[ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.146' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 33.382002] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 33.389142] UDF-fs: Scanning with blocksize 512 failed [ 33.398865] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 33.405785] UDF-fs: Scanning with blocksize 1024 failed [ 33.411533] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 33.418611] UDF-fs: Scanning with blocksize 2048 failed [ 33.425572] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 33.442067] ================================================================== [ 33.449662] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x780/0x860 [ 33.456696] Write of size 4 at addr ffff88809512ecf0 by task syz-executor105/8097 [ 33.464328] [ 33.466058] CPU: 0 PID: 8097 Comm: syz-executor105 Not tainted 4.19.211-syzkaller #0 [ 33.474332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 33.483793] Call Trace: [ 33.486693] dump_stack+0x1fc/0x2ef [ 33.490437] print_address_description.cold+0x54/0x219 [ 33.495806] kasan_report_error.cold+0x8a/0x1b9 [ 33.500549] ? udf_write_aext+0x780/0x860 [ 33.505049] __asan_report_store_n_noabort+0x8b/0xa0 [ 33.510259] ? udf_get_pblock_spar15+0x131/0x4a0 [ 33.515348] ? udf_write_aext+0x780/0x860 [ 33.519491] udf_write_aext+0x780/0x860 [ 33.523907] udf_add_entry+0xdab/0x2a20 [ 33.527897] ? udf_write_fi+0xf40/0xf40 [ 33.531890] ? udf_new_inode+0xa7b/0xf30 [ 33.536016] udf_mkdir+0x145/0x650 [ 33.539728] ? map_id_up+0x178/0x2f0 [ 33.543606] ? udf_create+0x180/0x180 [ 33.547660] ? putname+0xe1/0x120 [ 33.551103] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 33.556133] ? generic_permission+0x116/0x4d0 [ 33.560614] ? security_inode_permission+0xc5/0xf0 [ 33.565540] ? inode_permission.part.0+0x10c/0x450 [ 33.570496] vfs_mkdir+0x508/0x7a0 [ 33.574025] do_mkdirat+0x262/0x2d0 [ 33.577652] ? __ia32_sys_mknod+0x120/0x120 [ 33.581983] ? trace_hardirqs_off_caller+0x6e/0x210 [ 33.586985] ? do_syscall_64+0x21/0x620 [ 33.590945] do_syscall_64+0xf9/0x620 [ 33.594738] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.600012] RIP: 0033:0x7fadf7cc9839 [ 33.603712] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 33.622598] RSP: 002b:00007ffcd1016938 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 33.630563] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007fadf7cc9839 [ 33.637854] RDX: 0000000000000004 RSI: 0000000020000100 RDI: 00000000ffffff9c [ 33.645295] RBP: 00007fadf7d050cf R08: 0000000037393038 R09: 0000000037393038 [ 33.652545] R10: 000000000000189e R11: 0000000000000246 R12: 00007ffcd1016a40 [ 33.659829] R13: 00007fadf7d050e8 R14: 0000000000000000 R15: 0000000000000000 [ 33.667652] [ 33.669269] Allocated by task 8097: [ 33.673146] __kmalloc+0x15a/0x3c0 [ 33.676785] udf_new_inode+0xbb3/0xf30 [ 33.680683] udf_mkdir+0xa8/0x650 [ 33.684133] vfs_mkdir+0x508/0x7a0 [ 33.687797] do_mkdirat+0x262/0x2d0 [ 33.691517] do_syscall_64+0xf9/0x620 [ 33.695589] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.701044] [ 33.702822] Freed by task 0: [ 33.705880] (stack is not available) [ 33.710053] [ 33.711704] The buggy address belongs to the object at ffff88809512ed00 [ 33.711704] which belongs to the cache kmalloc-4096 of size 4096 [ 33.725068] The buggy address is located 16 bytes to the left of [ 33.725068] 4096-byte region [ffff88809512ed00, ffff88809512fd00) [ 33.737986] The buggy address belongs to the page: [ 33.743077] page:ffffea0002544b80 count:1 mapcount:0 mapping:ffff88813bff0dc0 index:0x0 compound_mapcount: 0 [ 33.753320] flags: 0xfff00000008100(slab|head) [ 33.757921] raw: 00fff00000008100 ffffea0002c58d08 ffffea0002c91188 ffff88813bff0dc0 [ 33.765888] raw: 0000000000000000 ffff88809512ed00 0000000100000001 0000000000000000 [ 33.773846] page dumped because: kasan: bad access detected [ 33.779628] [ 33.781233] Memory state around the buggy address: [ 33.786241] ffff88809512eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.793688] ffff88809512ec00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.801123] >ffff88809512ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.808814] ^ [ 33.816770] ffff88809512ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.824444] ffff88809512ed80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.831836] ================================================================== [ 33.839843] Disabling lock debugging due to kernel taint [ 33.851384] Kernel panic - not syncing: panic_on_warn set ... [ 33.851384] [ 33.858968] CPU: 0 PID: 8097 Comm: syz-executor105 Tainted: G B 4.19.211-syzkaller #0 [ 33.868341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 33.878154] Call Trace: [ 33.880736] dump_stack+0x1fc/0x2ef [ 33.884633] panic+0x26a/0x50e [ 33.887816] ? __warn_printk+0xf3/0xf3 [ 33.891704] ? preempt_schedule_common+0x45/0xc0 [ 33.896541] ? ___preempt_schedule+0x16/0x18 [ 33.901116] ? trace_hardirqs_on+0x55/0x210 [ 33.905605] kasan_end_report+0x43/0x49 [ 33.909663] kasan_report_error.cold+0xa7/0x1b9 [ 33.914426] ? udf_write_aext+0x780/0x860 [ 33.918554] __asan_report_store_n_noabort+0x8b/0xa0 [ 33.923847] ? udf_get_pblock_spar15+0x131/0x4a0 [ 33.928862] ? udf_write_aext+0x780/0x860 [ 33.933012] udf_write_aext+0x780/0x860 [ 33.937127] udf_add_entry+0xdab/0x2a20 [ 33.941098] ? udf_write_fi+0xf40/0xf40 [ 33.945234] ? udf_new_inode+0xa7b/0xf30 [ 33.949277] udf_mkdir+0x145/0x650 [ 33.952912] ? map_id_up+0x178/0x2f0 [ 33.956754] ? udf_create+0x180/0x180 [ 33.960614] ? putname+0xe1/0x120 [ 33.964070] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 33.969175] ? generic_permission+0x116/0x4d0 [ 33.973662] ? security_inode_permission+0xc5/0xf0 [ 33.978611] ? inode_permission.part.0+0x10c/0x450 [ 33.983673] vfs_mkdir+0x508/0x7a0 [ 33.987282] do_mkdirat+0x262/0x2d0 [ 33.990960] ? __ia32_sys_mknod+0x120/0x120 [ 33.995396] ? trace_hardirqs_off_caller+0x6e/0x210 [ 34.000404] ? do_syscall_64+0x21/0x620 [ 34.004370] do_syscall_64+0xf9/0x620 [ 34.008210] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.013387] RIP: 0033:0x7fadf7cc9839 [ 34.017094] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 34.036947] RSP: 002b:00007ffcd1016938 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 34.044816] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007fadf7cc9839 [ 34.052064] RDX: 0000000000000004 RSI: 0000000020000100 RDI: 00000000ffffff9c [ 34.059314] RBP: 00007fadf7d050cf R08: 0000000037393038 R09: 0000000037393038 [ 34.066660] R10: 000000000000189e R11: 0000000000000246 R12: 00007ffcd1016a40 [ 34.073915] R13: 00007fadf7d050e8 R14: 0000000000000000 R15: 0000000000000000 [ 34.081381] Kernel Offset: disabled [ 34.084996] Rebooting in 86400 seconds..