./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor152096405 <...> Warning: Permanently added '10.128.1.5' (ED25519) to the list of known hosts. execve("./syz-executor152096405", ["./syz-executor152096405"], 0x7ffee2c8e730 /* 10 vars */) = 0 brk(NULL) = 0x55555c503000 brk(0x55555c503e00) = 0x55555c503e00 arch_prctl(ARCH_SET_FS, 0x55555c503480) = 0 set_tid_address(0x55555c503750) = 5830 set_robust_list(0x55555c503760, 24) = 0 rseq(0x55555c503da0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor152096405", 4096) = 27 getrandom("\x3f\x75\x6f\xc8\xb2\x9a\x61\x21", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555c503e00 brk(0x55555c524e00) = 0x55555c524e00 brk(0x55555c525000) = 0x55555c525000 mprotect(0x7f9b70903000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5830}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5830}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5830}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5830}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5830}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5830}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5830}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f9b70846080, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f9b7084e550}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f9b70846080, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f9b7084e550}, NULL, 8) = 0 mkdir("./syzkaller.SR6TPi", 0700) = 0 chmod("./syzkaller.SR6TPi", 0777) = 0 chdir("./syzkaller.SR6TPi") = 0 write(1, "executing program\n", 18executing program ) = 18 futex(0x7f9b709096ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f9b708ac930, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9b7084e550}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9b70815000 mprotect(0x7f9b70816000, 131072, PROT_READ|PROT_WRITE) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9b70835990, parent_tid=0x7f9b70835990, exit_signal=0, stack=0x7f9b70815000, stack_size=0x20240, tls=0x7f9b708356c0}./strace-static-x86_64: Process 5833 attached [pid 5833] rseq(0x7f9b70835fe0, 0x20, 0, 0x53053053 [pid 5830] <... clone3 resumed> => {parent_tid=[5833]}, 88) = 5833 [pid 5833] <... rseq resumed>) = 0 [pid 5830] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] set_robust_list(0x7f9b708359a0, 24 [pid 5830] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... set_robust_list resumed>) = 0 [pid 5830] futex(0x7f9b709096a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] <... futex resumed>) = 0 [pid 5830] futex(0x7f9b709096ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5833] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] memfd_create("syzkaller", 0) = 3 [pid 5833] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b68400000 [pid 5833] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5833] munmap(0x7f9b68400000, 138412032) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5833] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5833] close(3) = 0 [pid 5833] close(4) = 0 [pid 5833] mkdir("./file1", 0777) = 0 [ 57.345189][ T5833] loop0: detected capacity change from 0 to 32768 [ 57.382061][ T5833] ======================================================= [ 57.382061][ T5833] WARNING: The mand mount option has been deprecated and [ 57.382061][ T5833] and is ignored by this kernel. Remove the mand [ 57.382061][ T5833] option from the mount to silence this warning. [ 57.382061][ T5833] ======================================================= [ 57.428953][ T5833] JBD2: Ignoring recovery information on journal [pid 5833] mount("/dev/loop0", "./file1", "ocfs2", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME, "acl,heartbeat=none,dir_resv_level=00003,coherency=full,coherency=full,localflocks,coherency=full,noa"...) = 0 [pid 5833] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5833] chdir("./file1") = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5833] futex(0x7f9b709096ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... futex resumed>) = 0 [pid 5833] <... futex resumed>) = 1 [pid 5830] futex(0x7f9b709096a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_SYNC|O_DIRECT, 000 [pid 5830] <... futex resumed>) = 0 [ 57.452571][ T5833] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 57.500388][ T5833] ================================================================== [ 57.508571][ T5833] BUG: KASAN: use-after-free in ocfs2_reserve_suballoc_bits+0x1023/0x4eb0 [ 57.517098][ T5833] Read of size 4 at addr ffff888071539004 by task syz-executor152/5833 [ 57.525339][ T5833] [ 57.527670][ T5833] CPU: 1 UID: 0 PID: 5833 Comm: syz-executor152 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 [ 57.538764][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 57.548812][ T5833] Call Trace: [ 57.552082][ T5833] [ 57.555011][ T5833] dump_stack_lvl+0x241/0x360 [ 57.559702][ T5833] ? __pfx_dump_stack_lvl+0x10/0x10 [ 57.564903][ T5833] ? __pfx__printk+0x10/0x10 [ 57.569488][ T5833] ? _printk+0xd5/0x120 [ 57.573632][ T5833] ? __virt_addr_valid+0x183/0x530 [ 57.578733][ T5833] ? __virt_addr_valid+0x183/0x530 [ 57.583837][ T5833] print_report+0x169/0x550 [ 57.588330][ T5833] ? __virt_addr_valid+0x183/0x530 [ 57.593423][ T5833] ? __virt_addr_valid+0x183/0x530 [ 57.598514][ T5833] ? __virt_addr_valid+0x45f/0x530 [ 57.603607][ T5833] ? __phys_addr+0xba/0x170 [ 57.608094][ T5833] ? ocfs2_reserve_suballoc_bits+0x1023/0x4eb0 [ 57.614235][ T5833] kasan_report+0x143/0x180 [ 57.618745][ T5833] ? ocfs2_reserve_suballoc_bits+0x1023/0x4eb0 [ 57.624906][ T5833] ocfs2_reserve_suballoc_bits+0x1023/0x4eb0 [ 57.630881][ T5833] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 57.636844][ T5833] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 57.643158][ T5833] ? lockdep_hardirqs_on+0x99/0x150 [ 57.648336][ T5833] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 57.654648][ T5833] ? __pfx_ocfs2_reserve_suballoc_bits+0x10/0x10 [ 57.660963][ T5833] ? stack_depot_save_flags+0x6e4/0x830 [ 57.666487][ T5833] ? kasan_save_track+0x51/0x80 [ 57.671320][ T5833] ? kasan_save_track+0x3f/0x80 [ 57.676160][ T5833] ? __kasan_kmalloc+0x98/0xb0 [ 57.680905][ T5833] ? __kmalloc_cache_noprof+0x19c/0x2c0 [ 57.686427][ T5833] ? ocfs2_reserve_new_metadata_blocks+0x117/0x9c0 [ 57.692911][ T5833] ? ocfs2_mknod+0x143a/0x2b40 [ 57.697653][ T5833] ? ocfs2_create+0x1ab/0x480 [ 57.702310][ T5833] ? path_openat+0x1c03/0x3590 [ 57.707053][ T5833] ? do_filp_open+0x235/0x490 [ 57.711728][ T5833] ? do_sys_openat2+0x13e/0x1d0 [ 57.716556][ T5833] ? __x64_sys_openat+0x247/0x2a0 [ 57.721576][ T5833] ? do_syscall_64+0xf3/0x230 [ 57.726250][ T5833] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.732308][ T5833] ? __kasan_kmalloc+0x98/0xb0 [ 57.737055][ T5833] ? ocfs2_reserve_new_metadata_blocks+0x117/0x9c0 [ 57.743541][ T5833] ? __kmalloc_cache_noprof+0x19c/0x2c0 [ 57.749068][ T5833] ocfs2_reserve_new_metadata_blocks+0x41c/0x9c0 [ 57.755381][ T5833] ? __pfx_ocfs2_reserve_new_metadata_blocks+0x10/0x10 [ 57.762218][ T5833] ? __pfx_ocfs2_calc_xattr_init+0x10/0x10 [ 57.768008][ T5833] ? ocfs2_init_security_get+0x12d/0x1a0 [ 57.773628][ T5833] ocfs2_mknod+0x143a/0x2b40 [ 57.778212][ T5833] ? __pfx_validate_chain+0x10/0x10 [ 57.783396][ T5833] ? __pfx_ocfs2_mknod+0x10/0x10 [ 57.788317][ T5833] ? __lock_acquire+0x1384/0x2050 [ 57.793347][ T5833] ? __pfx_lock_acquire+0x10/0x10 [ 57.798356][ T5833] ? ocfs2_inode_unlock+0xa7/0x150 [ 57.803451][ T5833] ? __pfx_lock_release+0x10/0x10 [ 57.808458][ T5833] ? do_raw_spin_lock+0x14f/0x370 [ 57.813470][ T5833] ? do_raw_spin_unlock+0x13c/0x8b0 [ 57.818652][ T5833] ? _raw_spin_unlock+0x28/0x50 [ 57.823489][ T5833] ? rcu_is_watching+0x15/0xb0 [ 57.828234][ T5833] ? ocfs2_lookup+0x503/0xa60 [ 57.832900][ T5833] ocfs2_create+0x1ab/0x480 [ 57.837385][ T5833] ? __pfx_ocfs2_create+0x10/0x10 [ 57.842398][ T5833] ? bpf_lsm_inode_create+0x9/0x10 [ 57.847495][ T5833] ? security_inode_create+0xbe/0x340 [ 57.852858][ T5833] ? __pfx_ocfs2_create+0x10/0x10 [ 57.857868][ T5833] path_openat+0x1c03/0x3590 [ 57.862467][ T5833] ? __pfx_path_openat+0x10/0x10 [ 57.867389][ T5833] do_filp_open+0x235/0x490 [ 57.871877][ T5833] ? __pfx_do_filp_open+0x10/0x10 [ 57.876888][ T5833] ? _raw_spin_unlock+0x28/0x50 [ 57.881729][ T5833] ? alloc_fd+0x5a1/0x640 [ 57.886045][ T5833] do_sys_openat2+0x13e/0x1d0 [ 57.890702][ T5833] ? __pfx_do_sys_openat2+0x10/0x10 [ 57.895882][ T5833] ? lockdep_hardirqs_on+0x99/0x150 [ 57.901064][ T5833] ? _raw_spin_unlock_irq+0x2e/0x50 [ 57.906244][ T5833] ? ptrace_notify+0x279/0x380 [ 57.910993][ T5833] __x64_sys_openat+0x247/0x2a0 [ 57.915829][ T5833] ? __pfx___x64_sys_openat+0x10/0x10 [ 57.921185][ T5833] ? do_syscall_64+0x100/0x230 [ 57.925930][ T5833] do_syscall_64+0xf3/0x230 [ 57.930416][ T5833] ? clear_bhb_loop+0x35/0x90 [ 57.935074][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.940967][ T5833] RIP: 0033:0x7f9b708853f9 [ 57.945364][ T5833] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 57.964949][ T5833] RSP: 002b:00007f9b70835168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 57.973348][ T5833] RAX: ffffffffffffffda RBX: 00007f9b709096a8 RCX: 00007f9b708853f9 [ 57.981301][ T5833] RDX: 0000000000105042 RSI: 0000000020000080 RDI: 00000000ffffff9c [ 57.989262][ T5833] RBP: 00007f9b709096a0 R08: 00007f9b708356c0 R09: 0000000000000000 [ 57.997215][ T5833] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9b709096ac [ 58.005167][ T5833] R13: 0000000000000000 R14: 00007ffee6ee2da0 R15: 00007ffee6ee2e88 [ 58.013122][ T5833] [ 58.016123][ T5833] [ 58.018425][ T5833] The buggy address belongs to the physical page: [ 58.024820][ T5833] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x71539 [ 58.033572][ T5833] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 58.040663][ T5833] page_type: f0(buddy) [ 58.044711][ T5833] raw: 00fff00000000000 ffff88813fffc590 ffff88813fffc590 0000000000000000 [ 58.053271][ T5833] raw: 0000000000000000 0000000000000000 00000000f0000000 0000000000000000 [ 58.061851][ T5833] page dumped because: kasan: bad access detected [ 58.068249][ T5833] page_owner tracks the page as freed [ 58.073597][ T5833] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 14059647817, free_ts 15166247582 [ 58.088511][ T5833] post_alloc_hook+0x1f3/0x230 [ 58.093258][ T5833] alloc_contig_range_noprof+0x821/0xe00 [ 58.098875][ T5833] alloc_contig_pages_noprof+0x4b3/0x5c0 [ 58.104498][ T5833] debug_vm_pgtable_alloc_huge_page+0xaf/0x100 [ 58.110633][ T5833] init_args+0x83b/0xb20 [ 58.114855][ T5833] debug_vm_pgtable+0xe0/0x550 [ 58.119595][ T5833] do_one_initcall+0x248/0x880 [ 58.124354][ T5833] do_initcall_level+0x157/0x210 [ 58.129269][ T5833] do_initcalls+0x3f/0x80 [ 58.133576][ T5833] kernel_init_freeable+0x435/0x5d0 [ 58.138753][ T5833] kernel_init+0x1d/0x2b0 [ 58.143066][ T5833] ret_from_fork+0x4b/0x80 [ 58.147479][ T5833] ret_from_fork_asm+0x1a/0x30 [ 58.152223][ T5833] page last free pid 1 tgid 1 stack trace: [ 58.158001][ T5833] free_unref_page+0xcd0/0xf00 [ 58.162745][ T5833] free_contig_range+0x152/0x550 [ 58.167664][ T5833] destroy_args+0x8a/0x840 [ 58.172062][ T5833] debug_vm_pgtable+0x4be/0x550 [ 58.176900][ T5833] do_one_initcall+0x248/0x880 [ 58.181648][ T5833] do_initcall_level+0x157/0x210 [ 58.186564][ T5833] do_initcalls+0x3f/0x80 [ 58.190875][ T5833] kernel_init_freeable+0x435/0x5d0 [ 58.196076][ T5833] kernel_init+0x1d/0x2b0 [ 58.200386][ T5833] ret_from_fork+0x4b/0x80 [ 58.204807][ T5833] ret_from_fork_asm+0x1a/0x30 [ 58.209558][ T5833] [ 58.211861][ T5833] Memory state around the buggy address: [ 58.217468][ T5833] ffff888071538f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.225504][ T5833] ffff888071538f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.233640][ T5833] >ffff888071539000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.241768][ T5833] ^ [ 58.245816][ T5833] ffff888071539080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.253863][ T5833] ffff888071539100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.261901][ T5833] ================================================================== [ 58.270426][ T5833] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 58.277632][ T5833] CPU: 1 UID: 0 PID: 5833 Comm: syz-executor152 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 [ 58.288744][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 58.298808][ T5833] Call Trace: [ 58.302087][ T5833] [ 58.305015][ T5833] dump_stack_lvl+0x241/0x360 [ 58.309692][ T5833] ? __pfx_dump_stack_lvl+0x10/0x10 [ 58.314886][ T5833] ? __pfx__printk+0x10/0x10 [ 58.319467][ T5833] ? preempt_schedule+0xe1/0xf0 [ 58.324308][ T5833] ? vscnprintf+0x5d/0x90 [ 58.328628][ T5833] panic+0x349/0x880 [ 58.332516][ T5833] ? check_panic_on_warn+0x21/0xb0 [ 58.337615][ T5833] ? __pfx_panic+0x10/0x10 [ 58.342040][ T5833] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 58.348031][ T5833] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 58.354367][ T5833] ? print_report+0x502/0x550 [ 58.359052][ T5833] check_panic_on_warn+0x86/0xb0 [ 58.363992][ T5833] ? ocfs2_reserve_suballoc_bits+0x1023/0x4eb0 [ 58.370163][ T5833] end_report+0x77/0x160 [ 58.374403][ T5833] kasan_report+0x154/0x180 [ 58.378904][ T5833] ? ocfs2_reserve_suballoc_bits+0x1023/0x4eb0 [ 58.385056][ T5833] ocfs2_reserve_suballoc_bits+0x1023/0x4eb0 [ 58.391036][ T5833] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 58.397074][ T5833] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 58.403428][ T5833] ? lockdep_hardirqs_on+0x99/0x150 [ 58.408645][ T5833] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 58.414989][ T5833] ? __pfx_ocfs2_reserve_suballoc_bits+0x10/0x10 [ 58.421328][ T5833] ? stack_depot_save_flags+0x6e4/0x830 [ 58.426875][ T5833] ? kasan_save_track+0x51/0x80 [ 58.431726][ T5833] ? kasan_save_track+0x3f/0x80 [ 58.436575][ T5833] ? __kasan_kmalloc+0x98/0xb0 [ 58.441332][ T5833] ? __kmalloc_cache_noprof+0x19c/0x2c0 [ 58.446869][ T5833] ? ocfs2_reserve_new_metadata_blocks+0x117/0x9c0 [ 58.453366][ T5833] ? ocfs2_mknod+0x143a/0x2b40 [ 58.458122][ T5833] ? ocfs2_create+0x1ab/0x480 [ 58.462801][ T5833] ? path_openat+0x1c03/0x3590 [ 58.467554][ T5833] ? do_filp_open+0x235/0x490 [ 58.472342][ T5833] ? do_sys_openat2+0x13e/0x1d0 [ 58.477195][ T5833] ? __x64_sys_openat+0x247/0x2a0 [ 58.482211][ T5833] ? do_syscall_64+0xf3/0x230 [ 58.486888][ T5833] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.492966][ T5833] ? __kasan_kmalloc+0x98/0xb0 [ 58.497758][ T5833] ? ocfs2_reserve_new_metadata_blocks+0x117/0x9c0 [ 58.504262][ T5833] ? __kmalloc_cache_noprof+0x19c/0x2c0 [ 58.509824][ T5833] ocfs2_reserve_new_metadata_blocks+0x41c/0x9c0 [ 58.516160][ T5833] ? __pfx_ocfs2_reserve_new_metadata_blocks+0x10/0x10 [ 58.523008][ T5833] ? __pfx_ocfs2_calc_xattr_init+0x10/0x10 [ 58.528819][ T5833] ? ocfs2_init_security_get+0x12d/0x1a0 [ 58.534498][ T5833] ocfs2_mknod+0x143a/0x2b40 [ 58.539107][ T5833] ? __pfx_validate_chain+0x10/0x10 [ 58.544303][ T5833] ? __pfx_ocfs2_mknod+0x10/0x10 [ 58.549238][ T5833] ? __lock_acquire+0x1384/0x2050 [ 58.554265][ T5833] ? __pfx_lock_acquire+0x10/0x10 [ 58.559282][ T5833] ? ocfs2_inode_unlock+0xa7/0x150 [ 58.564388][ T5833] ? __pfx_lock_release+0x10/0x10 [ 58.569406][ T5833] ? do_raw_spin_lock+0x14f/0x370 [ 58.574429][ T5833] ? do_raw_spin_unlock+0x13c/0x8b0 [ 58.579621][ T5833] ? _raw_spin_unlock+0x28/0x50 [ 58.584561][ T5833] ? rcu_is_watching+0x15/0xb0 [ 58.589348][ T5833] ? ocfs2_lookup+0x503/0xa60 [ 58.594025][ T5833] ocfs2_create+0x1ab/0x480 [ 58.598522][ T5833] ? __pfx_ocfs2_create+0x10/0x10 [ 58.603554][ T5833] ? bpf_lsm_inode_create+0x9/0x10 [ 58.608662][ T5833] ? security_inode_create+0xbe/0x340 [ 58.614027][ T5833] ? __pfx_ocfs2_create+0x10/0x10 [ 58.619050][ T5833] path_openat+0x1c03/0x3590 [ 58.623641][ T5833] ? __pfx_path_openat+0x10/0x10 [ 58.628575][ T5833] do_filp_open+0x235/0x490 [ 58.633072][ T5833] ? __pfx_do_filp_open+0x10/0x10 [ 58.638097][ T5833] ? _raw_spin_unlock+0x28/0x50 [ 58.642943][ T5833] ? alloc_fd+0x5a1/0x640 [ 58.647269][ T5833] do_sys_openat2+0x13e/0x1d0 [ 58.651937][ T5833] ? __pfx_do_sys_openat2+0x10/0x10 [ 58.657149][ T5833] ? lockdep_hardirqs_on+0x99/0x150 [ 58.662429][ T5833] ? _raw_spin_unlock_irq+0x2e/0x50 [ 58.667619][ T5833] ? ptrace_notify+0x279/0x380 [ 58.672378][ T5833] __x64_sys_openat+0x247/0x2a0 [ 58.677219][ T5833] ? __pfx___x64_sys_openat+0x10/0x10 [ 58.682589][ T5833] ? do_syscall_64+0x100/0x230 [ 58.687352][ T5833] do_syscall_64+0xf3/0x230 [ 58.691847][ T5833] ? clear_bhb_loop+0x35/0x90 [ 58.696520][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.702405][ T5833] RIP: 0033:0x7f9b708853f9 [ 58.706822][ T5833] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 58.726428][ T5833] RSP: 002b:00007f9b70835168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 58.734833][ T5833] RAX: ffffffffffffffda RBX: 00007f9b709096a8 RCX: 00007f9b708853f9 [ 58.742797][ T5833] RDX: 0000000000105042 RSI: 0000000020000080 RDI: 00000000ffffff9c [ 58.750757][ T5833] RBP: 00007f9b709096a0 R08: 00007f9b708356c0 R09: 0000000000000000 [ 58.758720][ T5833] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9b709096ac [ 58.766681][ T5833] R13: 0000000000000000 R14: 00007ffee6ee2da0 R15: 00007ffee6ee2e88 [ 58.774654][ T5833] [ 58.777935][ T5833] Kernel Offset: disabled [ 58.782251][ T5833] Rebooting in 86400 seconds..