Warning: Permanently added '[localhost]:6403' (ED25519) to the list of known hosts.
executing program
[ 68.185267][ T5309] loop0: detected capacity change from 0 to 128
[ 68.201537][ T5309] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 68.208683][ T5309] syz-executor897: attempt to access beyond end of device
[ 68.208683][ T5309] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 68.220730][ T5309] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 68.229215][ T5309] syz-executor897: attempt to access beyond end of device
[ 68.229215][ T5309] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 68.235438][ T5309] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 68.251684][ T5308] sysv_free_block: flc_count > flc_size
[ 68.254335][ T5308] sysv_free_block: flc_count > flc_size
[ 68.256652][ T5308] sysv_free_block: flc_count > flc_size
[ 68.259008][ T5308] sysv_free_block: flc_count > flc_size
[ 68.261910][ T5308] sysv_free_block: flc_count > flc_size
[ 68.264325][ T5308] sysv_free_block: flc_count > flc_size
[ 68.266754][ T5308] sysv_free_block: flc_count > flc_size
[ 68.269209][ T5308] sysv_free_block: flc_count > flc_size
[ 68.273235][ T5308] sysv_free_block: flc_count > flc_size
[ 68.275579][ T5308] sysv_free_block: flc_count > flc_size
[ 68.278250][ T5308] sysv_free_inode: inode 0,1,2 or nonexistent inode
executing program
[ 68.333024][ T5311] loop0: detected capacity change from 0 to 128
[ 68.344066][ T5311] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 68.352745][ T5311] syz-executor897: attempt to access beyond end of device
[ 68.352745][ T5311] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 68.358424][ T5311] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 68.367802][ T5311] ==================================================================
[ 68.371126][ T5311] BUG: KASAN: use-after-free in sysv_new_inode+0xfe4/0x1190
[ 68.374322][ T5311] Read of size 2 at addr ffff8880451191ce by task syz-executor897/5311
[ 68.378781][ T5311]
[ 68.379793][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz-executor897 Not tainted 6.14.0-rc6-syzkaller-00007-g0b46b049d6ec #0
[ 68.379807][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 68.379813][ T5311] Call Trace:
[ 68.379820][ T5311]
[ 68.379825][ T5311] dump_stack_lvl+0x241/0x360
[ 68.379842][ T5311] ? __pfx_dump_stack_lvl+0x10/0x10
[ 68.379851][ T5311] ? __pfx__printk+0x10/0x10
[ 68.379861][ T5311] ? _printk+0xd5/0x120
[ 68.379869][ T5311] ? __virt_addr_valid+0x183/0x530
[ 68.379879][ T5311] ? __virt_addr_valid+0x183/0x530
[ 68.379889][ T5311] print_report+0x16e/0x5b0
[ 68.379901][ T5311] ? __virt_addr_valid+0x183/0x530
[ 68.379934][ T5311] ? __virt_addr_valid+0x183/0x530
[ 68.379944][ T5311] ? __virt_addr_valid+0x45f/0x530
[ 68.379953][ T5311] ? __phys_addr+0xba/0x170
[ 68.379962][ T5311] ? sysv_new_inode+0xfe4/0x1190
[ 68.379976][ T5311] kasan_report+0x143/0x180
[ 68.379986][ T5311] ? sysv_new_inode+0xfe4/0x1190
[ 68.379995][ T5311] sysv_new_inode+0xfe4/0x1190
[ 68.380006][ T5311] ? __pfx_sysv_new_inode+0x10/0x10
[ 68.380019][ T5311] ? _raw_spin_unlock+0x28/0x50
[ 68.380072][ T5311] ? __d_add+0x500/0x800
[ 68.380085][ T5311] sysv_mknod+0x4e/0xe0
[ 68.380095][ T5311] ? __pfx_sysv_create+0x10/0x10
[ 68.380105][ T5311] path_openat+0x193c/0x3590
[ 68.380128][ T5311] ? __pfx_path_openat+0x10/0x10
[ 68.380140][ T5311] do_filp_open+0x27f/0x4e0
[ 68.380151][ T5311] ? __pfx_do_filp_open+0x10/0x10
[ 68.380165][ T5311] ? do_raw_spin_lock+0x14f/0x370
[ 68.380187][ T5311] do_sys_openat2+0x13e/0x1d0
[ 68.380202][ T5311] ? mntput_no_expire+0xc2/0x850
[ 68.380213][ T5311] ? __pfx_do_sys_openat2+0x10/0x10
[ 68.380227][ T5311] ? __pfx_mntput_no_expire+0x10/0x10
[ 68.380238][ T5311] __x64_sys_open+0x225/0x270
[ 68.380256][ T5311] ? __pfx___x64_sys_open+0x10/0x10
[ 68.380275][ T5311] ? do_syscall_64+0x100/0x230
[ 68.380290][ T5311] ? do_syscall_64+0xb6/0x230
[ 68.380304][ T5311] do_syscall_64+0xf3/0x230
[ 68.380318][ T5311] ? clear_bhb_loop+0x35/0x90
[ 68.380333][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.380346][ T5311] RIP: 0033:0x7f0ad4e20129
[ 68.380356][ T5311] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 68.380364][ T5311] RSP: 002b:00007ffe6c3ea9f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[ 68.380377][ T5311] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0ad4e20129
[ 68.380384][ T5311] RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000400000000180
[ 68.380390][ T5311] RBP: 00000000ffffffff R08: 0000000000009e7f R09: 0000000000000000
[ 68.380397][ T5311] R10: 00007ffe6c3eaa90 R11: 0000000000000246 R12: 0000000000010000
[ 68.380403][ T5311] R13: 00007ffe6c3eaa90 R14: 0000400000000000 R15: 0000000000000003
[ 68.380413][ T5311]
[ 68.380417][ T5311]
[ 68.493085][ T5311] The buggy address belongs to the physical page:
[ 68.495718][ T5311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f08fdf24 pfn:0x45119
[ 68.499579][ T5311] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 68.502550][ T5311] raw: 04fff00000000000 dead000000000100 dead000000000122 0000000000000000
[ 68.505841][ T5311] raw: 00000007f08fdf24 0000000000000000 00000000ffffffff 0000000000000000
[ 68.509306][ T5311] page dumped because: kasan: bad access detected
[ 68.511983][ T5311] page_owner tracks the page as freed
[ 68.514157][ T5311] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5300, tgid 5300 (sshd), ts 66797148530, free_ts 66877990639
[ 68.521348][ T5311] post_alloc_hook+0x1f4/0x240
[ 68.523428][ T5311] get_page_from_freelist+0x365c/0x37a0
[ 68.525623][ T5311] __alloc_frozen_pages_noprof+0x292/0x710
[ 68.527952][ T5311] alloc_pages_mpol+0x311/0x660
[ 68.529910][ T5311] vma_alloc_folio_noprof+0x12b/0x260
[ 68.532095][ T5311] folio_prealloc+0x2e/0x170
[ 68.533984][ T5311] __handle_mm_fault+0x3e4b/0x70f0
[ 68.536011][ T5311] handle_mm_fault+0x3e5/0x8d0
[ 68.537956][ T5311] exc_page_fault+0x459/0x8b0
[ 68.540068][ T5311] asm_exc_page_fault+0x26/0x30
[ 68.542053][ T5311] page last free pid 5300 tgid 5300 stack trace:
[ 68.544668][ T5311] free_unref_folios+0xe40/0x18b0
[ 68.546792][ T5311] folios_put_refs+0x76c/0x860
[ 68.548825][ T5311] free_pages_and_swap_cache+0x2e5/0x690
[ 68.550993][ T5311] tlb_flush_mmu+0x3a3/0x680
[ 68.552833][ T5311] tlb_finish_mmu+0xd4/0x200
[ 68.554642][ T5311] vms_clear_ptes+0x432/0x530
[ 68.556564][ T5311] vms_complete_munmap_vmas+0x210/0x8f0
[ 68.558717][ T5311] do_vmi_align_munmap+0x5ef/0x6f0
[ 68.560654][ T5311] do_vmi_munmap+0x24e/0x2d0
[ 68.562414][ T5311] __vm_munmap+0x372/0x510
[ 68.564173][ T5311] __x64_sys_munmap+0x60/0x70
[ 68.566144][ T5311] do_syscall_64+0xf3/0x230
[ 68.568066][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.570448][ T5311]
[ 68.571426][ T5311] Memory state around the buggy address:
[ 68.573703][ T5311] ffff888045119080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 68.576945][ T5311] ffff888045119100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 68.580154][ T5311] >ffff888045119180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 68.583423][ T5311] ^
[ 68.586002][ T5311] ffff888045119200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 68.589310][ T5311] ffff888045119280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 68.592504][ T5311] ==================================================================
[ 68.602568][ T5311] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 68.605603][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz-executor897 Not tainted 6.14.0-rc6-syzkaller-00007-g0b46b049d6ec #0
[ 68.610081][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 68.614371][ T5311] Call Trace:
[ 68.615748][ T5311]
[ 68.616983][ T5311] dump_stack_lvl+0x241/0x360
[ 68.618986][ T5311] ? __pfx_dump_stack_lvl+0x10/0x10
[ 68.621202][ T5311] ? __pfx__printk+0x10/0x10
[ 68.623159][ T5311] ? preempt_schedule+0xe1/0xf0
[ 68.625180][ T5311] ? vscnprintf+0x5d/0x90
[ 68.627058][ T5311] panic+0x349/0x880
[ 68.628901][ T5311] ? check_panic_on_warn+0x21/0xb0
[ 68.631080][ T5311] ? __pfx_panic+0x10/0x10
[ 68.632989][ T5311] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 68.635414][ T5311] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 68.638073][ T5311] ? print_report+0x519/0x5b0
[ 68.640007][ T5311] check_panic_on_warn+0x86/0xb0
[ 68.642108][ T5311] ? sysv_new_inode+0xfe4/0x1190
[ 68.644162][ T5311] end_report+0x77/0x160
[ 68.645980][ T5311] kasan_report+0x154/0x180
[ 68.647988][ T5311] ? sysv_new_inode+0xfe4/0x1190
[ 68.650128][ T5311] sysv_new_inode+0xfe4/0x1190
[ 68.652150][ T5311] ? __pfx_sysv_new_inode+0x10/0x10
[ 68.654290][ T5311] ? _raw_spin_unlock+0x28/0x50
[ 68.656352][ T5311] ? __d_add+0x500/0x800
[ 68.658206][ T5311] sysv_mknod+0x4e/0xe0
[ 68.659955][ T5311] ? __pfx_sysv_create+0x10/0x10
[ 68.662095][ T5311] path_openat+0x193c/0x3590
[ 68.664133][ T5311] ? __pfx_path_openat+0x10/0x10
[ 68.666272][ T5311] do_filp_open+0x27f/0x4e0
[ 68.668424][ T5311] ? __pfx_do_filp_open+0x10/0x10
[ 68.670745][ T5311] ? do_raw_spin_lock+0x14f/0x370
[ 68.672914][ T5311] do_sys_openat2+0x13e/0x1d0
[ 68.674885][ T5311] ? mntput_no_expire+0xc2/0x850
[ 68.676970][ T5311] ? __pfx_do_sys_openat2+0x10/0x10
[ 68.679219][ T5311] ? __pfx_mntput_no_expire+0x10/0x10
[ 68.681544][ T5311] __x64_sys_open+0x225/0x270
[ 68.683480][ T5311] ? __pfx___x64_sys_open+0x10/0x10
[ 68.685755][ T5311] ? do_syscall_64+0x100/0x230
[ 68.687698][ T5311] ? do_syscall_64+0xb6/0x230
[ 68.689719][ T5311] do_syscall_64+0xf3/0x230
[ 68.691747][ T5311] ? clear_bhb_loop+0x35/0x90
[ 68.693905][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.696371][ T5311] RIP: 0033:0x7f0ad4e20129
[ 68.698351][ T5311] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 68.706051][ T5311] RSP: 002b:00007ffe6c3ea9f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[ 68.709295][ T5311] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0ad4e20129
[ 68.712662][ T5311] RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000400000000180
[ 68.716004][ T5311] RBP: 00000000ffffffff R08: 0000000000009e7f R09: 0000000000000000
[ 68.719359][ T5311] R10: 00007ffe6c3eaa90 R11: 0000000000000246 R12: 0000000000010000
[ 68.722771][ T5311] R13: 00007ffe6c3eaa90 R14: 0000400000000000 R15: 0000000000000003
[ 68.726103][ T5311]
[ 68.727698][ T5311] Kernel Offset: disabled
[ 68.729394][ T5311] Rebooting in 86400 seconds..
VM DIAGNOSIS:
05:38:28 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000032 RBX=ffffffff9a999100 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc9000d166df0
R8 =ffffffff858430fb R9 =1ffff11006830046 R10=dffffc0000000000 R11=ffffffff858430b0
R12=dffffc0000000000 R13=0000000000000032 R14=0000000000000032 R15=00000000000003f8
RIP=ffffffff8584312e RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555590100380 ffffffff 00c00000
GS =0000 ffff88801fc00000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0acc80f000 CR3=000000004289e000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fefeffd0 Opmask01=0000000000004211 Opmask02=000000000000ffdf Opmask03=0000000000000000
Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffce92aabb0 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2a2a2a2a2a2a2a2a 2a2a2a2a2a2a2a2a
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff0000ff000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff0000ff000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 656c696620732520 6465746165726300 0a73253a47000a73 253d73253a45000a
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 40494c4305560005 4140514440574600 0a56001f47000a56 001856001f45000a
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000071 0000000000000000 30706f6f6c2f6b63 6f6c622f6c617574
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5a8766d86ca29c79 000055e2b8ca16f8 0000000000000111 0000000000007374
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7b27697a787c7a30 23333a3a38263342 4943213f395b2249 5a6e786b6e646b7e
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3a2648393a3a264b 393a3a263e393a3a 2648383a3a26483b 3a0a00307f617930
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692054524f50202c 2064696c61696d20 0070253a20252054 524f504d49005452
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692020520050202c 2025204f504d4900 0061253a20252000 2527204d49005452
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000