Extracting prog: 2m36.291141872s
Minimizing prog: 6m11.921961959s
Simplifying prog options: 0s
Extracting C: 34.385780643s
Simplifying C: 8m36.151480456s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
detailed listing:
executing program 0:
r0 = syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f0000000000)='./file1\x00', 0x1804810, &(0x7f0000000180)=ANY=[], 0x0, 0x6ad, &(0x7f00000002c0)="$eJzs3ctvXFcdB/DvHU/sTFrSJE3agCrVaiRARCROrLSYDQEhlEVVVWXB2kqcxoqTFsdFboXIhOe2i/4BZZENYoXEik2kwoIN3XWHvERCYlMWhA2D7p079ng8nozbxA/4fKI759xzzj3n3N99zMOKboD/W1fOpvkgRa6cfXW1XF+7P7u0dn/2Vjf/WjPJVJJ2UmYbSYp/dTqdj5LLSbHeTTGQbvHB4twbn3y69rfuWrNeqvaNUdsNqNu1B4rbvbLpJBN1+jls6u/q5+6vWJ/55SRn6hT23KEknU1++Oen12v6tIZtfXhX5gg8WUX3fXOLY8mR+kIvPwf03nkbuzu78U2N2W7wEwQAAAAcNNV34OaW4k0lzzzMw6wWR3dxWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCgtTee/1/US6OXn07Re/7/ZF2WOr+/vLiz5g+e1DwAAAAAAAAAYBe9+DAPs5qjvfVOUf3N/6Vq5WT1+lTeyZ0sZDnnspr5rGQly7mQ5FhfR5Or8ysrU721UVteHLbl8sVHTLTXdesx7DQAAAAAAAAA/O/5aa5s/P0fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2gyKZ6CYp7vUVH0ujmeRwksmyoJ183MsfZA/2egIAAACwC6aSh1nN0d56p8jJJM9VvwEczju5nZUsZiVLWci16neB7rf+xtr92aW1+7O3ymVrv9/+x46mUfWY7m8Pw0c+XbVo5XoWq5JzuZq3spRraVRblk7X8+n1OjCve+Wcim/VXhlvZtfqtNzz9+t0i7s72tnt7PDHlGNVRA51IzKRzNRzK6NxvHdkhh+hHR6daqRW1mN/IY31yZ4cGGly885sjvlGl41R4x2p03J/frldzPdEN+b/6XQt5GLf2ffc6JgnX/n9b38wU+f3zy6NZ6JOO9Vra+Dsy0Jm+yLx/DiRuLF0++aN63fOHrRIbDFTReLU+vqVfC/fz9lM5/UsZzE/ynxWspDpfLfKzdcHv+i75LeJ1OVu0u4mrz9qJpP1Gdo9WDub00vVtkezmNfyVq5lIS9X/y7mQl7JpVzKXN8RPjX6CFdXfWPrVV/pfGHo5M98tc60kvyqTveHMq7H++K6cdbPVPE+vqlkI0onxojSkHvjKM0v1ZlyjJ896ka6qwYjcaEvEs+OjsSvq9vKnaXbN5dvzL893nAn3q8z5XX0i2R6/9xIyvPlRHmwqrWpTWdHWffset3meJV1J9frGlvqTuUPaTZ7oyymve2VOll/htva08Wq7vmhdbNV3em+umGftwDY94587chk6++tv7Q+bP28daP16uHvTH1j6oXJHPrjoW82Zya+3Hih+F0+zE82vv8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACf3Z1337s5v7S0sDyQ6XQ6dz8eXjVmpve8ms+4+WCm91SoMRpn+q9PlU2HVE2kc3ebqieV+eLTyW6NtX8z/+50OnVJsU2b3/xpMFBT2aPQ1c/56+zWoEna++Iw9WXq6+2ZPbktAbvg/Mqtt8/fefe9ry/emn9z4c2F23OXLs3NzF16efb89cWlhZnu617PEngSNt7093omAAAAAAAAAAAAwLge8/8ZaA+r2ut9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA62K2fTfJAiF2bOzZTra/dnl8qll99o2UzSSFL8OCk+Si6nu+RYX3fFduN8sDj3xiefrv2z01X3V7VvjNpuPO16yXSSiW5673H1d7VORypG7UKxvodlwM70Agd77b8BAAD//5riD3w=")
getdents64(r0, &(0x7f0000000100)=""/89, 0x59)
getdents64(r0, &(0x7f0000000100)=""/89, 0x59)
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=1m8.222224945s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64
detailed listing:
executing program 0:
r0 = syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f0000000000)='./file1\x00', 0x1804810, &(0x7f0000000180)=ANY=[], 0x0, 0x6ad, &(0x7f00000002c0)="$eJzs3ctvXFcdB/DvHU/sTFrSJE3agCrVaiRARCROrLSYDQEhlEVVVWXB2kqcxoqTFsdFboXIhOe2i/4BZZENYoXEik2kwoIN3XWHvERCYlMWhA2D7p079ng8nozbxA/4fKI759xzzj3n3N99zMOKboD/W1fOpvkgRa6cfXW1XF+7P7u0dn/2Vjf/WjPJVJJ2UmYbSYp/dTqdj5LLSbHeTTGQbvHB4twbn3y69rfuWrNeqvaNUdsNqNu1B4rbvbLpJBN1+jls6u/q5+6vWJ/55SRn6hT23KEknU1++Oen12v6tIZtfXhX5gg8WUX3fXOLY8mR+kIvPwf03nkbuzu78U2N2W7wEwQAAAAcNNV34OaW4k0lzzzMw6wWR3dxWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCgtTee/1/US6OXn07Re/7/ZF2WOr+/vLiz5g+e1DwAAAAAAAAAYBe9+DAPs5qjvfVOUf3N/6Vq5WT1+lTeyZ0sZDnnspr5rGQly7mQ5FhfR5Or8ysrU721UVteHLbl8sVHTLTXdesx7DQAAAAAAAAA/O/5aa5s/P0fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2gyKZ6CYp7vUVH0ujmeRwksmyoJ183MsfZA/2egIAAACwC6aSh1nN0d56p8jJJM9VvwEczju5nZUsZiVLWci16neB7rf+xtr92aW1+7O3ymVrv9/+x46mUfWY7m8Pw0c+XbVo5XoWq5JzuZq3spRraVRblk7X8+n1OjCve+Wcim/VXhlvZtfqtNzz9+t0i7s72tnt7PDHlGNVRA51IzKRzNRzK6NxvHdkhh+hHR6daqRW1mN/IY31yZ4cGGly885sjvlGl41R4x2p03J/frldzPdEN+b/6XQt5GLf2ffc6JgnX/n9b38wU+f3zy6NZ6JOO9Vra+Dsy0Jm+yLx/DiRuLF0++aN63fOHrRIbDFTReLU+vqVfC/fz9lM5/UsZzE/ynxWspDpfLfKzdcHv+i75LeJ1OVu0u4mrz9qJpP1Gdo9WDub00vVtkezmNfyVq5lIS9X/y7mQl7JpVzKXN8RPjX6CFdXfWPrVV/pfGHo5M98tc60kvyqTveHMq7H++K6cdbPVPE+vqlkI0onxojSkHvjKM0v1ZlyjJ896ka6qwYjcaEvEs+OjsSvq9vKnaXbN5dvzL893nAn3q8z5XX0i2R6/9xIyvPlRHmwqrWpTWdHWffset3meJV1J9frGlvqTuUPaTZ7oyymve2VOll/htva08Wq7vmhdbNV3em+umGftwDY94587chk6++tv7Q+bP28daP16uHvTH1j6oXJHPrjoW82Zya+3Hih+F0+zE82vv8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACf3Z1337s5v7S0sDyQ6XQ6dz8eXjVmpve8ms+4+WCm91SoMRpn+q9PlU2HVE2kc3ebqieV+eLTyW6NtX8z/+50OnVJsU2b3/xpMFBT2aPQ1c/56+zWoEna++Iw9WXq6+2ZPbktAbvg/Mqtt8/fefe9ry/emn9z4c2F23OXLs3NzF16efb89cWlhZnu617PEngSNt7093omAAAAAAAAAAAAwLge8/8ZaA+r2ut9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA62K2fTfJAiF2bOzZTra/dnl8qll99o2UzSSFL8OCk+Si6nu+RYX3fFduN8sDj3xiefrv2z01X3V7VvjNpuPO16yXSSiW5673H1d7VORypG7UKxvodlwM70Agd77b8BAAD//5riD3w=")
getdents64(r0, &(0x7f0000000100)=""/89, 0x59)
program did not crash
testing program (duration=1m8.222224945s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getdents64-getdents64
detailed listing:
executing program 0:
getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/89, 0x59)
getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/89, 0x59)
program did not crash
testing program (duration=1m8.222224945s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
detailed listing:
executing program 0:
r0 = syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f0000000000)='./file1\x00', 0x1804810, &(0x7f0000000180)=ANY=[], 0x0, 0x6ad, &(0x7f00000002c0)="$eJzs3ctvXFcdB/DvHU/sTFrSJE3agCrVaiRARCROrLSYDQEhlEVVVWXB2kqcxoqTFsdFboXIhOe2i/4BZZENYoXEik2kwoIN3XWHvERCYlMWhA2D7p079ng8nozbxA/4fKI759xzzj3n3N99zMOKboD/W1fOpvkgRa6cfXW1XF+7P7u0dn/2Vjf/WjPJVJJ2UmYbSYp/dTqdj5LLSbHeTTGQbvHB4twbn3y69rfuWrNeqvaNUdsNqNu1B4rbvbLpJBN1+jls6u/q5+6vWJ/55SRn6hT23KEknU1++Oen12v6tIZtfXhX5gg8WUX3fXOLY8mR+kIvPwf03nkbuzu78U2N2W7wEwQAAAAcNNV34OaW4k0lzzzMw6wWR3dxWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCgtTee/1/US6OXn07Re/7/ZF2WOr+/vLiz5g+e1DwAAAAAAAAAYBe9+DAPs5qjvfVOUf3N/6Vq5WT1+lTeyZ0sZDnnspr5rGQly7mQ5FhfR5Or8ysrU721UVteHLbl8sVHTLTXdesx7DQAAAAAAAAA/O/5aa5s/P0fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2gyKZ6CYp7vUVH0ujmeRwksmyoJ183MsfZA/2egIAAACwC6aSh1nN0d56p8jJJM9VvwEczju5nZUsZiVLWci16neB7rf+xtr92aW1+7O3ymVrv9/+x46mUfWY7m8Pw0c+XbVo5XoWq5JzuZq3spRraVRblk7X8+n1OjCve+Wcim/VXhlvZtfqtNzz9+t0i7s72tnt7PDHlGNVRA51IzKRzNRzK6NxvHdkhh+hHR6daqRW1mN/IY31yZ4cGGly885sjvlGl41R4x2p03J/frldzPdEN+b/6XQt5GLf2ffc6JgnX/n9b38wU+f3zy6NZ6JOO9Vra+Dsy0Jm+yLx/DiRuLF0++aN63fOHrRIbDFTReLU+vqVfC/fz9lM5/UsZzE/ynxWspDpfLfKzdcHv+i75LeJ1OVu0u4mrz9qJpP1Gdo9WDub00vVtkezmNfyVq5lIS9X/y7mQl7JpVzKXN8RPjX6CFdXfWPrVV/pfGHo5M98tc60kvyqTveHMq7H++K6cdbPVPE+vqlkI0onxojSkHvjKM0v1ZlyjJ896ka6qwYjcaEvEs+OjsSvq9vKnaXbN5dvzL893nAn3q8z5XX0i2R6/9xIyvPlRHmwqrWpTWdHWffset3meJV1J9frGlvqTuUPaTZ7oyymve2VOll/htva08Wq7vmhdbNV3em+umGftwDY94587chk6++tv7Q+bP28daP16uHvTH1j6oXJHPrjoW82Zya+3Hih+F0+zE82vv8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACf3Z1337s5v7S0sDyQ6XQ6dz8eXjVmpve8ms+4+WCm91SoMRpn+q9PlU2HVE2kc3ebqieV+eLTyW6NtX8z/+50OnVJsU2b3/xpMFBT2aPQ1c/56+zWoEna++Iw9WXq6+2ZPbktAbvg/Mqtt8/fefe9ry/emn9z4c2F23OXLs3NzF16efb89cWlhZnu617PEngSNt7093omAAAAAAAAAAAAwLge8/8ZaA+r2ut9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA62K2fTfJAiF2bOzZTra/dnl8qll99o2UzSSFL8OCk+Si6nu+RYX3fFduN8sDj3xiefrv2z01X3V7VvjNpuPO16yXSSiW5673H1d7VORypG7UKxvodlwM70Agd77b8BAAD//5riD3w=")
getdents64(r0, 0x0, 0x0)
getdents64(r0, &(0x7f0000000100)=""/89, 0x59)
program did not crash
testing program (duration=1m8.222224945s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
detailed listing:
executing program 0:
r0 = syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f0000000000)='./file1\x00', 0x1804810, &(0x7f0000000180)=ANY=[], 0x0, 0x6ad, &(0x7f00000002c0)="$eJzs3ctvXFcdB/DvHU/sTFrSJE3agCrVaiRARCROrLSYDQEhlEVVVWXB2kqcxoqTFsdFboXIhOe2i/4BZZENYoXEik2kwoIN3XWHvERCYlMWhA2D7p079ng8nozbxA/4fKI759xzzj3n3N99zMOKboD/W1fOpvkgRa6cfXW1XF+7P7u0dn/2Vjf/WjPJVJJ2UmYbSYp/dTqdj5LLSbHeTTGQbvHB4twbn3y69rfuWrNeqvaNUdsNqNu1B4rbvbLpJBN1+jls6u/q5+6vWJ/55SRn6hT23KEknU1++Oen12v6tIZtfXhX5gg8WUX3fXOLY8mR+kIvPwf03nkbuzu78U2N2W7wEwQAAAAcNNV34OaW4k0lzzzMw6wWR3dxWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCgtTee/1/US6OXn07Re/7/ZF2WOr+/vLiz5g+e1DwAAAAAAAAAYBe9+DAPs5qjvfVOUf3N/6Vq5WT1+lTeyZ0sZDnnspr5rGQly7mQ5FhfR5Or8ysrU721UVteHLbl8sVHTLTXdesx7DQAAAAAAAAA/O/5aa5s/P0fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2gyKZ6CYp7vUVH0ujmeRwksmyoJ183MsfZA/2egIAAACwC6aSh1nN0d56p8jJJM9VvwEczju5nZUsZiVLWci16neB7rf+xtr92aW1+7O3ymVrv9/+x46mUfWY7m8Pw0c+XbVo5XoWq5JzuZq3spRraVRblk7X8+n1OjCve+Wcim/VXhlvZtfqtNzz9+t0i7s72tnt7PDHlGNVRA51IzKRzNRzK6NxvHdkhh+hHR6daqRW1mN/IY31yZ4cGGly885sjvlGl41R4x2p03J/frldzPdEN+b/6XQt5GLf2ffc6JgnX/n9b38wU+f3zy6NZ6JOO9Vra+Dsy0Jm+yLx/DiRuLF0++aN63fOHrRIbDFTReLU+vqVfC/fz9lM5/UsZzE/ynxWspDpfLfKzdcHv+i75LeJ1OVu0u4mrz9qJpP1Gdo9WDub00vVtkezmNfyVq5lIS9X/y7mQl7JpVzKXN8RPjX6CFdXfWPrVV/pfGHo5M98tc60kvyqTveHMq7H++K6cdbPVPE+vqlkI0onxojSkHvjKM0v1ZlyjJ896ka6qwYjcaEvEs+OjsSvq9vKnaXbN5dvzL893nAn3q8z5XX0i2R6/9xIyvPlRHmwqrWpTWdHWffset3meJV1J9frGlvqTuUPaTZ7oyymve2VOll/htva08Wq7vmhdbNV3em+umGftwDY94587chk6++tv7Q+bP28daP16uHvTH1j6oXJHPrjoW82Zya+3Hih+F0+zE82vv8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACf3Z1337s5v7S0sDyQ6XQ6dz8eXjVmpve8ms+4+WCm91SoMRpn+q9PlU2HVE2kc3ebqieV+eLTyW6NtX8z/+50OnVJsU2b3/xpMFBT2aPQ1c/56+zWoEna++Iw9WXq6+2ZPbktAbvg/Mqtt8/fefe9ry/emn9z4c2F23OXLs3NzF16efb89cWlhZnu617PEngSNt7093omAAAAAAAAAAAAwLge8/8ZaA+r2ut9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA62K2fTfJAiF2bOzZTra/dnl8qll99o2UzSSFL8OCk+Si6nu+RYX3fFduN8sDj3xiefrv2z01X3V7VvjNpuPO16yXSSiW5673H1d7VORypG7UKxvodlwM70Agd77b8BAAD//5riD3w=")
getdents64(r0, &(0x7f0000000100)=""/89, 0x59)
getdents64(r0, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=1m8.222224945s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
simplifying C reproducer
testing compiled C program (duration=1m8.222224945s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=1m8.222224945s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=1m8.222224945s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=1m8.222224945s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=1m8.222224945s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=1m8.222224945s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
testing compiled C program (duration=1m8.222224945s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$hfsplus-getdents64-getdents64
program crashed: KASAN: slab-out-of-bounds Read in hfsplus_uni2asc
reproducing took 17m58.75038222s
repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 1024
==================================================================
BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x57f/0x1200 fs/hfsplus/unicode.c:179
Read of size 2 at addr ffff88814428440c by task syz-executor387/5818
CPU: 0 UID: 0 PID: 5818 Comm: syz-executor387 Not tainted 6.14.0-rc4-syzkaller-00278-gece144f151ac #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634
hfsplus_uni2asc+0x57f/0x1200 fs/hfsplus/unicode.c:179
hfsplus_readdir+0x938/0x1320 fs/hfsplus/dir.c:207
iterate_dir+0x5a9/0x760 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:403 [inline]
__se_sys_getdents64+0x1e2/0x4b0 fs/readdir.c:389
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4095f4eaa9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe137fb428 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 0000400000000100 RCX: 00007f4095f4eaa9
RDX: 0000000000000059 RSI: 0000400000000100 RDI: 0000000000000003
RBP: 00007f4095fc25f0 R08: 00005555594ba4c0 R09: 00005555594ba4c0
R10: 00000000000006a7 R11: 0000000000000246 R12: 00007ffe137fb450
R13: 00007ffe137fb678 R14: 431bde82d7b634db R15: 00007f4095f9701d
Allocated by task 5818:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4294 [inline]
__kmalloc_noprof+0x285/0x4c0 mm/slub.c:4306
kmalloc_noprof include/linux/slab.h:905 [inline]
hfsplus_find_init+0x85/0x1c0 fs/hfsplus/bfind.c:21
hfsplus_readdir+0x20b/0x1320 fs/hfsplus/dir.c:144
iterate_dir+0x5a9/0x760 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:403 [inline]
__se_sys_getdents64+0x1e2/0x4b0 fs/readdir.c:389
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888144284000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 0 bytes to the right of
allocated 1036-byte region [ffff888144284000, ffff88814428440c)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x144280
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000040 ffff88801b042000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000040 ffff88801b042000 dead000000000100 dead000000000122
head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000003 ffffea000510a001 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3056733256, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
prep_new_page mm/page_alloc.c:1559 [inline]
get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3477
__alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
alloc_slab_page mm/slub.c:2423 [inline]
allocate_slab+0x8f/0x3a0 mm/slub.c:2587
new_slab mm/slub.c:2640 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3826
__slab_alloc+0x58/0xa0 mm/slub.c:3916
__slab_alloc_node mm/slub.c:3991 [inline]
slab_alloc_node mm/slub.c:4152 [inline]
__kmalloc_cache_noprof+0x27b/0x390 mm/slub.c:4320
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
acpi_ds_create_walk_state+0x103/0x2a0 drivers/acpi/acpica/dswstate.c:518
acpi_ds_call_control_method+0x136/0x7c0 drivers/acpi/acpica/dsmethod.c:498
acpi_ps_parse_aml+0x2df/0x960 drivers/acpi/acpica/psparse.c:503
acpi_ps_execute_method+0x74d/0x880 drivers/acpi/acpica/psxface.c:190
acpi_ns_evaluate+0x5df/0xa40 drivers/acpi/acpica/nseval.c:205
acpi_evaluate_object+0x59b/0xaf0 drivers/acpi/acpica/nsxfeval.c:354
acpi_evaluate_integer+0x11b/0x300 drivers/acpi/utils.c:260
acpi_bus_get_status_handle drivers/acpi/bus.c:82 [inline]
acpi_bus_get_status+0x17e/0x430 drivers/acpi/bus.c:111
page_owner free stack trace missing
Memory state around the buggy address:
ffff888144284300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888144284380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888144284400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888144284480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888144284500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
final repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 1024
==================================================================
BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x57f/0x1200 fs/hfsplus/unicode.c:179
Read of size 2 at addr ffff88814428440c by task syz-executor387/5818
CPU: 0 UID: 0 PID: 5818 Comm: syz-executor387 Not tainted 6.14.0-rc4-syzkaller-00278-gece144f151ac #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634
hfsplus_uni2asc+0x57f/0x1200 fs/hfsplus/unicode.c:179
hfsplus_readdir+0x938/0x1320 fs/hfsplus/dir.c:207
iterate_dir+0x5a9/0x760 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:403 [inline]
__se_sys_getdents64+0x1e2/0x4b0 fs/readdir.c:389
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4095f4eaa9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe137fb428 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 0000400000000100 RCX: 00007f4095f4eaa9
RDX: 0000000000000059 RSI: 0000400000000100 RDI: 0000000000000003
RBP: 00007f4095fc25f0 R08: 00005555594ba4c0 R09: 00005555594ba4c0
R10: 00000000000006a7 R11: 0000000000000246 R12: 00007ffe137fb450
R13: 00007ffe137fb678 R14: 431bde82d7b634db R15: 00007f4095f9701d
Allocated by task 5818:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4294 [inline]
__kmalloc_noprof+0x285/0x4c0 mm/slub.c:4306
kmalloc_noprof include/linux/slab.h:905 [inline]
hfsplus_find_init+0x85/0x1c0 fs/hfsplus/bfind.c:21
hfsplus_readdir+0x20b/0x1320 fs/hfsplus/dir.c:144
iterate_dir+0x5a9/0x760 fs/readdir.c:108
__do_sys_getdents64 fs/readdir.c:403 [inline]
__se_sys_getdents64+0x1e2/0x4b0 fs/readdir.c:389
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888144284000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 0 bytes to the right of
allocated 1036-byte region [ffff888144284000, ffff88814428440c)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x144280
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000040 ffff88801b042000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000040 ffff88801b042000 dead000000000100 dead000000000122
head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 057ff00000000003 ffffea000510a001 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3056733256, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
prep_new_page mm/page_alloc.c:1559 [inline]
get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3477
__alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
alloc_slab_page mm/slub.c:2423 [inline]
allocate_slab+0x8f/0x3a0 mm/slub.c:2587
new_slab mm/slub.c:2640 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3826
__slab_alloc+0x58/0xa0 mm/slub.c:3916
__slab_alloc_node mm/slub.c:3991 [inline]
slab_alloc_node mm/slub.c:4152 [inline]
__kmalloc_cache_noprof+0x27b/0x390 mm/slub.c:4320
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
acpi_ds_create_walk_state+0x103/0x2a0 drivers/acpi/acpica/dswstate.c:518
acpi_ds_call_control_method+0x136/0x7c0 drivers/acpi/acpica/dsmethod.c:498
acpi_ps_parse_aml+0x2df/0x960 drivers/acpi/acpica/psparse.c:503
acpi_ps_execute_method+0x74d/0x880 drivers/acpi/acpica/psxface.c:190
acpi_ns_evaluate+0x5df/0xa40 drivers/acpi/acpica/nseval.c:205
acpi_evaluate_object+0x59b/0xaf0 drivers/acpi/acpica/nsxfeval.c:354
acpi_evaluate_integer+0x11b/0x300 drivers/acpi/utils.c:260
acpi_bus_get_status_handle drivers/acpi/bus.c:82 [inline]
acpi_bus_get_status+0x17e/0x430 drivers/acpi/bus.c:111
page_owner free stack trace missing
Memory state around the buggy address:
ffff888144284300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888144284380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888144284400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888144284480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888144284500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================