./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2715044442
<...>
Warning: Permanently added '10.128.1.150' (ED25519) to the list of known hosts.
execve("./syz-executor2715044442", ["./syz-executor2715044442"], 0x7ffe565f5680 /* 10 vars */) = 0
brk(NULL) = 0x555555f4a000
brk(0x555555f4ad00) = 0x555555f4ad00
arch_prctl(ARCH_SET_FS, 0x555555f4a380) = 0
set_tid_address(0x555555f4a650) = 5062
set_robust_list(0x555555f4a660, 24) = 0
rseq(0x555555f4aca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2715044442", 4096) = 28
getrandom("\xe9\x6e\xe3\x74\x6e\x14\x95\x7d", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555555f4ad00
brk(0x555555f6bd00) = 0x555555f6bd00
brk(0x555555f6c000) = 0x555555f6c000
mprotect(0x7fc8a6a81000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc89e5d1000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7fc89e5d1000, 138412032) = 0
[ 74.854151][ T27] audit: type=1400 audit(1704291360.630:83): avc: denied { execmem } for pid=5062 comm="syz-executor271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
[ 74.906819][ T27] audit: type=1400 audit(1704291360.690:84): avc: denied { read write } for pid=5062 comm="syz-executor271" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 74.921675][ T5062] loop0: detected capacity change from 0 to 1024
mkdir("./bus", 0777) = 0
[ 74.931290][ T27] audit: type=1400 audit(1704291360.690:85): avc: denied { open } for pid=5062 comm="syz-executor271" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 74.961938][ T27] audit: type=1400 audit(1704291360.700:86): avc: denied { ioctl } for pid=5062 comm="syz-executor271" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
mount("/dev/loop0", "./bus", "hfsplus", MS_SYNCHRONOUS|MS_MANDLOCK|MS_NODIRATIME|MS_RELATIME|MS_LAZYTIME, "") = 0
[ 74.999934][ T27] audit: type=1400 audit(1704291360.780:87): avc: denied { mounton } for pid=5062 comm="syz-executor271" path="/root/bus" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 75.022734][ T5062] =======================================================
[ 75.022734][ T5062] WARNING: The mand mount option has been deprecated and
[ 75.022734][ T5062] and is ignored by this kernel. Remove the mand
[ 75.022734][ T5062] option from the mount to silence this warning.
[ 75.022734][ T5062] =======================================================
openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
chdir("./bus") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 75.067424][ T27] audit: type=1400 audit(1704291360.850:88): avc: denied { mount } for pid=5062 comm="syz-executor271" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1
[ 75.124234][ T5062] hfsplus: request for non-existent node 256 in B*Tree
[ 75.131618][ T5062] hfsplus: request for non-existent node 256 in B*Tree
[ 75.139813][ T5062] ==================================================================
[ 75.147895][ T5062] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x234/0x250
[ 75.155825][ T5062] Read of size 8 at addr ffff88802093b9c0 by task syz-executor271/5062
[ 75.164048][ T5062]
[ 75.166361][ T5062] CPU: 0 PID: 5062 Comm: syz-executor271 Not tainted 6.7.0-rc8-syzkaller #0
[ 75.175118][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 75.185161][ T5062] Call Trace:
[ 75.188447][ T5062] <TASK>
[ 75.191376][ T5062] dump_stack_lvl+0xd9/0x1b0
[ 75.195979][ T5062] print_report+0xc4/0x620
[ 75.200402][ T5062] ? __virt_addr_valid+0x5e/0x2d0
[ 75.205415][ T5062] ? __phys_addr+0xc6/0x140
[ 75.209908][ T5062] kasan_report+0xda/0x110
[ 75.214323][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 75.219516][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 75.224714][ T5062] hfsplus_bnode_read+0x234/0x250
[ 75.229738][ T5062] hfsplus_bnode_dump+0x2a2/0x3d0
[ 75.234759][ T5062] ? hfsplus_bnode_move+0x910/0x910
[ 75.239953][ T5062] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 75.245413][ T5062] ? hfsplus_bnode_move+0x2a/0x910
[ 75.250518][ T5062] ? srcu_readers_active+0x30/0x250
[ 75.255723][ T5062] ? __mark_inode_dirty+0x297/0xd60
[ 75.260922][ T5062] hfsplus_brec_remove+0x3de/0x4f0
[ 75.266033][ T5062] __hfsplus_delete_attr+0x29e/0x3b0
[ 75.271316][ T5062] ? hfsplus_find_exit+0xc0/0xc0
[ 75.276261][ T5062] ? hfsplus_part_find+0xbb0/0xbb0
[ 75.281376][ T5062] hfsplus_delete_all_attrs+0x26d/0x330
[ 75.286921][ T5062] ? ktime_get_coarse_real_ts64+0x147/0x200
[ 75.292811][ T5062] ? hfsplus_delete_attr+0x300/0x300
[ 75.298095][ T5062] ? rcu_is_watching+0x12/0xb0
[ 75.302865][ T5062] ? __mark_inode_dirty+0x297/0xd60
[ 75.308164][ T5062] hfsplus_delete_cat+0x83b/0xdd0
[ 75.313207][ T5062] ? hfsplus_create_cat+0x10d0/0x10d0
[ 75.318615][ T5062] ? __mutex_lock+0x1a6/0x9d0
[ 75.323314][ T5062] ? mutex_trylock+0x130/0x130
[ 75.328086][ T5062] hfsplus_unlink+0x213/0x7f0
[ 75.332848][ T5062] ? hfsplus_symlink+0x2b0/0x2b0
[ 75.337870][ T5062] ? preempt_count_sub+0x160/0x160
[ 75.343093][ T5062] vfs_unlink+0x2f1/0x900
[ 75.347527][ T5062] do_unlinkat+0x5bc/0x740
[ 75.351956][ T5062] ? __ia32_sys_rmdir+0x110/0x110
[ 75.357078][ T5062] ? __check_object_size+0x323/0x730
[ 75.362365][ T5062] ? getname_flags.part.0+0x1e2/0x4e0
[ 75.367824][ T5062] __x64_sys_unlink+0xc8/0x110
[ 75.372594][ T5062] do_syscall_64+0x40/0x110
[ 75.377098][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 75.382998][ T5062] RIP: 0033:0x7fc8a6a0e5f9
[ 75.387407][ T5062] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 75.407013][ T5062] RSP: 002b:00007ffcc058b358 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 75.415421][ T5062] RAX: ffffffffffffffda RBX: 00007ffcc058b538 RCX: 00007fc8a6a0e5f9
[ 75.423385][ T5062] RDX: 00007fc8a6a0d8f0 RSI: 0000000000000000 RDI: 0000000020000000
[ 75.431350][ T5062] RBP: 00007fc8a6a81610 R08: 000000000000066d R09: 0000000000000000
[ 75.439320][ T5062] R10: 00007ffcc058b220 R11: 0000000000000246 R12: 0000000000000001
[ 75.447285][ T5062] R13: 00007ffcc058b528 R14: 0000000000000001 R15: 0000000000000001
[ 75.455254][ T5062] </TASK>
[ 75.458261][ T5062]
[ 75.460574][ T5062] Allocated by task 5062:
[ 75.464895][ T5062] kasan_save_stack+0x33/0x50
[ 75.469569][ T5062] kasan_set_track+0x25/0x30
[ 75.474175][ T5062] __kasan_kmalloc+0xa3/0xb0
[ 75.478755][ T5062] __kmalloc+0x59/0x90
[ 75.482834][ T5062] __hfs_bnode_create+0x108/0x860
[ 75.487853][ T5062] hfsplus_bnode_find+0x2c4/0xcb0
[ 75.492872][ T5062] hfsplus_brec_find+0x2b9/0x520
[ 75.497802][ T5062] hfsplus_delete_all_attrs+0x246/0x330
[ 75.503366][ T5062] hfsplus_delete_cat+0x83b/0xdd0
[ 75.508400][ T5062] hfsplus_unlink+0x213/0x7f0
[ 75.513078][ T5062] vfs_unlink+0x2f1/0x900
[ 75.517410][ T5062] do_unlinkat+0x5bc/0x740
[ 75.521827][ T5062] __x64_sys_unlink+0xc8/0x110
[ 75.526593][ T5062] do_syscall_64+0x40/0x110
[ 75.531094][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 75.536993][ T5062]
[ 75.539306][ T5062] Last potentially related work creation:
[ 75.545032][ T5062] kasan_save_stack+0x33/0x50
[ 75.549705][ T5062] __kasan_record_aux_stack+0x78/0x80
[ 75.555071][ T5062] insert_work+0x38/0x230
[ 75.559401][ T5062] __queue_work+0x62e/0x11d0
[ 75.564027][ T5062] queue_work_on+0xed/0x110
[ 75.568526][ T5062] call_usermodehelper_exec+0x1d2/0x4c0
[ 75.574155][ T5062] kobject_uevent_env+0x1693/0x1800
[ 75.579356][ T5062] kset_register+0x1b6/0x2a0
[ 75.583946][ T5062] class_register+0x21e/0x330
[ 75.588614][ T5062] mon_bin_init+0x17/0xe0
[ 75.592942][ T5062] mon_init+0xbb/0x210
[ 75.597010][ T5062] do_one_initcall+0x11c/0x650
[ 75.601773][ T5062] kernel_init_freeable+0x687/0xc10
[ 75.606965][ T5062] kernel_init+0x1c/0x2a0
[ 75.611289][ T5062] ret_from_fork+0x45/0x80
[ 75.615700][ T5062] ret_from_fork_asm+0x11/0x20
[ 75.620461][ T5062]
[ 75.622776][ T5062] The buggy address belongs to the object at ffff88802093b900
[ 75.622776][ T5062] which belongs to the cache kmalloc-192 of size 192
[ 75.639953][ T5062] The buggy address is located 40 bytes to the right of
[ 75.639953][ T5062] allocated 152-byte region [ffff88802093b900, ffff88802093b998)
[ 75.654784][ T5062]
[ 75.657097][ T5062] The buggy address belongs to the physical page:
[ 75.663495][ T5062] page:ffffea0000824ec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802093bb00 pfn:0x2093b
[ 75.675041][ T5062] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 75.682574][ T5062] page_type: 0xe()
[ 75.686290][ T5062] raw: 00fff00000000800 ffff888013040000 ffffea0000828410 ffff888013041140
[ 75.694876][ T5062] raw: ffff88802093bb00 ffff88802093b000 000000010000000e 0000000000000000
[ 75.703445][ T5062] page dumped because: kasan: bad access detected
[ 75.709843][ T5062] page_owner tracks the page as allocated
[ 75.715541][ T5062] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 10221424282, free_ts 0
[ 75.733943][ T5062] post_alloc_hook+0x2d0/0x350
[ 75.738709][ T5062] get_page_from_freelist+0xa25/0x36d0
[ 75.744166][ T5062] __alloc_pages+0x22e/0x2420
[ 75.748838][ T5062] cache_grow_begin+0x99/0x3a0
[ 75.753601][ T5062] cache_alloc_refill+0x295/0x3b0
[ 75.758628][ T5062] __kmem_cache_alloc_node+0x37f/0x460
[ 75.764101][ T5062] __kmalloc_node+0x4c/0x90
[ 75.768596][ T5062] setup_kmem_cache_node+0x1f6/0x3d0
[ 75.773882][ T5062] do_tune_cpucache+0x188/0x2d0
[ 75.778734][ T5062] enable_cpucache+0x60/0xc0
[ 75.783328][ T5062] __kmem_cache_create+0x1a9/0x230
[ 75.788446][ T5062] kmem_cache_create_usercopy+0x1e3/0x370
[ 75.794177][ T5062] kmem_cache_create+0x11/0x20
[ 75.799107][ T5062] isp1760_init_kmem_once+0x55/0xd0
[ 75.804394][ T5062] isp1760_init+0xf/0x90
[ 75.808636][ T5062] do_one_initcall+0x11c/0x650
[ 75.813398][ T5062] page_owner free stack trace missing
[ 75.818750][ T5062]
[ 75.821064][ T5062] Memory state around the buggy address:
[ 75.826679][ T5062] ffff88802093b880: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 75.834731][ T5062] ffff88802093b900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 75.842784][ T5062] >ffff88802093b980: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 75.850833][ T5062] ^
[ 75.856972][ T5062] ffff88802093ba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.865023][ T5062] ffff88802093ba80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 75.873070][ T5062] ==================================================================
[ 75.881745][ T5062] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.883417][ T27] audit: type=1400 audit(1704291361.660:89): avc: denied { append } for pid=4496 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 75.883496][ T27] audit: type=1400 audit(1704291361.660:90): avc: denied { open } for pid=4496 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 75.883547][ T27] audit: type=1400 audit(1704291361.660:91): avc: denied { getattr } for pid=4496 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 75.955920][ T5062] CPU: 0 PID: 5062 Comm: syz-executor271 Not tainted 6.7.0-rc8-syzkaller #0
[ 75.964584][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 75.974651][ T5062] Call Trace:
[ 75.977919][ T5062] <TASK>
[ 75.980848][ T5062] dump_stack_lvl+0xd9/0x1b0
[ 75.985439][ T5062] panic+0x6dc/0x790
[ 75.989339][ T5062] ? panic_smp_self_stop+0xa0/0xa0
[ 75.994462][ T5062] ? preempt_schedule_thunk+0x1a/0x30
[ 75.999867][ T5062] ? preempt_schedule_common+0x45/0xc0
[ 76.005347][ T5062] ? check_panic_on_warn+0x1f/0xb0
[ 76.010458][ T5062] check_panic_on_warn+0xab/0xb0
[ 76.015399][ T5062] end_report+0x108/0x150
[ 76.019725][ T5062] kasan_report+0xea/0x110
[ 76.024149][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 76.029351][ T5062] ? hfsplus_bnode_read+0x234/0x250
[ 76.034543][ T5062] hfsplus_bnode_read+0x234/0x250
[ 76.039562][ T5062] hfsplus_bnode_dump+0x2a2/0x3d0
[ 76.044584][ T5062] ? hfsplus_bnode_move+0x910/0x910
[ 76.049864][ T5062] ? hfsplus_bnode_write_u16+0x84/0xb0
[ 76.055318][ T5062] ? hfsplus_bnode_move+0x2a/0x910
[ 76.060425][ T5062] ? srcu_readers_active+0x30/0x250
[ 76.065618][ T5062] ? __mark_inode_dirty+0x297/0xd60
[ 76.070853][ T5062] hfsplus_brec_remove+0x3de/0x4f0
[ 76.075964][ T5062] __hfsplus_delete_attr+0x29e/0x3b0
[ 76.081251][ T5062] ? hfsplus_find_exit+0xc0/0xc0
[ 76.086192][ T5062] ? hfsplus_part_find+0xbb0/0xbb0
[ 76.091302][ T5062] hfsplus_delete_all_attrs+0x26d/0x330
[ 76.096852][ T5062] ? ktime_get_coarse_real_ts64+0x147/0x200
[ 76.102742][ T5062] ? hfsplus_delete_attr+0x300/0x300
[ 76.108030][ T5062] ? rcu_is_watching+0x12/0xb0
[ 76.112789][ T5062] ? __mark_inode_dirty+0x297/0xd60
[ 76.117985][ T5062] hfsplus_delete_cat+0x83b/0xdd0
[ 76.123008][ T5062] ? hfsplus_create_cat+0x10d0/0x10d0
[ 76.128376][ T5062] ? __mutex_lock+0x1a6/0x9d0
[ 76.133058][ T5062] ? mutex_trylock+0x130/0x130
[ 76.137827][ T5062] hfsplus_unlink+0x213/0x7f0
[ 76.142500][ T5062] ? hfsplus_symlink+0x2b0/0x2b0
[ 76.147430][ T5062] ? preempt_count_sub+0x160/0x160
[ 76.152538][ T5062] vfs_unlink+0x2f1/0x900
[ 76.156872][ T5062] do_unlinkat+0x5bc/0x740
[ 76.161295][ T5062] ? __ia32_sys_rmdir+0x110/0x110
[ 76.166325][ T5062] ? __check_object_size+0x323/0x730
[ 76.171643][ T5062] ? getname_flags.part.0+0x1e2/0x4e0
[ 76.177018][ T5062] __x64_sys_unlink+0xc8/0x110
[ 76.181785][ T5062] do_syscall_64+0x40/0x110
[ 76.186305][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 76.192208][ T5062] RIP: 0033:0x7fc8a6a0e5f9
[ 76.196618][ T5062] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 76.216222][ T5062] RSP: 002b:00007ffcc058b358 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 76.224637][ T5062] RAX: ffffffffffffffda RBX: 00007ffcc058b538 RCX: 00007fc8a6a0e5f9
[ 76.232600][ T5062] RDX: 00007fc8a6a0d8f0 RSI: 0000000000000000 RDI: 0000000020000000
[ 76.240562][ T5062] RBP: 00007fc8a6a81610 R08: 000000000000066d R09: 0000000000000000
[ 76.248535][ T5062] R10: 00007ffcc058b220 R11: 0000000000000246 R12: 0000000000000001
[ 76.256587][ T5062] R13: 00007ffcc058b528 R14: 0000000000000001 R15: 0000000000000001
[ 76.264643][ T5062] </TASK>
[ 76.267867][ T5062] Kernel Offset: disabled
[ 76.272176][ T5062] Rebooting in 86400 seconds..