/0x2e0 [ 45.567710][ T1503] ext4_fallocate+0x13f/0x2d60 [ 45.573263][ T1503] ? __lock_acquire.constprop.0+0x478/0xb30 [ 45.579508][ T1503] ? ext4_ext_truncate+0x1c0/0x1c0 [ 45.584833][ T1503] ? lock_acquire+0x11a/0x230 [ 45.589671][ T1503] ? __x64_sys_fallocate+0xb0/0x100 [ 45.596241][ T1503] vfs_fallocate+0x2a8/0xa40 [ 45.601360][ T1503] __x64_sys_fallocate+0xb0/0x100 [ 45.606470][ T1503] do_syscall_64+0x35/0x80 [ 45.610974][ T1503] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.616937][ T1503] RIP: 0033:0x7f4e3cf9d959 [ 45.621417][ T1503] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 45.641218][ T1503] RSP: 002b:00007f4e3cb200c8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 45.650063][ T1503] RAX: ffffffffffffffda RBX: 00007f4e3d0bcf80 RCX: 00007f4e3cf9d959 [ 45.658114][ T1503] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 45.666070][ T1503] RBP: 00007f4e3cff9c88 R08: 0000000000000000 R09: 0000000000000000 [ 45.675042][ T1503] R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 [ 45.683445][ T1503] R13: 0000000000000006 R14: 00007f4e3d0bcf80 R15: 00007ffc63be5d78 [ 45.691594][ T1503] [ 45.694679][ T1503] [ 45.696995][ T1503] Allocated by task 1295: [ 45.701458][ T1503] kasan_save_stack+0x1b/0x40 [ 45.706385][ T1503] __kasan_slab_alloc+0x61/0x80 [ 45.711216][ T1503] kmem_cache_alloc+0x211/0x310 [ 45.716052][ T1503] getname_flags.part.0+0x4a/0x440 [ 45.721138][ T1503] user_path_at_empty+0x1e/0x50 [ 45.725990][ T1503] vfs_statx+0xd6/0x2e0 [ 45.730835][ T1503] __do_sys_newfstatat+0x7d/0xd0 [ 45.736362][ T1503] do_syscall_64+0x35/0x80 [ 45.740867][ T1503] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.746833][ T1503] [ 45.749129][ T1503] Freed by task 1295: [ 45.753613][ T1503] kasan_save_stack+0x1b/0x40 [ 45.758463][ T1503] kasan_set_track+0x1c/0x30 [ 45.763258][ T1503] kasan_set_free_info+0x20/0x30 [ 45.768200][ T1503] __kasan_slab_free+0xe0/0x110 [ 45.773233][ T1503] kmem_cache_free+0x7e/0x450 [ 45.777886][ T1503] user_path_at_empty+0x40/0x50 [ 45.782812][ T1503] vfs_statx+0xd6/0x2e0 [ 45.787105][ T1503] __do_sys_newfstatat+0x7d/0xd0 [ 45.792101][ T1503] do_syscall_64+0x35/0x80 [ 45.796792][ T1503] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.804674][ T1503] [ 45.806988][ T1503] The buggy address belongs to the object at ffff88811a3d0000 [ 45.806988][ T1503] which belongs to the cache names_cache of size 4096 [ 45.822013][ T1503] The buggy address is located 419 bytes inside of [ 45.822013][ T1503] 4096-byte region [ffff88811a3d0000, ffff88811a3d1000) [ 45.836068][ T1503] The buggy address belongs to the page: [ 45.841857][ T1503] page:ffffea000468f400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a3d0 [ 45.853312][ T1503] head:ffffea000468f400 order:3 compound_mapcount:0 compound_pincount:0 [ 45.862558][ T1503] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 45.869225][ T1503] raw: 0200000000010200 0000000000000000 dead000000000122 ffff8881001403c0 [ 45.878138][ T1503] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 45.887181][ T1503] page dumped because: kasan: bad access detected [ 45.893835][ T1503] page_owner tracks the page as allocated [ 45.899787][ T1503] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 1295, ts 44293913993, free_ts 44123771281 [ 45.922937][ T1503] get_page_from_freelist+0x166f/0x2910 [ 45.929618][ T1503] __alloc_pages+0x2b3/0x590 [ 45.934199][ T1503] allocate_slab+0x2eb/0x430 [ 45.938790][ T1503] ___slab_alloc+0xb1c/0xf80 [ 45.943358][ T1503] kmem_cache_alloc+0x2d7/0x310 [ 45.948420][ T1503] getname_flags.part.0+0x4a/0x440 [ 45.953697][ T1503] user_path_at_empty+0x1e/0x50 [ 45.958532][ T1503] vfs_statx+0xd6/0x2e0 [ 45.962699][ T1503] __do_sys_newfstatat+0x7d/0xd0 [ 45.967961][ T1503] do_syscall_64+0x35/0x80 [ 45.972441][ T1503] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.978969][ T1503] page last free stack trace: [ 45.983780][ T1503] free_pcp_prepare+0x34e/0x730 [ 45.989393][ T1503] free_unref_page+0x19/0x3b0 [ 45.994206][ T1503] __unfreeze_partials+0x27d/0x2a0 [ 45.999655][ T1503] qlist_free_all+0x68/0x110 [ 46.004861][ T1503] kasan_quarantine_reduce+0x180/0x1f0 [ 46.012124][ T1503] __kasan_slab_alloc+0x73/0x80 [ 46.017221][ T1503] kmem_cache_alloc+0x211/0x310 [ 46.022323][ T1503] getname_flags.part.0+0x4a/0x440 [ 46.028004][ T1503] user_path_at_empty+0x1e/0x50 [ 46.033095][ T1503] vfs_statx+0xd6/0x2e0 [ 46.037235][ T1503] __do_sys_newfstatat+0x7d/0xd0 [ 46.042248][ T1503] do_syscall_64+0x35/0x80 [ 46.046637][ T1503] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 46.052614][ T1503] [ 46.055204][ T1503] Memory state around the buggy address: [ 46.061630][ T1503] ffff88811a3d0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.071024][ T1503] ffff88811a3d0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.079157][ T1503] >ffff88811a3d0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.087751][ T1503] ^ [ 46.093472][ T1503] ffff88811a3d0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.102486][ T1503] ffff88811a3d0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.110613][ T1503] ================================================================== [ 46.118662][ T1503] Disabling lock debugging due to kernel taint [ 46.125007][ T1503] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 46.132576][ T1503] Kernel Offset: disabled [ 46.136883][ T1503] Rebooting in 86400 seconds..