./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3978412348
<...>
DUID 00:04:f8:32:f0:25:6b:f7:7b:d6:d2:5e:34:7f:1d:07:e3:4e
forked to background, child pid 4660
[ 29.219538][ T4661] 8021q: adding VLAN 0 to HW filter on device bond0
[ 29.231009][ T4661] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.35' (ECDSA) to the list of known hosts.
execve("./syz-executor3978412348", ["./syz-executor3978412348"], 0x7ffd630e8ef0 /* 10 vars */) = 0
brk(NULL) = 0x555556bec000
brk(0x555556becc40) = 0x555556becc40
arch_prctl(ARCH_SET_FS, 0x555556bec300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3978412348", 4096) = 28
brk(0x555556c0dc40) = 0x555556c0dc40
brk(0x555556c0e000) = 0x555556c0e000
mprotect(0x7f88bb1e0000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556bec5d0) = 4993
./strace-static-x86_64: Process 4993 attached
[pid 4993] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4993] setpgid(0, 0) = 0
[pid 4993] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4993] write(3, "1000", 4) = 4
[pid 4993] close(3) = 0
[pid 4993] memfd_create("syzkaller", 0) = 3
[pid 4993] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f88b2d20000
syzkaller login: [ 58.254311][ T4993] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4993 'syz-executor397'
[pid 4993] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 4993] munmap(0x7f88b2d20000, 16777216) = 0
[pid 4993] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4993] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4993] close(3) = 0
[pid 4993] mkdir("./bus", 0777) = 0
[pid 4993] mount("/dev/loop0", "./bus", "jfs", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME|MS_LAZYTIME, "") = 0
[pid 4993] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid 4993] chdir("./bus") = 0
[pid 4993] ioctl(4, LOOP_CLR_FD) = 0
[pid 4993] close(4) = 0
[pid 4993] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = 4
[pid 4993] open("./bus", O_RDWR|O_CREAT|O_SYNC|O_DIRECT|O_NOATIME|FASYNC, 000) = 5
[pid 4993] ftruncate(5, 33587199) = 0
[pid 4993] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = 6
[pid 4993] open("./bus", O_RDONLY) = 7
[pid 4993] lseek(6, 0, SEEK_END) = 33587199
[ 58.429601][ T4993] loop0: detected capacity change from 0 to 32768
[ 58.454707][ T27] audit: type=1804 audit(1684052542.654:2): pid=4993 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor397" name="/root/bus/bus" dev="loop0" ino=7 res=1 errno=0
[ 58.996063][ T4993] ================================================================================
[ 59.006263][ T4993] UBSAN: shift-out-of-bounds in fs/jfs/jfs_extent.c:314:16
[ 59.013533][ T4993] shift exponent -1 is negative
[ 59.018503][ T4993] CPU: 0 PID: 4993 Comm: syz-executor397 Not tainted 6.4.0-rc1-syzkaller-00138-gd4d58949a6ea #0
[ 59.029271][ T4993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 59.039385][ T4993] Call Trace:
[ 59.042666][ T4993]
[ 59.045626][ T4993] dump_stack_lvl+0x1e7/0x2d0
[ 59.050328][ T4993] ? nf_tcp_handle_invalid+0x650/0x650
[ 59.055795][ T4993] ? panic+0x770/0x770
[ 59.059882][ T4993] ? extAlloc+0x10a/0x1010
[ 59.064312][ T4993] __ubsan_handle_shift_out_of_bounds+0x3c3/0x420
[ 59.070744][ T4993] ? do_raw_spin_unlock+0x13b/0x8b0
[ 59.075967][ T4993] extAlloc+0xe53/0x1010
[ 59.080215][ T4993] ? jfs_ioc_trim+0x660/0x660
[ 59.084900][ T4993] ? clear_nonspinnable+0x60/0x60
[ 59.089944][ T4993] jfs_get_block+0x41b/0xe60
[ 59.094557][ T4993] ? jfs_dirty_inode+0x240/0x240
[ 59.099616][ T4993] ? _raw_spin_unlock+0x28/0x40
[ 59.104488][ T4993] ? folio_create_buffers+0x132/0x250
[ 59.109890][ T4993] __block_write_begin_int+0x548/0x1a50
[ 59.115493][ T4993] ? jfs_dirty_inode+0x240/0x240
[ 59.120446][ T4993] ? PageUptodate+0x290/0x290
[ 59.125133][ T4993] ? folio_test_hugetlb+0xa0/0x1d0
[ 59.130267][ T4993] ? pagecache_get_page+0xeb/0x220
[ 59.135378][ T4993] ? jfs_dirty_inode+0x240/0x240
[ 59.140311][ T4993] block_write_begin+0x9c/0x1f0
[ 59.145156][ T4993] ? jfs_write_begin+0x1a/0x70
[ 59.149916][ T4993] jfs_write_begin+0x31/0x70
[ 59.154512][ T4993] generic_perform_write+0x300/0x5e0
[ 59.159840][ T4993] ? generic_file_direct_write+0x460/0x460
[ 59.165771][ T4993] ? __file_remove_privs+0x640/0x640
[ 59.171065][ T4993] ? generic_write_checks+0x160/0x1c0
[ 59.176455][ T4993] __generic_file_write_iter+0x17a/0x400
[ 59.182116][ T4993] generic_file_write_iter+0xaf/0x310
[ 59.187504][ T4993] do_iter_write+0x7b1/0xcb0
[ 59.192107][ T4993] ? vfs_iter_write+0xa0/0xa0
[ 59.196791][ T4993] ? vfs_iter_write+0x6d/0xa0
[ 59.201474][ T4993] iter_file_splice_write+0x843/0xfe0
[ 59.206855][ T4993] ? splice_from_pipe+0x230/0x230
[ 59.211888][ T4993] ? asm_sysvec_reschedule_ipi+0x1a/0x20
[ 59.217558][ T4993] ? direct_splice_read+0xa10/0xa10
[ 59.222796][ T4993] ? splice_from_pipe+0x230/0x230
[ 59.228010][ T4993] direct_splice_actor+0xe7/0x1c0
[ 59.233040][ T4993] splice_direct_to_actor+0x4c4/0xbd0
[ 59.238445][ T4993] ? do_splice_direct+0x3d0/0x3d0
[ 59.243584][ T4993] ? pipe_to_sendpage+0x350/0x350
[ 59.248616][ T4993] ? fsnotify_perm+0x67/0x590
[ 59.253314][ T4993] ? bpf_lsm_file_permission+0x9/0x10
[ 59.258792][ T4993] do_splice_direct+0x283/0x3d0
[ 59.263747][ T4993] ? splice_direct_to_actor+0xbd0/0xbd0
[ 59.269397][ T4993] ? rcu_read_lock_any_held+0xb7/0x160
[ 59.274863][ T4993] do_sendfile+0x620/0xff0
[ 59.279277][ T4993] ? ptrace_stop+0x75a/0x970
[ 59.283883][ T4993] ? do_pwritev+0x360/0x360
[ 59.288395][ T4993] ? _raw_spin_unlock_irq+0x2e/0x50
[ 59.293604][ T4993] ? ptrace_notify+0x278/0x380
[ 59.298384][ T4993] __se_sys_sendfile64+0x17c/0x1e0
[ 59.303496][ T4993] ? __x64_sys_sendfile64+0xb0/0xb0
[ 59.308689][ T4993] ? syscall_enter_from_user_mode+0x32/0x230
[ 59.314667][ T4993] ? syscall_enter_from_user_mode+0x8c/0x230
[ 59.320656][ T4993] do_syscall_64+0x41/0xc0
[ 59.325080][ T4993] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 59.331055][ T4993] RIP: 0033:0x7f88bb16d309
[ 59.335477][ T4993] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 59.355100][ T4993] RSP: 002b:00007ffcf90daf88 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 59.363519][ T4993] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f88bb16d309
[ 59.371563][ T4993] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000006
[ 59.379543][ T4993] RBP: 0000000000000000 R08: 00007f88bb1e0ec0 R09: 00007f88bb1e0ec0
[ 59.387535][ T4993] R10: 0001000000201005 R11: 0000000000000246 R12: 00007ffcf90dafb0
[ 59.395528][ T4993] R13: 0000000000000000 R14: 431bde82d7b634db R15: 0000000000000000
[ 59.403510][ T4993]
[ 59.407260][ T4993] ================================================================================
[ 59.416962][ T4993] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 59.424164][ T4993] CPU: 0 PID: 4993 Comm: syz-executor397 Not tainted 6.4.0-rc1-syzkaller-00138-gd4d58949a6ea #0
[ 59.434583][ T4993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 59.444645][ T4993] Call Trace:
[ 59.447978][ T4993]
[ 59.450927][ T4993] dump_stack_lvl+0x1e7/0x2d0
[ 59.455615][ T4993] ? nf_tcp_handle_invalid+0x650/0x650
[ 59.461074][ T4993] ? panic+0x770/0x770
[ 59.465140][ T4993] ? vscnprintf+0x5d/0x80
[ 59.469506][ T4993] panic+0x30f/0x770
[ 59.473440][ T4993] ? check_panic_on_warn+0x21/0xa0
[ 59.478570][ T4993] ? __memcpy_flushcache+0x2b0/0x2b0
[ 59.483859][ T4993] ? dump_stack_lvl+0x253/0x2d0
[ 59.488712][ T4993] check_panic_on_warn+0x82/0xa0
[ 59.493653][ T4993] __ubsan_handle_shift_out_of_bounds+0x3e2/0x420
[ 59.500085][ T4993] ? do_raw_spin_unlock+0x13b/0x8b0
[ 59.505290][ T4993] extAlloc+0xe53/0x1010
[ 59.509550][ T4993] ? jfs_ioc_trim+0x660/0x660
[ 59.514224][ T4993] ? clear_nonspinnable+0x60/0x60
[ 59.519263][ T4993] jfs_get_block+0x41b/0xe60
[ 59.523877][ T4993] ? jfs_dirty_inode+0x240/0x240
[ 59.528835][ T4993] ? _raw_spin_unlock+0x28/0x40
[ 59.533703][ T4993] ? folio_create_buffers+0x132/0x250
[ 59.539075][ T4993] __block_write_begin_int+0x548/0x1a50
[ 59.544636][ T4993] ? jfs_dirty_inode+0x240/0x240
[ 59.549581][ T4993] ? PageUptodate+0x290/0x290
[ 59.554257][ T4993] ? folio_test_hugetlb+0xa0/0x1d0
[ 59.559375][ T4993] ? pagecache_get_page+0xeb/0x220
[ 59.564483][ T4993] ? jfs_dirty_inode+0x240/0x240
[ 59.569593][ T4993] block_write_begin+0x9c/0x1f0
[ 59.574564][ T4993] ? jfs_write_begin+0x1a/0x70
[ 59.579346][ T4993] jfs_write_begin+0x31/0x70
[ 59.584035][ T4993] generic_perform_write+0x300/0x5e0
[ 59.589357][ T4993] ? generic_file_direct_write+0x460/0x460
[ 59.595185][ T4993] ? __file_remove_privs+0x640/0x640
[ 59.600472][ T4993] ? generic_write_checks+0x160/0x1c0
[ 59.605849][ T4993] __generic_file_write_iter+0x17a/0x400
[ 59.611485][ T4993] generic_file_write_iter+0xaf/0x310
[ 59.616858][ T4993] do_iter_write+0x7b1/0xcb0
[ 59.621452][ T4993] ? vfs_iter_write+0xa0/0xa0
[ 59.626160][ T4993] ? vfs_iter_write+0x6d/0xa0
[ 59.630859][ T4993] iter_file_splice_write+0x843/0xfe0
[ 59.636245][ T4993] ? splice_from_pipe+0x230/0x230
[ 59.641976][ T4993] ? asm_sysvec_reschedule_ipi+0x1a/0x20
[ 59.647663][ T4993] ? direct_splice_read+0xa10/0xa10
[ 59.652882][ T4993] ? splice_from_pipe+0x230/0x230
[ 59.657923][ T4993] direct_splice_actor+0xe7/0x1c0
[ 59.662947][ T4993] splice_direct_to_actor+0x4c4/0xbd0
[ 59.668325][ T4993] ? do_splice_direct+0x3d0/0x3d0
[ 59.673346][ T4993] ? pipe_to_sendpage+0x350/0x350
[ 59.678381][ T4993] ? fsnotify_perm+0x67/0x590
[ 59.683076][ T4993] ? bpf_lsm_file_permission+0x9/0x10
[ 59.688453][ T4993] do_splice_direct+0x283/0x3d0
[ 59.693402][ T4993] ? splice_direct_to_actor+0xbd0/0xbd0
[ 59.698954][ T4993] ? rcu_read_lock_any_held+0xb7/0x160
[ 59.704421][ T4993] do_sendfile+0x620/0xff0
[ 59.708835][ T4993] ? ptrace_stop+0x75a/0x970
[ 59.713441][ T4993] ? do_pwritev+0x360/0x360
[ 59.717956][ T4993] ? _raw_spin_unlock_irq+0x2e/0x50
[ 59.723184][ T4993] ? ptrace_notify+0x278/0x380
[ 59.727947][ T4993] __se_sys_sendfile64+0x17c/0x1e0
[ 59.733055][ T4993] ? __x64_sys_sendfile64+0xb0/0xb0
[ 59.738245][ T4993] ? syscall_enter_from_user_mode+0x32/0x230
[ 59.744224][ T4993] ? syscall_enter_from_user_mode+0x8c/0x230
[ 59.750217][ T4993] do_syscall_64+0x41/0xc0
[ 59.754634][ T4993] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 59.760541][ T4993] RIP: 0033:0x7f88bb16d309
[ 59.764967][ T4993] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 59.784613][ T4993] RSP: 002b:00007ffcf90daf88 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 59.793083][ T4993] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f88bb16d309
[ 59.801053][ T4993] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000006
[ 59.809031][ T4993] RBP: 0000000000000000 R08: 00007f88bb1e0ec0 R09: 00007f88bb1e0ec0
[ 59.817037][ T4993] R10: 0001000000201005 R11: 0000000000000246 R12: 00007ffcf90dafb0
[ 59.825026][ T4993] R13: 0000000000000000 R14: 431bde82d7b634db R15: 0000000000000000
[ 59.833007][ T4993]
[ 59.836234][ T4993] Kernel Offset: disabled
[ 59.840663][ T4993] Rebooting in 86400 seconds..