Warning: Permanently added '10.128.1.17' (ED25519) to the list of known hosts. executing program [ 55.105412][ T4242] loop0: detected capacity change from 0 to 64 [ 55.126208][ T4242] ================================================================== [ 55.134303][ T4242] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x2e7/0x430 [ 55.142233][ T4242] Write of size 94 at addr ffff88802f365a00 by task syz-executor138/4242 [ 55.150646][ T4242] [ 55.152981][ T4242] CPU: 1 PID: 4242 Comm: syz-executor138 Not tainted 6.1.130-syzkaller #0 [ 55.161476][ T4242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 55.171518][ T4242] Call Trace: [ 55.174785][ T4242] <TASK> [ 55.177695][ T4242] dump_stack_lvl+0x1e3/0x2cb [ 55.182358][ T4242] ? nf_tcp_handle_invalid+0x647/0x647 [ 55.187799][ T4242] ? panic+0x764/0x764 [ 55.191850][ T4242] ? _printk+0xd1/0x111 [ 55.195996][ T4242] ? __virt_addr_valid+0x17f/0x530 [ 55.201101][ T4242] ? __virt_addr_valid+0x17f/0x530 [ 55.206191][ T4242] print_report+0x15f/0x4f0 [ 55.210670][ T4242] ? __virt_addr_valid+0x17f/0x530 [ 55.215762][ T4242] ? __virt_addr_valid+0x17f/0x530 [ 55.220848][ T4242] ? __virt_addr_valid+0x45b/0x530 [ 55.225937][ T4242] ? __phys_addr+0xb6/0x170 [ 55.230419][ T4242] ? hfs_bnode_read_key+0x2e7/0x430 [ 55.235595][ T4242] kasan_report+0x136/0x160 [ 55.240077][ T4242] ? hfs_bnode_read_key+0x2e7/0x430 [ 55.245257][ T4242] kasan_check_range+0x27f/0x290 [ 55.250169][ T4242] ? hfs_bnode_read_key+0x2e7/0x430 [ 55.255342][ T4242] memcpy+0x3c/0x60 [ 55.259139][ T4242] hfs_bnode_read_key+0x2e7/0x430 [ 55.264142][ T4242] hfs_brec_insert+0x7ef/0xbd0 [ 55.268900][ T4242] ? hfs_brec_keylen+0x350/0x350 [ 55.273818][ T4242] hfs_cat_create+0x419/0x8e0 [ 55.278476][ T4242] ? hfs_cat_build_key+0x170/0x170 [ 55.283565][ T4242] ? do_raw_spin_unlock+0x137/0x8a0 [ 55.288742][ T4242] ? hfs_new_inode+0x93c/0xc00 [ 55.293486][ T4242] hfs_create+0x62/0xd0 [ 55.297621][ T4242] vfs_create+0x306/0x490 [ 55.301933][ T4242] do_mknodat+0x338/0x5a0 [ 55.306238][ T4242] ? do_o_path+0x230/0x230 [ 55.310641][ T4242] ? syscall_enter_from_user_mode+0x2e/0x230 [ 55.316598][ T4242] __x64_sys_mknodat+0xa5/0xc0 [ 55.321343][ T4242] do_syscall_64+0x3b/0xb0 [ 55.325734][ T4242] ? clear_bhb_loop+0x45/0xa0 [ 55.330387][ T4242] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 55.336256][ T4242] RIP: 0033:0x7fb74ee80ad9 [ 55.340659][ T4242] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 55.360242][ T4242] RSP: 002b:00007ffd18deb5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000103 [ 55.368633][ T4242] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb74ee80ad9 [ 55.376581][ T4242] RDX: 0000000000000000 RSI: 0000400000000100 RDI: 00000000ffffff9c [ 55.384531][ T4242] RBP: 00007fb74eef45f0 R08: 0000555560ad54c0 R09: 0000555560ad54c0 [ 55.392478][ T4242] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd18deb600 [ 55.400426][ T4242] R13: 00007ffd18deb828 R14: 431bde82d7b634db R15: 00007fb74eec903b [ 55.408383][ T4242] </TASK> [ 55.411382][ T4242] [ 55.413683][ T4242] Allocated by task 4242: [ 55.417999][ T4242] kasan_set_track+0x4b/0x70 [ 55.422566][ T4242] __kasan_kmalloc+0x97/0xb0 [ 55.427132][ T4242] __kmalloc+0xb2/0x230 [ 55.431262][ T4242] hfs_find_init+0x8c/0x1e0 [ 55.435743][ T4242] hfs_cat_create+0x17d/0x8e0 [ 55.440397][ T4242] hfs_create+0x62/0xd0 [ 55.444527][ T4242] vfs_create+0x306/0x490 [ 55.448834][ T4242] do_mknodat+0x338/0x5a0 [ 55.453136][ T4242] __x64_sys_mknodat+0xa5/0xc0 [ 55.457877][ T4242] do_syscall_64+0x3b/0xb0 [ 55.462277][ T4242] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 55.468146][ T4242] [ 55.470444][ T4242] The buggy address belongs to the object at ffff88802f365a00 [ 55.470444][ T4242] which belongs to the cache kmalloc-96 of size 96 [ 55.484311][ T4242] The buggy address is located 0 bytes inside of [ 55.484311][ T4242] 96-byte region [ffff88802f365a00, ffff88802f365a60) [ 55.497311][ T4242] [ 55.499614][ T4242] The buggy address belongs to the physical page: [ 55.506017][ T4242] page:ffffea0000bcd940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f365 [ 55.516154][ T4242] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 55.523685][ T4242] raw: 00fff00000000200 ffffea000090b140 dead000000000003 ffff888017c41780 [ 55.532244][ T4242] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 55.540801][ T4242] page dumped because: kasan: bad access detected [ 55.547195][ T4242] page_owner tracks the page as allocated [ 55.552981][ T4242] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 3635, tgid 3635 (udevd), ts 29166761553, free_ts 29159385427 [ 55.570592][ T4242] post_alloc_hook+0x18d/0x1b0 [ 55.575340][ T4242] get_page_from_freelist+0x3731/0x38d0 [ 55.580864][ T4242] __alloc_pages+0x28d/0x770 [ 55.585434][ T4242] alloc_slab_page+0x6a/0x150 [ 55.590110][ T4242] new_slab+0x84/0x2d0 [ 55.594176][ T4242] ___slab_alloc+0xc20/0x1270 [ 55.598849][ T4242] __kmem_cache_alloc_node+0x19f/0x260 [ 55.604300][ T4242] __kmalloc+0xa1/0x230 [ 55.608527][ T4242] tomoyo_encode+0x26b/0x530 [ 55.613112][ T4242] tomoyo_realpath_from_path+0x594/0x5d0 [ 55.618726][ T4242] tomoyo_check_open_permission+0x240/0x4c0 [ 55.624595][ T4242] security_file_open+0x5f/0xa0 [ 55.629454][ T4242] do_dentry_open+0x308/0x10f0 [ 55.634213][ T4242] path_openat+0x2644/0x2e60 [ 55.638788][ T4242] do_filp_open+0x230/0x480 [ 55.643273][ T4242] do_sys_openat2+0x13b/0x4f0 [ 55.647937][ T4242] page last free stack trace: [ 55.652590][ T4242] free_unref_page_prepare+0x12a6/0x15b0 [ 55.658223][ T4242] free_unref_page+0x33/0x3e0 [ 55.662887][ T4242] qlist_free_all+0x76/0xe0 [ 55.667378][ T4242] kasan_quarantine_reduce+0x156/0x170 [ 55.672824][ T4242] __kasan_slab_alloc+0x1f/0x70 [ 55.677661][ T4242] slab_post_alloc_hook+0x52/0x3a0 [ 55.682752][ T4242] kmem_cache_alloc+0x10c/0x2d0 [ 55.687643][ T4242] getname_flags+0xb8/0x4f0 [ 55.692139][ T4242] do_sys_openat2+0xd2/0x4f0 [ 55.696713][ T4242] __x64_sys_openat+0x243/0x290 [ 55.701545][ T4242] do_syscall_64+0x3b/0xb0 [ 55.705957][ T4242] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 55.711831][ T4242] [ 55.714133][ T4242] Memory state around the buggy address: [ 55.719750][ T4242] ffff88802f365900: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 55.727799][ T4242] ffff88802f365980: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 55.735844][ T4242] >ffff88802f365a00: 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc fc [ 55.743889][ T4242] ^ [ 55.750284][ T4242] ffff88802f365a80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 55.758336][ T4242] ffff88802f365b00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 55.766380][ T4242] ================================================================== [ 55.774695][ T4242] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 55.781886][ T4242] CPU: 1 PID: 4242 Comm: syz-executor138 Not tainted 6.1.130-syzkaller #0 [ 55.790368][ T4242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 55.800410][ T4242] Call Trace: [ 55.803677][ T4242] <TASK> [ 55.806594][ T4242] dump_stack_lvl+0x1e3/0x2cb [ 55.811263][ T4242] ? nf_tcp_handle_invalid+0x647/0x647 [ 55.816707][ T4242] ? panic+0x764/0x764 [ 55.820761][ T4242] ? preempt_schedule_common+0xa6/0xd0 [ 55.826218][ T4242] ? vscnprintf+0x59/0x80 [ 55.830533][ T4242] panic+0x318/0x764 [ 55.834412][ T4242] ? check_panic_on_warn+0x1d/0xa0 [ 55.839508][ T4242] ? memcpy_page_flushcache+0xfc/0xfc [ 55.845215][ T4242] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 55.851176][ T4242] ? _raw_spin_unlock+0x40/0x40 [ 55.856007][ T4242] ? print_report+0x4a3/0x4f0 [ 55.860670][ T4242] check_panic_on_warn+0x7e/0xa0 [ 55.865591][ T4242] ? hfs_bnode_read_key+0x2e7/0x430 [ 55.870776][ T4242] end_report+0x66/0x110 [ 55.875000][ T4242] kasan_report+0x143/0x160 [ 55.879500][ T4242] ? hfs_bnode_read_key+0x2e7/0x430 [ 55.884693][ T4242] kasan_check_range+0x27f/0x290 [ 55.889639][ T4242] ? hfs_bnode_read_key+0x2e7/0x430 [ 55.894837][ T4242] memcpy+0x3c/0x60 [ 55.898636][ T4242] hfs_bnode_read_key+0x2e7/0x430 [ 55.903651][ T4242] hfs_brec_insert+0x7ef/0xbd0 [ 55.908410][ T4242] ? hfs_brec_keylen+0x350/0x350 [ 55.913332][ T4242] hfs_cat_create+0x419/0x8e0 [ 55.917996][ T4242] ? hfs_cat_build_key+0x170/0x170 [ 55.923090][ T4242] ? do_raw_spin_unlock+0x137/0x8a0 [ 55.928273][ T4242] ? hfs_new_inode+0x93c/0xc00 [ 55.933022][ T4242] hfs_create+0x62/0xd0 [ 55.937161][ T4242] vfs_create+0x306/0x490 [ 55.941485][ T4242] do_mknodat+0x338/0x5a0 [ 55.945796][ T4242] ? do_o_path+0x230/0x230 [ 55.950193][ T4242] ? syscall_enter_from_user_mode+0x2e/0x230 [ 55.956158][ T4242] __x64_sys_mknodat+0xa5/0xc0 [ 55.960905][ T4242] do_syscall_64+0x3b/0xb0 [ 55.965302][ T4242] ? clear_bhb_loop+0x45/0xa0 [ 55.969962][ T4242] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 55.975838][ T4242] RIP: 0033:0x7fb74ee80ad9 [ 55.980237][ T4242] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 55.999822][ T4242] RSP: 002b:00007ffd18deb5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000103 [ 56.008219][ T4242] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb74ee80ad9 [ 56.016173][ T4242] RDX: 0000000000000000 RSI: 0000400000000100 RDI: 00000000ffffff9c [ 56.024133][ T4242] RBP: 00007fb74eef45f0 R08: 0000555560ad54c0 R09: 0000555560ad54c0 [ 56.032085][ T4242] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd18deb600 [ 56.040036][ T4242] R13: 00007ffd18deb828 R14: 431bde82d7b634db R15: 00007fb74eec903b [ 56.048020][ T4242] </TASK> [ 56.051266][ T4242] Kernel Offset: disabled [ 56.055570][ T4242] Rebooting in 86400 seconds..