INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.30' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 29.041351] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 29.048412] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 29.056581] F2FS-fs (loop0): invalid crc value [ 29.062369] ================================================================== [ 29.069722] BUG: KASAN: slab-out-of-bounds in build_segment_manager+0x962a/0x9d30 [ 29.077313] Read of size 4 at addr ffff8801c4754a00 by task syzkaller107152/3637 [ 29.084811] [ 29.086414] CPU: 1 PID: 3637 Comm: syzkaller107152 Not tainted 4.9.94-g8683408 #1 [ 29.094007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.103334] ffff8801c471f870 ffffffff81eb0aa9 ffffea000711d400 ffff8801c4754a00 [ 29.111305] 0000000000000000 ffff8801c4754a00 ffff8801d6db3300 ffff8801c471f8a8 [ 29.119270] ffffffff815652cb ffff8801c4754a00 0000000000000004 0000000000000000 [ 29.127245] Call Trace: [ 29.129803] [] dump_stack+0xc1/0x128 [ 29.135137] [] print_address_description+0x6c/0x234 [ 29.141775] [] kasan_report.cold.6+0x242/0x2fe [ 29.147975] [] ? build_segment_manager+0x962a/0x9d30 [ 29.154695] [] __asan_report_load4_noabort+0x14/0x20 [ 29.161418] [] build_segment_manager+0x962a/0x9d30 [ 29.167967] [] ? flush_sit_entries+0x2560/0x2560 [ 29.174345] [] ? __raw_spin_lock_init+0x2d/0x100 [ 29.180719] [] f2fs_fill_super+0x1d10/0x5d00 [ 29.186745] [] ? vsnprintf+0x1a8/0x1840 [ 29.192340] [] ? vsprintf+0x40/0x40 [ 29.197587] [] ? f2fs_commit_super+0x3c0/0x3c0 [ 29.203788] [] ? set_blocksize+0x267/0x300 [ 29.209643] [] ? set_bdev_super+0x150/0x150 [ 29.215584] [] mount_bdev+0x2c7/0x390 [ 29.221005] [] ? f2fs_commit_super+0x3c0/0x3c0 [ 29.227205] [] f2fs_mount+0x34/0x40 [ 29.232453] [] mount_fs+0x28c/0x370 [ 29.237711] [] vfs_kern_mount.part.29+0xd1/0x3d0 [ 29.244089] [] ? ns_capable_common+0x12a/0x150 [ 29.250290] [] do_mount+0x3c9/0x2740 [ 29.255625] [] ? copy_mount_string+0x40/0x40 [ 29.261651] [] ? kasan_unpoison_shadow+0x35/0x50 [ 29.268024] [] ? kasan_kmalloc+0xc7/0xe0 [ 29.273707] [] ? kmem_cache_alloc_trace+0xfd/0x2b0 [ 29.280256] [] ? copy_mount_options+0x5f/0x320 [ 29.286453] [] ? copy_mount_options+0x1e5/0x320 [ 29.292739] [] SyS_mount+0xfe/0x110 [ 29.297987] [] ? copy_mnt_ns+0x8e0/0x8e0 [ 29.303668] [] do_syscall_64+0x1a6/0x490 [ 29.309347] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 29.316242] [ 29.317841] Allocated by task 0: [ 29.321175] (stack is not available) [ 29.324854] [ 29.326451] Freed by task 0: [ 29.329436] (stack is not available) [ 29.333116] [ 29.334716] The buggy address belongs to the object at ffff8801c4754400 [ 29.334716] which belongs to the cache kmalloc-2048 of size 2048 [ 29.347515] The buggy address is located 1536 bytes inside of [ 29.347515] 2048-byte region [ffff8801c4754400, ffff8801c4754c00) [ 29.359529] The buggy address belongs to the page: [ 29.364427] page:ffffea000711d400 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 29.374597] flags: 0x8000000000004080(slab|head) [ 29.379319] page dumped because: kasan: bad access detected [ 29.384998] [ 29.386592] Memory state around the buggy address: [ 29.391490] ffff8801c4754900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.398818] ffff8801c4754980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.406148] >ffff8801c4754a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.413480] ^ [ 29.416820] ffff8801c4754a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.424147] ffff8801c4754b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.431482] ================================================================== [ 29.438813] Disabling lock debugging due to kernel taint [ 29.444832] Kernel panic - not syncing: panic_on_warn set ... [ 29.444832] [ 29.452182] CPU: 1 PID: 3637 Comm: syzkaller107152 Tainted: G B 4.9.94-g8683408 #1 [ 29.460994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.470322] ffff8801c471f7d0 ffffffff81eb0aa9 ffffffff841c4445 00000000ffffffff [ 29.478294] 0000000000000000 0000000000000001 ffff8801d6db3300 ffff8801c471f890 [ 29.486265] ffffffff8141f845 0000000041b58ab3 ffffffff841b7b48 ffffffff8141f686 [ 29.494231] Call Trace: [ 29.496790] [] dump_stack+0xc1/0x128 [ 29.502126] [] panic+0x1bf/0x3bc [ 29.507113] [] ? add_taint.cold.6+0x16/0x16 [ 29.513052] [] ? ___preempt_schedule+0x16/0x18 [ 29.519253] [] kasan_end_report+0x47/0x4f [ 29.525020] [] kasan_report.cold.6+0x76/0x2fe [ 29.531136] [] ? build_segment_manager+0x962a/0x9d30 [ 29.537859] [] __asan_report_load4_noabort+0x14/0x20 [ 29.544582] [] build_segment_manager+0x962a/0x9d30 [ 29.551135] [] ? flush_sit_entries+0x2560/0x2560 [ 29.557513] [] ? __raw_spin_lock_init+0x2d/0x100 [ 29.563891] [] f2fs_fill_super+0x1d10/0x5d00 [ 29.569922] [] ? vsnprintf+0x1a8/0x1840 [ 29.575517] [] ? vsprintf+0x40/0x40 [ 29.580762] [] ? f2fs_commit_super+0x3c0/0x3c0 [ 29.586968] [] ? set_blocksize+0x267/0x300 [ 29.592835] [] ? set_bdev_super+0x150/0x150 [ 29.598780] [] mount_bdev+0x2c7/0x390 [ 29.604202] [] ? f2fs_commit_super+0x3c0/0x3c0 [ 29.610404] [] f2fs_mount+0x34/0x40 [ 29.615655] [] mount_fs+0x28c/0x370 [ 29.620902] [] vfs_kern_mount.part.29+0xd1/0x3d0 [ 29.627284] [] ? ns_capable_common+0x12a/0x150 [ 29.633485] [] do_mount+0x3c9/0x2740 [ 29.638818] [] ? copy_mount_string+0x40/0x40 [ 29.644845] [] ? kasan_unpoison_shadow+0x35/0x50 [ 29.651219] [] ? kasan_kmalloc+0xc7/0xe0 [ 29.656899] [] ? kmem_cache_alloc_trace+0xfd/0x2b0 [ 29.663449] [] ? copy_mount_options+0x5f/0x320 [ 29.669649] [] ? copy_mount_options+0x1e5/0x320 [ 29.675935] [] SyS_mount+0xfe/0x110 [ 29.681179] [] ? copy_mnt_ns+0x8e0/0x8e0 [ 29.686859] [] do_syscall_64+0x1a6/0x490 [ 29.692539] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 29.699848] Dumping ftrace buffer: [ 29.703366] (ftrace buffer empty) [ 29.707046] Kernel Offset: disabled [ 29.710642] Rebooting in 86400 seconds..