INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 46.293482] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 46.300656] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 46.308817] F2FS-fs (loop0): invalid crc value [ 46.315425] ================================================================== [ 46.322851] BUG: KASAN: use-after-free in build_segment_manager+0xb92d/0xbf70 [ 46.330106] Read of size 4 at addr ffff8801b4e5bb40 by task syzkaller058580/4474 [ 46.337620] [ 46.339233] CPU: 1 PID: 4474 Comm: syzkaller058580 Not tainted 4.17.0-rc1+ #10 [ 46.346579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 46.355909] Call Trace: [ 46.358485] dump_stack+0x1b9/0x294 [ 46.362091] ? dump_stack_print_info.cold.2+0x52/0x52 [ 46.367258] ? printk+0x9e/0xba [ 46.370516] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 46.375250] ? kasan_check_write+0x14/0x20 [ 46.379462] print_address_description+0x6c/0x20b [ 46.384283] ? build_segment_manager+0xb92d/0xbf70 [ 46.389191] kasan_report.cold.7+0x242/0x2fe [ 46.393587] __asan_report_load4_noabort+0x14/0x20 [ 46.398500] build_segment_manager+0xb92d/0xbf70 [ 46.403241] ? flush_sit_entries+0x2c40/0x2c40 [ 46.407801] ? __remove_ino_entry+0x3c0/0x3c0 [ 46.412274] ? console_unlock+0x1100/0x1100 [ 46.416581] ? lock_downgrade+0x8e0/0x8e0 [ 46.420721] ? mark_held_locks+0xc9/0x160 [ 46.424847] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 46.429416] ? vprintk_default+0x28/0x30 [ 46.433463] ? vprintk_func+0x81/0xe7 [ 46.437240] ? printk+0x9e/0xba [ 46.440498] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 46.446011] ? kernel_fpu_enable+0x23/0x40 [ 46.450222] ? __kernel_fpu_end+0xab/0x160 [ 46.454434] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 46.459428] ? crc32_le+0x3a0/0x610 [ 46.463031] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 46.468553] ? crc32_pclmul_le+0x49/0x120 [ 46.472683] ? kasan_unpoison_shadow+0x35/0x50 [ 46.477242] ? __asan_allocas_unpoison+0x16/0x20 [ 46.481976] ? crypto_shash_update+0x10b/0x2a0 [ 46.486538] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 46.492054] ? unlock_page+0x1d0/0x2b0 [ 46.495922] ? wake_up_page_bit+0x580/0x580 [ 46.500224] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.505747] ? bpf_prog_kallsyms_find+0xd6/0x4a0 [ 46.510485] ? modules_open+0xa0/0xa0 [ 46.514264] ? __bpf_trace_bpf_map_next_key+0x40/0x40 [ 46.519434] ? lock_downgrade+0x8e0/0x8e0 [ 46.523562] ? noop_count+0x40/0x40 [ 46.527170] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.532681] ? bpf_prog_kallsyms_find+0xd6/0x4a0 [ 46.537413] ? modules_open+0xa0/0xa0 [ 46.541190] ? __bpf_trace_bpf_map_next_key+0x40/0x40 [ 46.546358] ? kernel_text_address+0x79/0xf0 [ 46.550741] ? is_bpf_text_address+0xae/0x170 [ 46.555212] ? lock_downgrade+0x8e0/0x8e0 [ 46.559337] ? lock_release+0xa10/0xa10 [ 46.563298] ? kasan_check_read+0x11/0x20 [ 46.567441] ? rcu_is_watching+0x85/0x140 [ 46.571569] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 46.576739] ? is_bpf_text_address+0xd7/0x170 [ 46.581211] ? kernel_text_address+0x79/0xf0 [ 46.585597] ? __unwind_start+0x166/0x330 [ 46.589720] ? __kernel_text_address+0xd/0x40 [ 46.594196] ? unwind_get_return_address+0x61/0xa0 [ 46.599104] ? __save_stack_trace+0x7e/0xd0 [ 46.603403] ? add_lock_to_list.isra.29+0x1e4/0x490 [ 46.608396] ? trace_hardirqs_off+0x10/0x10 [ 46.612696] ? save_stack_trace+0x1a/0x20 [ 46.616820] ? save_trace+0xe0/0x290 [ 46.620515] ? kasan_check_read+0x11/0x20 [ 46.624655] ? __lock_acquire+0x28fb/0x5140 [ 46.628963] ? debug_check_no_locks_freed+0x310/0x310 [ 46.634129] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 46.638691] ? kasan_check_read+0x11/0x20 [ 46.642821] ? mark_held_locks+0xc9/0x160 [ 46.646946] ? print_usage_bug+0xc0/0xc0 [ 46.650985] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 46.655978] ? __lockdep_init_map+0x105/0x590 [ 46.660450] ? lockdep_init_map+0x9/0x10 [ 46.664489] ? __mutex_init+0x1ef/0x280 [ 46.668443] ? print_usage_bug+0xc0/0xc0 [ 46.672480] ? mark_held_locks+0xc9/0x160 [ 46.676606] ? __raw_spin_lock_init+0x1c/0x100 [ 46.681176] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 46.686176] ? __lockdep_init_map+0x105/0x590 [ 46.690652] ? lockdep_init_map+0x9/0x10 [ 46.694692] ? mark_held_locks+0xc9/0x160 [ 46.698818] ? f2fs_update_extent_cache_range+0x1d0/0x1d0 [ 46.704334] ? __raw_spin_lock_init+0x1c/0x100 [ 46.708894] ? __lockdep_init_map+0x105/0x590 [ 46.713371] ? lockdep_init_map+0x9/0x10 [ 46.717409] ? __raw_spin_lock_init+0x2d/0x100 [ 46.721992] f2fs_fill_super+0x4095/0x7bf0 [ 46.726205] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 46.731211] ? f2fs_commit_super+0x400/0x400 [ 46.735600] ? lock_downgrade+0x8e0/0x8e0 [ 46.739729] ? lock_release+0xa10/0xa10 [ 46.743682] ? check_same_owner+0x320/0x320 [ 46.747982] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 46.752977] ? widen_string+0xd8/0x2d0 [ 46.756843] ? rcu_note_context_switch+0x710/0x710 [ 46.761752] ? format_decode+0xae0/0xae0 [ 46.765792] ? graph_lock+0x170/0x170 [ 46.769582] ? widen_string+0x2d0/0x2d0 [ 46.773535] ? sget_userns+0x2dd/0xf00 [ 46.777412] ? find_held_lock+0x13f/0x1c0 [ 46.781539] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.787057] ? bdev_name.isra.7+0x1a1/0x1f0 [ 46.791369] ? pointer+0x1b0/0xa20 [ 46.794890] ? netdev_bits+0xb0/0xb0 [ 46.798578] ? format_decode+0x1a9/0xae0 [ 46.802621] ? set_precision+0xe0/0xe0 [ 46.806500] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 46.811671] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 46.817185] ? vsnprintf+0x242/0x1b40 [ 46.820965] ? pointer+0xa20/0xa20 [ 46.824509] ? snprintf+0xa5/0xd0 [ 46.827938] ? vsprintf+0x40/0x40 [ 46.831371] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 46.836378] ? set_blocksize+0x2c4/0x350 [ 46.840420] mount_bdev+0x30c/0x3e0 [ 46.844026] ? f2fs_commit_super+0x400/0x400 [ 46.848412] ? mount_bdev+0x30c/0x3e0 [ 46.852191] ? f2fs_commit_super+0x400/0x400 [ 46.856579] f2fs_mount+0x34/0x40 [ 46.860010] mount_fs+0xae/0x328 [ 46.863360] vfs_kern_mount.part.34+0xd4/0x4d0 [ 46.867922] ? may_umount+0xb0/0xb0 [ 46.871532] ? _raw_read_unlock+0x22/0x30 [ 46.875663] ? __get_fs_type+0x97/0xc0 [ 46.879531] do_mount+0x564/0x3070 [ 46.883051] ? copy_mount_string+0x40/0x40 [ 46.887263] ? rcu_pm_notify+0xc0/0xc0 [ 46.891135] ? copy_mount_options+0x5f/0x380 [ 46.895533] ? rcu_read_lock_sched_held+0x108/0x120 [ 46.900530] ? kmem_cache_alloc_trace+0x616/0x780 [ 46.905364] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 46.910882] ? _copy_from_user+0xdf/0x150 [ 46.915013] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.920532] ? copy_mount_options+0x285/0x380 [ 46.925008] ksys_mount+0x12d/0x140 [ 46.928621] __x64_sys_mount+0xbe/0x150 [ 46.932576] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 46.937572] do_syscall_64+0x1b1/0x800 [ 46.941449] ? syscall_return_slowpath+0x5c0/0x5c0 [ 46.946359] ? syscall_return_slowpath+0x30f/0x5c0 [ 46.951267] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 46.956616] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.961441] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 46.966623] RIP: 0033:0x443d8a [ 46.969789] RSP: 002b:00007ffdf3c9d788 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5 [ 46.977474] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443d8a [ 46.984722] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffdf3c9d7a0 [ 46.992055] RBP: 0000000020000b58 R08: 00000000200001c0 R09: 000000000000000a [ 46.999316] R10: 0000000000000000 R11: 0000000000000297 R12: 6f6d5f636f6c6c61 [ 47.006572] R13: 656d5f6873756c66 R14: 0030656c69662f2e R15: 0000000000000004 [ 47.013826] [ 47.015430] The buggy address belongs to the page: [ 47.020336] page:ffffea0006d396c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 47.028459] flags: 0x2fffc0000000000() [ 47.032338] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 47.040200] raw: 0000000000000000 ffffea0006d30101 0000000000000000 0000000000000000 [ 47.048055] page dumped because: kasan: bad access detected [ 47.053735] [ 47.055336] Memory state around the buggy address: [ 47.060240] ffff8801b4e5ba00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.067584] ffff8801b4e5ba80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.074936] >ffff8801b4e5bb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.082270] ^ [ 47.087699] ffff8801b4e5bb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.095039] ffff8801b4e5bc00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.102371] ================================================================== [ 47.109707] Disabling lock debugging due to kernel taint [ 47.115390] Kernel panic - not syncing: panic_on_warn set ... [ 47.115390] [ 47.122747] CPU: 1 PID: 4474 Comm: syzkaller058580 Tainted: G B 4.17.0-rc1+ #10 [ 47.131472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.140800] Call Trace: [ 47.143373] dump_stack+0x1b9/0x294 [ 47.146977] ? dump_stack_print_info.cold.2+0x52/0x52 [ 47.152147] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 47.157382] ? build_segment_manager+0xb8d0/0xbf70 [ 47.162290] panic+0x22f/0x4de [ 47.165459] ? add_taint.cold.5+0x16/0x16 [ 47.169586] ? do_raw_spin_unlock+0x9e/0x2e0 [ 47.173972] ? do_raw_spin_unlock+0x9e/0x2e0 [ 47.178357] ? build_segment_manager+0xb92d/0xbf70 [ 47.183265] kasan_end_report+0x47/0x4f [ 47.187214] kasan_report.cold.7+0x76/0x2fe [ 47.191515] __asan_report_load4_noabort+0x14/0x20 [ 47.196440] build_segment_manager+0xb92d/0xbf70 [ 47.201177] ? flush_sit_entries+0x2c40/0x2c40 [ 47.205745] ? __remove_ino_entry+0x3c0/0x3c0 [ 47.210221] ? console_unlock+0x1100/0x1100 [ 47.214533] ? lock_downgrade+0x8e0/0x8e0 [ 47.218659] ? mark_held_locks+0xc9/0x160 [ 47.222783] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 47.227343] ? vprintk_default+0x28/0x30 [ 47.231385] ? vprintk_func+0x81/0xe7 [ 47.235163] ? printk+0x9e/0xba [ 47.238423] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 47.243937] ? kernel_fpu_enable+0x23/0x40 [ 47.248145] ? __kernel_fpu_end+0xab/0x160 [ 47.252356] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 47.257356] ? crc32_le+0x3a0/0x610 [ 47.260959] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 47.266474] ? crc32_pclmul_le+0x49/0x120 [ 47.270602] ? kasan_unpoison_shadow+0x35/0x50 [ 47.275163] ? __asan_allocas_unpoison+0x16/0x20 [ 47.279905] ? crypto_shash_update+0x10b/0x2a0 [ 47.284470] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 47.289982] ? unlock_page+0x1d0/0x2b0 [ 47.293847] ? wake_up_page_bit+0x580/0x580 [ 47.298156] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.303674] ? bpf_prog_kallsyms_find+0xd6/0x4a0 [ 47.308407] ? modules_open+0xa0/0xa0 [ 47.312183] ? __bpf_trace_bpf_map_next_key+0x40/0x40 [ 47.317352] ? lock_downgrade+0x8e0/0x8e0 [ 47.321477] ? noop_count+0x40/0x40 [ 47.325083] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.330597] ? bpf_prog_kallsyms_find+0xd6/0x4a0 [ 47.335326] ? modules_open+0xa0/0xa0 [ 47.339102] ? __bpf_trace_bpf_map_next_key+0x40/0x40 [ 47.344267] ? kernel_text_address+0x79/0xf0 [ 47.348650] ? is_bpf_text_address+0xae/0x170 [ 47.353122] ? lock_downgrade+0x8e0/0x8e0 [ 47.357245] ? lock_release+0xa10/0xa10 [ 47.361198] ? kasan_check_read+0x11/0x20 [ 47.365326] ? rcu_is_watching+0x85/0x140 [ 47.369449] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 47.374615] ? is_bpf_text_address+0xd7/0x170 [ 47.379088] ? kernel_text_address+0x79/0xf0 [ 47.383473] ? __unwind_start+0x166/0x330 [ 47.387597] ? __kernel_text_address+0xd/0x40 [ 47.392074] ? unwind_get_return_address+0x61/0xa0 [ 47.396979] ? __save_stack_trace+0x7e/0xd0 [ 47.401277] ? add_lock_to_list.isra.29+0x1e4/0x490 [ 47.406267] ? trace_hardirqs_off+0x10/0x10 [ 47.410573] ? save_stack_trace+0x1a/0x20 [ 47.414701] ? save_trace+0xe0/0x290 [ 47.418389] ? kasan_check_read+0x11/0x20 [ 47.422510] ? __lock_acquire+0x28fb/0x5140 [ 47.426809] ? debug_check_no_locks_freed+0x310/0x310 [ 47.431972] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 47.436531] ? kasan_check_read+0x11/0x20 [ 47.440657] ? mark_held_locks+0xc9/0x160 [ 47.444780] ? print_usage_bug+0xc0/0xc0 [ 47.448815] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 47.453808] ? __lockdep_init_map+0x105/0x590 [ 47.458281] ? lockdep_init_map+0x9/0x10 [ 47.462319] ? __mutex_init+0x1ef/0x280 [ 47.466270] ? print_usage_bug+0xc0/0xc0 [ 47.470306] ? mark_held_locks+0xc9/0x160 [ 47.474431] ? __raw_spin_lock_init+0x1c/0x100 [ 47.478990] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 47.483992] ? __lockdep_init_map+0x105/0x590 [ 47.488472] ? lockdep_init_map+0x9/0x10 [ 47.492519] ? mark_held_locks+0xc9/0x160 [ 47.496646] ? f2fs_update_extent_cache_range+0x1d0/0x1d0 [ 47.502159] ? __raw_spin_lock_init+0x1c/0x100 [ 47.506721] ? __lockdep_init_map+0x105/0x590 [ 47.511200] ? lockdep_init_map+0x9/0x10 [ 47.515238] ? __raw_spin_lock_init+0x2d/0x100 [ 47.519802] f2fs_fill_super+0x4095/0x7bf0 [ 47.524010] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 47.529008] ? f2fs_commit_super+0x400/0x400 [ 47.533400] ? lock_downgrade+0x8e0/0x8e0 [ 47.537521] ? lock_release+0xa10/0xa10 [ 47.541471] ? check_same_owner+0x320/0x320 [ 47.545772] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 47.550765] ? widen_string+0xd8/0x2d0 [ 47.554631] ? rcu_note_context_switch+0x710/0x710 [ 47.559534] ? format_decode+0xae0/0xae0 [ 47.563571] ? graph_lock+0x170/0x170 [ 47.567349] ? widen_string+0x2d0/0x2d0 [ 47.571301] ? sget_userns+0x2dd/0xf00 [ 47.575165] ? find_held_lock+0x13f/0x1c0 [ 47.579288] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.584802] ? bdev_name.isra.7+0x1a1/0x1f0 [ 47.589101] ? pointer+0x1b0/0xa20 [ 47.592619] ? netdev_bits+0xb0/0xb0 [ 47.596305] ? format_decode+0x1a9/0xae0 [ 47.600343] ? set_precision+0xe0/0xe0 [ 47.604205] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 47.609371] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 47.614880] ? vsnprintf+0x242/0x1b40 [ 47.618658] ? pointer+0xa20/0xa20 [ 47.622181] ? snprintf+0xa5/0xd0 [ 47.625610] ? vsprintf+0x40/0x40 [ 47.629042] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 47.634032] ? set_blocksize+0x2c4/0x350 [ 47.638070] mount_bdev+0x30c/0x3e0 [ 47.641672] ? f2fs_commit_super+0x400/0x400 [ 47.646054] ? mount_bdev+0x30c/0x3e0 [ 47.649829] ? f2fs_commit_super+0x400/0x400 [ 47.654215] f2fs_mount+0x34/0x40 [ 47.657643] mount_fs+0xae/0x328 [ 47.660988] vfs_kern_mount.part.34+0xd4/0x4d0 [ 47.665544] ? may_umount+0xb0/0xb0 [ 47.669146] ? _raw_read_unlock+0x22/0x30 [ 47.673272] ? __get_fs_type+0x97/0xc0 [ 47.677137] do_mount+0x564/0x3070 [ 47.680653] ? copy_mount_string+0x40/0x40 [ 47.684860] ? rcu_pm_notify+0xc0/0xc0 [ 47.688724] ? copy_mount_options+0x5f/0x380 [ 47.693115] ? rcu_read_lock_sched_held+0x108/0x120 [ 47.698106] ? kmem_cache_alloc_trace+0x616/0x780 [ 47.702926] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 47.708440] ? _copy_from_user+0xdf/0x150 [ 47.712565] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.718076] ? copy_mount_options+0x285/0x380 [ 47.722557] ksys_mount+0x12d/0x140 [ 47.726159] __x64_sys_mount+0xbe/0x150 [ 47.730109] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 47.735100] do_syscall_64+0x1b1/0x800 [ 47.738963] ? syscall_return_slowpath+0x5c0/0x5c0 [ 47.743868] ? syscall_return_slowpath+0x30f/0x5c0 [ 47.748775] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 47.754128] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 47.758947] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 47.764111] RIP: 0033:0x443d8a [ 47.767275] RSP: 002b:00007ffdf3c9d788 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5 [ 47.774958] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443d8a [ 47.782204] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffdf3c9d7a0 [ 47.789448] RBP: 0000000020000b58 R08: 00000000200001c0 R09: 000000000000000a [ 47.796778] R10: 0000000000000000 R11: 0000000000000297 R12: 6f6d5f636f6c6c61 [ 47.804023] R13: 656d5f6873756c66 R14: 0030656c69662f2e R15: 0000000000000004 [ 47.811678] Dumping ftrace buffer: [ 47.815191] (ftrace buffer empty) [ 47.818874] Kernel Offset: disabled [ 47.822476] Rebooting in 86400 seconds..