Warning: Permanently added '10.128.1.120' (ED25519) to the list of known hosts.
[*] Starting JFFS2 summary NULL-pointer dereference reproducer...
[+] Mountpoint /tmp/jffs2_target ready.
[*] Cleanup umount2 on /tmp/jffs2_target returned: Invalid argument (expected if not mounted)
[+] /dev/mtd0 device node exists.
[*] === Starting iteration 0 ===
[+] Erased /dev/mtd0 (0x20000 bytes).
[+] Mounted mtd0 RW on /tmp/jffs2_target.
[ 141.008921][ T6023] jffs2: notice: (6023) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[+] Created 16 files on JFFS2 filesystem.
[+] Unlinked files and synced (eraseblocks marked obsolete).
[+] Unmounted RW filesystem cleanly.
[+] Mounted mtd0 RO on /tmp/jffs2_target.
[+] fspick successful (fd=3).
[+] fsconfig reconfigure successful (GC thread started).
[+] umount2 executed while GC thread was running.
[*] Waiting 200ms for asynchronous GC thread execution...
[ 141.527546][ T6023] jffs2: notice: (6023) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 1 orphan) and 16 of xref (0 dead, 16 orphan) found.
[ 141.590835][ T6030] ==================================================================
[ 141.590853][ T6030] BUG: KASAN: slab-use-after-free in mutex_lock_interruptible_nested+0x55/0x1c0
[ 141.590888][ T6030] Read of size 1 at addr ffff88803dca0128 by task jffs2_gcd_mtd0/6030
[ 141.590904][ T6030]
[ 141.590926][ T6030] CPU: 0 UID: 0 PID: 6030 Comm: jffs2_gcd_mtd0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 141.590967][ T6030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 141.590984][ T6030] Call Trace:
[ 141.590994][ T6030]
[ 141.591003][ T6030] dump_stack_lvl+0xe8/0x150
[ 141.591029][ T6030] print_address_description+0x55/0x1e0
[ 141.591053][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 141.591071][ T6030] print_report+0x58/0x70
[ 141.591088][ T6030] kasan_report+0x117/0x150
[ 141.591109][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 141.591134][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 141.591158][ T6030] __kasan_check_byte+0x2a/0x40
[ 141.591176][ T6030] lock_acquire+0x7d/0x350
[ 141.591200][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 141.591226][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 141.591248][ T6030] mutex_lock_interruptible_nested+0x55/0x1c0
[ 141.591266][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 141.591281][ T6030] jffs2_garbage_collect_pass+0xb0/0x2170
[ 141.591296][ T6030] ? reacquire_held_locks+0x117/0x1a0
[ 141.591310][ T6030] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 141.591325][ T6030] ? rt_spin_unlock+0x159/0x200
[ 141.591338][ T6030] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 141.591352][ T6030] ? rt_spin_unlock+0x165/0x200
[ 141.591365][ T6030] ? sigprocmask+0x24c/0x2a0
[ 141.591384][ T6030] ? __pfx_sigprocmask+0x10/0x10
[ 141.591397][ T6030] ? rt_spin_unlock+0x159/0x200
[ 141.591412][ T6030] jffs2_garbage_collect_thread+0x693/0x720
[ 141.591430][ T6030] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 141.591446][ T6030] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 141.591457][ T6030] ? __kthread_parkme+0x71/0x1f0
[ 141.591467][ T6030] ? __kthread_parkme+0x199/0x1f0
[ 141.591477][ T6030] kthread+0x38b/0x470
[ 141.591488][ T6030] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 141.591502][ T6030] ? __pfx_kthread+0x10/0x10
[ 141.591513][ T6030] ret_from_fork+0x514/0xb70
[ 141.591524][ T6030] ? __pfx_ret_from_fork+0x10/0x10
[ 141.591535][ T6030] ? __switch_to+0xc78/0x1410
[ 141.591545][ T6030] ? __pfx_kthread+0x10/0x10
[ 141.591622][ T6030] ret_from_fork_asm+0x1a/0x30
[ 141.591636][ T6030]
[ 141.591640][ T6030]
[ 141.591642][ T6030] Allocated by task 6023:
[ 141.591647][ T6030] kasan_save_track+0x3e/0x80
[ 141.591656][ T6030] __kasan_kmalloc+0x93/0xb0
[ 141.591664][ T6030] __kmalloc_cache_noprof+0x3d0/0x670
[ 141.591673][ T6030] jffs2_init_fs_context+0x4f/0xc0
[ 141.591681][ T6030] alloc_fs_context+0x99e/0xd00
[ 141.591690][ T6030] do_new_mount+0x177/0xb00
[ 141.591701][ T6030] __se_sys_mount+0x31d/0x420
[ 141.591712][ T6030] do_syscall_64+0x166/0x520
[ 141.591722][ T6030] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 141.591731][ T6030]
[ 141.591733][ T6030] Freed by task 6023:
[ 141.591738][ T6030] kasan_save_track+0x3e/0x80
[ 141.591745][ T6030] kasan_save_free_info+0x40/0x50
[ 141.591756][ T6030] __kasan_slab_free+0x5c/0x80
[ 141.591764][ T6030] kfree+0x1c5/0x6d0
[ 141.591776][ T6030] deactivate_locked_super+0xbe/0x110
[ 141.591788][ T6030] cleanup_mnt+0x204/0x2a0
[ 141.591795][ T6030] task_work_run+0x1d9/0x260
[ 141.591806][ T6030] exit_to_user_mode_loop+0x204/0x770
[ 141.591815][ T6030] do_syscall_64+0x328/0x520
[ 141.591823][ T6030] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 141.591832][ T6030]
[ 141.591834][ T6030] The buggy address belongs to the object at ffff88803dca0000
[ 141.591834][ T6030] which belongs to the cache kmalloc-4k of size 4096
[ 141.591842][ T6030] The buggy address is located 296 bytes inside of
[ 141.591842][ T6030] freed 4096-byte region [ffff88803dca0000, ffff88803dca1000)
[ 141.591852][ T6030]
[ 141.591855][ T6030] The buggy address belongs to the physical page:
[ 141.591870][ T6030] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3dca0
[ 141.591883][ T6030] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 141.591891][ T6030] flags: 0x80000000000040(head|node=0|zone=1)
[ 141.591908][ T6030] page_type: f5(slab)
[ 141.591918][ T6030] raw: 0080000000000040 ffff88813ff12140 dead000000000100 dead000000000122
[ 141.591925][ T6030] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 141.591934][ T6030] head: 0080000000000040 ffff88813ff12140 dead000000000100 dead000000000122
[ 141.591941][ T6030] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 141.591949][ T6030] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 141.591956][ T6030] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 141.591961][ T6030] page dumped because: kasan: bad access detected
[ 141.591972][ T6030] page_owner tracks the page as allocated
[ 141.591975][ T6030] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6023, tgid 6023 (syz-executor745), ts 141524765777
[ 141.591992][ T6030] post_alloc_hook+0x1f9/0x250
[ 141.592005][ T6030] get_page_from_freelist+0x258b/0x2600
[ 141.592014][ T6030] __alloc_frozen_pages_noprof+0x227/0x440
[ 141.592022][ T6030] allocate_slab+0x7d/0x5e0
[ 141.592033][ T6030] refill_objects+0x2d8/0x350
[ 141.592043][ T6030] __pcs_replace_empty_main+0x339/0x690
[ 141.592054][ T6030] __kmalloc_cache_noprof+0x46a/0x670
[ 141.592064][ T6030] jffs2_init_fs_context+0x4f/0xc0
[ 141.592072][ T6030] alloc_fs_context+0x99e/0xd00
[ 141.592080][ T6030] do_new_mount+0x177/0xb00
[ 141.592091][ T6030] __se_sys_mount+0x31d/0x420
[ 141.592102][ T6030] do_syscall_64+0x166/0x520
[ 141.592110][ T6030] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 141.592119][ T6030] page last free pid 6023 tgid 6023 ts 141179786561 stack trace:
[ 141.592125][ T6030] __free_frozen_pages+0xf8a/0x1060
[ 141.592138][ T6030] __slab_free+0x26e/0x2c0
[ 141.592149][ T6030] qlist_free_all+0x99/0x100
[ 141.592161][ T6030] kasan_quarantine_reduce+0x148/0x160
[ 141.592174][ T6030] __kasan_slab_alloc+0x22/0x80
[ 141.592182][ T6030] __kmalloc_cache_noprof+0x34e/0x670
[ 141.592190][ T6030] tomoyo_init_log+0x187/0x1f60
[ 141.592200][ T6030] tomoyo_supervisor+0x35f/0x1550
[ 141.592209][ T6030] tomoyo_path_permission+0x262/0x3b0
[ 141.592221][ T6030] tomoyo_path_perm+0x3f3/0x560
[ 141.592233][ T6030] tomoyo_path_unlink+0xaa/0xf0
[ 141.592242][ T6030] security_path_unlink+0x15f/0x330
[ 141.592253][ T6030] filename_unlinkat+0x34f/0x610
[ 141.592263][ T6030] __se_sys_unlink+0x2e/0x140
[ 141.592272][ T6030] do_syscall_64+0x166/0x520
[ 141.592280][ T6030] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 141.592289][ T6030]
[ 141.592291][ T6030] Memory state around the buggy address:
[ 141.592300][ T6030] ffff88803dca0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.592310][ T6030] ffff88803dca0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.592319][ T6030] >ffff88803dca0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.592326][ T6030] ^
[ 141.592335][ T6030] ffff88803dca0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.592345][ T6030] ffff88803dca0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 141.592350][ T6030] ==================================================================
[ 141.592359][ T6030] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 142.352152][ T6030] CPU: 0 UID: 0 PID: 6030 Comm: jffs2_gcd_mtd0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 142.362390][ T6030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 142.372788][ T6030] Call Trace:
[ 142.376272][ T6030]
[ 142.379198][ T6030] vpanic+0x26f/0x710
[ 142.383264][ T6030] panic+0xc5/0xd0
[ 142.386995][ T6030] ? __pfx_panic+0x10/0x10
[ 142.391411][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.397675][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.403923][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.410166][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.416404][ T6030] check_panic_on_warn+0x89/0xb0
[ 142.421485][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.427721][ T6030] end_report+0x73/0x170
[ 142.431979][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.438213][ T6030] kasan_report+0x128/0x150
[ 142.442709][ T6030] ? mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.448951][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 142.456934][ T6030] __kasan_check_byte+0x2a/0x40
[ 142.461999][ T6030] lock_acquire+0x7d/0x350
[ 142.466532][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 142.472575][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 142.478938][ T6030] mutex_lock_interruptible_nested+0x55/0x1c0
[ 142.485203][ T6030] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 142.491124][ T6030] jffs2_garbage_collect_pass+0xb0/0x2170
[ 142.496949][ T6030] ? reacquire_held_locks+0x117/0x1a0
[ 142.503204][ T6030] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 142.509070][ T6030] ? rt_spin_unlock+0x159/0x200
[ 142.514127][ T6030] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 142.520500][ T6030] ? rt_spin_unlock+0x165/0x200
[ 142.525476][ T6030] ? sigprocmask+0x24c/0x2a0
[ 142.530110][ T6030] ? __pfx_sigprocmask+0x10/0x10
[ 142.535088][ T6030] ? rt_spin_unlock+0x159/0x200
[ 142.539971][ T6030] jffs2_garbage_collect_thread+0x693/0x720
[ 142.545974][ T6030] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 142.552524][ T6030] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 142.558345][ T6030] ? __kthread_parkme+0x71/0x1f0
[ 142.563447][ T6030] ? __kthread_parkme+0x199/0x1f0
[ 142.568469][ T6030] kthread+0x38b/0x470
[ 142.572535][ T6030] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 142.579470][ T6030] ? __pfx_kthread+0x10/0x10
[ 142.584059][ T6030] ret_from_fork+0x514/0xb70
[ 142.588661][ T6030] ? __pfx_ret_from_fork+0x10/0x10
[ 142.593790][ T6030] ? __switch_to+0xc78/0x1410
[ 142.598476][ T6030] ? __pfx_kthread+0x10/0x10
[ 142.603194][ T6030] ret_from_fork_asm+0x1a/0x30
[ 142.608218][ T6030]
[ 142.611767][ T6030] Kernel Offset: disabled
[ 142.616292][ T6030] Rebooting in 86400 seconds..