syzkaller login: [ 92.154367][ T54] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:40694' (ED25519) to the list of known hosts.
executing program
[ 94.015652][ T5317] loop0: detected capacity change from 0 to 32768
[ 94.055851][ T5317] ==================================================================
[ 94.059056][ T5317] BUG: KASAN: slab-out-of-bounds in dtSearch+0x1683/0x21b0
[ 94.062776][ T5317] Read of size 1 at addr ffff888043adc030 by task syz-executor361/5317
[ 94.066756][ T5317]
[ 94.067861][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz-executor361 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full)
[ 94.067878][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 94.067903][ T5317] Call Trace:
[ 94.067913][ T5317]
[ 94.067918][ T5317] dump_stack_lvl+0x189/0x250
[ 94.067942][ T5317] ? __virt_addr_valid+0x1c8/0x5c0
[ 94.067977][ T5317] ? rcu_is_watching+0x15/0xb0
[ 94.067995][ T5317] ? __kasan_check_byte+0x12/0x40
[ 94.068025][ T5317] ? __pfx_dump_stack_lvl+0x10/0x10
[ 94.068039][ T5317] ? rcu_is_watching+0x15/0xb0
[ 94.068056][ T5317] ? lock_release+0x4b/0x3e0
[ 94.068071][ T5317] ? __virt_addr_valid+0x1c8/0x5c0
[ 94.068083][ T5317] ? __virt_addr_valid+0x4a5/0x5c0
[ 94.068094][ T5317] print_report+0xd2/0x2b0
[ 94.068110][ T5317] ? dtSearch+0x1683/0x21b0
[ 94.068123][ T5317] kasan_report+0x118/0x150
[ 94.068134][ T5317] ? dtSearch+0x1683/0x21b0
[ 94.068147][ T5317] dtSearch+0x1683/0x21b0
[ 94.068168][ T5317] jfs_lookup+0x155/0x380
[ 94.068184][ T5317] ? __pfx_jfs_lookup+0x10/0x10
[ 94.068205][ T5317] ? _raw_spin_unlock+0x28/0x50
[ 94.068266][ T5317] ? d_alloc+0x144/0x190
[ 94.068282][ T5317] lookup_one_qstr_excl_raw+0x115/0x280
[ 94.068297][ T5317] do_renameat2+0x401/0xc50
[ 94.068314][ T5317] ? __pfx_do_renameat2+0x10/0x10
[ 94.068327][ T5317] ? getname_flags+0x1e5/0x540
[ 94.068342][ T5317] __x64_sys_renameat2+0xce/0xe0
[ 94.068353][ T5317] do_syscall_64+0xfa/0x3b0
[ 94.068364][ T5317] ? lockdep_hardirqs_on+0x9c/0x150
[ 94.068387][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.068399][ T5317] ? clear_bhb_loop+0x60/0xb0
[ 94.068411][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.068421][ T5317] RIP: 0033:0x7f01cdd9cad9
[ 94.068450][ T5317] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 94.068462][ T5317] RSP: 002b:00007ffe7e556908 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
[ 94.068475][ T5317] RAX: ffffffffffffffda RBX: 0000200000000040 RCX: 00007f01cdd9cad9
[ 94.068483][ T5317] RDX: 00000000ffffff9c RSI: 0000200000000000 RDI: 00000000ffffff9c
[ 94.068491][ T5317] RBP: 00007f01cde155f0 R08: 0000000000000000 R09: 000055558f0a54c0
[ 94.068499][ T5317] R10: 00002000000000c0 R11: 0000000000000246 R12: 00007ffe7e556930
[ 94.068506][ T5317] R13: 00007ffe7e556b58 R14: 431bde82d7b634db R15: 00007f01cdde503b
[ 94.068517][ T5317]
[ 94.068521][ T5317]
[ 94.186975][ T5317] Allocated by task 5317:
[ 94.189093][ T5317] kasan_save_track+0x3e/0x80
[ 94.191410][ T5317] __kasan_slab_alloc+0x6c/0x80
[ 94.194086][ T5317] kmem_cache_alloc_lru_noprof+0x1c6/0x3d0
[ 94.197167][ T5317] jfs_alloc_inode+0x28/0x70
[ 94.199182][ T5317] alloc_inode+0x67/0x1b0
[ 94.201112][ T5317] new_inode+0x22/0x170
[ 94.202932][ T5317] ialloc+0x4c/0x8f0
[ 94.204782][ T5317] jfs_create+0x18d/0xa80
[ 94.207125][ T5317] path_openat+0x14f4/0x3830
[ 94.209536][ T5317] do_filp_open+0x1fa/0x410
[ 94.211730][ T5317] do_sys_openat2+0x121/0x1c0
[ 94.213976][ T5317] __x64_sys_openat+0x138/0x170
[ 94.216380][ T5317] do_syscall_64+0xfa/0x3b0
[ 94.218910][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.222217][ T5317]
[ 94.223545][ T5317] The buggy address belongs to the object at ffff888043adb750
[ 94.223545][ T5317] which belongs to the cache jfs_ip of size 2232
[ 94.229559][ T5317] The buggy address is located 40 bytes to the right of
[ 94.229559][ T5317] allocated 2232-byte region [ffff888043adb750, ffff888043adc008)
[ 94.236428][ T5317]
[ 94.237756][ T5317] The buggy address belongs to the physical page:
[ 94.240568][ T5317] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43ad8
[ 94.244393][ T5317] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 94.248144][ T5317] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 94.252173][ T5317] page_type: f5(slab)
[ 94.254170][ T5317] raw: 04fff00000000040 ffff8880008718c0 dead000000000122 0000000000000000
[ 94.257953][ T5317] raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
[ 94.261966][ T5317] head: 04fff00000000040 ffff8880008718c0 dead000000000122 0000000000000000
[ 94.266705][ T5317] head: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
[ 94.270464][ T5317] head: 04fff00000000003 ffffea00010eb601 00000000ffffffff 00000000ffffffff
[ 94.274250][ T5317] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 94.278715][ T5317] page dumped because: kasan: bad access detected
[ 94.282220][ T5317] page_owner tracks the page as allocated
[ 94.284884][ T5317] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_RECLAIMABLE|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5317, tgid 5317 (syz-executor361), ts 94030062522, free_ts 0
[ 94.294656][ T5317] post_alloc_hook+0x240/0x2a0
[ 94.297182][ T5317] get_page_from_freelist+0x21e4/0x22c0
[ 94.299811][ T5317] __alloc_frozen_pages_noprof+0x181/0x370
[ 94.302457][ T5317] alloc_pages_mpol+0x232/0x4a0
[ 94.304712][ T5317] allocate_slab+0x8a/0x3b0
[ 94.307110][ T5317] ___slab_alloc+0xbfc/0x1480
[ 94.309824][ T5317] kmem_cache_alloc_lru_noprof+0x288/0x3d0
[ 94.312636][ T5317] jfs_alloc_inode+0x28/0x70
[ 94.314679][ T5317] alloc_inode+0x67/0x1b0
[ 94.316607][ T5317] new_inode+0x22/0x170
[ 94.318609][ T5317] jfs_fill_super+0x569/0xd90
[ 94.321159][ T5317] get_tree_bdev_flags+0x40b/0x4d0
[ 94.324042][ T5317] vfs_get_tree+0x92/0x2b0
[ 94.326091][ T5317] do_new_mount+0x24a/0xa40
[ 94.328145][ T5317] __se_sys_mount+0x317/0x410
[ 94.330188][ T5317] do_syscall_64+0xfa/0x3b0
[ 94.332221][ T5317] page_owner free stack trace missing
[ 94.334829][ T5317]
[ 94.336093][ T5317] Memory state around the buggy address:
[ 94.338786][ T5317] ffff888043adbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.342238][ T5317] ffff888043adbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.345571][ T5317] >ffff888043adc000: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.349510][ T5317] ^
[ 94.353035][ T5317] ffff888043adc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.357483][ T5317] ffff888043adc100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.361081][ T5317] ==================================================================
[ 94.409505][ T5317] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.412919][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz-executor361 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full)
[ 94.418664][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 94.424442][ T5317] Call Trace:
[ 94.426113][ T5317]
[ 94.427301][ T5317] dump_stack_lvl+0x99/0x250
[ 94.429392][ T5317] ? __asan_memcpy+0x40/0x70
[ 94.431729][ T5317] ? __pfx_dump_stack_lvl+0x10/0x10
[ 94.434374][ T5317] ? __pfx__printk+0x10/0x10
[ 94.436853][ T5317] panic+0x2db/0x790
[ 94.438603][ T5317] ? __pfx_panic+0x10/0x10
[ 94.440493][ T5317] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 94.443274][ T5317] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 94.446636][ T5317] ? print_memory_metadata+0x314/0x400
[ 94.449673][ T5317] ? dtSearch+0x1683/0x21b0
[ 94.451584][ T5317] check_panic_on_warn+0x89/0xb0
[ 94.453811][ T5317] ? dtSearch+0x1683/0x21b0
[ 94.455697][ T5317] end_report+0x78/0x160
[ 94.457507][ T5317] kasan_report+0x129/0x150
[ 94.459582][ T5317] ? dtSearch+0x1683/0x21b0
[ 94.462140][ T5317] dtSearch+0x1683/0x21b0
[ 94.464493][ T5317] jfs_lookup+0x155/0x380
[ 94.466518][ T5317] ? __pfx_jfs_lookup+0x10/0x10
[ 94.468682][ T5317] ? _raw_spin_unlock+0x28/0x50
[ 94.470690][ T5317] ? d_alloc+0x144/0x190
[ 94.472601][ T5317] lookup_one_qstr_excl_raw+0x115/0x280
[ 94.475009][ T5317] do_renameat2+0x401/0xc50
[ 94.477214][ T5317] ? __pfx_do_renameat2+0x10/0x10
[ 94.479669][ T5317] ? getname_flags+0x1e5/0x540
[ 94.482247][ T5317] __x64_sys_renameat2+0xce/0xe0
[ 94.485207][ T5317] do_syscall_64+0xfa/0x3b0
[ 94.487258][ T5317] ? lockdep_hardirqs_on+0x9c/0x150
[ 94.489541][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.492319][ T5317] ? clear_bhb_loop+0x60/0xb0
[ 94.494648][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.497758][ T5317] RIP: 0033:0x7f01cdd9cad9
[ 94.500153][ T5317] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 94.508607][ T5317] RSP: 002b:00007ffe7e556908 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
[ 94.512824][ T5317] RAX: ffffffffffffffda RBX: 0000200000000040 RCX: 00007f01cdd9cad9
[ 94.516677][ T5317] RDX: 00000000ffffff9c RSI: 0000200000000000 RDI: 00000000ffffff9c
[ 94.520238][ T5317] RBP: 00007f01cde155f0 R08: 0000000000000000 R09: 000055558f0a54c0
[ 94.524159][ T5317] R10: 00002000000000c0 R11: 0000000000000246 R12: 00007ffe7e556930
[ 94.528556][ T5317] R13: 00007ffe7e556b58 R14: 431bde82d7b634db R15: 00007f01cdde503b
[ 94.532302][ T5317]
[ 94.534132][ T5317] Kernel Offset: disabled
[ 94.536237][ T5317] Rebooting in 86400 seconds..
VM DIAGNOSIS:
15:38:21 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000d26f210
R8 =ffff888033bb8237 R9 =1ffff11006777046 R10=dffffc0000000000 R11=ffffffff85470f70
R12=dffffc0000000000 R13=ffffffff99ac3911 R14=ffffffff99dc8780 R15=0000000000000000
RIP=ffffffff85470fec RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055558f0a4380 ffffffff 00c00000
GS =0000 ffff88808d252000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f898e468000 CR3=0000000042a84000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000ffffffff Opmask01=0000000000000006 Opmask02=0000000000000007 Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0073657479625f6e 695f65676173752e
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7e555f00 00007ffe7e555ee0
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7e556040 00007ffe7e555ec0
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f01cde07424 00007f01cde1a240
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7e555f00
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7e556040
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7e556040 00007ffe7e555ec0
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7e555f00 00007ffe7e555ee0
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000073666a
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000