ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor1202405449 <...> Warning: Permanently added '10.128.0.80' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor1202405449", ["ci2-android-6-1/syz-executor1202405449"], 0x7fffdb3d94b0 /* 10 vars */) = 0 brk(NULL) = 0x555582418000 brk(0x555582418e00) = 0x555582418e00 arch_prctl(ARCH_SET_FS, 0x555582418480) = 0 set_tid_address(0x555582418750) = 306 set_robust_list(0x555582418760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor1202405449", 4096) = 44 getrandom("\x6e\x6a\xbb\xb7\x8a\x8a\x83\x6b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555582418e00 brk(0x555582439e00) = 0x555582439e00 brk(0x55558243a000) = 0x55558243a000 mprotect(0x7fda5a223000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555582418750) = 307 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 executing program close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/failslab/task-filter", O_WRONLY|O_CLOEXEC) = 3 write(3, "Y", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/task-filter", O_WRONLY|O_CLOEXEC) = 3 write(3, "Y", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/task-filter", O_WRONLY|O_CLOEXEC) = 3 write(3, "Y", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_usercopy/task-filter", O_WRONLY|O_CLOEXEC) = 3 write(3, "Y", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_make_request/task-filter", O_WRONLY|O_CLOEXEC) = 3 write(3, "Y", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_io_timeout/task-filter", O_WRONLY|O_CLOEXEC) = 3 write(3, "Y", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_iommufd/task-filter", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "307", 3) = 3 close(3) = 0 kill(307, SIGKILL) = 0 ci2-android-6-1/strace-static-x86_64: Process 307 attached [pid 307] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=307, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7fda5a179af0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fda5a17d8c0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7fda5a179af0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fda5a17d8c0}, NULL, 8) = 0 write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fda51d71000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7fda51d71000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 23.745696][ T28] audit: type=1400 audit(1785545806.381:64): avc: denied { execmem } for pid=306 comm="syz-executor120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.767469][ T28] audit: type=1400 audit(1785545806.401:65): avc: denied { read write } for pid=306 comm="syz-executor120" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file2", 0777) = 0 [ 23.768275][ T306] loop0: detected capacity change from 0 to 512 [ 23.792343][ T28] audit: type=1400 audit(1785545806.401:66): avc: denied { open } for pid=306 comm="syz-executor120" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 23.809634][ T306] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 23.823443][ T28] audit: type=1400 audit(1785545806.401:67): avc: denied { ioctl } for pid=306 comm="syz-executor120" path="/dev/loop0" dev="devtmpfs" ino=118 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 23.835504][ T306] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 23.861278][ T28] audit: type=1400 audit(1785545806.441:68): avc: denied { mounton } for pid=306 comm="syz-executor120" path="/root/file2" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,lazytime,block_validity,stripe=0x000000000000000d"...) = 0 openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 chdir("./file2") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 chdir("./file0") = 0 openat(AT_FDCWD, "memory.events.local", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) lsetxattr("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL, NULL, 0, 0) = -1 ENOENT (No such file or directory) mprotect(0x200000000000, 12288, PROT_READ) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 memfd_create("syzkaller", 0) = 6 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fda51d71000 write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 munmap(0x7fda51d71000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) ioctl(7, LOOP_CLR_FD) = 0 ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [ 23.884909][ T306] EXT4-fs (loop0): 1 truncate cleaned up [ 23.899650][ T306] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 23.908485][ T28] audit: type=1400 audit(1785545806.551:69): avc: denied { mount } for pid=306 comm="syz-executor120" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 close(7) = 0 close(6) = 0 [ 23.935630][ T28] audit: type=1400 audit(1785545806.561:70): avc: denied { write } for pid=306 comm="syz-executor120" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 23.958318][ T28] audit: type=1400 audit(1785545806.561:71): avc: denied { add_name } for pid=306 comm="syz-executor120" name="memory.events.local" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 23.960772][ T306] ================================================================== [ 23.980835][ T28] audit: type=1400 audit(1785545806.561:72): avc: denied { create } for pid=306 comm="syz-executor120" name="memory.events.local" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 23.988541][ T306] BUG: KASAN: use-after-free in ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 23.988585][ T306] Read of size 68 at addr ffff888121963c80 by task syz-executor120/306 [ 24.010390][ T28] audit: type=1400 audit(1785545806.561:73): avc: denied { read append open } for pid=306 comm="syz-executor120" path="/root/file2/file0/memory.events.local" dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 24.019040][ T306] [ 24.019047][ T306] CPU: 0 PID: 306 Comm: syz-executor120 Not tainted syzkaller #0 [ 24.019065][ T306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.019075][ T306] Call Trace: [ 24.077086][ T306] [ 24.080024][ T306] __dump_stack+0x21/0x24 [ 24.084521][ T306] dump_stack_lvl+0x110/0x170 [ 24.089188][ T306] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.094380][ T306] ? ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 24.100809][ T306] print_address_description+0x71/0x200 [ 24.106353][ T306] print_report+0x4a/0x60 [ 24.110854][ T306] kasan_report+0x122/0x150 [ 24.115372][ T306] ? ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 24.121725][ T306] kasan_check_range+0x249/0x2a0 [ 24.126685][ T306] ? ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 24.133123][ T306] memcpy+0x2d/0x70 [ 24.136939][ T306] ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 24.143281][ T306] ? ext4_add_dirent_to_inline+0x440/0x440 [ 24.149178][ T306] ext4_try_add_inline_entry+0x732/0xa60 [ 24.154825][ T306] ? __cfi_ext4_try_add_inline_entry+0x10/0x10 [ 24.161006][ T306] ext4_add_entry+0x509/0xda0 [ 24.165716][ T306] ? ext4_inc_count+0x1b0/0x1b0 [ 24.170573][ T306] ? __ext4_mark_inode_dirty+0x409/0x5d0 [ 24.176209][ T306] ext4_mkdir+0x520/0xc90 [ 24.180543][ T306] ? __cfi_ext4_mkdir+0x10/0x10 [ 24.185487][ T306] ? selinux_inode_mkdir+0x22/0x30 [ 24.190599][ T306] ? security_inode_mkdir+0xd2/0x120 [ 24.195890][ T306] vfs_mkdir+0x39c/0x580 [ 24.200137][ T306] do_mkdirat+0x174/0x4d0 [ 24.204470][ T306] __x64_sys_mkdir+0x6e/0x80 [ 24.209071][ T306] x64_sys_call+0x966/0x9a0 [ 24.213578][ T306] do_syscall_64+0x4c/0xa0 [ 24.218001][ T306] ? clear_bhb_loop+0x30/0x80 [ 24.222700][ T306] ? clear_bhb_loop+0x30/0x80 [ 24.227459][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.233358][ T306] RIP: 0033:0x7fda5a196747 [ 24.237771][ T306] Code: 44 00 00 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 03 31 c9 31 d2 31 f6 e8 f6 2a 01 00 48 83 c4 18 c3 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 24.257462][ T306] RSP: 002b:00007fff9b252e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 24.265879][ T306] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fda5a196747 [ 24.273857][ T306] RDX: 000000000399446c RSI: 00000000000001ff RDI: 0000200000000080 [ 24.281829][ T306] RBP: 0000200000000140 R08: 0000000000000001 R09: 0000000000000000 [ 24.290082][ T306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000080 [ 24.298137][ T306] R13: 00007fff9b252eb0 R14: 0000000000000000 R15: 0000000000000000 [ 24.306134][ T306] [ 24.309162][ T306] [ 24.311486][ T306] Allocated by task 242: [ 24.315720][ T306] kasan_set_track+0x4b/0x70 [ 24.320316][ T306] kasan_save_alloc_info+0x1f/0x30 [ 24.325423][ T306] __kasan_slab_alloc+0x72/0x80 [ 24.330275][ T306] slab_post_alloc_hook+0x4f/0x2d0 [ 24.335389][ T306] kmem_cache_alloc+0x166/0x320 [ 24.340244][ T306] mas_alloc_nodes+0x2d8/0x850 [ 24.345102][ T306] mas_preallocate+0xe3d/0x1430 [ 24.349949][ T306] __vma_adjust+0x622/0x1f10 [ 24.354541][ T306] __split_vma+0x725/0x980 [ 24.359058][ T306] do_mas_align_munmap+0x787/0x1330 [ 24.364344][ T306] do_mas_munmap+0x23d/0x2b0 [ 24.369021][ T306] mmap_region+0x89e/0x2130 [ 24.373622][ T306] do_mmap+0x858/0xdd0 [ 24.377701][ T306] vm_mmap_pgoff+0x206/0x3f0 [ 24.382585][ T306] ksys_mmap_pgoff+0x161/0x1d0 [ 24.387364][ T306] __x64_sys_mmap+0xfa/0x110 [ 24.391975][ T306] x64_sys_call+0x8fd/0x9a0 [ 24.396580][ T306] do_syscall_64+0x4c/0xa0 [ 24.401095][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.406992][ T306] [ 24.409315][ T306] Freed by task 242: [ 24.413198][ T306] kasan_set_track+0x4b/0x70 [ 24.417797][ T306] kasan_save_free_info+0x2b/0x40 [ 24.422817][ T306] ____kasan_slab_free+0x132/0x180 [ 24.427925][ T306] __kasan_slab_free+0x11/0x20 [ 24.432699][ T306] slab_free_freelist_hook+0xc2/0x190 [ 24.438067][ T306] kmem_cache_free+0x12d/0x300 [ 24.442834][ T306] mas_destroy+0x30e9/0x3a90 [ 24.447427][ T306] mas_store_prealloc+0x241/0x3c0 [ 24.452450][ T306] vma_mas_store+0xde/0x1c0 [ 24.456950][ T306] __vma_adjust+0x1470/0x1f10 [ 24.461654][ T306] __split_vma+0x725/0x980 [ 24.466070][ T306] do_mas_align_munmap+0x787/0x1330 [ 24.471268][ T306] do_mas_munmap+0x23d/0x2b0 [ 24.475857][ T306] mmap_region+0x89e/0x2130 [ 24.480364][ T306] do_mmap+0x858/0xdd0 [ 24.484432][ T306] vm_mmap_pgoff+0x206/0x3f0 [ 24.489064][ T306] ksys_mmap_pgoff+0x161/0x1d0 [ 24.493926][ T306] __x64_sys_mmap+0xfa/0x110 [ 24.498510][ T306] x64_sys_call+0x8fd/0x9a0 [ 24.503273][ T306] do_syscall_64+0x4c/0xa0 [ 24.507792][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.513816][ T306] [ 24.516148][ T306] The buggy address belongs to the object at ffff888121963c00 [ 24.516148][ T306] which belongs to the cache maple_node of size 256 [ 24.530213][ T306] The buggy address is located 128 bytes inside of [ 24.530213][ T306] 256-byte region [ffff888121963c00, ffff888121963d00) [ 24.543664][ T306] [ 24.546075][ T306] The buggy address belongs to the physical page: [ 24.552487][ T306] page:ffffea0004865880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121962 [ 24.562806][ T306] head:ffffea0004865880 order:1 compound_mapcount:0 compound_pincount:0 [ 24.571124][ T306] flags: 0x4000000000010200(slab|head|zone=1) [ 24.577190][ T306] raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810004d080 [ 24.585777][ T306] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 24.594434][ T306] page dumped because: kasan: bad access detected [ 24.600842][ T306] page_owner tracks the page as allocated [ 24.606548][ T306] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x52800(GFP_NOWAIT|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 242, tgid 242 (sh), ts 15894060073, free_ts 15232033187 [ 24.624870][ T306] post_alloc_hook+0x1f5/0x210 [ 24.629642][ T306] prep_new_page+0x1c/0x110 [ 24.634228][ T306] get_page_from_freelist+0x2ca9/0x2d20 [ 24.639786][ T306] __alloc_pages+0x1fa/0x610 [ 24.644573][ T306] alloc_slab_page+0x6e/0xf0 [ 24.649174][ T306] new_slab+0x98/0x3e0 [ 24.653245][ T306] ___slab_alloc+0x70f/0xb70 [ 24.657920][ T306] kmem_cache_alloc_bulk+0x165/0x3c0 [ 24.663253][ T306] mas_alloc_nodes+0x423/0x850 [ 24.668014][ T306] mas_wr_spanning_store+0x3e3/0x1800 [ 24.673390][ T306] mas_wr_store_entry+0x4db/0x630 [ 24.678414][ T306] mas_store_gfp+0x226/0x3e0 [ 24.683002][ T306] do_mas_align_munmap+0x8ac/0x1330 [ 24.688209][ T306] do_mas_munmap+0x23d/0x2b0 [ 24.692801][ T306] mmap_region+0x89e/0x2130 [ 24.697397][ T306] do_mmap+0x858/0xdd0 [ 24.701471][ T306] page last free stack trace: [ 24.706165][ T306] free_unref_page_prepare+0x80c/0x820 [ 24.711654][ T306] free_unref_page+0x93/0x530 [ 24.716424][ T306] __folio_put+0xac/0xe0 [ 24.720716][ T306] anon_pipe_buf_release+0x15f/0x1d0 [ 24.726006][ T306] pipe_read+0x582/0x1070 [ 24.730329][ T306] vfs_read+0x46e/0x930 [ 24.734577][ T306] ksys_read+0x14a/0x260 [ 24.738815][ T306] __x64_sys_read+0x7b/0x90 [ 24.743324][ T306] x64_sys_call+0x2f/0x9a0 [ 24.748003][ T306] do_syscall_64+0x4c/0xa0 [ 24.752599][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.758498][ T306] [ 24.760816][ T306] Memory state around the buggy address: [ 24.766529][ T306] ffff888121963b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.774762][ T306] ffff888121963c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.782859][ T306] >ffff888121963c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.791006][ T306] ^ mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- exit_group(0) = ? [ 24.795160][ T306] ffff888121963d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.803212][ T306] ffff888121963d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.811275][ T306] ================================================================== [ 24.819632][ T306] Disabling lock debugging due to kernel taint [ 24.825832][ T306] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor120: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 +++ exited with 0 +++ [ 24.848936][ T