ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor1158233149 <...> Warning: Permanently added '10.128.0.91' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor1158233149", ["ci2-upstream-fs/syz-executor1158233149"], 0x7ffd69d6d1a0 /* 10 vars */) = 0 brk(NULL) = 0x55557c9b0000 brk(0x55557c9b0d80) = 0x55557c9b0d80 arch_prctl(ARCH_SET_FS, 0x55557c9b0400) = 0 set_tid_address(0x55557c9b06d0) = 5628 set_robust_list(0x55557c9b06e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor1158233149", 4096) = 44 getrandom("\x30\xde\xde\x08\x97\x52\x3e\x09", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557c9b0d80 brk(0x55557c9d1d80) = 0x55557c9d1d80 brk(0x55557c9d2000) = 0x55557c9d2000 mprotect(0x7fce8baf6000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 getrandom("\xd2\xdf\xea\xe1\x19\x4e\x53\x6f", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.66Xx4A", 0700) = 0 chmod("./syzkaller.66Xx4A", 0777) = 0 chdir("./syzkaller.66Xx4A") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5629 attached [pid 5629] set_robust_list(0x55557c9b06e0, 24 [pid 5628] <... clone resumed>, child_tidptr=0x55557c9b06d0) = 5629 [pid 5629] <... set_robust_list resumed>) = 0 [pid 5628] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5629] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5629] chdir("./0") = 0 [pid 5629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5629] setpgid(0, 0) = 0 [pid 5629] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5629] write(3, "1000", 4) = 4 [pid 5629] close(3) = 0 [pid 5629] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5629] write(1, "executing program\n", 18) = 18 executing program [pid 5629] memfd_create("syzkaller", 0) = 3 [pid 5629] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fce83634000 [pid 5629] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536 [pid 5629] munmap(0x7fce83634000, 138412032) = 0 [pid 5629] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5629] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5629] close(3) = 0 [pid 5629] close(4) = 0 [pid 5629] mkdir("./file1", 0777) = 0 [ 98.795124][ T5629] loop0: detected capacity change from 0 to 128 [ 98.817315][ T5629] ======================================================= [ 98.817315][ T5629] WARNING: The mand mount option has been deprecated and [ 98.817315][ T5629] and is ignored by this kernel. Remove the mand [ 98.817315][ T5629] option from the mount to silence this warning. [ 98.817315][ T5629] ======================================================= [ 98.871271][ T5629] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 98.871411][ T5629] hpfs: filesystem error: improperly stopped [ 98.871428][ T5629] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 98.871442][ T5629] hpfs: You really don't want any checks? You are crazy... [ 98.872027][ T5629] hpfs: hpfs_map_sector(): read error [ 98.872039][ T5629] hpfs: code page support is disabled [ 98.874239][ T5629] hpfs: hpfs_map_sector(): read error [ 98.874282][ T5629] hpfs: hpfs_map_sector(): read error [ 98.874300][ T5629] hpfs: hpfs_map_sector(): read error [ 98.874316][ T5629] hpfs: hpfs_map_sector(): read error [pid 5629] mount("/dev/loop0", "./file1", "hpfs", MS_RDONLY|MS_MANDLOCK|MS_RELATIME|MS_STRICTATIME|MS_LAZYTIME, "eas=no,eas=no,eas=rw,check=none,") = 0 [pid 5629] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5629] chdir("./file1") = 0 [pid 5629] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5629] ioctl(4, LOOP_CLR_FD) = 0 [pid 5629] close(4) = 0 [pid 5629] exit_group(0) = ? [pid 5629] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5629, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55557c9b1790 /* 4 entries */, 32768) = 112 [ 98.874343][ T5629] hpfs: hpfs_map_4sectors(): unaligned read [ 98.875101][ T5629] hpfs: hpfs_map_4sectors(): unaligned read [ 98.875111][ T5629] hpfs: filesystem error: unable to find root dir umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55557c9b97d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55557c9b97d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file1") = 0 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 getdents64(3, 0x55557c9b1790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5630 attached [pid 5630] set_robust_list(0x55557c9b06e0, 24 [pid 5628] <... clone resumed>, child_tidptr=0x55557c9b06d0) = 5630 [pid 5630] <... set_robust_list resumed>) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5628] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] chdir("./1") = 0 [pid 5630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5630] setpgid(0, 0) = 0 [pid 5630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1000", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5630] write(1, "executing program\n", 18) = 18 executing program [pid 5630] memfd_create("syzkaller", 0) = 3 [pid 5630] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fce83634000 [pid 5630] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536 [pid 5630] munmap(0x7fce83634000, 138412032) = 0 [pid 5630] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5630] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5630] close(3) = 0 [pid 5630] close(4) = 0 [pid 5630] mkdir("./file1", 0777) = 0 [ 99.137718][ T5630] loop0: detected capacity change from 0 to 128 [ 99.172435][ T5630] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [pid 5630] mount("/dev/loop0", "./file1", "hpfs", MS_RDONLY|MS_MANDLOCK|MS_RELATIME|MS_STRICTATIME|MS_LAZYTIME, "eas=no,eas=no,eas=rw,check=none,") = 0 [pid 5630] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [ 99.172503][ T5630] hpfs: filesystem error: improperly stopped [ 99.172519][ T5630] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 99.172534][ T5630] hpfs: You really don't want any checks? You are crazy... [ 99.174844][ T5630] hpfs: hpfs_map_sector(): read error [ 99.174858][ T5630] hpfs: code page support is disabled [ 99.219673][ T5630] hpfs: hpfs_map_sector(): read error [ 99.219699][ T5630] hpfs: hpfs_map_sector(): read error [pid 5630] chdir("./file1") = 0 [pid 5630] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5630] ioctl(4, LOOP_CLR_FD) = 0 [pid 5630] close(4) = 0 [pid 5630] exit_group(0) = ? [pid 5630] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5630, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55557c9b1790 /* 4 entries */, 32768) = 112 [ 99.219712][ T5630] hpfs: hpfs_map_sector(): read error [ 99.219725][ T5630] hpfs: hpfs_map_sector(): read error [ 99.219732][ T5630] hpfs: hpfs_map_4sectors(): unaligned read [ 99.219771][ T5630] hpfs: hpfs_map_4sectors(): unaligned read [ 99.219778][ T5630] hpfs: filesystem error: unable to find root dir umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55557c9b97d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55557c9b97d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file1") = 0 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 getdents64(3, 0x55557c9b1790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5631 attached [pid 5631] set_robust_list(0x55557c9b06e0, 24 [pid 5628] <... clone resumed>, child_tidptr=0x55557c9b06d0) = 5631 [pid 5631] <... set_robust_list resumed>) = 0 [pid 5631] rt_sigprocmask(SIG_SETMASK, [] [pid 5628] rt_sigprocmask(SIG_SETMASK, [] [pid 5631] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5631] chdir("./2") = 0 [pid 5631] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5631] setpgid(0, 0) = 0 [pid 5631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5631] write(3, "1000", 4) = 4 [pid 5631] close(3) = 0 [pid 5631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5631] write(1, "executing program\n", 18) = 18 executing program [pid 5631] memfd_create("syzkaller", 0) = 3 [pid 5631] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fce83634000 [pid 5631] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536 [pid 5631] munmap(0x7fce83634000, 138412032) = 0 [pid 5631] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5631] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5631] close(3) = 0 [pid 5631] close(4) = 0 [pid 5631] mkdir("./file1", 0777) = 0 [ 99.407906][ T5631] loop0: detected capacity change from 0 to 128 [ 99.439786][ T5631] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 99.439846][ T5631] hpfs: filesystem error: improperly stopped [ 99.439857][ T5631] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 99.439868][ T5631] hpfs: You really don't want any checks? You are crazy... [ 99.440089][ T5631] hpfs: hpfs_map_sector(): read error [ 99.440096][ T5631] hpfs: code page support is disabled [ 99.440244][ T5631] ================================================================== [ 99.440252][ T5631] BUG: KASAN: use-after-free in strcmp+0x6b/0xc0 [ 99.440279][ T5631] Read of size 1 at addr ffff8880457538a6 by task syz-executor115/5631 [ 99.440291][ T5631] [ 99.440310][ T5631] CPU: 0 UID: 0 PID: 5631 Comm: syz-executor115 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 99.440328][ T5631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 99.440346][ T5631] Call Trace: [ 99.440354][ T5631] [ 99.440361][ T5631] dump_stack_lvl+0xe8/0x150 [ 99.440389][ T5631] print_address_description+0x55/0x1e0 [ 99.440414][ T5631] ? strcmp+0x6b/0xc0 [ 99.440431][ T5631] print_report+0x58/0x70 [ 99.440453][ T5631] kasan_report+0x117/0x150 [ 99.440473][ T5631] ? strcmp+0x6b/0xc0 [ 99.440493][ T5631] strcmp+0x6b/0xc0 [ 99.440512][ T5631] hpfs_get_ea+0x137/0xeb0 [ 99.440530][ T5631] ? __pfx_hpfs_get_ea+0x10/0x10 [ 99.440543][ T5631] ? bdev_getblk+0xbc/0x670 [ 99.440563][ T5631] ? bdev_getblk+0x530/0x670 [ 99.440586][ T5631] ? __bread_gfp+0xc3/0x370 [ 99.440606][ T5631] ? hpfs_map_sector+0x162/0x390 [ 99.440633][ T5631] hpfs_read_inode+0x1a9/0x1060 [ 99.440651][ T5631] ? __pfx_hpfs_read_inode+0x10/0x10 [ 99.440665][ T5631] ? inode_set_ctime_to_ts+0x116/0x2e0 [ 99.440681][ T5631] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 99.440699][ T5631] ? rt_spin_unlock+0x165/0x200 [ 99.440724][ T5631] ? hpfs_init_inode+0x1c9/0x380 [ 99.440741][ T5631] hpfs_fill_super+0x1275/0x1fa0 [ 99.440768][ T5631] ? __pfx_hpfs_fill_super+0x10/0x10 [ 99.440788][ T5631] ? __pfx_snprintf+0x10/0x10 [ 99.440811][ T5631] ? set_blocksize+0x1c8/0x3d0 [ 99.440826][ T5631] ? rt_spin_unlock+0x159/0x200 [ 99.440849][ T5631] ? sb_set_blocksize+0x11b/0x210 [ 99.440892][ T5631] ? setup_bdev_super+0x586/0x680 [ 99.440914][ T5631] get_tree_bdev_flags+0x430/0x4f0 [ 99.440937][ T5631] ? __pfx_hpfs_fill_super+0x10/0x10 [ 99.440955][ T5631] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 99.440971][ T5631] ? safesetid_security_capable+0xa9/0x1a0 [ 99.440996][ T5631] vfs_get_tree+0x92/0x2a0 [ 99.441010][ T5631] do_new_mount+0x325/0xb00 [ 99.441031][ T5631] ? cap_capable+0x123/0x460 [ 99.441053][ T5631] ? __pfx_do_new_mount+0x10/0x10 [ 99.441074][ T5631] ? ns_capable+0x84/0xe0 [ 99.441096][ T5631] ? path_mount+0x647/0x1050 [ 99.441118][ T5631] ? user_path_at+0xd4/0x160 [ 99.441142][ T5631] __se_sys_mount+0x31d/0x420 [ 99.441166][ T5631] ? __pfx___se_sys_mount+0x10/0x10 [ 99.441190][ T5631] ? __x64_sys_mount+0x20/0xc0 [ 99.441212][ T5631] do_syscall_64+0x166/0x520 [ 99.441232][ T5631] ? trace_irq_disable+0x3b/0x140 [ 99.441248][ T5631] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.441264][ T5631] ? clear_bhb_loop+0x70/0xc0 [ 99.441281][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.441297][ T5631] RIP: 0033:0x7fce8ba610aa [ 99.441321][ T5631] Code: 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 99.441335][ T5631] RSP: 002b:00007ffd6f290bb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 99.441351][ T5631] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce8ba610aa [ 99.441362][ T5631] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 00007ffd6f290c00 [ 99.441373][ T5631] RBP: 0000000000000004 R08: 00007ffd6f290c40 R09: 0000000000000000 [ 99.441383][ T5631] R10: 0000000003200041 R11: 0000000000000206 R12: 0000200000000040 [ 99.441393][ T5631] R13: 00007ffd6f290c40 R14: 0000000000010000 R15: 0000000000000003 [ 99.441411][ T5631] [ 99.441416][ T5631] [ 99.441420][ T5631] The buggy address belongs to the physical page: [ 99.441430][ T5631] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7fe06f434 pfn:0x45753 [ 99.441447][ T5631] flags: 0x80000000000000(node=0|zone=1) [ 99.441468][ T5631] raw: 0080000000000000 dead000000000100 dead000000000122 0000000000000000 [ 99.441481][ T5631] raw: 00000007fe06f434 0000000000000000 00000000ffffffff 0000000000000000 [ 99.441489][ T5631] page dumped because: kasan: bad access detected [ 99.441500][ T5631] page_owner tracks the page as freed [ 99.441505][ T5631] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|__GFP_COMP), pid 5613, tgid 5613 (sshd-session), ts 92992686310 [ 99.441528][ T5631] post_alloc_hook+0x1f9/0x250 [ 99.441550][ T5631] get_page_from_freelist+0x258b/0x2600 [ 99.441565][ T5631] __alloc_frozen_pages_noprof+0x227/0x440 [ 99.441580][ T5631] alloc_pages_mpol+0xd4/0x280 [ 99.441596][ T5631] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 99.441613][ T5631] vma_alloc_folio_noprof+0xe1/0x1e0 [ 99.441630][ T5631] do_pte_missing+0x7fb/0x2970 [ 99.441643][ T5631] handle_mm_fault+0xf64/0x28c0 [ 99.441663][ T5631] do_user_addr_fault+0xb35/0x1480 [ 99.441681][ T5631] exc_page_fault+0x6a/0xc0 [ 99.441694][ T5631] asm_exc_page_fault+0x26/0x30 [ 99.441707][ T5631] page last free pid 5613 tgid 5613 ts 93028405350 stack trace: [ 99.441717][ T5631] free_unref_folios+0xd0b/0x1940 [ 99.441741][ T5631] folios_put_refs+0x815/0x920 [ 99.441758][ T5631] free_pages_and_swap_cache+0x2ba/0x490 [ 99.441779][ T5631] tlb_flush_mmu+0x6d3/0xa30 [ 99.441792][ T5631] tlb_finish_mmu+0xf4/0x220 [ 99.441805][ T5631] unmap_region+0x2a5/0x330 [ 99.441817][ T5631] vms_complete_munmap_vmas+0x442/0xc10 [ 99.441833][ T5631] do_vmi_align_munmap+0x3bd/0x4d0 [ 99.441848][ T5631] do_vmi_munmap+0x252/0x2d0 [ 99.441862][ T5631] __vm_munmap+0x240/0x420 [ 99.441879][ T5631] __x64_sys_munmap+0x60/0x70 [ 99.441899][ T5631] do_syscall_64+0x166/0x520 [ 99.441913][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.441927][ T5631] [ 99.441930][ T5631] Memory state around the buggy address: [ 99.441938][ T5631] ffff888045753780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 99.441948][ T5631] ffff888045753800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 99.441958][ T5631] >ffff888045753880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 99.441966][ T5631] ^ [ 99.441974][ T5631] ffff888045753900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 99.441984][ T5631] ffff888045753980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 99.441991][ T5631] ================================================================== [ 99.445075][ T5631] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 100.099095][ T5631] CPU: 0 UID: 0 PID: 5631 Comm: syz-executor115 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 100.109348][ T5631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 100.119440][ T5631] Call Trace: [ 100.122750][ T5631] [ 100.125699][ T5631] vpanic+0x26f/0x710 [ 100.129700][ T5631] panic+0xc5/0xd0 [ 100.133436][ T5631] ? __pfx_panic+0x10/0x10 [ 100.137888][ T5631] ? preempt_schedule_thunk+0x16/0x40 [ 100.143293][ T5631] ? strcmp+0x6b/0xc0 [ 100.147290][ T5631] check_panic_on_warn+0x89/0xb0 [ 100.152252][ T5631] ? strcmp+0x6b/0xc0 [ 100.156261][ T5631] end_report+0x73/0x170 [ 100.160541][ T5631] ? strcmp+0x6b/0xc0 [ 100.164539][ T5631] kasan_report+0x128/0x150 [ 100.169063][ T5631] ? strcmp+0x6b/0xc0 [ 100.173086][ T5631] strcmp+0x6b/0xc0 [ 100.176908][ T5631] hpfs_get_ea+0x137/0xeb0 [ 100.181336][ T5631] ? __pfx_hpfs_get_ea+0x10/0x10 [ 100.186372][ T5631] ? bdev_getblk+0xbc/0x670 [ 100.190890][ T5631] ? bdev_getblk+0x530/0x670 [ 100.195506][ T5631] ? __bread_gfp+0xc3/0x370 [ 100.200029][ T5631] ? hpfs_map_sector+0x162/0x390 [ 100.205005][ T5631] hpfs_read_inode+0x1a9/0x1060 [ 100.209911][ T5631] ? __pfx_hpfs_read_inode+0x10/0x10 [ 100.215307][ T5631] ? inode_set_ctime_to_ts+0x116/0x2e0 [ 100.220799][ T5631] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 100.226618][ T5631] ? rt_spin_unlock+0x165/0x200 [ 100.231551][ T5631] ? hpfs_init_inode+0x1c9/0x380 [ 100.236514][ T5631] hpfs_fill_super+0x1275/0x1fa0 [ 100.241496][ T5631] ? __pfx_hpfs_fill_super+0x10/0x10 [ 100.246858][ T5631] ? __pfx_snprintf+0x10/0x10 [ 100.251553][ T5631] ? set_blocksize+0x1c8/0x3d0 [ 100.256345][ T5631] ? rt_spin_unlock+0x159/0x200 [ 100.261219][ T5631] ? sb_set_blocksize+0x11b/0x210 [ 100.266256][ T5631] ? setup_bdev_super+0x586/0x680 [ 100.271296][ T5631] get_tree_bdev_flags+0x430/0x4f0 [ 100.276421][ T5631] ? __pfx_hpfs_fill_super+0x10/0x10 [ 100.281753][ T5631] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 100.287399][ T5631] ? safesetid_security_capable+0xa9/0x1a0 [ 100.293227][ T5631] vfs_get_tree+0x92/0x2a0 [ 100.297748][ T5631] do_new_mount+0x325/0xb00 [ 100.302272][ T5631] ? cap_capable+0x123/0x460 [ 100.306886][ T5631] ? __pfx_do_new_mount+0x10/0x10 [ 100.311932][ T5631] ? ns_capable+0x84/0xe0 [ 100.316303][ T5631] ? path_mount+0x647/0x1050 [ 100.320914][ T5631] ? user_path_at+0xd4/0x160 [ 100.325532][ T5631] __se_sys_mount+0x31d/0x420 [ 100.330270][ T5631] ? __pfx___se_sys_mount+0x10/0x10 [ 100.335590][ T5631] ? __x64_sys_mount+0x20/0xc0 [ 100.340421][ T5631] do_syscall_64+0x166/0x520 [ 100.345051][ T5631] ? trace_irq_disable+0x3b/0x140 [ 100.350110][ T5631] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.356199][ T5631] ? clear_bhb_loop+0x70/0xc0 [ 100.360896][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.366808][ T5631] RIP: 0033:0x7fce8ba610aa [ 100.371243][ T5631] Code: 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 100.390904][ T5631] RSP: 002b:00007ffd6f290bb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 100.399340][ T5631] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce8ba610aa [ 100.407330][ T5631] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 00007ffd6f290c00 [ 100.415339][ T5631] RBP: 0000000000000004 R08: 00007ffd6f290c40 R09: 0000000000000000 [ 100.423331][ T5631] R10: 0000000003200041 R11: 0000000000000206 R12: 0000200000000040 [ 100.431327][ T5631] R13: 00007ffd6f290c40 R14: 0000000000010000 R15: 0000000000000003 [ 100.439368][ T5631] [ 100.443020][ T5631] Kernel Offset: disabled [ 100.447363][ T5631] Rebooting in 86400 seconds..