./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4126693847
<...>
DUID 00:04:dd:0f:a4:e5:cb:b8:04:95:2f:30:92:03:b3:b6:0d:bc
forked to background, child pid 3210
[ 29.239583][ T3211] 8021q: adding VLAN 0 to HW filter on device bond0
[ 29.248981][ T3211] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.202' (ECDSA) to the list of known hosts.
execve("./syz-executor4126693847", ["./syz-executor4126693847"], 0x7ffe9b0e92f0 /* 10 vars */) = 0
brk(NULL) = 0x55555694e000
brk(0x55555694ec40) = 0x55555694ec40
arch_prctl(ARCH_SET_FS, 0x55555694e300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor4126693847", 4096) = 28
brk(0x55555696fc40) = 0x55555696fc40
brk(0x555556970000) = 0x555556970000
mprotect(0x7fc194736000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc18c200000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
munmap(0x7fc18c200000, 524288) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./bus", 0777) = 0
mount("/dev/loop0", "./bus", "hfsplus", MS_NOEXEC|MS_RELATIME, "") = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
chdir("./bus") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
openat(AT_FDCWD, ".", O_RDONLY) = 4
getdents64(4, 0x20000340 /* 3 entries */, 97) = 80
getdents64(4, 0x20000340 /* 3 entries */, 97) = 96
syzkaller login: [ 51.624366][ T3632] loop0: detected capacity change from 0 to 1024
[ 51.647192][ T3632] ==================================================================
[ 51.655285][ T3632] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x683/0x1290
[ 51.663035][ T3632] Read of size 2 at addr ffff88801887a40c by task syz-executor412/3632
[ 51.671275][ T3632]
[ 51.673601][ T3632] CPU: 1 PID: 3632 Comm: syz-executor412 Not tainted 6.1.0-rc6-syzkaller-00315-gfaf68e3523c2 #0
[ 51.684005][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 51.694037][ T3632] Call Trace:
[ 51.697295][ T3632]
[ 51.700213][ T3632] dump_stack_lvl+0x1b1/0x28e
[ 51.704890][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 51.710349][ T3632] ? __wake_up_klogd+0xcd/0x100
[ 51.715191][ T3632] ? panic+0x710/0x710
[ 51.719335][ T3632] ? _printk+0xc0/0x100
[ 51.723480][ T3632] print_address_description+0x74/0x340
[ 51.729015][ T3632] print_report+0x107/0x1f0
[ 51.733505][ T3632] ? _raw_spin_lock+0x40/0x40
[ 51.738173][ T3632] ? hfsplus_bnode_read_u16+0x7f/0xf0
[ 51.743546][ T3632] ? __virt_addr_valid+0x21b/0x2d0
[ 51.748649][ T3632] ? __phys_addr+0xb5/0x160
[ 51.753147][ T3632] ? hfsplus_uni2asc+0x683/0x1290
[ 51.758255][ T3632] kasan_report+0xcd/0x100
[ 51.762658][ T3632] ? hfsplus_uni2asc+0x683/0x1290
[ 51.767684][ T3632] hfsplus_uni2asc+0x683/0x1290
[ 51.772534][ T3632] hfsplus_readdir+0x8be/0x1230
[ 51.777400][ T3632] ? hfsplus_rename+0x1b0/0x1b0
[ 51.782267][ T3632] ? read_lock_is_recursive+0x10/0x10
[ 51.787635][ T3632] ? ptrace_notify+0x245/0x340
[ 51.792397][ T3632] ? __might_sleep+0xc0/0xc0
[ 51.796984][ T3632] ? __down_read_common+0x156/0x2a0
[ 51.802176][ T3632] ? iterate_dir+0x121/0x5f0
[ 51.806762][ T3632] iterate_dir+0x257/0x5f0
[ 51.811170][ T3632] ? hfsplus_rename+0x1b0/0x1b0
[ 51.816017][ T3632] __se_sys_getdents64+0x1db/0x4c0
[ 51.821120][ T3632] ? _raw_spin_unlock_irq+0x2a/0x40
[ 51.826317][ T3632] ? __x64_sys_getdents64+0x80/0x80
[ 51.831509][ T3632] ? filldir+0x670/0x670
[ 51.835748][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 51.841717][ T3632] ? syscall_enter_from_user_mode+0x86/0x1d0
[ 51.847688][ T3632] do_syscall_64+0x3d/0xb0
[ 51.852091][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 51.857973][ T3632] RIP: 0033:0x7fc1946c8869
[ 51.862378][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 51.881970][ T3632] RSP: 002b:00007fff9a1bc768 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 51.890368][ T3632] RAX: ffffffffffffffda RBX: 000000000000003f RCX: 00007fc1946c8869
[ 51.898327][ T3632] RDX: 0000000000000061 RSI: 0000000020000340 RDI: 0000000000000004
[ 51.906285][ T3632] RBP: 00007fc194688100 R08: 0000000000000000 R09: 0000000000000000
[ 51.914244][ T3632] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc194688190
[ 51.922203][ T3632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 51.930166][ T3632]
[ 51.933174][ T3632]
[ 51.935481][ T3632] Allocated by task 3632:
[ 51.939790][ T3632] kasan_set_track+0x3d/0x60
[ 51.944368][ T3632] __kasan_kmalloc+0x97/0xb0
[ 51.948944][ T3632] __kmalloc+0xaf/0x1a0
[ 51.953095][ T3632] hfsplus_find_init+0x80/0x1b0
[ 51.957941][ T3632] hfsplus_readdir+0x1a5/0x1230
[ 51.962780][ T3632] iterate_dir+0x257/0x5f0
[ 51.967187][ T3632] __se_sys_getdents64+0x1db/0x4c0
[ 51.972289][ T3632] do_syscall_64+0x3d/0xb0
[ 51.976690][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 51.982570][ T3632]
[ 51.984882][ T3632] The buggy address belongs to the object at ffff88801887a000
[ 51.984882][ T3632] which belongs to the cache kmalloc-2k of size 2048
[ 51.998917][ T3632] The buggy address is located 1036 bytes inside of
[ 51.998917][ T3632] 2048-byte region [ffff88801887a000, ffff88801887a800)
[ 52.012521][ T3632]
[ 52.014832][ T3632] The buggy address belongs to the physical page:
[ 52.021229][ T3632] page:ffffea0000621e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x18878
[ 52.031362][ T3632] head:ffffea0000621e00 order:3 compound_mapcount:0 compound_pincount:0
[ 52.039669][ T3632] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 52.047636][ T3632] raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888012842000
[ 52.056203][ T3632] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 52.064765][ T3632] page dumped because: kasan: bad access detected
[ 52.071164][ T3632] page_owner tracks the page as allocated
[ 52.076859][ T3632] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2305445820, free_ts 0
[ 52.096464][ T3632] get_page_from_freelist+0x742/0x7c0
[ 52.101828][ T3632] __alloc_pages+0x259/0x560
[ 52.106410][ T3632] alloc_page_interleave+0x22/0x1c0
[ 52.111602][ T3632] alloc_slab_page+0x70/0xf0
[ 52.116180][ T3632] allocate_slab+0x5e/0x4b0
[ 52.120672][ T3632] ___slab_alloc+0x782/0xe20
[ 52.125249][ T3632] __kmem_cache_alloc_node+0x252/0x310
[ 52.130697][ T3632] kmalloc_trace+0x26/0x60
[ 52.135104][ T3632] acpi_ds_create_walk_state+0xe2/0x292
[ 52.140642][ T3632] acpi_ds_auto_serialize_method+0xe1/0x22c
[ 52.146524][ T3632] acpi_ds_init_one_object+0x1a8/0x34f
[ 52.151969][ T3632] acpi_ns_walk_namespace+0x250/0x4bf
[ 52.157326][ T3632] acpi_ds_initialize_objects+0x149/0x23d
[ 52.163037][ T3632] acpi_ns_load_table+0xf4/0x118
[ 52.167959][ T3632] acpi_tb_load_namespace+0x283/0x6cc
[ 52.173316][ T3632] acpi_load_tables+0x45/0xf5
[ 52.177984][ T3632] page_owner free stack trace missing
[ 52.183331][ T3632]
[ 52.185638][ T3632] Memory state around the buggy address:
[ 52.191252][ T3632] ffff88801887a300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 52.199298][ T3632] ffff88801887a380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 52.207342][ T3632] >ffff88801887a400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 52.215382][ T3632] ^
[ 52.219690][ T3632] ffff88801887a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 52.227734][ T3632] ffff88801887a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 52.235776][ T3632] ==================================================================
[ 52.244037][ T3632] Kernel panic - not syncing: panic_on_warn set ...
[ 52.250665][ T3632] CPU: 0 PID: 3632 Comm: syz-executor412 Not tainted 6.1.0-rc6-syzkaller-00315-gfaf68e3523c2 #0
[ 52.261072][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 52.271115][ T3632] Call Trace:
[ 52.274384][ T3632]
[ 52.277311][ T3632] dump_stack_lvl+0x1b1/0x28e
[ 52.281982][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 52.287425][ T3632] ? panic+0x710/0x710
[ 52.291481][ T3632] ? preempt_schedule_common+0xb7/0xe0
[ 52.296928][ T3632] ? vscnprintf+0x59/0x80
[ 52.301248][ T3632] panic+0x2d6/0x710
[ 52.305141][ T3632] ? memcpy_page_flushcache+0xfc/0xfc
[ 52.310500][ T3632] ? _raw_spin_unlock_irqrestore+0x110/0x120
[ 52.316471][ T3632] ? print_report+0x1b4/0x1f0
[ 52.321138][ T3632] ? hfsplus_uni2asc+0x683/0x1290
[ 52.326156][ T3632] end_report+0x91/0xa0
[ 52.330302][ T3632] kasan_report+0xda/0x100
[ 52.334707][ T3632] ? hfsplus_uni2asc+0x683/0x1290
[ 52.339726][ T3632] hfsplus_uni2asc+0x683/0x1290
[ 52.344572][ T3632] hfsplus_readdir+0x8be/0x1230
[ 52.349421][ T3632] ? hfsplus_rename+0x1b0/0x1b0
[ 52.354283][ T3632] ? read_lock_is_recursive+0x10/0x10
[ 52.359644][ T3632] ? ptrace_notify+0x245/0x340
[ 52.364395][ T3632] ? __might_sleep+0xc0/0xc0
[ 52.368978][ T3632] ? __down_read_common+0x156/0x2a0
[ 52.374163][ T3632] ? iterate_dir+0x121/0x5f0
[ 52.378743][ T3632] iterate_dir+0x257/0x5f0
[ 52.383148][ T3632] ? hfsplus_rename+0x1b0/0x1b0
[ 52.387989][ T3632] __se_sys_getdents64+0x1db/0x4c0
[ 52.393087][ T3632] ? _raw_spin_unlock_irq+0x2a/0x40
[ 52.398282][ T3632] ? __x64_sys_getdents64+0x80/0x80
[ 52.403470][ T3632] ? filldir+0x670/0x670
[ 52.407703][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0
[ 52.413674][ T3632] ? syscall_enter_from_user_mode+0x86/0x1d0
[ 52.419641][ T3632] do_syscall_64+0x3d/0xb0
[ 52.424042][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 52.429921][ T3632] RIP: 0033:0x7fc1946c8869
[ 52.434324][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 52.453915][ T3632] RSP: 002b:00007fff9a1bc768 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 52.462316][ T3632] RAX: ffffffffffffffda RBX: 000000000000003f RCX: 00007fc1946c8869
[ 52.470293][ T3632] RDX: 0000000000000061 RSI: 0000000020000340 RDI: 0000000000000004
[ 52.478249][ T3632] RBP: 00007fc194688100 R08: 0000000000000000 R09: 0000000000000000
[ 52.486206][ T3632] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc194688190
[ 52.494164][ T3632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 52.502125][ T3632]
[ 52.505313][ T3632] Kernel Offset: disabled
[ 52.509637][ T3632] Rebooting in 86400 seconds..