./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2760361404 <...> Warning: Permanently added '10.128.10.56' (ED25519) to the list of known hosts. execve("./syz-executor2760361404", ["./syz-executor2760361404"], 0x7ffe34521550 /* 10 vars */) = 0 brk(NULL) = 0x555556517000 brk(0x555556517d00) = 0x555556517d00 arch_prctl(ARCH_SET_FS, 0x555556517380) = 0 set_tid_address(0x555556517650) = 295 set_robust_list(0x555556517660, 24) = 0 rseq(0x555556517ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2760361404", 4096) = 28 getrandom("\x3f\x0c\x61\xb3\x4a\x48\x02\x38", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556517d00 brk(0x555556538d00) = 0x555556538d00 brk(0x555556539000) = 0x555556539000 mprotect(0x7f23a84ee000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 296 attached , child_tidptr=0x555556517650) = 296 [pid 296] set_robust_list(0x555556517660, 24) = 0 [pid 296] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 296] getppid() = 0 [pid 296] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 296] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 296] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 296] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 296] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 296] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 296] unshare(CLONE_NEWNS) = 0 [pid 296] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 296] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 296] unshare(CLONE_NEWCGROUP) = 0 [pid 296] unshare(CLONE_NEWUTS) = 0 [pid 296] unshare(CLONE_SYSVSEM) = 0 [pid 296] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 296] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 296] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 296] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 296] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 296] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 296] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 296] getpid() = 1 [pid 296] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 0b 4c 89 f7 be 08 00 00 00 e8 2b 6d 95 ff f0 41 80 0e 04 e9 96 [ 25.267057][ T296] RSP: 0018:ffffc900009f7720 EFLAGS: 00010293 [ 25.272912][ T296] RAX: ffffffff821d1706 RBX: 0000000000000002 RCX: ffff88811c5a93c0 [ 25.280803][ T296] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 25.288776][ T296] RBP: ffffc900009f7890 R08: ffffffff821d13a1 R09: ffffed10241d7673 [ 25.296555][ T296] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888120ebb0c0 [ 25.304411][ T296] R13: dffffc0000000000 R14: ffff88810fa24078 R15: 1ffff9200013eef8 [ 25.312564][ T296] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 25.321340][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.327796][ T296] CR2: 00007f23a84bc138 CR3: 000000010c692000 CR4: 00000000003506b0 [ 25.335557][ T296] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.343536][ T296] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.351451][ T296] Call Trace: [ 25.354471][ T296] [ 25.357248][ T296] ? _raw_spin_unlock+0x4d/0x70 [ 25.362052][ T296] ? f2fs_write_inode+0x640/0x640 [ 25.366897][ T296] ? bit_waitqueue+0x30/0x30 [ 25.371349][ T296] ? locks_free_lock_context+0x42/0x70 [ 25.376702][ T296] ? __destroy_inode+0x35f/0x4e0 [ 25.381531][ T296] ? f2fs_write_inode+0x640/0x640 [ 25.386336][ T296] evict+0x529/0x930 [ 25.390096][ T296] ? proc_nr_inodes+0x330/0x330 [ 25.394754][ T296] ? __kasan_check_write+0x14/0x20 [ 25.399855][ T296] ? _raw_spin_lock+0xa4/0x1b0 [ 25.404459][ T296] ? _raw_spin_unlock+0x4d/0x70 [ 25.409404][ T296] ? list_lru_del+0x295/0x2d0 [ 25.414020][ T296] evict_inodes+0x642/0x6d0 [ 25.418443][ T296] ? clear_inode+0x150/0x150 [ 25.422802][ T296] generic_shutdown_super+0x97/0x330 [ 25.427944][ T296] kill_block_super+0x7e/0xe0 [ 25.432416][ T296] kill_f2fs_super+0x2f9/0x3c0 [ 25.436991][ T296] ? f2fs_mount+0x40/0x40 [ 25.441361][ T296] ? unregister_shrinker+0x23c/0x2d0 [ 25.446476][ T296] deactivate_locked_super+0xad/0x110 [ 25.451739][ T296] deactivate_super+0xbe/0xf0 [ 25.456281][ T296] cleanup_mnt+0x45c/0x510 [ 25.460553][ T296] __cleanup_mnt+0x19/0x20 [ 25.464790][ T296] task_work_run+0x129/0x190 [ 25.469233][ T296] do_exit+0xc48/0x2ca0 [ 25.473210][ T296] ? put_task_struct+0x80/0x80 [ 25.477836][ T296] ? _raw_spin_unlock_irq+0x4e/0x70 [ 25.482831][ T296] ? ptrace_notify+0x24c/0x350 [ 25.487430][ T296] ? do_notify_parent+0xa30/0xa30 [ 25.492328][ T296] do_group_exit+0x141/0x310 [ 25.496720][ T296] __x64_sys_exit_group+0x3f/0x40 [ 25.501603][ T296] x64_sys_call+0x610/0x9a0 [ 25.505919][ T296] do_syscall_64+0x3b/0x80 [ 25.510202][ T296] ? clear_bhb_loop+0x35/0x90 [ 25.514685][ T296] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.520526][ T296] RIP: 0033:0x7f23a84707a9 [ 25.524754][ T296] Code: Unable to access opcode bytes at RIP 0x7f23a847077f. [ 25.531981][ T296] RSP: 002b:00007ffd6880f678 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 25.540215][ T296] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f23a84707a9 [ 25.548046][ T296] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 25.555823][ T296] RBP: 00007f23a84f4390 R08: ffffffffffffffb8 R09: 0000555500000000 [ 25.563786][ T296] R10: 0000555500000000 R11: 0000000000000246 R12: 00007f23a84f4390 [ 25.571705][ T296] R13: 0000000000000000 R14: 00007f23a84f71c0 R15: 00007f23a843df80 [ 25.579682][ T296] [ 25.582541][ T296] ---[ end trace 3916c003d28c6bd4 ]--- [ 25.638377][ T296] ================================================================== [ 25.646263][ T296] BUG: KASAN: use-after-free in _raw_spin_lock+0x97/0x1b0 [ 25.653326][ T296] Write of size 4 at addr ffff888120ebb108 by task syz-executor276/296 [ 25.661398][ T296] [ 25.663568][ T296] CPU: 1 PID: 296 Comm: syz-executor276 Tainted: G W 5.15.180-syzkaller-android13-5.15.180_r00 #0 [ 25.675284][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 25.685181][ T296] Call Trace: [ 25.688306][ T296] [ 25.691082][ T296] dump_stack_lvl+0x151/0x1c0 [ 25.695594][ T296] ? io_uring_drop_tctx_refs+0x190/0x190 [ 25.701065][ T296] ? __wake_up_klogd+0xd5/0x110 [ 25.705751][ T296] ? panic+0x760/0x760 [ 25.709657][ T296] ? preempt_schedule_irq+0xe7/0x140 [ 25.714776][ T296] print_address_description+0x87/0x3b0 [ 25.720168][ T296] kasan_report+0x179/0x1c0 [ 25.724495][ T296] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 25.730488][ T296] ? _raw_spin_lock+0x97/0x1b0 [ 25.735095][ T296] ? _raw_spin_lock+0x97/0x1b0 [ 25.739686][ T296] kasan_check_range+0x293/0x2a0 [ 25.744468][ T296] __kasan_check_write+0x14/0x20 [ 25.749234][ T296] _raw_spin_lock+0x97/0x1b0 [ 25.753660][ T296] ? _raw_spin_trylock_bh+0x190/0x190 [ 25.758865][ T296] ? _raw_spin_lock+0xa4/0x1b0 [ 25.763466][ T296] ? _raw_spin_trylock_bh+0x190/0x190 [ 25.768673][ T296] ? remove_wait_queue+0x140/0x140 [ 25.773620][ T296] igrab+0x20/0xa0 [ 25.777180][ T296] f2fs_sync_inode_meta+0x14d/0x2a0 [ 25.782214][ T296] f2fs_write_checkpoint+0xab4/0x1fb0 [ 25.787426][ T296] ? f2fs_get_sectors_written+0x500/0x500 [ 25.792978][ T296] ? rwsem_write_trylock+0x153/0x340 [ 25.798097][ T296] ? __kasan_check_write+0x14/0x20 [ 25.803046][ T296] ? mutex_unlock+0xb2/0x260 [ 25.807470][ T296] f2fs_issue_checkpoint+0x31b/0x4d0 [ 25.812590][ T296] ? f2fs_destroy_checkpoint_caches+0x30/0x30 [ 25.818491][ T296] ? sync_inodes_sb+0x7cd/0x8b0 [ 25.823199][ T296] ? try_to_writeback_inodes_sb+0xc0/0xc0 [ 25.828739][ T296] f2fs_sync_fs+0x186/0x2f0 [ 25.833077][ T296] sync_filesystem+0x1cf/0x250 [ 25.837673][ T296] f2fs_quota_off_umount+0x20e/0x220 [ 25.842798][ T296] f2fs_put_super+0xbc/0xb80 [ 25.847249][ T296] ? fsnotify_sb_delete+0x480/0x4e0 [ 25.852259][ T296] ? f2fs_drop_inode+0xa20/0xa20 [ 25.857032][ T296] ? __fsnotify_vfsmount_delete+0x20/0x20 [ 25.862589][ T296] ? clear_inode+0x150/0x150 [ 25.867009][ T296] ? fscrypt_destroy_keyring+0x287/0x2a0 [ 25.872484][ T296] ? f2fs_drop_inode+0xa20/0xa20 [ 25.877253][ T296] generic_shutdown_super+0x14f/0x330 [ 25.882462][ T296] kill_block_super+0x7e/0xe0 [ 25.886974][ T296] kill_f2fs_super+0x2f9/0x3c0 [ 25.891573][ T296] ? f2fs_mount+0x40/0x40 [ 25.895739][ T296] ? unregister_shrinker+0x23c/0x2d0 [ 25.900874][ T296] deactivate_locked_super+0xad/0x110 [ 25.906069][ T296] deactivate_super+0xbe/0xf0 [ 25.910793][ T296] cleanup_mnt+0x45c/0x510 [ 25.915043][ T296] __cleanup_mnt+0x19/0x20 [ 25.919299][ T296] task_work_run+0x129/0x190 [ 25.923723][ T296] do_exit+0xc48/0x2ca0 [ 25.927718][ T296] ? put_task_struct+0x80/0x80 [ 25.932314][ T296] ? _raw_spin_unlock_irq+0x4e/0x70 [ 25.937346][ T296] ? ptrace_notify+0x24c/0x350 [ 25.941954][ T296] ? do_notify_parent+0xa30/0xa30 [ 25.946809][ T296] do_group_exit+0x141/0x310 [ 25.951243][ T296] __x64_sys_exit_group+0x3f/0x40 [ 25.956097][ T296] x64_sys_call+0x610/0x9a0 [ 25.960434][ T296] do_syscall_64+0x3b/0x80 [ 25.964688][ T296] ? clear_bhb_loop+0x35/0x90 [ 25.969201][ T296] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.975139][ T296] RIP: 0033:0x7f23a84707a9 [ 25.979384][ T296] Code: Unable to access opcode bytes at RIP 0x7f23a847077f. [ 25.986664][ T296] RSP: 002b:00007ffd6880f678 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 25.994916][ T296] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f23a84707a9 [ 26.002810][ T296] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 26.010620][ T296] RBP: 00007f23a84f4390 R08: ffffffffffffffb8 R09: 0000555500000000 [ 26.018433][ T296] R10: 0000555500000000 R11: 0000000000000246 R12: 00007f23a84f4390 [ 26.026240][ T296] R13: 0000000000000000 R14: 00007f23a84f71c0 R15: 00007f23a843df80 [ 26.034058][ T296] [ 26.036936][ T296] [ 26.039174][ T296] Allocated by task 296: [ 26.043253][ T296] __kasan_slab_alloc+0xb1/0xe0 [ 26.047938][ T296] slab_post_alloc_hook+0x53/0x2c0 [ 26.052889][ T296] kmem_cache_alloc+0xf5/0x250 [ 26.057488][ T296] f2fs_alloc_inode+0x26/0x340 [ 26.062089][ T296] new_inode_pseudo+0x64/0x220 [ 26.066687][ T296] new_inode+0x28/0x1c0 [ 26.070678][ T296] f2fs_new_inode+0x10e/0x1410 [ 26.075278][ T296] f2fs_create+0x17b/0x15e0 [ 26.079629][ T296] path_openat+0x13a8/0x2f40 [ 26.084043][ T296] do_filp_open+0x21c/0x460 [ 26.088385][ T296] do_sys_openat2+0x13f/0x820 [ 26.092902][ T296] __x64_sys_openat+0x243/0x290 [ 26.097844][ T296] x64_sys_call+0x6bf/0x9a0 [ 26.102187][ T296] do_syscall_64+0x3b/0x80 [ 26.106435][ T296] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.112165][ T296] [ 26.114334][ T296] Freed by task 296: [ 26.118067][ T296] kasan_set_track+0x4b/0x70 [ 26.122494][ T296] kasan_set_free_info+0x23/0x40 [ 26.127267][ T296] ____kasan_slab_free+0x126/0x160 [ 26.132215][ T296] __kasan_slab_free+0x11/0x20 [ 26.136815][ T296] slab_free_freelist_hook+0xbd/0x190 [ 26.142022][ T296] kmem_cache_free+0x115/0x330 [ 26.146621][ T296] f2fs_free_inode+0x24/0x30 [ 26.151050][ T296] i_callback+0x4b/0x70 [ 26.155053][ T296] rcu_do_batch+0x57a/0xc10 [ 26.159401][ T296] rcu_core+0x517/0x1020 [ 26.163461][ T296] rcu_core_si+0x9/0x10 [ 26.167452][ T296] handle_softirqs+0x25e/0x5c0 [ 26.172056][ T296] __irq_exit_rcu+0x52/0xf0 [ 26.176393][ T296] irq_exit_rcu+0x9/0x10 [ 26.180470][ T296] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 26.185952][ T296] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 26.191754][ T296] [ 26.193923][ T296] Last potentially related work creation: [ 26.199482][ T296] kasan_save_stack+0x3b/0x60 [ 26.203994][ T296] __kasan_record_aux_stack+0xd3/0xf0 [ 26.209201][ T296] kasan_record_aux_stack_noalloc+0xb/0x10 [ 26.214841][ T296] call_rcu+0x123/0x10b0 [ 26.218920][ T296] evict+0x87d/0x930 [ 26.222655][ T296] evict_inodes+0x642/0x6d0 [ 26.226991][ T296] generic_shutdown_super+0x97/0x330 [ 26.232120][ T296] kill_block_super+0x7e/0xe0 [ 26.236625][ T296] kill_f2fs_super+0x2f9/0x3c0 [ 26.241229][ T296] deactivate_locked_super+0xad/0x110 [ 26.246436][ T296] deactivate_super+0xbe/0xf0 [ 26.250946][ T296] cleanup_mnt+0x45c/0x510 [ 26.255214][ T296] __cleanup_mnt+0x19/0x20 [ 26.259454][ T296] task_work_run+0x129/0x190 [ 26.263878][ T296] do_exit+0xc48/0x2ca0 [ 26.267909][ T296] do_group_exit+0x141/0x310 [ 26.272297][ T296] __x64_sys_exit_group+0x3f/0x40 [ 26.277157][ T296] x64_sys_call+0x610/0x9a0 [ 26.281499][ T296] do_syscall_64+0x3b/0x80 [ 26.285792][ T296] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.291480][ T296] [ 26.293650][ T296] The buggy address belongs to the object at ffff888120ebb080 [ 26.293650][ T296] which belongs to the cache f2fs_inode_cache of size 1424 [ 26.308189][ T296] The buggy address is located 136 bytes inside of [ 26.308189][ T296] 1424-byte region [ffff888120ebb080, ffff888120ebb610) [ 26.321393][ T296] The buggy address belongs to the page: [ 26.326850][ T296] page:ffffea000483ae00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120eb8 [ 26.336915][ T296] head:ffffea000483ae00 order:3 compound_mapcount:0 compound_pincount:0 [ 26.345075][ T296] flags: 0x4000000000010200(slab|head|zone=1) [ 26.350982][ T296] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888107fb2180 [ 26.359400][ T296] raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 [ 26.367810][ T296] page dumped because: kasan: bad access detected [ 26.374069][ T296] page_owner tracks the page as allocated [ 26.379619][ T296] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 296, ts 25125377263, free_ts 0 [ 26.398537][ T296] post_alloc_hook+0x1a3/0x1b0 [ 26.403136][ T296] prep_new_page+0x1b/0x110 [ 26.407493][ T296] get_page_from_freelist+0x3550/0x35d0 [ 26.412857][ T296] __alloc_pages+0x27e/0x8f0 [ 26.417294][ T296] new_slab+0x9a/0x4e0 [ 26.421188][ T296] ___slab_alloc+0x39e/0x830 [ 26.425617][ T296] __slab_alloc+0x4a/0x90 [ 26.429782][ T296] kmem_cache_alloc+0x139/0x250 [ 26.434470][ T296] f2fs_alloc_inode+0x26/0x340 [ 26.439189][ T296] iget_locked+0x174/0x860 [ 26.443447][ T296] f2fs_iget+0x55/0x4fe0 [ 26.447526][ T296] f2fs_fill_super+0x4f0f/0x8190 [ 26.452300][ T296] mount_bdev+0x282/0x3b0 [ 26.456473][ T296] f2fs_mount+0x34/0x40 [ 26.460462][ T296] legacy_get_tree+0xf1/0x190 [ 26.464981][ T296] vfs_get_tree+0x88/0x290 [ 26.469227][ T296] page_owner free stack trace missing [ 26.474436][ T296] [ 26.476603][ T296] Memory state around the buggy address: [ 26.482078][ T296] ffff888120ebb000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.489978][ T296] ffff888120ebb080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.497878][ T296] >ffff888120ebb100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.505766][ T296] ^ [ 26.509946][ T296] ffff888120ebb180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.517922][ T296] ffff888120ebb200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.525822][ T296] ================================================================== [ 26.533713][ T296] Disabling lock debugging due to kernel taint [ 26.958509][ T8] device bridge_slave_1 left promiscuous mode [ 26.964472][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.972260][ T8] device bridge_slave_0 left promiscuous mode [ 26.978304][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.986204][ T8] device veth1_macvtap left promiscuous mode [ 26.992308][ T8] device veth0_vlan left promiscuous mode