Warning: Permanently added '10.128.0.88' (ED25519) to the list of known hosts. 2024/05/16 05:34:31 ignoring optional flag "sandboxArg"="0" 2024/05/16 05:34:31 parsed 1 programs 2024/05/16 05:34:34 executed programs: 0 [ 67.086573][ T2679] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 68.626220][ T2684] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.636664][ T2684] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.647282][ T2684] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.663242][ T2684] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 75.103502][ T1217] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.111970][ T1217] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.137056][ T1217] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.145151][ T1217] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2024/05/16 05:34:42 executed programs: 1 [ 75.220094][ T3410] jffs2: notice: (3410) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 75.253874][ T3413] jffs2: notice: (3413) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 75.289795][ T3411] ================================================================== [ 75.290641][ T3416] jffs2: notice: (3416) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 75.297978][ T3411] BUG: KASAN: slab-use-after-free in __mutex_lock+0x11b/0x1990 [ 75.322360][ T3411] Read of size 8 at addr ffff888113cca130 by task jffs2_gcd_mtd0/3411 [ 75.330941][ T3411] [ 75.333256][ T3411] CPU: 1 PID: 3411 Comm: jffs2_gcd_mtd0 Not tainted 6.9.0-syzkaller #0 [ 75.341567][ T3411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 75.351964][ T3411] Call Trace: [ 75.355225][ T3411] [ 75.358330][ T3411] dump_stack_lvl+0x231/0x330 [ 75.363022][ T3411] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.368216][ T3411] ? __pfx__printk+0x10/0x10 [ 75.372794][ T3411] ? lock_acquire+0xc2/0x3a0 [ 75.377460][ T3411] ? __pfx_lock_acquire+0x10/0x10 [ 75.382466][ T3411] ? _printk+0xd5/0x120 [ 75.386618][ T3411] ? __virt_addr_valid+0x169/0x370 [ 75.391739][ T3411] print_report+0x169/0x550 [ 75.396321][ T3411] ? __virt_addr_valid+0x169/0x370 [ 75.401425][ T3411] ? __virt_addr_valid+0x2b4/0x370 [ 75.406703][ T3411] ? __phys_addr+0x90/0x130 [ 75.411195][ T3411] ? __mutex_lock+0x11b/0x1990 [ 75.416054][ T3411] kasan_report+0x143/0x180 [ 75.420637][ T3411] ? __mutex_lock+0x11b/0x1990 [ 75.425396][ T3411] ? jffs2_garbage_collect_pass+0xae/0x2080 [ 75.431653][ T3411] __mutex_lock+0x11b/0x1990 [ 75.436405][ T3411] ? __lock_acquire+0x5cd/0xc10 [ 75.441248][ T3411] ? __pfx___mutex_lock+0x10/0x10 [ 75.446471][ T3411] ? __lock_acquire+0x5cd/0xc10 [ 75.451508][ T3411] ? __set_current_blocked+0x310/0x380 [ 75.456973][ T3411] jffs2_garbage_collect_pass+0xae/0x2080 [ 75.462743][ T3411] ? _raw_spin_unlock_irq+0x29/0x50 [ 75.468040][ T3411] ? __set_current_blocked+0x310/0x380 [ 75.473500][ T3411] ? __pfx___set_current_blocked+0x10/0x10 [ 75.479499][ T3411] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10 [ 75.485820][ T3411] ? schedule_timeout+0x21a/0x2e0 [ 75.490848][ T3411] ? sigprocmask+0x228/0x280 [ 75.495512][ T3411] ? __pfx_sigprocmask+0x10/0x10 [ 75.500529][ T3411] ? do_raw_spin_unlock+0x13c/0x8b0 [ 75.505738][ T3411] jffs2_garbage_collect_thread+0x5c0/0x650 [ 75.511707][ T3411] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 75.518114][ T3411] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 75.523996][ T3411] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 75.530310][ T3411] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 75.536272][ T3411] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 75.542853][ T3411] ? __kthread_parkme+0x126/0x170 [ 75.547864][ T3411] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 75.554354][ T3411] kthread+0x290/0x300 [ 75.558411][ T3411] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 75.565089][ T3411] ? __pfx_kthread+0x10/0x10 [ 75.569710][ T3411] ret_from_fork+0x4b/0x80 [ 75.574122][ T3411] ? __pfx_kthread+0x10/0x10 [ 75.578698][ T3411] ret_from_fork_asm+0x1a/0x30 [ 75.583456][ T3411] [ 75.586460][ T3411] [ 75.588767][ T3411] Allocated by task 3410: [ 75.593072][ T3411] kasan_save_track+0x3f/0x80 [ 75.597741][ T3411] __kasan_kmalloc+0x98/0xb0 [ 75.602405][ T3411] kmalloc_trace+0x1c9/0x3b0 [ 75.606981][ T3411] jffs2_init_fs_context+0x4f/0xc0 [ 75.612075][ T3411] alloc_fs_context+0x685/0x800 [ 75.616917][ T3411] do_new_mount+0x160/0xb40 [ 75.621417][ T3411] __se_sys_mount+0x2c8/0x3b0 [ 75.626087][ T3411] do_syscall_64+0x8f/0x1a0 [ 75.630841][ T3411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.636809][ T3411] [ 75.639112][ T3411] Freed by task 2684: [ 75.643077][ T3411] kasan_save_track+0x3f/0x80 [ 75.648177][ T3411] kasan_save_free_info+0x40/0x50 [ 75.653183][ T3411] poison_slab_object+0xee/0x1a0 [ 75.658116][ T3411] __kasan_slab_free+0x37/0x60 [ 75.662865][ T3411] kfree+0x139/0x360 [ 75.666746][ T3411] deactivate_locked_super+0xca/0x450 [ 75.672192][ T3411] cleanup_mnt+0x359/0x3e0 [ 75.676611][ T3411] task_work_run+0x24f/0x300 [ 75.681284][ T3411] syscall_exit_to_user_mode+0xc5/0x1f0 [ 75.686844][ T3411] do_syscall_64+0x9c/0x1a0 [ 75.691334][ T3411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.697222][ T3411] [ 75.699615][ T3411] The buggy address belongs to the object at ffff888113cca000 [ 75.699615][ T3411] which belongs to the cache kmalloc-4k of size 4096 [ 75.713663][ T3411] The buggy address is located 304 bytes inside of [ 75.713663][ T3411] freed 4096-byte region [ffff888113cca000, ffff888113ccb000) [ 75.727885][ T3411] [ 75.730193][ T3411] The buggy address belongs to the physical page: [ 75.736590][ T3411] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113cc8 [ 75.745434][ T3411] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 75.752960][ T3411] anon flags: 0x200000000000840(slab|head|node=0|zone=2) [ 75.759974][ T3411] page_type: 0xffffffff() [ 75.764287][ T3411] raw: 0200000000000840 ffff888100042140 0000000000000000 dead000000000001 [ 75.773126][ T3411] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 75.782304][ T3411] head: 0200000000000840 ffff888100042140 0000000000000000 dead000000000001 [ 75.791049][ T3411] head: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 75.799828][ T3411] head: 0200000000000003 ffffea00044f3201 ffffea00044f3248 00000000ffffffff [ 75.808500][ T3411] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 75.817168][ T3411] page dumped because: kasan: bad access detected [ 75.823560][ T3411] page_owner tracks the page as allocated [ 75.829252][ T3411] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1695, tgid 1695 (mtd_probe), ts 10666361898, free_ts 10661690501 [ 75.851046][ T3411] post_alloc_hook+0x10f/0x130 [ 75.855832][ T3411] get_page_from_freelist+0x30be/0x3240 [ 75.861367][ T3411] __alloc_pages+0x256/0x670 [ 75.865969][ T3411] alloc_slab_page+0x5f/0x160 [ 75.870806][ T3411] new_slab+0x70/0x270 [ 75.874862][ T3411] ___slab_alloc+0x993/0x10b0 [ 75.879549][ T3411] kmalloc_trace+0x254/0x3b0 [ 75.884210][ T3411] tomoyo_init_log+0x1c9/0x1e70 [ 75.889148][ T3411] tomoyo_supervisor+0x369/0x11a0 [ 75.894160][ T3411] tomoyo_path_perm+0x6d9/0x970 [ 75.899067][ T3411] security_inode_getattr+0xd8/0x130 [ 75.904344][ T3411] vfs_fstat+0x4c/0x980 [ 75.908575][ T3411] __se_sys_newfstatat+0xc6/0x770 [ 75.913707][ T3411] do_syscall_64+0x8f/0x1a0 [ 75.918192][ T3411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.924159][ T3411] page last free pid 1684 tgid 1684 stack trace: [ 75.930558][ T3411] free_unref_page_prepare+0x87f/0x9a0 [ 75.935998][ T3411] free_unref_page+0x37/0x3a0 [ 75.940672][ T3411] __put_partials+0x18e/0x1d0 [ 75.945330][ T3411] put_cpu_partial+0x151/0x1b0 [ 75.950076][ T3411] __slab_free+0x2b8/0x3a0 [ 75.954476][ T3411] qlist_free_all+0x5e/0xc0 [ 75.959056][ T3411] kasan_quarantine_reduce+0x14f/0x170 [ 75.964498][ T3411] __kasan_slab_alloc+0x23/0x80 [ 75.969438][ T3411] kmem_cache_alloc+0x15f/0x3a0 [ 75.974305][ T3411] getname_flags+0xbd/0x4f0 [ 75.978881][ T3411] __x64_sys_symlink+0x5f/0x90 [ 75.983632][ T3411] do_syscall_64+0x8f/0x1a0 [ 75.988119][ T3411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.994007][ T3411] [ 75.996319][ T3411] Memory state around the buggy address: [ 76.001932][ T3411] ffff888113cca000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.010068][ T3411] ffff888113cca080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.018109][ T3411] >ffff888113cca100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.026156][ T3411] ^ [ 76.031860][ T3411] ffff888113cca180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.039907][ T3411] ffff888113cca200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.047950][ T3411] ================================================================== [ 76.057065][ T3411] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.180978][ T3411] Shutting down cpus with NMI [ 77.186727][ T3411] Kernel Offset: disabled [ 77.191248][ T3411] Rebooting in 86400 seconds..