./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1170456827

<...>
Warning: Permanently added '10.128.1.130' (ED25519) to the list of known hosts.
execve("./syz-executor1170456827", ["./syz-executor1170456827"], 0x7ffe0110ddf0 /* 10 vars */) = 0
brk(NULL)                               = 0x5555569ca000
brk(0x5555569cae00)                     = 0x5555569cae00
arch_prctl(ARCH_SET_FS, 0x5555569ca480) = 0
set_tid_address(0x5555569ca750)         = 5062
set_robust_list(0x5555569ca760, 24)     = 0
rseq(0x5555569cada0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1170456827", 4096) = 28
getrandom("\x1b\x3a\x79\xa9\x6f\x29\x62\x35", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555569cae00
brk(0x5555569ebe00)                     = 0x5555569ebe00
brk(0x5555569ec000)                     = 0x5555569ec000
mprotect(0x7f88a774a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7f88a76a2970, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f88a76aa870}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7f88a76a2970, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f88a76aa870}, NULL, 8) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5063 attached
 <unfinished ...>
[pid  5063] set_robust_list(0x5555569ca760, 24 <unfinished ...>
[pid  5062] <... clone resumed>, child_tidptr=0x5555569ca750) = 5063
[pid  5063] <... set_robust_list resumed>) = 0
[pid  5063] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5063] setpgid(0, 0)               = 0
[pid  5063] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5063] write(3, "1000", 4)         = 4
[pid  5063] close(3)                    = 0
[pid  5063] mkdir("./file0", 0777)      = 0
[pid  5063] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid  5063] pipe2([3, 4], 0)            = 0
[pid  5063] mount(NULL, NULL, NULL, 0, "trans=fd,rfdno=0xffffffffffffffff,wfdno=0xffffffffffffffff,") = -1 EFAULT (Bad address)
[pid  5063] write(4, "\x15\x00\x00\x00\x65\xff\xff\x01\x80\x00\x00\x08\x00\x39\x50\x32\x30\x30\x30\x2e\x4c", 21) = 21
[pid  5063] dup(4)                      = 5
[pid  5063] write(5, "\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 24) = 24
[pid  5063] write(5, "\x38\x01\x00\x00\xfe\x00\x00\xff\xff\x72\x66\x64\x6e\x6f\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x2c\x77\x66\x64\x6e\x6f\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x2c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 312) = 312
[   80.921199][ T5063] ==================================================================
[   80.929317][ T5063] BUG: KASAN: slab-use-after-free in v9fs_stat2inode_dotl+0xb3f/0xce0
[   80.937487][ T5063] Read of size 8 at addr ffff8880172d4bb0 by task syz-executor117/5063
[   80.945724][ T5063] 
[   80.948121][ T5063] CPU: 1 PID: 5063 Comm: syz-executor117 Not tainted 6.8.0-rc1-next-20240129-syzkaller #0
[   80.960464][ T5063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[   80.970539][ T5063] Call Trace:
[   80.973805][ T5063]  <TASK>
[   80.976729][ T5063]  dump_stack_lvl+0xd9/0x1b0
[   80.981346][ T5063]  print_report+0xc3/0x620
[   80.985775][ T5063]  ? __virt_addr_valid+0x5e/0x580
[   80.990804][ T5063]  ? __phys_addr+0xc6/0x150
[   80.995341][ T5063]  kasan_report+0xd9/0x110
[   80.999758][ T5063]  ? v9fs_stat2inode_dotl+0xb3f/0xce0
[   81.005138][ T5063]  ? v9fs_stat2inode_dotl+0xb3f/0xce0
[   81.010695][ T5063]  v9fs_stat2inode_dotl+0xb3f/0xce0
[   81.015907][ T5063]  v9fs_fid_iget_dotl+0x1cb/0x260
[   81.020938][ T5063]  v9fs_mount+0x515/0xa90
[   81.025274][ T5063]  ? __pfx_v9fs_mount+0x10/0x10
[   81.030214][ T5063]  ? apparmor_capable+0x126/0x1e0
[   81.035242][ T5063]  ? __pfx_v9fs_mount+0x10/0x10
[   81.040095][ T5063]  legacy_get_tree+0x109/0x220
[   81.044892][ T5063]  vfs_get_tree+0x8f/0x380
[   81.049341][ T5063]  path_mount+0x14e6/0x1f20
[   81.053857][ T5063]  ? kmem_cache_free+0x12e/0x360
[   81.058813][ T5063]  ? __pfx_path_mount+0x10/0x10
[   81.063665][ T5063]  ? putname+0x12e/0x170
[   81.067912][ T5063]  __x64_sys_mount+0x297/0x320
[   81.072673][ T5063]  ? __pfx___x64_sys_mount+0x10/0x10
[   81.077965][ T5063]  ? lockdep_hardirqs_on+0x7c/0x110
[   81.083174][ T5063]  ? _raw_spin_unlock_irq+0x2e/0x50
[   81.088377][ T5063]  ? ptrace_notify+0xf1/0x130
[   81.093064][ T5063]  do_syscall_64+0xd2/0x260
[   81.097583][ T5063]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[   81.103484][ T5063] RIP: 0033:0x7f88a76d7b69
[   81.107922][ T5063] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   81.127526][ T5063] RSP: 002b:00007fff734da2a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   81.135938][ T5063] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f88a76d7b69
[   81.144339][ T5063] RDX: 0000000020004500 RSI: 00000000200002c0 RDI: 0000000000000000
[   81.152319][ T5063] RBP: 0000000000000000 R08: 0000000020000300 R09: 00007fff734da2e0
[   81.160292][ T5063] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff734da2e0
[   81.168262][ T5063] R13: 00007fff734da568 R14: 431bde82d7b634db R15: 00007f88a7720074
[   81.176238][ T5063]  </TASK>
[   81.179250][ T5063] 
[   81.181563][ T5063] Allocated by task 5063:
[   81.185879][ T5063]  kasan_save_stack+0x33/0x60
[   81.190566][ T5063]  kasan_save_track+0x14/0x30
[   81.195244][ T5063]  __kasan_kmalloc+0xaa/0xb0
[   81.199830][ T5063]  p9_client_getattr_dotl+0x4c/0x1e0
[   81.205304][ T5063]  v9fs_fid_iget_dotl+0xe7/0x260
[   81.210423][ T5063]  v9fs_mount+0x515/0xa90
[   81.214751][ T5063]  legacy_get_tree+0x109/0x220
[   81.219535][ T5063]  vfs_get_tree+0x8f/0x380
[   81.224022][ T5063]  path_mount+0x14e6/0x1f20
[   81.228527][ T5063]  __x64_sys_mount+0x297/0x320
[   81.233286][ T5063]  do_syscall_64+0xd2/0x260
[   81.237783][ T5063]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[   81.243681][ T5063] 
[   81.246131][ T5063] Freed by task 5063:
[   81.250113][ T5063]  kasan_save_stack+0x33/0x60
[   81.254793][ T5063]  kasan_save_track+0x14/0x30
[   81.259471][ T5063]  kasan_save_free_info+0x3f/0x60
[   81.264514][ T5063]  __kasan_slab_free+0x121/0x1c0
[   81.269450][ T5063]  kfree+0x129/0x370
[   81.273344][ T5063]  v9fs_fid_iget_dotl+0x195/0x260
[   81.278374][ T5063]  v9fs_mount+0x515/0xa90
[   81.282703][ T5063]  legacy_get_tree+0x109/0x220
[   81.287469][ T5063]  vfs_get_tree+0x8f/0x380
[   81.292062][ T5063]  path_mount+0x14e6/0x1f20
[   81.296558][ T5063]  __x64_sys_mount+0x297/0x320
[   81.301316][ T5063]  do_syscall_64+0xd2/0x260
[   81.305818][ T5063]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[   81.311714][ T5063] 
[   81.314032][ T5063] The buggy address belongs to the object at ffff8880172d4bb0
[   81.314032][ T5063]  which belongs to the cache kmalloc-192 of size 192
[   81.328165][ T5063] The buggy address is located 0 bytes inside of
[   81.328165][ T5063]  freed 192-byte region [ffff8880172d4bb0, ffff8880172d4c70)
[   81.341790][ T5063] 
[   81.344104][ T5063] The buggy address belongs to the physical page:
[   81.350501][ T5063] page:ffffea00005cb500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x172d4
[   81.360666][ T5063] flags: 0xfff80000000800(slab|node=0|zone=1|lastcpupid=0xfff)
[   81.368317][ T5063] page_type: 0xffffffff()
[   81.372648][ T5063] raw: 00fff80000000800 ffff888014c41a00 ffffea00005fa5c0 dead000000000004
[   81.381232][ T5063] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000
[   81.389806][ T5063] page dumped because: kasan: bad access detected
[   81.396204][ T5063] page_owner tracks the page as allocated
[   81.401901][ T5063] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 7, tgid 7 (kworker/0:0), ts 3076962571, free_ts 0
[   81.418662][ T5063]  post_alloc_hook+0x2d4/0x350
[   81.423471][ T5063]  get_page_from_freelist+0xa19/0x3740
[   81.428943][ T5063]  __alloc_pages+0x22e/0x2420
[   81.433618][ T5063]  new_slab+0xcc/0x3a0
[   81.437684][ T5063]  ___slab_alloc+0x66d/0x17a0
[   81.442389][ T5063]  __slab_alloc.constprop.0+0x56/0xb0
[   81.447794][ T5063]  kmalloc_node_trace+0x113/0x390
[   81.453016][ T5063]  alloc_worker+0x40/0x1b0
[   81.457473][ T5063]  create_worker+0xf3/0x730
[   81.461998][ T5063]  worker_thread+0xca1/0x1290
[   81.466689][ T5063]  kthread+0x2c1/0x3a0
[   81.470777][ T5063]  ret_from_fork+0x45/0x80
[   81.475200][ T5063]  ret_from_fork_asm+0x1a/0x30
[   81.480001][ T5063] page_owner free stack trace missing
[   81.485379][ T5063] 
[   81.487703][ T5063] Memory state around the buggy address:
[   81.493334][ T5063]  ffff8880172d4a80: fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb fb
[   81.501500][ T5063]  ffff8880172d4b00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   81.509757][ T5063] >ffff8880172d4b80: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb
[   81.517835][ T5063]                                      ^
[   81.523470][ T5063]  ffff8880172d4c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   81.531529][ T5063]  ffff8880172d4c80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[   81.539583][ T5063] ==================================================================
[   81.548560][ T5063] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   81.555795][ T5063] CPU: 0 PID: 5063 Comm: syz-executor117 Not tainted 6.8.0-rc1-next-20240129-syzkaller #0
[   81.565715][ T5063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[   81.575785][ T5063] Call Trace:
[   81.579096][ T5063]  <TASK>
[   81.582020][ T5063]  dump_stack_lvl+0xd9/0x1b0
[   81.586614][ T5063]  panic+0x6ee/0x7a0
[   81.590501][ T5063]  ? __pfx_panic+0x10/0x10
[   81.594924][ T5063]  ? irqentry_exit+0x3b/0x90
[   81.599558][ T5063]  ? lockdep_hardirqs_on+0x7c/0x110
[   81.604755][ T5063]  ? preempt_schedule_thunk+0x1a/0x30
[   81.612332][ T5063]  ? preempt_schedule_common+0x44/0xc0
[   81.617820][ T5063]  ? check_panic_on_warn+0x1f/0xb0
[   81.622924][ T5063]  check_panic_on_warn+0xab/0xb0
[   81.628136][ T5063]  end_report+0x117/0x160
[   81.632461][ T5063]  kasan_report+0xe9/0x110
[   81.636984][ T5063]  ? v9fs_stat2inode_dotl+0xb3f/0xce0
[   81.642460][ T5063]  ? v9fs_stat2inode_dotl+0xb3f/0xce0
[   81.647940][ T5063]  v9fs_stat2inode_dotl+0xb3f/0xce0
[   81.653160][ T5063]  v9fs_fid_iget_dotl+0x1cb/0x260
[   81.658222][ T5063]  v9fs_mount+0x515/0xa90
[   81.662556][ T5063]  ? __pfx_v9fs_mount+0x10/0x10
[   81.667494][ T5063]  ? apparmor_capable+0x126/0x1e0
[   81.672527][ T5063]  ? __pfx_v9fs_mount+0x10/0x10
[   81.677381][ T5063]  legacy_get_tree+0x109/0x220
[   81.682155][ T5063]  vfs_get_tree+0x8f/0x380
[   81.686654][ T5063]  path_mount+0x14e6/0x1f20
[   81.691155][ T5063]  ? kmem_cache_free+0x12e/0x360
[   81.696262][ T5063]  ? __pfx_path_mount+0x10/0x10
[   81.701101][ T5063]  ? putname+0x12e/0x170
[   81.705348][ T5063]  __x64_sys_mount+0x297/0x320
[   81.710108][ T5063]  ? __pfx___x64_sys_mount+0x10/0x10
[   81.715473][ T5063]  ? lockdep_hardirqs_on+0x7c/0x110
[   81.720708][ T5063]  ? _raw_spin_unlock_irq+0x2e/0x50
[   81.725900][ T5063]  ? ptrace_notify+0xf1/0x130
[   81.730572][ T5063]  do_syscall_64+0xd2/0x260
[   81.735067][ T5063]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[   81.741000][ T5063] RIP: 0033:0x7f88a76d7b69
[   81.745495][ T5063] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   81.765099][ T5063] RSP: 002b:00007fff734da2a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   81.773847][ T5063] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f88a76d7b69
[   81.781825][ T5063] RDX: 0000000020004500 RSI: 00000000200002c0 RDI: 0000000000000000
[   81.789802][ T5063] RBP: 0000000000000000 R08: 0000000020000300 R09: 00007fff734da2e0
[   81.798309][ T5063] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff734da2e0
[   81.806550][ T5063] R13: 00007fff734da568 R14: 431bde82d7b634db R15: 00007f88a7720074
[   81.814523][ T5063]  </TASK>
[   81.817730][ T5063] Kernel Offset: disabled
[   81.822040][ T5063] Rebooting in 86400 seconds..