Warning: Permanently added '10.128.1.5' (ED25519) to the list of known hosts. 2024/06/22 19:43:12 ignoring optional flag "sandboxArg"="0" 2024/06/22 19:43:12 parsed 1 programs 2024/06/22 19:43:15 executed programs: 0 [ 58.377937][ T2582] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 59.893653][ T2588] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 59.908928][ T2588] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 59.918656][ T2588] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 59.928274][ T2588] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.155966][ T65] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.163902][ T65] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.180118][ T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.188007][ T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2024/06/22 19:43:22 executed programs: 1 [ 66.264387][ T3308] jffs2: notice: (3308) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 66.298651][ T3311] jffs2: notice: (3311) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 66.331326][ T3314] jffs2: notice: (3314) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 66.347758][ T3309] ================================================================== [ 66.347774][ T3309] BUG: KASAN: slab-use-after-free in __mutex_lock+0x11b/0x1990 [ 66.347812][ T3309] Read of size 8 at addr ffff88811e036130 by task jffs2_gcd_mtd0/3309 [ 66.347826][ T3309] [ 66.347869][ T3309] CPU: 1 PID: 3309 Comm: jffs2_gcd_mtd0 Not tainted 6.10.0-rc4-syzkaller #0 [ 66.347887][ T3309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 66.347900][ T3309] Call Trace: [ 66.347908][ T3309] [ 66.347914][ T3309] dump_stack_lvl+0x231/0x330 [ 66.347934][ T3309] ? __pfx_dump_stack_lvl+0x10/0x10 [ 66.347951][ T3309] ? __pfx__printk+0x10/0x10 [ 66.347969][ T3309] ? lock_acquire+0xc2/0x3a0 [ 66.347989][ T3309] ? __pfx_lock_acquire+0x10/0x10 [ 66.348006][ T3309] ? _printk+0xd5/0x120 [ 66.348024][ T3309] ? __virt_addr_valid+0x169/0x370 [ 66.348042][ T3309] print_report+0x169/0x550 [ 66.348058][ T3309] ? __virt_addr_valid+0x169/0x370 [ 66.348074][ T3309] ? __virt_addr_valid+0x2b4/0x370 [ 66.348090][ T3309] ? __phys_addr+0x90/0x130 [ 66.348105][ T3309] ? __mutex_lock+0x11b/0x1990 [ 66.348125][ T3309] kasan_report+0x143/0x180 [ 66.348141][ T3309] ? __mutex_lock+0x11b/0x1990 [ 66.348161][ T3309] ? jffs2_garbage_collect_pass+0xae/0x2080 [ 66.471760][ T3309] __mutex_lock+0x11b/0x1990 [ 66.476355][ T3309] ? __lock_acquire+0x5cd/0xc10 [ 66.481211][ T3309] ? __pfx___mutex_lock+0x10/0x10 [ 66.486223][ T3309] ? __lock_acquire+0x5cd/0xc10 [ 66.491148][ T3309] ? __set_current_blocked+0x310/0x380 [ 66.496593][ T3309] jffs2_garbage_collect_pass+0xae/0x2080 [ 66.502299][ T3309] ? _raw_spin_unlock_irq+0x29/0x50 [ 66.507480][ T3309] ? __set_current_blocked+0x310/0x380 [ 66.513010][ T3309] ? __pfx___set_current_blocked+0x10/0x10 [ 66.518892][ T3309] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10 [ 66.525289][ T3309] ? schedule_timeout+0x21a/0x2e0 [ 66.530293][ T3309] ? sigprocmask+0x228/0x280 [ 66.534873][ T3309] ? __pfx_sigprocmask+0x10/0x10 [ 66.539796][ T3309] ? do_raw_spin_unlock+0x13c/0x8b0 [ 66.544997][ T3309] jffs2_garbage_collect_thread+0x5c0/0x650 [ 66.550881][ T3309] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.557283][ T3309] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 66.563251][ T3309] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.569563][ T3309] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 66.575466][ T3309] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.581786][ T3309] ? __kthread_parkme+0x126/0x170 [ 66.586986][ T3309] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.593493][ T3309] kthread+0x290/0x300 [ 66.597564][ T3309] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10 [ 66.603967][ T3309] ? __pfx_kthread+0x10/0x10 [ 66.608542][ T3309] ret_from_fork+0x4b/0x80 [ 66.613030][ T3309] ? __pfx_kthread+0x10/0x10 [ 66.617695][ T3309] ret_from_fork_asm+0x1a/0x30 [ 66.622450][ T3309] [ 66.625457][ T3309] [ 66.627760][ T3309] Allocated by task 3308: [ 66.632064][ T3309] kasan_save_track+0x3f/0x80 [ 66.636902][ T3309] __kasan_kmalloc+0x98/0xb0 [ 66.641474][ T3309] kmalloc_trace_noprof+0x19e/0x360 [ 66.646652][ T3309] jffs2_init_fs_context+0x4f/0xc0 [ 66.651745][ T3309] alloc_fs_context+0x685/0x800 [ 66.656587][ T3309] do_new_mount+0x160/0xb40 [ 66.661102][ T3309] __se_sys_mount+0x2c8/0x3b0 [ 66.665763][ T3309] do_syscall_64+0x8d/0x1a0 [ 66.670337][ T3309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.676217][ T3309] [ 66.678803][ T3309] Freed by task 2588: [ 66.682764][ T3309] kasan_save_track+0x3f/0x80 [ 66.687434][ T3309] kasan_save_free_info+0x40/0x50 [ 66.692449][ T3309] poison_slab_object+0xe0/0x150 [ 66.697379][ T3309] __kasan_slab_free+0x37/0x60 [ 66.702217][ T3309] kfree+0x12f/0x310 [ 66.706098][ T3309] deactivate_locked_super+0xca/0x450 [ 66.711461][ T3309] cleanup_mnt+0x352/0x3e0 [ 66.716208][ T3309] task_work_run+0x24f/0x300 [ 66.720777][ T3309] syscall_exit_to_user_mode+0xc5/0x1f0 [ 66.726310][ T3309] do_syscall_64+0x9a/0x1a0 [ 66.730794][ T3309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.736681][ T3309] [ 66.739007][ T3309] The buggy address belongs to the object at ffff88811e036000 [ 66.739007][ T3309] which belongs to the cache kmalloc-4k of size 4096 [ 66.753142][ T3309] The buggy address is located 304 bytes inside of [ 66.753142][ T3309] freed 4096-byte region [ffff88811e036000, ffff88811e037000) [ 66.767017][ T3309] [ 66.769329][ T3309] The buggy address belongs to the physical page: [ 66.775902][ T3309] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e030 [ 66.784735][ T3309] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 66.793232][ T3309] flags: 0x200000000000040(head|node=0|zone=2) [ 66.799397][ T3309] page_type: 0xffffefff(slab) [ 66.804075][ T3309] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 66.812646][ T3309] raw: 0000000000000000 0000000000040004 00000001ffffefff 0000000000000000 [ 66.821298][ T3309] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 66.829950][ T3309] head: 0000000000000000 0000000000040004 00000001ffffefff 0000000000000000 [ 66.838600][ T3309] head: 0200000000000003 ffffea0004780c01 ffffffffffffffff 0000000000000000 [ 66.847358][ T3309] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 66.856003][ T3309] page dumped because: kasan: bad access detected [ 66.862410][ T3309] page_owner tracks the page as allocated [ 66.868103][ T3309] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 3307, tgid 3307 (syz-executor.0), ts 66261063035, free_ts 65604767156 [ 66.890334][ T3309] post_alloc_hook+0x10f/0x130 [ 66.895116][ T3309] get_page_from_freelist+0x37f4/0x3920 [ 66.900646][ T3309] __alloc_pages_noprof+0x256/0x670 [ 66.906058][ T3309] alloc_slab_page+0x5f/0x120 [ 66.910738][ T3309] allocate_slab+0x5d/0x290 [ 66.915259][ T3309] ___slab_alloc+0xa7f/0x11d0 [ 66.919952][ T3309] __kmalloc_noprof+0x25a/0x440 [ 66.924800][ T3309] tomoyo_realpath_from_path+0xcf/0x5e0 [ 66.930426][ T3309] tomoyo_path_perm+0x29f/0x970 [ 66.935356][ T3309] tomoyo_path_symlink+0xde/0x120 [ 66.940468][ T3309] security_path_symlink+0xe3/0x140 [ 66.945674][ T3309] do_symlinkat+0x136/0x3a0 [ 66.950192][ T3309] __x64_sys_symlinkat+0x99/0xb0 [ 66.955121][ T3309] do_syscall_64+0x8d/0x1a0 [ 66.959628][ T3309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.965516][ T3309] page last free pid 3250 tgid 3250 stack trace: [ 66.971833][ T3309] free_unref_page+0xbae/0xcf0 [ 66.976618][ T3309] __put_partials+0x18e/0x1d0 [ 66.981401][ T3309] put_cpu_partial+0x151/0x1b0 [ 66.986322][ T3309] __slab_free+0x2b8/0x3a0 [ 66.990810][ T3309] qlist_free_all+0x9e/0x140 [ 66.995424][ T3309] kasan_quarantine_reduce+0x14f/0x170 [ 67.000885][ T3309] __kasan_slab_alloc+0x23/0x80 [ 67.005745][ T3309] kmem_cache_alloc_noprof+0x12b/0x350 [ 67.011206][ T3309] vm_area_dup+0x26/0x150 [ 67.015540][ T3309] __split_vma+0x12b/0xaf0 [ 67.019948][ T3309] vma_modify+0x17f/0x340 [ 67.024275][ T3309] mprotect_fixup+0x496/0xa80 [ 67.028942][ T3309] do_mprotect_pkey+0x902/0xdc0 [ 67.033786][ T3309] __x64_sys_mprotect+0x80/0x90 [ 67.038619][ T3309] do_syscall_64+0x8d/0x1a0 [ 67.043105][ T3309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.048988][ T3309] [ 67.051296][ T3309] Memory state around the buggy address: [ 67.057082][ T3309] ffff88811e036000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.065225][ T3309] ffff88811e036080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.073273][ T3309] >ffff88811e036100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.081397][ T3309] ^ [ 67.087025][ T3309] ffff88811e036180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.095067][ T3309] ffff88811e036200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.103548][ T3309] ================================================================== [ 67.112049][ T3309] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 67.119483][ T3309] Kernel Offset: disabled [ 67.123811][ T3309] Rebooting in 86400 seconds..