Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.112' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 36.293463] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 36.310855] audit: type=1800 audit(1669398228.037:2): pid=8128 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor590" name=789CECDD4F6C1CD77D07F0DF1B922229B715133B8ADDC6C5A62D5299B15CFD8BA95885BBAA69B601649908C5DC02704552EAC214499054231B69C1F4D2430F018AA2879C08B44681140D8CA6087A645B17482E3E1439F544B4B011143DB045809C020633FB565C5294458BA444DA9F8F4D7D6767DF9B796F663C230B7AF302 dev="loop0" ino=1318 res=0 [ 36.311267] ================================================================== [ 36.359370] BUG: KASAN: slab-out-of-bounds in udf_find_entry+0xa33/0x1070 [ 36.366319] Write of size 165 at addr ffff8880abf84bda by task syz-executor590/8128 [ 36.374113] [ 36.375757] CPU: 1 PID: 8128 Comm: syz-executor590 Not tainted 4.19.211-syzkaller #0 [ 36.383645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 36.393009] Call Trace: [ 36.395603] dump_stack+0x1fc/0x2ef [ 36.399224] print_address_description.cold+0x54/0x219 [ 36.404490] kasan_report_error.cold+0x8a/0x1b9 [ 36.409172] ? udf_find_entry+0xa33/0x1070 [ 36.413487] kasan_report+0x8f/0xa0 [ 36.417109] ? rcu_read_lock_sched_held+0xa1/0x1d0 [ 36.422028] ? udf_find_entry+0xa33/0x1070 [ 36.426275] memcpy+0x35/0x50 [ 36.429362] udf_find_entry+0xa33/0x1070 [ 36.433407] ? empty_dir+0x7e0/0x7e0 [ 36.437101] ? __d_lookup_rcu+0x382/0x6b0 [ 36.441241] ? check_preemption_disabled+0x41/0x280 [ 36.446374] ? common_perm+0x4be/0x800 [ 36.450294] ? apparmor_file_open+0xc90/0xc90 [ 36.454789] udf_lookup+0x156/0x270 [ 36.458697] ? udf_tmpfile+0x190/0x190 [ 36.462576] ? userns_put+0xb0/0xb0 [ 36.466187] ? apparmor_path_mknod+0x16a/0x240 [ 36.471095] ? param_get_aalockpolicy+0x90/0x90 [ 36.475888] ? security_inode_permission+0xc5/0xf0 [ 36.480813] ? inode_permission.part.0+0x10c/0x450 [ 36.485737] ? security_inode_create+0xd6/0x100 [ 36.490401] ? udf_tmpfile+0x190/0x190 [ 36.494290] lookup_open+0x698/0x1a20 [ 36.498090] ? vfs_mkdir+0x7a0/0x7a0 [ 36.501788] ? unlazy_walk+0x1a4/0x540 [ 36.505666] ? check_preemption_disabled+0x41/0x280 [ 36.510779] path_openat+0x1094/0x2df0 [ 36.514668] ? path_lookupat+0x8d0/0x8d0 [ 36.518726] ? mark_held_locks+0xf0/0xf0 [ 36.522862] ? check_preemption_disabled+0x41/0x280 [ 36.527862] do_filp_open+0x18c/0x3f0 [ 36.531642] ? may_open_dev+0xf0/0xf0 [ 36.535426] ? lock_downgrade+0x720/0x720 [ 36.539556] ? lock_acquire+0x170/0x3c0 [ 36.543517] ? __alloc_fd+0x34/0x570 [ 36.547311] ? do_raw_spin_unlock+0x171/0x230 [ 36.551793] ? _raw_spin_unlock+0x29/0x40 [ 36.555920] ? __alloc_fd+0x28d/0x570 [ 36.559712] do_sys_open+0x3b3/0x520 [ 36.563418] ? filp_open+0x70/0x70 [ 36.566948] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 36.572310] ? trace_hardirqs_off_caller+0x6e/0x210 [ 36.577436] ? do_syscall_64+0x21/0x620 [ 36.581465] do_syscall_64+0xf9/0x620 [ 36.585311] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.590514] RIP: 0033:0x7f142f503639 [ 36.594317] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 36.613866] RSP: 002b:00007ffcdfef57c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 36.621772] RAX: ffffffffffffffda RBX: 00007ffcdfef57d8 RCX: 00007f142f503639 [ 36.629020] RDX: 00007f142f503639 RSI: 0000000000000000 RDI: 0000000020000000 [ 36.636357] RBP: 00007ffcdfef57d0 R08: 00007ffcdfef57d0 R09: 00007f142f4c0960 [ 36.643612] R10: 00007ffcdfef57d0 R11: 0000000000000246 R12: 0000000000000000 [ 36.650876] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 36.658133] [ 36.659742] Allocated by task 8128: [ 36.663363] kmem_cache_alloc_trace+0x12f/0x380 [ 36.668645] udf_find_entry+0xa82/0x1070 [ 36.672709] udf_lookup+0x156/0x270 [ 36.676323] lookup_open+0x698/0x1a20 [ 36.680104] path_openat+0x1094/0x2df0 [ 36.683971] do_filp_open+0x18c/0x3f0 [ 36.688631] do_sys_open+0x3b3/0x520 [ 36.692326] do_syscall_64+0xf9/0x620 [ 36.696113] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.701370] [ 36.702994] Freed by task 6416: [ 36.706264] kfree+0xcc/0x210 [ 36.709363] __do_execve_file+0x187a/0x2360 [ 36.713673] do_execve+0x35/0x50 [ 36.717032] call_usermodehelper_exec_async+0x50e/0x6a0 [ 36.722400] ret_from_fork+0x24/0x30 [ 36.726107] [ 36.727720] The buggy address belongs to the object at ffff8880abf84b80 [ 36.727720] which belongs to the cache kmalloc-256 of size 256 [ 36.740378] The buggy address is located 90 bytes inside of [ 36.740378] 256-byte region [ffff8880abf84b80, ffff8880abf84c80) [ 36.752159] The buggy address belongs to the page: [ 36.757082] page:ffffea0002afe100 count:1 mapcount:0 mapping:ffff88813bff07c0 index:0xffff8880abf84cc0 [ 36.766643] flags: 0xfff00000000100(slab) [ 36.770786] raw: 00fff00000000100 ffffea0002adaf48 ffffea0002ac0308 ffff88813bff07c0 [ 36.778815] raw: ffff8880abf84cc0 ffff8880abf84040 0000000100000003 0000000000000000 [ 36.786773] page dumped because: kasan: bad access detected [ 36.792554] [ 36.794177] Memory state around the buggy address: [ 36.799098] ffff8880abf84b00: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 36.806540] ffff8880abf84b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.813894] >ffff8880abf84c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 [ 36.821252] ^ [ 36.828507] ffff8880abf84c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 36.835844] ffff8880abf84d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.843182] ================================================================== [ 36.850522] Disabling lock debugging due to kernel taint [ 36.856947] Kernel panic - not syncing: panic_on_warn set ... [ 36.856947] [ 36.864338] CPU: 1 PID: 8128 Comm: syz-executor590 Tainted: G B 4.19.211-syzkaller #0 [ 36.873615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 36.882972] Call Trace: [ 36.885566] dump_stack+0x1fc/0x2ef [ 36.889207] panic+0x26a/0x50e [ 36.892924] ? __warn_printk+0xf3/0xf3 [ 36.896806] ? preempt_schedule_common+0x45/0xc0 [ 36.901553] ? ___preempt_schedule+0x16/0x18 [ 36.905953] ? trace_hardirqs_on+0x55/0x210 [ 36.910273] kasan_end_report+0x43/0x49 [ 36.914238] kasan_report_error.cold+0xa7/0x1b9 [ 36.918895] ? udf_find_entry+0xa33/0x1070 [ 36.923111] kasan_report+0x8f/0xa0 [ 36.926720] ? rcu_read_lock_sched_held+0xa1/0x1d0 [ 36.931626] ? udf_find_entry+0xa33/0x1070 [ 36.935844] memcpy+0x35/0x50 [ 36.938933] udf_find_entry+0xa33/0x1070 [ 36.942973] ? empty_dir+0x7e0/0x7e0 [ 36.946665] ? __d_lookup_rcu+0x382/0x6b0 [ 36.950795] ? check_preemption_disabled+0x41/0x280 [ 36.955791] ? common_perm+0x4be/0x800 [ 36.959677] ? apparmor_file_open+0xc90/0xc90 [ 36.964580] udf_lookup+0x156/0x270 [ 36.968221] ? udf_tmpfile+0x190/0x190 [ 36.972104] ? userns_put+0xb0/0xb0 [ 36.975738] ? apparmor_path_mknod+0x16a/0x240 [ 36.980349] ? param_get_aalockpolicy+0x90/0x90 [ 36.985009] ? security_inode_permission+0xc5/0xf0 [ 36.990014] ? inode_permission.part.0+0x10c/0x450 [ 36.994938] ? security_inode_create+0xd6/0x100 [ 36.999592] ? udf_tmpfile+0x190/0x190 [ 37.003466] lookup_open+0x698/0x1a20 [ 37.007253] ? vfs_mkdir+0x7a0/0x7a0 [ 37.011116] ? unlazy_walk+0x1a4/0x540 [ 37.015001] ? check_preemption_disabled+0x41/0x280 [ 37.020009] path_openat+0x1094/0x2df0 [ 37.023880] ? path_lookupat+0x8d0/0x8d0 [ 37.027920] ? mark_held_locks+0xf0/0xf0 [ 37.031957] ? check_preemption_disabled+0x41/0x280 [ 37.036957] do_filp_open+0x18c/0x3f0 [ 37.040735] ? may_open_dev+0xf0/0xf0 [ 37.044517] ? lock_downgrade+0x720/0x720 [ 37.048639] ? lock_acquire+0x170/0x3c0 [ 37.052588] ? __alloc_fd+0x34/0x570 [ 37.056280] ? do_raw_spin_unlock+0x171/0x230 [ 37.060759] ? _raw_spin_unlock+0x29/0x40 [ 37.064887] ? __alloc_fd+0x28d/0x570 [ 37.068670] do_sys_open+0x3b3/0x520 [ 37.072366] ? filp_open+0x70/0x70 [ 37.075887] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 37.081245] ? trace_hardirqs_off_caller+0x6e/0x210 [ 37.086269] ? do_syscall_64+0x21/0x620 [ 37.090229] do_syscall_64+0xf9/0x620 [ 37.094012] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 37.099187] RIP: 0033:0x7f142f503639 [ 37.102883] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 37.124023] RSP: 002b:00007ffcdfef57c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 37.131711] RAX: ffffffffffffffda RBX: 00007ffcdfef57d8 RCX: 00007f142f503639 [ 37.139566] RDX: 00007f142f503639 RSI: 0000000000000000 RDI: 0000000020000000 [ 37.146905] RBP: 00007ffcdfef57d0 R08: 00007ffcdfef57d0 R09: 00007f142f4c0960 [ 37.154183] R10: 00007ffcdfef57d0 R11: 0000000000000246 R12: 0000000000000000 [ 37.161453] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 37.168891] Kernel Offset: disabled [ 37.172520] Rebooting in 86400 seconds..