Warning: Permanently added '10.128.0.244' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 43.026453][ T6849] ================================================================== [ 43.034587][ T6849] BUG: KASAN: slab-out-of-bounds in squashfs_get_id+0xb9/0x1c0 [ 43.042100][ T6849] Read of size 8 at addr ffff888093f3acb8 by task syz-executor895/6849 [ 43.050301][ T6849] [ 43.052606][ T6849] CPU: 1 PID: 6849 Comm: syz-executor895 Not tainted 5.9.0-rc7-syzkaller #0 [ 43.061275][ T6849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.071302][ T6849] Call Trace: [ 43.074567][ T6849] dump_stack+0x1d6/0x29e [ 43.078869][ T6849] print_address_description+0x66/0x620 [ 43.084389][ T6849] ? printk+0x62/0x83 [ 43.088342][ T6849] ? _raw_spin_lock_irqsave+0x84/0xd0 [ 43.093685][ T6849] ? vprintk_emit+0x2f0/0x370 [ 43.098333][ T6849] kasan_report+0x132/0x1d0 [ 43.102807][ T6849] ? squashfs_get_id+0xb9/0x1c0 [ 43.107629][ T6849] squashfs_get_id+0xb9/0x1c0 [ 43.112284][ T6849] squashfs_read_inode+0x19b/0x2170 [ 43.117458][ T6849] ? _raw_spin_unlock+0x24/0x40 [ 43.122302][ T6849] ? new_inode+0x1be/0x1d0 [ 43.126713][ T6849] squashfs_fill_super+0x1478/0x1790 [ 43.131974][ T6849] get_tree_bdev+0x3e9/0x5f0 [ 43.136533][ T6849] ? squashfs_reconfigure+0xa0/0xa0 [ 43.141703][ T6849] vfs_get_tree+0x88/0x270 [ 43.146089][ T6849] path_mount+0x179d/0x29e0 [ 43.150568][ T6849] __se_sys_mount+0x126/0x180 [ 43.155218][ T6849] do_syscall_64+0x31/0x70 [ 43.159603][ T6849] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 43.165463][ T6849] RIP: 0033:0x446d2a [ 43.169328][ T6849] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 43.188902][ T6849] RSP: 002b:00007ffeb1eba8b8 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 43.197283][ T6849] RAX: ffffffffffffffda RBX: 00007ffeb1eba910 RCX: 0000000000446d2a [ 43.205239][ T6849] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffeb1eba8d0 [ 43.213203][ T6849] RBP: 00007ffeb1eba8d0 R08: 00007ffeb1eba910 R09: 00007ffe00000015 [ 43.221150][ T6849] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 43.229096][ T6849] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 43.237046][ T6849] [ 43.239355][ T6849] Allocated by task 6849: [ 43.243678][ T6849] __kasan_kmalloc+0x100/0x130 [ 43.248415][ T6849] __kmalloc+0x205/0x300 [ 43.252628][ T6849] kcalloc+0x2b/0x50 [ 43.256496][ T6849] squashfs_read_table+0x5c/0x370 [ 43.261494][ T6849] squashfs_read_inode_lookup_table+0x5a/0xd0 [ 43.267563][ T6849] squashfs_fill_super+0x108a/0x1790 [ 43.272819][ T6849] get_tree_bdev+0x3e9/0x5f0 [ 43.277379][ T6849] vfs_get_tree+0x88/0x270 [ 43.281796][ T6849] path_mount+0x179d/0x29e0 [ 43.286293][ T6849] __se_sys_mount+0x126/0x180 [ 43.290940][ T6849] do_syscall_64+0x31/0x70 [ 43.295338][ T6849] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 43.301208][ T6849] [ 43.303507][ T6849] Freed by task 6849: [ 43.307470][ T6849] kasan_set_track+0x3d/0x70 [ 43.312045][ T6849] kasan_set_free_info+0x17/0x30 [ 43.316950][ T6849] __kasan_slab_free+0xdd/0x110 [ 43.321769][ T6849] kfree+0x113/0x200 [ 43.325634][ T6849] squashfs_read_table+0x32a/0x370 [ 43.330713][ T6849] squashfs_read_inode_lookup_table+0x5a/0xd0 [ 43.336747][ T6849] squashfs_fill_super+0x108a/0x1790 [ 43.342000][ T6849] get_tree_bdev+0x3e9/0x5f0 [ 43.346569][ T6849] vfs_get_tree+0x88/0x270 [ 43.350952][ T6849] path_mount+0x179d/0x29e0 [ 43.355434][ T6849] __se_sys_mount+0x126/0x180 [ 43.360080][ T6849] do_syscall_64+0x31/0x70 [ 43.364465][ T6849] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 43.370331][ T6849] [ 43.372631][ T6849] The buggy address belongs to the object at ffff888093f3ac80 [ 43.372631][ T6849] which belongs to the cache kmalloc-32 of size 32 [ 43.386479][ T6849] The buggy address is located 24 bytes to the right of [ 43.386479][ T6849] 32-byte region [ffff888093f3ac80, ffff888093f3aca0) [ 43.400060][ T6849] The buggy address belongs to the page: [ 43.405664][ T6849] page:0000000080f9f3ac refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888093f3afc1 pfn:0x93f3a [ 43.417079][ T6849] flags: 0xfffe0000000200(slab) [ 43.421900][ T6849] raw: 00fffe0000000200 ffffea000256db08 ffff8880aa441250 ffff8880aa440100 [ 43.430498][ T6849] raw: ffff888093f3afc1 ffff888093f3a000 000000010000003f 0000000000000000 [ 43.439175][ T6849] page dumped because: kasan: bad access detected [ 43.445554][ T6849] [ 43.447851][ T6849] Memory state around the buggy address: [ 43.453494][ T6849] ffff888093f3ab80: fa fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc [ 43.461525][ T6849] ffff888093f3ac00: fa fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc [ 43.469563][ T6849] >ffff888093f3ac80: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 43.477602][ T6849] ^ [ 43.483470][ T6849] ffff888093f3ad00: 00 00 01 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 43.491504][ T6849] ffff888093f3ad80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 43.499542][ T6849] ================================================================== [ 43.507586][ T6849] Disabling lock debugging due to kernel taint [ 43.514096][ T6849] Kernel panic - not syncing: panic_on_warn set ... [ 43.520673][ T6849] CPU: 1 PID: 6849 Comm: syz-executor895 Tainted: G B 5.9.0-rc7-syzkaller #0 [ 43.530714][ T6849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.540750][ T6849] Call Trace: [ 43.544009][ T6849] dump_stack+0x1d6/0x29e [ 43.548328][ T6849] panic+0x2c0/0x800 [ 43.552192][ T6849] ? trace_hardirqs_on+0x30/0x80 [ 43.557096][ T6849] kasan_report+0x1c9/0x1d0 [ 43.561570][ T6849] ? squashfs_get_id+0xb9/0x1c0 [ 43.566386][ T6849] squashfs_get_id+0xb9/0x1c0 [ 43.571033][ T6849] squashfs_read_inode+0x19b/0x2170 [ 43.576201][ T6849] ? _raw_spin_unlock+0x24/0x40 [ 43.581019][ T6849] ? new_inode+0x1be/0x1d0 [ 43.585400][ T6849] squashfs_fill_super+0x1478/0x1790 [ 43.590654][ T6849] get_tree_bdev+0x3e9/0x5f0 [ 43.595208][ T6849] ? squashfs_reconfigure+0xa0/0xa0 [ 43.600372][ T6849] vfs_get_tree+0x88/0x270 [ 43.604755][ T6849] path_mount+0x179d/0x29e0 [ 43.609256][ T6849] __se_sys_mount+0x126/0x180 [ 43.613899][ T6849] do_syscall_64+0x31/0x70 [ 43.618283][ T6849] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 43.624148][ T6849] RIP: 0033:0x446d2a [ 43.628012][ T6849] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 43.647584][ T6849] RSP: 002b:00007ffeb1eba8b8 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 43.655966][ T6849] RAX: ffffffffffffffda RBX: 00007ffeb1eba910 RCX: 0000000000446d2a [ 43.663904][ T6849] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffeb1eba8d0 [ 43.671843][ T6849] RBP: 00007ffeb1eba8d0 R08: 00007ffeb1eba910 R09: 00007ffe00000015 [ 43.679805][ T6849] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 43.687753][ T6849] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 43.696966][ T6849] Kernel Offset: disabled [ 43.701275][ T6849] Rebooting in 86400 seconds..