Warning: Permanently added '10.128.0.210' (ED25519) to the list of known hosts. 2024/02/21 06:35:19 ignoring optional flag "sandboxArg"="0" 2024/02/21 06:35:19 parsed 1 programs 2024/02/21 06:35:19 executed programs: 0 [ 55.336921][ T1503] loop0: detected capacity change from 0 to 2048 [ 55.351569][ T1503] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 55.366749][ T1503] ================================================================== [ 55.374860][ T1503] BUG: KASAN: slab-out-of-bounds in ext4_convert_inline_data_nolock+0x282/0xc10 [ 55.383963][ T1503] Read of size 20 at addr ffff8881186651a3 by task syz-executor.0/1503 [ 55.392263][ T1503] [ 55.394573][ T1503] CPU: 1 PID: 1503 Comm: syz-executor.0 Not tainted 6.1.78-syzkaller #0 [ 55.403131][ T1503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 55.413332][ T1503] Call Trace: [ 55.416595][ T1503] [ 55.419638][ T1503] dump_stack_lvl+0xf4/0x251 [ 55.424279][ T1503] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 55.429813][ T1503] ? panic+0x3f7/0x3f7 [ 55.433852][ T1503] ? _printk+0xca/0x10a [ 55.437977][ T1503] ? __virt_addr_valid+0x139/0x260 [ 55.443151][ T1503] ? __virt_addr_valid+0x211/0x260 [ 55.448409][ T1503] print_report+0x15f/0x4f0 [ 55.452887][ T1503] ? __virt_addr_valid+0x139/0x260 [ 55.457967][ T1503] ? __virt_addr_valid+0x211/0x260 [ 55.463235][ T1503] ? ext4_convert_inline_data_nolock+0x282/0xc10 [ 55.469727][ T1503] kasan_report+0x136/0x160 [ 55.475513][ T1503] ? ext4_convert_inline_data_nolock+0x282/0xc10 [ 55.482682][ T1503] kasan_check_range+0x27f/0x290 [ 55.487681][ T1503] ? ext4_convert_inline_data_nolock+0x282/0xc10 [ 55.493977][ T1503] memcpy+0x25/0x60 [ 55.497851][ T1503] ext4_convert_inline_data_nolock+0x282/0xc10 [ 55.504063][ T1503] ? __down_write_common+0x12a/0x1e0 [ 55.509408][ T1503] ? ext4_add_dirent_to_inline+0x390/0x390 [ 55.515210][ T1503] ? __ext4_journal_start_sb+0xa4/0x360 [ 55.520759][ T1503] ext4_convert_inline_data+0x3b8/0x4d0 [ 55.526289][ T1503] ? ext4_inline_data_truncate+0xb70/0xb70 [ 55.532158][ T1503] ext4_fallocate+0x136/0x1790 [ 55.537268][ T1503] ? read_lock_is_recursive+0x10/0x10 [ 55.542622][ T1503] ? ext4_ext_truncate+0x260/0x260 [ 55.547820][ T1503] ? preempt_count_add+0x8f/0x120 [ 55.552843][ T1503] vfs_fallocate+0x30c/0x3d0 [ 55.557589][ T1503] __x64_sys_fallocate+0xa6/0xd0 [ 55.563110][ T1503] do_syscall_64+0x3d/0x80 [ 55.567763][ T1503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.573629][ T1503] RIP: 0033:0x7f7af9b16959 [ 55.578118][ T1503] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 55.598087][ T1503] RSP: 002b:00007f7af96990c8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 55.607894][ T1503] RAX: ffffffffffffffda RBX: 00007f7af9c35f80 RCX: 00007f7af9b16959 [ 55.615847][ T1503] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 55.623813][ T1503] RBP: 00007f7af9b72c88 R08: 0000000000000000 R09: 0000000000000000 [ 55.631787][ T1503] R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 [ 55.639917][ T1503] R13: 0000000000000006 R14: 00007f7af9c35f80 R15: 00007ffcfc0f9528 [ 55.648074][ T1503] [ 55.651108][ T1503] [ 55.653421][ T1503] Allocated by task 1418: [ 55.657734][ T1503] kasan_set_track+0x4b/0x70 [ 55.662321][ T1503] __kasan_slab_alloc+0x65/0x70 [ 55.667241][ T1503] slab_post_alloc_hook+0x54/0x3e0 [ 55.672325][ T1503] kmem_cache_alloc_bulk+0x2d4/0x360 [ 55.677877][ T1503] mas_alloc_nodes+0x359/0x680 [ 55.682699][ T1503] mas_preallocate+0xee/0x290 [ 55.687352][ T1503] do_mas_align_munmap+0x2e5/0x11e0 [ 55.692607][ T1503] do_mas_munmap+0x195/0x1f0 [ 55.697269][ T1503] mmap_region+0x708/0x1780 [ 55.701756][ T1503] do_mmap+0x69e/0xb60 [ 55.705882][ T1503] vm_mmap_pgoff+0x1b7/0x280 [ 55.710452][ T1503] ksys_mmap_pgoff+0x2cf/0x3b0 [ 55.715200][ T1503] do_syscall_64+0x3d/0x80 [ 55.719677][ T1503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.725639][ T1503] [ 55.728113][ T1503] Freed by task 1418: [ 55.732244][ T1503] kasan_set_track+0x4b/0x70 [ 55.736827][ T1503] kasan_save_free_info+0x27/0x40 [ 55.741821][ T1503] ____kasan_slab_free+0x122/0x1e0 [ 55.747074][ T1503] kmem_cache_free_bulk+0x582/0x770 [ 55.752252][ T1503] mas_destroy+0x2730/0x2ec0 [ 55.757260][ T1503] mas_store_prealloc+0x283/0x3b0 [ 55.762417][ T1503] do_mas_align_munmap+0x999/0x11e0 [ 55.767598][ T1503] do_mas_munmap+0x195/0x1f0 [ 55.772167][ T1503] mmap_region+0x708/0x1780 [ 55.776662][ T1503] do_mmap+0x69e/0xb60 [ 55.780704][ T1503] vm_mmap_pgoff+0x1b7/0x280 [ 55.785327][ T1503] ksys_mmap_pgoff+0x2cf/0x3b0 [ 55.790151][ T1503] do_syscall_64+0x3d/0x80 [ 55.794543][ T1503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.800580][ T1503] [ 55.802883][ T1503] Last potentially related work creation: [ 55.808834][ T1503] kasan_save_stack+0x3b/0x60 [ 55.813788][ T1503] __kasan_record_aux_stack+0xb0/0xc0 [ 55.819369][ T1503] call_rcu+0x149/0x830 [ 55.823501][ T1503] mas_wmb_replace+0x1346/0x19c0 [ 55.828431][ T1503] mas_wr_modify+0x360b/0x6760 [ 55.833256][ T1503] mas_store_gfp+0x25c/0x3c0 [ 55.837991][ T1503] do_brk_flags+0x500/0xa70 [ 55.842464][ T1503] __se_sys_brk+0x6a4/0x9c0 [ 55.847302][ T1503] do_syscall_64+0x3d/0x80 [ 55.851808][ T1503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.857935][ T1503] [ 55.860848][ T1503] The buggy address belongs to the object at ffff888118665000 [ 55.860848][ T1503] which belongs to the cache maple_node of size 256 [ 55.875333][ T1503] The buggy address is located 163 bytes to the right of [ 55.875333][ T1503] 256-byte region [ffff888118665000, ffff888118665100) [ 55.889284][ T1503] [ 55.891647][ T1503] The buggy address belongs to the physical page: [ 55.898029][ T1503] page:ffffea0004619900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118664 [ 55.908326][ T1503] head:ffffea0004619900 order:1 compound_mapcount:0 compound_pincount:0 [ 55.916798][ T1503] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 55.923535][ T1503] raw: 0200000000010200 ffffea0004631f80 dead000000000002 ffff8881000cd000 [ 55.932174][ T1503] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 55.940832][ T1503] page dumped because: kasan: bad access detected [ 55.947301][ T1503] page_owner tracks the page as allocated [ 55.953072][ T1503] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 592, tgid 592 (modprobe), ts 26477684480, free_ts 26263075353 [ 55.973984][ T1503] post_alloc_hook+0x286/0x2b0 [ 55.978725][ T1503] get_page_from_freelist+0x2ba7/0x2de0 [ 55.984323][ T1503] __alloc_pages+0x251/0x640 [ 55.988981][ T1503] alloc_slab_page+0x6a/0x150 [ 55.993627][ T1503] new_slab+0x70/0x250 [ 55.997783][ T1503] ___slab_alloc+0x9df/0xe70 [ 56.002353][ T1503] kmem_cache_alloc_bulk+0x15c/0x360 [ 56.007785][ T1503] mas_alloc_nodes+0x359/0x680 [ 56.012608][ T1503] mas_preallocate+0xee/0x290 [ 56.017280][ T1503] __vma_adjust+0x31c/0x12b0 [ 56.021861][ T1503] __split_vma+0x32f/0x4a0 [ 56.026252][ T1503] mprotect_fixup+0x5b3/0x630 [ 56.031182][ T1503] do_mprotect_pkey+0x6e1/0x930 [ 56.036092][ T1503] __x64_sys_mprotect+0x77/0x90 [ 56.041180][ T1503] do_syscall_64+0x3d/0x80 [ 56.045658][ T1503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.051715][ T1503] page last free stack trace: [ 56.056494][ T1503] free_unref_page_prepare+0xca9/0xd80 [ 56.062139][ T1503] free_unref_page+0x30/0x230 [ 56.066981][ T1503] __unfreeze_partials+0x1af/0x210 [ 56.072609][ T1503] put_cpu_partial+0x150/0x1a0 [ 56.077416][ T1503] qlist_free_all+0x76/0xe0 [ 56.081897][ T1503] kasan_quarantine_reduce+0x156/0x170 [ 56.087347][ T1503] __kasan_slab_alloc+0x1f/0x70 [ 56.092210][ T1503] slab_post_alloc_hook+0x54/0x3e0 [ 56.097440][ T1503] kmem_cache_alloc+0x10c/0x290 [ 56.102262][ T1503] vm_area_alloc+0x1b/0xd0 [ 56.106650][ T1503] mmap_region+0x9fe/0x1780 [ 56.111573][ T1503] do_mmap+0x69e/0xb60 [ 56.115611][ T1503] vm_mmap_pgoff+0x1b7/0x280 [ 56.120268][ T1503] do_syscall_64+0x3d/0x80 [ 56.124744][ T1503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.130791][ T1503] [ 56.133111][ T1503] Memory state around the buggy address: [ 56.138746][ T1503] ffff888118665080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 56.146779][ T1503] ffff888118665100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.155186][ T1503] >ffff888118665180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.163323][ T1503] ^ [ 56.168599][ T1503] ffff888118665200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 56.176839][ T1503] ffff888118665280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 56.185006][ T1503] ================================================================== [ 56.193238][ T1503] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 56.200824][ T1503] Kernel Offset: disabled [ 56.205134][ T1503] Rebooting in 86400 seconds..