./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4051571571
<...>
Warning: Permanently added '10.128.1.168' (ED25519) to the list of known hosts.
execve("./syz-executor4051571571", ["./syz-executor4051571571"], 0x7ffcbc7bbc90 /* 10 vars */) = 0
brk(NULL) = 0x5555565c1000
brk(0x5555565c1d00) = 0x5555565c1d00
arch_prctl(ARCH_SET_FS, 0x5555565c1380) = 0
set_tid_address(0x5555565c1650) = 5060
set_robust_list(0x5555565c1660, 24) = 0
rseq(0x5555565c1ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor4051571571", 4096) = 28
getrandom("\xc1\xc0\xd9\x96\x35\x61\xea\xbb", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555565c1d00
brk(0x5555565e2d00) = 0x5555565e2d00
brk(0x5555565e3000) = 0x5555565e3000
mprotect(0x7fd647687000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd63f1d6000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7fd63f1d6000, 138412032) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file1", 0777) = 0
[ 71.946725][ T5060] loop0: detected capacity change from 0 to 1024
[ 71.977920][ T5060] =======================================================
[ 71.977920][ T5060] WARNING: The mand mount option has been deprecated and
mount("/dev/loop0", "./file1", "hfsplus", MS_SYNCHRONOUS|MS_MANDLOCK, "") = 0
openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
chdir("./file1") = 0
ioctl(4, LOOP_CLR_FD) = 0
[ 71.977920][ T5060] and is ignored by this kernel. Remove the mand
[ 71.977920][ T5060] option from the mount to silence this warning.
[ 71.977920][ T5060] =======================================================
close(4) = 0
openat(AT_FDCWD, ".", O_RDONLY) = 4
[ 72.070977][ T5060] ==================================================================
[ 72.079134][ T5060] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x57a/0x11f0
[ 72.086919][ T5060] Read of size 2 at addr ffff88807aa4840c by task syz-executor405/5060
[ 72.095260][ T5060]
[ 72.097613][ T5060] CPU: 1 PID: 5060 Comm: syz-executor405 Not tainted 6.7.0-rc3-syzkaller-00284-g815fb87b7530 #0
[ 72.108049][ T5060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
[ 72.118135][ T5060] Call Trace:
[ 72.121432][ T5060] <TASK>
[ 72.124377][ T5060] dump_stack_lvl+0x1e7/0x2d0
[ 72.129108][ T5060] ? nf_tcp_handle_invalid+0x650/0x650
[ 72.134570][ T5060] ? panic+0x850/0x850
[ 72.138634][ T5060] ? _printk+0xd5/0x120
[ 72.142785][ T5060] print_report+0x163/0x540
[ 72.147288][ T5060] ? __virt_addr_valid+0x22f/0x2e0
[ 72.152396][ T5060] ? __phys_addr+0xba/0x170
[ 72.156895][ T5060] ? hfsplus_uni2asc+0x57a/0x11f0
[ 72.161930][ T5060] kasan_report+0x142/0x170
[ 72.166427][ T5060] ? hfsplus_uni2asc+0x57a/0x11f0
[ 72.171452][ T5060] hfsplus_uni2asc+0x57a/0x11f0
[ 72.176319][ T5060] ? __asan_memcpy+0x40/0x70
[ 72.180927][ T5060] hfsplus_readdir+0x92c/0x1310
[ 72.185792][ T5060] ? hfsplus_rename+0x1c0/0x1c0
[ 72.190677][ T5060] ? __mutex_lock+0x2ee/0xd60
[ 72.195357][ T5060] ? iterate_dir+0xd7/0x540
[ 72.199951][ T5060] ? down_read_interruptible+0xc50/0xc50
[ 72.205593][ T5060] ? __fdget_pos+0x2b0/0x340
[ 72.210187][ T5060] ? fsnotify_perm+0x43e/0x5a0
[ 72.214955][ T5060] iterate_dir+0x1cd/0x540
[ 72.219375][ T5060] __se_sys_getdents64+0x20d/0x4f0
[ 72.224502][ T5060] ? lockdep_hardirqs_on_prepare+0x43c/0x780
[ 72.230487][ T5060] ? __x64_sys_getdents64+0x80/0x80
[ 72.235780][ T5060] ? filldir+0x6a0/0x6a0
[ 72.240039][ T5060] ? syscall_enter_from_user_mode+0xa4/0x2d0
[ 72.246035][ T5060] ? syscall_enter_from_user_mode+0xf5/0x2d0
[ 72.252018][ T5060] do_syscall_64+0x45/0x110
[ 72.256523][ T5060] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 72.262438][ T5060] RIP: 0033:0x7fd6476138b9
[ 72.266848][ T5060] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 72.286446][ T5060] RSP: 002b:00007ffe9a803288 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 72.294853][ T5060] RAX: ffffffffffffffda RBX: 00007ffe9a803458 RCX: 00007fd6476138b9
[ 72.302823][ T5060] RDX: 00000000000000a5 RSI: 00000000200002c0 RDI: 0000000000000004
[ 72.310790][ T5060] RBP: 00007fd647687610 R08: 0000000000000000 R09: 00007ffe9a803458
[ 72.318756][ T5060] R10: 0000000000000632 R11: 0000000000000246 R12: 0000000000000001
[ 72.326757][ T5060] R13: 00007ffe9a803448 R14: 0000000000000001 R15: 0000000000000001
[ 72.334731][ T5060] </TASK>
[ 72.337744][ T5060]
[ 72.340076][ T5060] Allocated by task 5060:
[ 72.344479][ T5060] kasan_set_track+0x4f/0x70
[ 72.349070][ T5060] __kasan_kmalloc+0x98/0xb0
[ 72.353655][ T5060] __kmalloc+0xb3/0x1a0
[ 72.357816][ T5060] hfsplus_find_init+0x85/0x1c0
[ 72.362665][ T5060] hfsplus_readdir+0x20e/0x1310
[ 72.367514][ T5060] iterate_dir+0x1cd/0x540
[ 72.371926][ T5060] __se_sys_getdents64+0x20d/0x4f0
[ 72.377037][ T5060] do_syscall_64+0x45/0x110
[ 72.381551][ T5060] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 72.387444][ T5060]
[ 72.389775][ T5060] The buggy address belongs to the object at ffff88807aa48000
[ 72.389775][ T5060] which belongs to the cache kmalloc-2k of size 2048
[ 72.403821][ T5060] The buggy address is located 0 bytes to the right of
[ 72.403821][ T5060] allocated 1036-byte region [ffff88807aa48000, ffff88807aa4840c)
[ 72.418390][ T5060]
[ 72.420708][ T5060] The buggy address belongs to the physical page:
[ 72.427121][ T5060] page:ffffea0001ea9200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7aa48
[ 72.437272][ T5060] head:ffffea0001ea9200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 72.446200][ T5060] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 72.454168][ T5060] page_type: 0xffffffff()
[ 72.458495][ T5060] raw: 00fff00000000840 ffff888012c42000 dead000000000122 0000000000000000
[ 72.467261][ T5060] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 72.475836][ T5060] page dumped because: kasan: bad access detected
[ 72.482241][ T5060] page_owner tracks the page as allocated
[ 72.487943][ T5060] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5060, tgid 5060 (syz-executor405), ts 72070699557, free_ts 72046545908
[ 72.509558][ T5060] post_alloc_hook+0x1e6/0x210
[ 72.514317][ T5060] get_page_from_freelist+0x33ea/0x3570
[ 72.519877][ T5060] __alloc_pages+0x255/0x680
[ 72.524463][ T5060] alloc_pages_mpol+0x3de/0x640
[ 72.529307][ T5060] alloc_slab_page+0x6a/0x170
[ 72.533997][ T5060] new_slab+0x84/0x2f0
[ 72.538086][ T5060] ___slab_alloc+0xc8a/0x1330
[ 72.542764][ T5060] __kmem_cache_alloc_node+0x21d/0x300
[ 72.548223][ T5060] __kmalloc+0xa2/0x1a0
[ 72.552369][ T5060] hfsplus_find_init+0x85/0x1c0
[ 72.557217][ T5060] hfsplus_readdir+0x20e/0x1310
[ 72.562065][ T5060] iterate_dir+0x1cd/0x540
[ 72.566480][ T5060] __se_sys_getdents64+0x20d/0x4f0
[ 72.571592][ T5060] do_syscall_64+0x45/0x110
[ 72.576096][ T5060] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 72.581995][ T5060] page last free stack trace:
[ 72.586670][ T5060] free_unref_page_prepare+0x931/0xa60
[ 72.592126][ T5060] free_unref_page+0x37/0x3f0
[ 72.596796][ T5060] page_to_skb+0x3dc/0x9a0
[ 72.601226][ T5060] receive_buf+0x3b9/0x3800
[ 72.605729][ T5060] virtnet_poll+0x75a/0x1670
[ 72.610334][ T5060] __napi_poll+0xc7/0x470
[ 72.614663][ T5060] net_rx_action+0x78b/0x1010
[ 72.619334][ T5060] __do_softirq+0x2b8/0x939
[ 72.623833][ T5060]
[ 72.626154][ T5060] Memory state around the buggy address:
[ 72.631777][ T5060] ffff88807aa48300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 72.639845][ T5060] ffff88807aa48380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 72.647899][ T5060] >ffff88807aa48400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 72.655949][ T5060] ^
[ 72.660278][ T5060] ffff88807aa48480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 72.668344][ T5060] ffff88807aa48500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 72.676392][ T5060] ==================================================================
[ 72.684643][ T5060] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 72.691859][ T5060] CPU: 1 PID: 5060 Comm: syz-executor405 Not tainted 6.7.0-rc3-syzkaller-00284-g815fb87b7530 #0
[ 72.702291][ T5060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
[ 72.712378][ T5060] Call Trace:
[ 72.715668][ T5060] <TASK>
[ 72.718611][ T5060] dump_stack_lvl+0x1e7/0x2d0
[ 72.723308][ T5060] ? nf_tcp_handle_invalid+0x650/0x650
[ 72.728779][ T5060] ? panic+0x850/0x850
[ 72.732851][ T5060] ? lockdep_hardirqs_on_prepare+0x43c/0x780
[ 72.738932][ T5060] ? vscnprintf+0x5d/0x80
[ 72.743283][ T5060] panic+0x349/0x850
[ 72.747183][ T5060] ? check_panic_on_warn+0x21/0xa0
[ 72.752299][ T5060] ? __memcpy_flushcache+0x2b0/0x2b0
[ 72.757587][ T5060] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 72.763659][ T5060] ? _raw_spin_unlock+0x40/0x40
[ 72.768519][ T5060] check_panic_on_warn+0x82/0xa0
[ 72.773473][ T5060] ? hfsplus_uni2asc+0x57a/0x11f0
[ 72.778505][ T5060] end_report+0x6e/0x140
[ 72.782763][ T5060] kasan_report+0x153/0x170
[ 72.787281][ T5060] ? hfsplus_uni2asc+0x57a/0x11f0
[ 72.792323][ T5060] hfsplus_uni2asc+0x57a/0x11f0
[ 72.797196][ T5060] ? __asan_memcpy+0x40/0x70
[ 72.801820][ T5060] hfsplus_readdir+0x92c/0x1310
[ 72.806687][ T5060] ? hfsplus_rename+0x1c0/0x1c0
[ 72.811583][ T5060] ? __mutex_lock+0x2ee/0xd60
[ 72.816276][ T5060] ? iterate_dir+0xd7/0x540
[ 72.820787][ T5060] ? down_read_interruptible+0xc50/0xc50
[ 72.826442][ T5060] ? __fdget_pos+0x2b0/0x340
[ 72.831050][ T5060] ? fsnotify_perm+0x43e/0x5a0
[ 72.835825][ T5060] iterate_dir+0x1cd/0x540
[ 72.840254][ T5060] __se_sys_getdents64+0x20d/0x4f0
[ 72.845410][ T5060] ? lockdep_hardirqs_on_prepare+0x43c/0x780
[ 72.851403][ T5060] ? __x64_sys_getdents64+0x80/0x80
[ 72.856612][ T5060] ? filldir+0x6a0/0x6a0
[ 72.860868][ T5060] ? syscall_enter_from_user_mode+0xa4/0x2d0
[ 72.866851][ T5060] ? syscall_enter_from_user_mode+0xf5/0x2d0
[ 72.872855][ T5060] do_syscall_64+0x45/0x110
[ 72.877418][ T5060] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 72.883337][ T5060] RIP: 0033:0x7fd6476138b9
[ 72.887754][ T5060] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 72.907366][ T5060] RSP: 002b:00007ffe9a803288 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 72.915788][ T5060] RAX: ffffffffffffffda RBX: 00007ffe9a803458 RCX: 00007fd6476138b9
[ 72.923772][ T5060] RDX: 00000000000000a5 RSI: 00000000200002c0 RDI: 0000000000000004
[ 72.931922][ T5060] RBP: 00007fd647687610 R08: 0000000000000000 R09: 00007ffe9a803458
[ 72.939903][ T5060] R10: 0000000000000632 R11: 0000000000000246 R12: 0000000000000001
[ 72.947877][ T5060] R13: 00007ffe9a803448 R14: 0000000000000001 R15: 0000000000000001
[ 72.955864][ T5060] </TASK>
[ 72.959159][ T5060] Kernel Offset: disabled
[ 72.963482][ T5060] Rebooting in 86400 seconds..