Warning: Permanently added '[localhost]:55788' (ED25519) to the list of known hosts.
executing program
syzkaller login: [ 79.925701][ T5306] loop0: detected capacity change from 0 to 32768
[ 79.936566][ T5306] =======================================================
[ 79.936566][ T5306] WARNING: The mand mount option has been deprecated and
[ 79.936566][ T5306] and is ignored by this kernel. Remove the mand
[ 79.936566][ T5306] option from the mount to silence this warning.
[ 79.936566][ T5306] =======================================================
[ 80.012447][ T5306] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[ 82.059191][ T1047] ==================================================================
[ 82.062427][ T1047] BUG: KASAN: use-after-free in __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.065819][ T1047] Read of size 4 at addr ffff8880489312c0 by task kworker/u4:9/1047
[ 82.069875][ T1047]
[ 82.070889][ T1047] CPU: 0 UID: 0 PID: 1047 Comm: kworker/u4:9 Not tainted 6.15.0-syzkaller-08486-gf66bc387efbe #0 PREEMPT(full)
[ 82.070904][ T1047] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 82.070912][ T1047] Workqueue: ocfs2_wq ocfs2_truncate_log_worker
[ 82.070929][ T1047] Call Trace:
[ 82.070936][ T1047]
[ 82.070941][ T1047] dump_stack_lvl+0x189/0x250
[ 82.070960][ T1047] ? __virt_addr_valid+0x1c8/0x5c0
[ 82.070974][ T1047] ? rcu_is_watching+0x15/0xb0
[ 82.070987][ T1047] ? __kasan_check_byte+0x12/0x40
[ 82.071001][ T1047] ? __pfx_dump_stack_lvl+0x10/0x10
[ 82.071016][ T1047] ? rcu_is_watching+0x15/0xb0
[ 82.071029][ T1047] ? lock_release+0x4b/0x3e0
[ 82.071042][ T1047] ? __virt_addr_valid+0x1c8/0x5c0
[ 82.071056][ T1047] ? __virt_addr_valid+0x4a5/0x5c0
[ 82.071070][ T1047] print_report+0xd2/0x2b0
[ 82.071084][ T1047] ? __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.071100][ T1047] kasan_report+0x118/0x150
[ 82.071115][ T1047] ? __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.071132][ T1047] __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.071151][ T1047] ? __pfx___ocfs2_flush_truncate_log+0x10/0x10
[ 82.071166][ T1047] ? ocfs2_truncate_log_worker+0x9a/0x190
[ 82.071179][ T1047] ? down_write+0x162/0x1f0
[ 82.071234][ T1047] ? __pfx_down_write+0x10/0x10
[ 82.071248][ T1047] ocfs2_truncate_log_worker+0xa2/0x190
[ 82.071259][ T1047] ? __pfx_ocfs2_truncate_log_worker+0x10/0x10
[ 82.071270][ T1047] ? _raw_spin_unlock_irq+0x23/0x50
[ 82.071280][ T1047] ? process_scheduled_works+0x9ef/0x17b0
[ 82.071293][ T1047] ? process_scheduled_works+0x9ef/0x17b0
[ 82.071306][ T1047] process_scheduled_works+0xae1/0x17b0
[ 82.071321][ T1047] ? __pfx_process_scheduled_works+0x10/0x10
[ 82.071332][ T1047] worker_thread+0x8a0/0xda0
[ 82.071344][ T1047] kthread+0x70e/0x8a0
[ 82.071356][ T1047] ? __pfx_worker_thread+0x10/0x10
[ 82.071364][ T1047] ? __pfx_kthread+0x10/0x10
[ 82.071374][ T1047] ? _raw_spin_unlock_irq+0x23/0x50
[ 82.071383][ T1047] ? lockdep_hardirqs_on+0x9c/0x150
[ 82.071393][ T1047] ? __pfx_kthread+0x10/0x10
[ 82.071407][ T1047] ret_from_fork+0x3fc/0x770
[ 82.071420][ T1047] ? __pfx_ret_from_fork+0x10/0x10
[ 82.071432][ T1047] ? __pfx_kthread+0x10/0x10
[ 82.071447][ T1047] ret_from_fork_asm+0x1a/0x30
[ 82.071462][ T1047]
[ 82.071466][ T1047]
[ 82.171750][ T1047] The buggy address belongs to the physical page:
[ 82.175116][ T1047] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x44 pfn:0x48931
[ 82.178747][ T1047] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 82.181753][ T1047] raw: 04fff00000000000 ffffea0001224c88 ffffea0001224c08 0000000000000000
[ 82.185276][ T1047] raw: 0000000000000044 0000000000000000 00000000ffffffff 0000000000000000
[ 82.188814][ T1047] page dumped because: kasan: bad access detected
[ 82.191295][ T1047] page_owner tracks the page as freed
[ 82.193531][ T1047] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5318, tgid 5318 (syz-executor339), ts 81843603680, free_ts 81934993911
[ 82.200397][ T1047] post_alloc_hook+0x240/0x2a0
[ 82.202301][ T1047] get_page_from_freelist+0x21e0/0x22c0
[ 82.204616][ T1047] __alloc_frozen_pages_noprof+0x181/0x370
[ 82.206918][ T1047] alloc_pages_mpol+0x232/0x4a0
[ 82.208829][ T1047] folio_alloc_mpol_noprof+0x39/0x70
[ 82.210886][ T1047] shmem_alloc_and_add_folio+0x447/0xf60
[ 82.213044][ T1047] shmem_get_folio_gfp+0x59d/0x1660
[ 82.215050][ T1047] shmem_write_begin+0xf7/0x2b0
[ 82.216908][ T1047] generic_perform_write+0x2c4/0x910
[ 82.218949][ T1047] shmem_file_write_iter+0xf8/0x120
[ 82.220959][ T1047] vfs_write+0x54b/0xa90
[ 82.222586][ T1047] ksys_write+0x145/0x250
[ 82.224295][ T1047] do_syscall_64+0xfa/0x3b0
[ 82.226041][ T1047] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 82.228351][ T1047] page last free pid 5318 tgid 5318 stack trace:
[ 82.230973][ T1047] free_unref_folios+0xcc9/0x1550
[ 82.233080][ T1047] folios_put_refs+0x559/0x640
[ 82.235172][ T1047] shmem_undo_range+0x49e/0x14b0
[ 82.237185][ T1047] shmem_evict_inode+0x272/0xa70
[ 82.239315][ T1047] evict+0x501/0x9c0
[ 82.240944][ T1047] __dentry_kill+0x209/0x660
[ 82.242907][ T1047] dput+0x19f/0x2b0
[ 82.244522][ T1047] __fput+0x68e/0xa70
[ 82.246220][ T1047] fput_close_sync+0x119/0x200
[ 82.248215][ T1047] __x64_sys_close+0x7f/0x110
[ 82.250228][ T1047] do_syscall_64+0xfa/0x3b0
[ 82.252153][ T1047] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 82.254664][ T1047]
[ 82.255718][ T1047] Memory state around the buggy address:
[ 82.258029][ T1047] ffff888048931180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 82.261480][ T1047] ffff888048931200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 82.264865][ T1047] >ffff888048931280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 82.268233][ T1047] ^
[ 82.270836][ T1047] ffff888048931300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 82.274160][ T1047] ffff888048931380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 82.277485][ T1047] ==================================================================
executing program
[ 82.480464][ T1047] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 82.483538][ T1047] CPU: 0 UID: 0 PID: 1047 Comm: kworker/u4:9 Not tainted 6.15.0-syzkaller-08486-gf66bc387efbe #0 PREEMPT(full)
[ 82.488299][ T1047] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 82.492743][ T1047] Workqueue: ocfs2_wq ocfs2_truncate_log_worker
[ 82.495272][ T1047] Call Trace:
[ 82.496689][ T1047]
[ 82.497914][ T1047] dump_stack_lvl+0x99/0x250
[ 82.499834][ T1047] ? __asan_memcpy+0x40/0x70
[ 82.501754][ T1047] ? __pfx_dump_stack_lvl+0x10/0x10
[ 82.503919][ T1047] ? __pfx__printk+0x10/0x10
[ 82.505848][ T1047] panic+0x2db/0x790
[ 82.507473][ T1047] ? __pfx_panic+0x10/0x10
[ 82.509422][ T1047] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 82.511840][ T1047] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 82.514412][ T1047] ? print_memory_metadata+0x314/0x400
[ 82.516637][ T1047] ? __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.519095][ T1047] check_panic_on_warn+0x89/0xb0
[ 82.521187][ T1047] ? __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.523696][ T1047] end_report+0x78/0x160
[ 82.525444][ T1047] kasan_report+0x129/0x150
[ 82.527316][ T1047] ? __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.529780][ T1047] __ocfs2_flush_truncate_log+0x7c7/0x10e0
[ 82.532138][ T1047] ? __pfx___ocfs2_flush_truncate_log+0x10/0x10
[ 82.534677][ T1047] ? ocfs2_truncate_log_worker+0x9a/0x190
[ 82.537143][ T1047] ? down_write+0x162/0x1f0
[ 82.539070][ T1047] ? __pfx_down_write+0x10/0x10
[ 82.541143][ T1047] ocfs2_truncate_log_worker+0xa2/0x190
[ 82.543507][ T1047] ? __pfx_ocfs2_truncate_log_worker+0x10/0x10
[ 82.546138][ T1047] ? _raw_spin_unlock_irq+0x23/0x50
[ 82.548425][ T1047] ? process_scheduled_works+0x9ef/0x17b0
[ 82.550801][ T1047] ? process_scheduled_works+0x9ef/0x17b0
[ 82.553196][ T1047] process_scheduled_works+0xae1/0x17b0
[ 82.555439][ T1047] ? __pfx_process_scheduled_works+0x10/0x10
[ 82.557981][ T1047] worker_thread+0x8a0/0xda0
[ 82.560070][ T1047] kthread+0x70e/0x8a0
[ 82.561821][ T1047] ? __pfx_worker_thread+0x10/0x10
[ 82.564071][ T1047] ? __pfx_kthread+0x10/0x10
[ 82.566068][ T1047] ? _raw_spin_unlock_irq+0x23/0x50
[ 82.568313][ T1047] ? lockdep_hardirqs_on+0x9c/0x150
[ 82.570558][ T1047] ? __pfx_kthread+0x10/0x10
[ 82.572616][ T1047] ret_from_fork+0x3fc/0x770
[ 82.574635][ T1047] ? __pfx_ret_from_fork+0x10/0x10
[ 82.576827][ T1047] ? __pfx_kthread+0x10/0x10
[ 82.578814][ T1047] ret_from_fork_asm+0x1a/0x30
[ 82.580745][ T1047]
[ 82.582202][ T1047] Kernel Offset: disabled
[ 82.583975][ T1047] Rebooting in 86400 seconds..
VM DIAGNOSIS:
17:46:54 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900026a70b0
R8 =ffff888033870237 R9 =1ffff1100670e046 R10=dffffc0000000000 R11=ffffffff8545e3b0
R12=dffffc0000000000 R13=ffffffff99ab2927 R14=ffffffff99db7d20 R15=0000000000000000
RIP=ffffffff8545e42c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88808d263000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f175c7ff000 CR3=0000000042e95000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000440401 Opmask01=0000000000000001 Opmask02=00000000fff7ffff Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffc6aced60 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1763d3d560 00007f1763d315d8
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1763d227c4 00007f1763d36240
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 65723d73726f7272 6500747865003036 36396f7369007265 6c6c616b7a797300
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 40571856574a5757 4000515d40001513 131c4a564c005740 4949444e5f5c5600
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000