Warning: Permanently added '10.128.0.184' (ED25519) to the list of known hosts. executing program [ 46.886408][ T3564] loop0: detected capacity change from 0 to 32768 [ 46.929875][ T3564] ======================================================= [ 46.929875][ T3564] WARNING: The mand mount option has been deprecated and [ 46.929875][ T3564] and is ignored by this kernel. Remove the mand [ 46.929875][ T3564] option from the mount to silence this warning. [ 46.929875][ T3564] ======================================================= [ 46.964841][ T3564] XFS: noattr2 mount option is deprecated. [ 46.970661][ T3564] xfs: Unknown parameter 'mtpt' [ 47.101405][ T3564] loop0: detected capacity change from 0 to 2048 [ 47.195928][ T3564] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 47.203752][ T3564] UDF-fs: Scanning with blocksize 512 failed [ 47.214963][ T3564] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 47.328352][ T3563] ================================================================== [ 47.336549][ T3563] BUG: KASAN: use-after-free in crc_itu_t+0x218/0x2a0 [ 47.343314][ T3563] Read of size 1 at addr ffff88806c8e2000 by task syz-executor307/3563 [ 47.351528][ T3563] [ 47.353833][ T3563] CPU: 0 PID: 3563 Comm: syz-executor307 Not tainted 5.15.165-syzkaller #0 [ 47.362396][ T3563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 47.372524][ T3563] Call Trace: [ 47.375802][ T3563] [ 47.378727][ T3563] dump_stack_lvl+0x1e3/0x2d0 [ 47.383388][ T3563] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 47.389022][ T3563] ? _printk+0xd1/0x120 [ 47.393177][ T3563] ? __wake_up_klogd+0xcc/0x100 [ 47.398010][ T3563] ? panic+0x860/0x860 [ 47.402060][ T3563] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 47.407522][ T3563] print_address_description+0x63/0x3b0 [ 47.413081][ T3563] ? crc_itu_t+0x218/0x2a0 [ 47.417491][ T3563] kasan_report+0x16b/0x1c0 [ 47.421982][ T3563] ? crc_itu_t+0x218/0x2a0 [ 47.426385][ T3563] ? pvclock_gtod_unregister_notifier+0x50/0x50 [ 47.432611][ T3563] crc_itu_t+0x218/0x2a0 [ 47.436843][ T3563] udf_sync_fs+0x1ce/0x380 [ 47.441248][ T3563] ? udf_put_super+0x160/0x160 [ 47.446001][ T3563] ? get_nr_dirty_inodes+0x25f/0x2e0 [ 47.451267][ T3563] sync_filesystem+0xe8/0x220 [ 47.455947][ T3563] generic_shutdown_super+0x6e/0x2c0 [ 47.461225][ T3563] kill_block_super+0x7a/0xe0 [ 47.465885][ T3563] deactivate_locked_super+0xa0/0x110 [ 47.471359][ T3563] cleanup_mnt+0x44e/0x500 [ 47.475759][ T3563] ? lockdep_hardirqs_on+0x94/0x130 [ 47.480938][ T3563] task_work_run+0x129/0x1a0 [ 47.485511][ T3563] do_exit+0x6a3/0x2480 [ 47.489654][ T3563] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 47.495611][ T3563] ? put_task_struct+0x80/0x80 [ 47.500356][ T3563] ? print_irqtrace_events+0x210/0x210 [ 47.505794][ T3563] ? _raw_spin_lock_irq+0xdb/0x110 [ 47.510890][ T3563] ? _raw_spin_unlock_irq+0x1f/0x40 [ 47.516068][ T3563] ? lockdep_hardirqs_on+0x94/0x130 [ 47.521247][ T3563] do_group_exit+0x144/0x310 [ 47.525823][ T3563] __x64_sys_exit_group+0x3b/0x40 [ 47.530828][ T3563] do_syscall_64+0x3b/0xb0 [ 47.535224][ T3563] ? clear_bhb_loop+0x15/0x70 [ 47.539882][ T3563] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.545757][ T3563] RIP: 0033:0x7f7eee2a8609 [ 47.550154][ T3563] Code: Unable to access opcode bytes at RIP 0x7f7eee2a85df. [ 47.557492][ T3563] RSP: 002b:00007ffc1a7075d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 47.565884][ T3563] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f7eee2a8609 [ 47.573835][ T3563] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 47.581808][ T3563] RBP: 00007f7eee33d390 R08: ffffffffffffffb0 R09: 0000000000000010 [ 47.589774][ T3563] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7eee33d390 [ 47.597743][ T3563] R13: 0000000000000000 R14: 00007f7eee33e200 R15: 00007f7eee273730 [ 47.605710][ T3563] [ 47.608711][ T3563] [ 47.611012][ T3563] The buggy address belongs to the page: [ 47.616654][ T3563] page:ffffea0001b23880 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6c8e2 [ 47.626781][ T3563] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 47.633878][ T3563] raw: 00fff00000000000 ffffea0001b23908 ffffea0001b233c8 0000000000000000 [ 47.642444][ T3563] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 47.651004][ T3563] page dumped because: kasan: bad access detected [ 47.657392][ T3563] page_owner tracks the page as freed [ 47.662755][ T3563] page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 3564, ts 47195348145, free_ts 47210921294 [ 47.679839][ T3563] get_page_from_freelist+0x322a/0x33c0 [ 47.685367][ T3563] __alloc_pages+0x272/0x700 [ 47.689936][ T3563] __page_cache_alloc+0xd4/0x4a0 [ 47.694854][ T3563] pagecache_get_page+0xa91/0x1010 [ 47.699942][ T3563] __getblk_gfp+0x22a/0xaf0 [ 47.704426][ T3563] __bread_gfp+0x2a/0x390 [ 47.708731][ T3563] udf_read_tagged+0x126/0xe70 [ 47.713476][ T3563] udf_check_anchor_block+0x20c/0x700 [ 47.718825][ T3563] udf_scan_anchors+0x586/0x680 [ 47.723651][ T3563] udf_load_vrs+0x2f6/0xc40 [ 47.728134][ T3563] udf_fill_super+0x99d/0x23a0 [ 47.732879][ T3563] mount_bdev+0x2c9/0x3f0 [ 47.737279][ T3563] legacy_get_tree+0xeb/0x180 [ 47.741952][ T3563] vfs_get_tree+0x88/0x270 [ 47.746354][ T3563] do_new_mount+0x2ba/0xb40 [ 47.750831][ T3563] __se_sys_mount+0x2d5/0x3c0 [ 47.755514][ T3563] page last free stack trace: [ 47.760245][ T3563] free_unref_page_prepare+0xc34/0xcf0 [ 47.765688][ T3563] free_unref_page_list+0x1f7/0x8e0 [ 47.770881][ T3563] release_pages+0x1bb9/0x1f40 [ 47.775625][ T3563] __pagevec_release+0x80/0xf0 [ 47.780370][ T3563] truncate_inode_pages_range+0x48b/0x1290 [ 47.786159][ T3563] set_blocksize+0x2ff/0x370 [ 47.790732][ T3563] sb_set_blocksize+0x45/0xe0 [ 47.795407][ T3563] udf_load_vrs+0xdd/0xc40 [ 47.799820][ T3563] udf_fill_super+0x99d/0x23a0 [ 47.804561][ T3563] mount_bdev+0x2c9/0x3f0 [ 47.808866][ T3563] legacy_get_tree+0xeb/0x180 [ 47.813517][ T3563] vfs_get_tree+0x88/0x270 [ 47.817908][ T3563] do_new_mount+0x2ba/0xb40 [ 47.822390][ T3563] __se_sys_mount+0x2d5/0x3c0 [ 47.827050][ T3563] do_syscall_64+0x3b/0xb0 [ 47.831441][ T3563] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.837333][ T3563] [ 47.839636][ T3563] Memory state around the buggy address: [ 47.845238][ T3563] ffff88806c8e1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.853273][ T3563] ffff88806c8e1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.861449][ T3563] >ffff88806c8e2000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.869610][ T3563] ^ [ 47.873656][ T3563] ffff88806c8e2080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.881794][ T3563] ffff88806c8e2100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 47.889827][ T3563] ================================================================== [ 47.897859][ T3563] Disabling lock debugging due to kernel taint [ 47.904273][ T3563] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 47.911458][ T3563] CPU: 0 PID: 3563 Comm: syz-executor307 Tainted: G B 5.15.165-syzkaller #0 [ 47.921408][ T3563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 47.931547][ T3563] Call Trace: [ 47.934806][ T3563] [ 47.937716][ T3563] dump_stack_lvl+0x1e3/0x2d0 [ 47.942373][ T3563] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 47.948085][ T3563] ? panic+0x860/0x860 [ 47.952168][ T3563] ? preempt_schedule_common+0xa6/0xd0 [ 47.957611][ T3563] ? preempt_schedule+0xd9/0xe0 [ 47.962465][ T3563] panic+0x318/0x860 [ 47.966346][ T3563] ? check_panic_on_warn+0x1d/0xa0 [ 47.971534][ T3563] ? fb_is_primary_device+0xd0/0xd0 [ 47.976713][ T3563] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 47.982672][ T3563] ? _raw_spin_unlock+0x40/0x40 [ 47.987509][ T3563] ? print_memory_metadata+0xe2/0x140 [ 47.992863][ T3563] check_panic_on_warn+0x7e/0xa0 [ 47.997783][ T3563] ? crc_itu_t+0x218/0x2a0 [ 48.002177][ T3563] end_report+0x6d/0xf0 [ 48.006312][ T3563] kasan_report+0x18e/0x1c0 [ 48.010794][ T3563] ? crc_itu_t+0x218/0x2a0 [ 48.015187][ T3563] ? pvclock_gtod_unregister_notifier+0x50/0x50 [ 48.021405][ T3563] crc_itu_t+0x218/0x2a0 [ 48.025644][ T3563] udf_sync_fs+0x1ce/0x380 [ 48.030046][ T3563] ? udf_put_super+0x160/0x160 [ 48.034790][ T3563] ? get_nr_dirty_inodes+0x25f/0x2e0 [ 48.040055][ T3563] sync_filesystem+0xe8/0x220 [ 48.044714][ T3563] generic_shutdown_super+0x6e/0x2c0 [ 48.049977][ T3563] kill_block_super+0x7a/0xe0 [ 48.054630][ T3563] deactivate_locked_super+0xa0/0x110 [ 48.059981][ T3563] cleanup_mnt+0x44e/0x500 [ 48.064376][ T3563] ? lockdep_hardirqs_on+0x94/0x130 [ 48.069550][ T3563] task_work_run+0x129/0x1a0 [ 48.074120][ T3563] do_exit+0x6a3/0x2480 [ 48.078257][ T3563] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 48.084213][ T3563] ? put_task_struct+0x80/0x80 [ 48.088959][ T3563] ? print_irqtrace_events+0x210/0x210 [ 48.094395][ T3563] ? _raw_spin_lock_irq+0xdb/0x110 [ 48.099489][ T3563] ? _raw_spin_unlock_irq+0x1f/0x40 [ 48.104671][ T3563] ? lockdep_hardirqs_on+0x94/0x130 [ 48.109855][ T3563] do_group_exit+0x144/0x310 [ 48.114426][ T3563] __x64_sys_exit_group+0x3b/0x40 [ 48.119427][ T3563] do_syscall_64+0x3b/0xb0 [ 48.123823][ T3563] ? clear_bhb_loop+0x15/0x70 [ 48.128480][ T3563] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.134349][ T3563] RIP: 0033:0x7f7eee2a8609 [ 48.138740][ T3563] Code: Unable to access opcode bytes at RIP 0x7f7eee2a85df. [ 48.146079][ T3563] RSP: 002b:00007ffc1a7075d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 48.154469][ T3563] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f7eee2a8609 [ 48.162426][ T3563] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 48.170378][ T3563] RBP: 00007f7eee33d390 R08: ffffffffffffffb0 R09: 0000000000000010 [ 48.178324][ T3563] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7eee33d390 [ 48.186286][ T3563] R13: 0000000000000000 R14: 00007f7eee33e200 R15: 00007f7eee273730 [ 48.194255][ T3563] [ 48.197531][ T3563] Kernel Offset: disabled [ 48.201868][ T3563] Rebooting in 86400 seconds..