ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor2006212661 <...> Warning: Permanently added '10.128.0.244' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor2006212661", ["ci2-upstream-fs/syz-executor2006212661"], 0x7fff49284b60 /* 10 vars */) = 0 brk(NULL) = 0x55556ff14000 brk(0x55556ff14d80) = 0x55556ff14d80 arch_prctl(ARCH_SET_FS, 0x55556ff14400) = 0 set_tid_address(0x55556ff146d0) = 5604 set_robust_list(0x55556ff146e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor2006212661", 4096) = 44 getrandom("\x7b\x65\x6f\xbc\x00\x6e\x95\x2c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556ff14d80 brk(0x55556ff35d80) = 0x55556ff35d80 brk(0x55556ff36000) = 0x55556ff36000 mprotect(0x7fc8cfcb5000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5606 attached , child_tidptr=0x55556ff146d0) = 5606 [pid 5606] set_robust_list(0x55556ff146e0, 24 [pid 5604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5606] <... set_robust_list resumed>) = 0 [pid 5606] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5606] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5606] setpgid(0, 0) = 0 [pid 5606] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5606] write(3, "1000", 4) = 4 [pid 5606] close(3) = 0 [pid 5606] write(1, "executing program\n", 18) = 18 executing program [pid 5606] memfd_create("syzkaller", 0) = 3 [pid 5606] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc8c77fd000 [pid 5606] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5606] munmap(0x7fc8c77fd000, 138412032) = 0 [pid 5606] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5606] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5606] close(3) = 0 [pid 5606] close(4) = 0 [pid 5606] mkdir("./file2", 0777) = 0 [ 100.335451][ T5606] loop0: detected capacity change from 0 to 512 [pid 5606] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "block_validity,,errors=continue") = 0 [pid 5606] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [ 100.404494][ T5606] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 100.404518][ T5606] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 100.408822][ T5606] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 100.432035][ T5606] EXT4-fs (loop0): orphan cleanup on readonly fs [pid 5606] chdir("./file2") = 0 [pid 5606] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5606] chdir("./file0") = 0 [pid 5606] openat(AT_FDCWD, ".", O_RDONLY) = 4 [pid 5606] lseek(4, -4, SEEK_END) = 56 [ 100.453576][ T5606] EXT4-fs (loop0): 1 truncate cleaned up [ 100.456263][ T5606] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 100.486438][ T5606] ================================================================== [ 100.486455][ T5606] BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry+0x71c/0x8a0 [ 100.486520][ T5606] Read of size 2 at addr ffff8880341c28bc by task syz-executor200/5606 [ 100.486539][ T5606] [ 100.486563][ T5606] CPU: 1 UID: 0 PID: 5606 Comm: syz-executor200 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 100.486593][ T5606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.486615][ T5606] Call Trace: [ 100.486624][ T5606] [ 100.486633][ T5606] dump_stack_lvl+0xe8/0x150 [ 100.486667][ T5606] print_address_description+0x55/0x1e0 [ 100.486697][ T5606] ? __ext4_check_dir_entry+0x71c/0x8a0 [ 100.486728][ T5606] print_report+0x58/0x70 [ 100.486755][ T5606] kasan_report+0x117/0x150 [ 100.486780][ T5606] ? __ext4_check_dir_entry+0x71c/0x8a0 [ 100.486815][ T5606] __ext4_check_dir_entry+0x71c/0x8a0 [ 100.486864][ T5606] ? ext4_read_inline_dir+0x327/0xbc0 [ 100.486891][ T5606] ext4_read_inline_dir+0x779/0xbc0 [ 100.486921][ T5606] ? __pfx_ext4_read_inline_dir+0x10/0x10 [ 100.486942][ T5606] ext4_readdir+0x406/0x41c0 [ 100.486967][ T5606] ? __lock_acquire+0x683/0x2ce0 [ 100.486984][ T5606] ? trace_sched_exit_tp+0x3a/0x130 [ 100.487014][ T5606] ? __lock_acquire+0x683/0x2ce0 [ 100.487032][ T5606] ? iterate_dir+0x215/0x4e0 [ 100.487052][ T5606] ? __pfx_ext4_readdir+0x10/0x10 [ 100.487079][ T5606] ? iterate_dir+0x215/0x4e0 [ 100.487097][ T5606] ? down_read_killable+0x14c/0x220 [ 100.487123][ T5606] ? __pfx_down_read_killable+0x10/0x10 [ 100.487141][ T5606] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 100.487167][ T5606] ? lockdep_hardirqs_on+0x7a/0x110 [ 100.487189][ T5606] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 100.487207][ T5606] iterate_dir+0x2f1/0x4e0 [ 100.487228][ T5606] __se_sys_getdents+0xf1/0x270 [ 100.487250][ T5606] ? __pfx___se_sys_getdents+0x10/0x10 [ 100.487270][ T5606] ? __pfx_filldir+0x10/0x10 [ 100.487294][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.487310][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.487327][ T5606] do_syscall_64+0x174/0x580 [ 100.487343][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.487359][ T5606] ? clear_bhb_loop+0x40/0x90 [ 100.487377][ T5606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.487393][ T5606] RIP: 0033:0x7fc8cfc298a9 [ 100.487411][ T5606] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 100.487425][ T5606] RSP: 002b:00007ffd78037ed8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 100.487447][ T5606] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8cfc298a9 [ 100.487459][ T5606] RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004 [ 100.487468][ T5606] RBP: 0000000000000001 R08: 000055556ff15560 R09: 000055556ff15560 [ 100.487483][ T5606] R10: 000055556ff15560 R11: 0000000000000246 R12: 00007ffd78037f00 [ 100.487494][ T5606] R13: 0000000000000002 R14: 431bde82d7b634db R15: 00007fc8cfc8904b [ 100.487512][ T5606] [ 100.487518][ T5606] [ 100.487521][ T5606] Allocated by task 5606: [ 100.487529][ T5606] kasan_save_track+0x3e/0x80 [ 100.487555][ T5606] __kasan_kmalloc+0x93/0xb0 [ 100.487569][ T5606] __kmalloc_noprof+0x41a/0x780 [ 100.487582][ T5606] ext4_read_inline_dir+0x2f6/0xbc0 [ 100.487596][ T5606] ext4_readdir+0x406/0x41c0 [ 100.487616][ T5606] iterate_dir+0x2f1/0x4e0 [ 100.487633][ T5606] __se_sys_getdents+0xf1/0x270 [ 100.487652][ T5606] do_syscall_64+0x174/0x580 [ 100.487667][ T5606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.487683][ T5606] [ 100.487687][ T5606] The buggy address belongs to the object at ffff8880341c2880 [ 100.487687][ T5606] which belongs to the cache kmalloc-64 of size 64 [ 100.487708][ T5606] The buggy address is located 0 bytes to the right of [ 100.487708][ T5606] allocated 60-byte region [ffff8880341c2880, ffff8880341c28bc) [ 100.487724][ T5606] [ 100.487728][ T5606] The buggy address belongs to the physical page: [ 100.487746][ T5606] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880341c2900 pfn:0x341c2 [ 100.487762][ T5606] flags: 0x80000000000200(workingset|node=0|zone=1) [ 100.487779][ T5606] page_type: f5(slab) [ 100.487794][ T5606] raw: 0080000000000200 ffff88813ffaf8c0 ffff88813ffae788 ffffea0000d1f290 [ 100.487808][ T5606] raw: ffff8880341c2900 000000080020001e 00000000f5000000 0000000000000000 [ 100.487816][ T5606] page dumped because: kasan: bad access detected [ 100.487826][ T5606] page_owner tracks the page as allocated [ 100.487832][ T5606] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3810, tgid 3810 (kworker/u8:17), ts 28303353836, free_ts 0 [ 100.487865][ T5606] post_alloc_hook+0x1f9/0x250 [ 100.487888][ T5606] get_page_from_freelist+0x262a/0x26a0 [ 100.487904][ T5606] __alloc_frozen_pages_noprof+0x18d/0x380 [ 100.487919][ T5606] allocate_slab+0x79/0x5e0 [ 100.487944][ T5606] refill_objects+0x2d8/0x350 [ 100.487963][ T5606] __pcs_replace_empty_main+0x330/0x690 [ 100.487984][ T5606] __kmalloc_node_noprof+0x632/0x7d0 [ 100.487997][ T5606] __vmalloc_node_range_noprof+0x5d9/0x1730 [ 100.488021][ T5606] __vmalloc_node_noprof+0xc2/0x100 [ 100.488043][ T5606] dup_task_struct+0x2a0/0x8f0 [ 100.488059][ T5606] copy_process+0x820/0x4390 [ 100.488074][ T5606] kernel_clone+0x2d2/0x8d0 [ 100.488092][ T5606] user_mode_thread+0x110/0x180 [ 100.488109][ T5606] call_usermodehelper_exec_work+0x5c/0x230 [ 100.488125][ T5606] process_scheduled_works+0xa8e/0x14e0 [ 100.488140][ T5606] worker_thread+0xa47/0xfb0 [ 100.488155][ T5606] page_owner free stack trace missing [ 100.488161][ T5606] [ 100.488164][ T5606] Memory state around the buggy address: [ 100.488172][ T5606] ffff8880341c2780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 100.488189][ T5606] ffff8880341c2800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 100.488199][ T5606] >ffff8880341c2880: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc [ 100.488207][ T5606] ^ [ 100.488215][ T5606] ffff8880341c2900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 100.488225][ T5606] ffff8880341c2980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 100.488233][ T5606] ================================================================== [ 100.488505][ T5606] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 100.488518][ T5606] CPU: 1 UID: 0 PID: 5606 Comm: syz-executor200 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 100.488537][ T5606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.488546][ T5606] Call Trace: [ 100.488551][ T5606] [ 100.488557][ T5606] vpanic+0x56c/0xa60 [ 100.488584][ T5606] ? __pfx_vpanic+0x10/0x10 [ 100.488607][ T5606] ? __pfx___schedule+0x10/0x10 [ 100.488635][ T5606] panic+0xc5/0xd0 [ 100.488658][ T5606] ? __pfx_panic+0x10/0x10 [ 100.488684][ T5606] ? preempt_schedule_thunk+0x16/0x40 [ 100.488705][ T5606] ? __ext4_check_dir_entry+0x71c/0x8a0 [ 100.488727][ T5606] check_panic_on_warn+0x89/0xb0 [ 100.488752][ T5606] ? __ext4_check_dir_entry+0x71c/0x8a0 [ 100.488774][ T5606] end_report+0x73/0x170 [ 100.488790][ T5606] ? __ext4_check_dir_entry+0x71c/0x8a0 [ 100.488812][ T5606] kasan_report+0x128/0x150 [ 100.488829][ T5606] ? __ext4_check_dir_entry+0x71c/0x8a0 [ 100.488854][ T5606] __ext4_check_dir_entry+0x71c/0x8a0 [ 100.488877][ T5606] ? ext4_read_inline_dir+0x327/0xbc0 [ 100.488896][ T5606] ext4_read_inline_dir+0x779/0xbc0 [ 100.488918][ T5606] ? __pfx_ext4_read_inline_dir+0x10/0x10 [ 100.488940][ T5606] ext4_readdir+0x406/0x41c0 [ 100.488963][ T5606] ? __lock_acquire+0x683/0x2ce0 [ 100.488979][ T5606] ? trace_sched_exit_tp+0x3a/0x130 [ 100.489005][ T5606] ? __lock_acquire+0x683/0x2ce0 [ 100.489023][ T5606] ? iterate_dir+0x215/0x4e0 [ 100.489055][ T5606] ? __pfx_ext4_readdir+0x10/0x10 [ 100.489082][ T5606] ? iterate_dir+0x215/0x4e0 [ 100.489101][ T5606] ? down_read_killable+0x14c/0x220 [ 100.489120][ T5606] ? __pfx_down_read_killable+0x10/0x10 [ 100.489139][ T5606] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 100.489156][ T5606] ? lockdep_hardirqs_on+0x7a/0x110 [ 100.489172][ T5606] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 100.489197][ T5606] iterate_dir+0x2f1/0x4e0 [ 100.489218][ T5606] __se_sys_getdents+0xf1/0x270 [ 100.489240][ T5606] ? __pfx___se_sys_getdents+0x10/0x10 [ 100.489260][ T5606] ? __pfx_filldir+0x10/0x10 [ 100.489285][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.489302][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.489318][ T5606] do_syscall_64+0x174/0x580 [ 100.489335][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.489351][ T5606] ? clear_bhb_loop+0x40/0x90 [ 100.489368][ T5606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.489384][ T5606] RIP: 0033:0x7fc8cfc298a9 [ 100.489397][ T5606] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 100.489410][ T5606] RSP: 002b:00007ffd78037ed8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 100.489427][ T5606] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8cfc298a9 [ 100.489438][ T5606] RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004 [ 100.489447][ T5606] RBP: 0000000000000001 R08: 000055556ff15560 R09: 000055556ff15560 [ 100.489458][ T5606] R10: 000055556ff15560 R11: 0000000000000246 R12: 00007ffd78037f00 [ 100.489469][ T5606] R13: 0000000000000002 R14: 431bde82d7b634db R15: 00007fc8cfc8904b [ 100.489486][ T5606] [ 100.490107][ T5606] Kernel Offset: disabled