Warning: Permanently added '10.128.1.62' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 67.753721][ T8480] loop0: detected capacity change from 0 to 4096 [ 67.781971][ T8480] ================================================================== [ 67.790275][ T8480] BUG: KASAN: slab-out-of-bounds in squashfs_get_id+0x1ae/0x1d0 [ 67.797942][ T8480] Read of size 8 at addr ffff8880128d9330 by task syz-executor227/8480 [ 67.806185][ T8480] [ 67.808534][ T8480] CPU: 0 PID: 8480 Comm: syz-executor227 Not tainted 5.10.0-rc5-next-20201126-syzkaller #0 [ 67.819347][ T8480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.829425][ T8480] Call Trace: [ 67.832809][ T8480] dump_stack+0x107/0x163 [ 67.837152][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 67.842087][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 67.847014][ T8480] print_address_description.constprop.0.cold+0x5b/0x2f8 [ 67.854028][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 67.858973][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 67.863898][ T8480] kasan_report.cold+0x79/0xd5 [ 67.868655][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 67.873590][ T8480] squashfs_get_id+0x1ae/0x1d0 [ 67.878356][ T8480] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 67.884774][ T8480] ? squashfs_read_metadata+0x2f9/0x460 [ 67.890345][ T8480] squashfs_read_inode+0x1b4/0x1b40 [ 67.895896][ T8480] ? find_held_lock+0x2d/0x110 [ 67.900650][ T8480] ? squashfs_read_id_index_table+0x120/0x120 [ 67.906816][ T8480] ? new_inode+0x23b/0x2f0 [ 67.911240][ T8480] ? lock_downgrade+0x6d0/0x6d0 [ 67.916168][ T8480] ? do_raw_spin_lock+0x120/0x2b0 [ 67.921898][ T8480] ? rwlock_bug.part.0+0x90/0x90 [ 67.926921][ T8480] ? do_raw_spin_unlock+0x171/0x230 [ 67.932225][ T8480] ? _raw_spin_unlock+0x24/0x40 [ 67.937600][ T8480] ? new_inode+0x240/0x2f0 [ 67.942161][ T8480] squashfs_fill_super+0x1140/0x23b0 [ 67.947597][ T8480] get_tree_bdev+0x421/0x740 [ 67.952264][ T8480] ? init_once+0x20/0x20 [ 67.958673][ T8480] vfs_get_tree+0x89/0x2f0 [ 67.963099][ T8480] path_mount+0x12ae/0x1e70 [ 67.967613][ T8480] ? strncpy_from_user+0x2a0/0x3e0 [ 67.972728][ T8480] ? finish_automount+0xac0/0xac0 [ 67.977740][ T8480] ? getname_flags.part.0+0x1dd/0x4f0 [ 67.983217][ T8480] __x64_sys_mount+0x27f/0x300 [ 67.988410][ T8480] ? copy_mnt_ns+0xae0/0xae0 [ 67.993022][ T8480] ? syscall_enter_from_user_mode+0x1d/0x50 [ 67.998912][ T8480] do_syscall_64+0x2d/0x70 [ 68.003343][ T8480] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.009542][ T8480] RIP: 0033:0x446d2a [ 68.013430][ T8480] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 68.033034][ T8480] RSP: 002b:00007fff297de278 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 68.041460][ T8480] RAX: ffffffffffffffda RBX: 00007fff297de2d0 RCX: 0000000000446d2a [ 68.049441][ T8480] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff297de290 [ 68.057427][ T8480] RBP: 00007fff297de290 R08: 00007fff297de2d0 R09: 00007fff00000015 [ 68.065411][ T8480] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 68.073397][ T8480] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 68.081425][ T8480] [ 68.083745][ T8480] Allocated by task 8480: [ 68.088086][ T8480] kasan_save_stack+0x1b/0x40 [ 68.092852][ T8480] ____kasan_kmalloc.constprop.0+0xa0/0xd0 [ 68.098654][ T8480] squashfs_read_table+0x43/0x1e0 [ 68.105364][ T8480] squashfs_read_inode_lookup_table+0xa9/0x120 [ 68.111520][ T8480] squashfs_fill_super+0xeba/0x23b0 [ 68.116766][ T8480] get_tree_bdev+0x421/0x740 [ 68.121451][ T8480] vfs_get_tree+0x89/0x2f0 [ 68.125947][ T8480] path_mount+0x12ae/0x1e70 [ 68.130455][ T8480] __x64_sys_mount+0x27f/0x300 [ 68.135216][ T8480] do_syscall_64+0x2d/0x70 [ 68.139732][ T8480] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.145783][ T8480] [ 68.148104][ T8480] The buggy address belongs to the object at ffff8880128d9320 [ 68.148104][ T8480] which belongs to the cache kmalloc-8 of size 8 [ 68.161893][ T8480] The buggy address is located 8 bytes to the right of [ 68.161893][ T8480] 8-byte region [ffff8880128d9320, ffff8880128d9328) [ 68.175361][ T8480] The buggy address belongs to the page: [ 68.181016][ T8480] page:00000000882c01b9 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880128d9050 pfn:0x128d9 [ 68.192479][ T8480] flags: 0xfff00000000200(slab) [ 68.197416][ T8480] raw: 00fff00000000200 ffffea00004c7dc0 0000001e0000001e ffff888010041c80 [ 68.206010][ T8480] raw: ffff8880128d9050 0000000080660062 00000001ffffffff 0000000000000000 [ 68.215015][ T8480] page dumped because: kasan: bad access detected [ 68.221436][ T8480] [ 68.223749][ T8480] Memory state around the buggy address: [ 68.229372][ T8480] ffff8880128d9200: fc fa fc fc fc fc fa fc fc fc fc fa fc fc fc fc [ 68.237709][ T8480] ffff8880128d9280: fb fc fc fc fc fb fc fc fc fc 00 fc fc fc fc 00 [ 68.246470][ T8480] >ffff8880128d9300: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc fa fc [ 68.254522][ T8480] ^ [ 68.260139][ T8480] ffff8880128d9380: fc fc fc fa fc fc fc fc 00 fc fc fc fc fa fc fc [ 68.268186][ T8480] ffff8880128d9400: fc fc fa fc fc fc fc fa fc fc fc fc 00 fc fc fc [ 68.276234][ T8480] ================================================================== [ 68.284730][ T8480] Disabling lock debugging due to kernel taint [ 68.292681][ T8480] Kernel panic - not syncing: panic_on_warn set ... [ 68.299296][ T8480] CPU: 1 PID: 8480 Comm: syz-executor227 Tainted: G B 5.10.0-rc5-next-20201126-syzkaller #0 [ 68.310658][ T8480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.320714][ T8480] Call Trace: [ 68.324029][ T8480] dump_stack+0x107/0x163 [ 68.328362][ T8480] ? squashfs_get_id+0x170/0x1d0 [ 68.333296][ T8480] panic+0x306/0x73d [ 68.337202][ T8480] ? __warn_printk+0xf3/0xf3 [ 68.341786][ T8480] ? preempt_schedule_common+0x59/0xc0 [ 68.347249][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 68.352210][ T8480] ? preempt_schedule_thunk+0x16/0x18 [ 68.357574][ T8480] ? trace_hardirqs_on+0x51/0x1c0 [ 68.362589][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 68.367519][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 68.372448][ T8480] end_report+0x58/0x5e [ 68.376624][ T8480] kasan_report.cold+0x67/0xd5 [ 68.381389][ T8480] ? squashfs_get_id+0x1ae/0x1d0 [ 68.386321][ T8480] squashfs_get_id+0x1ae/0x1d0 [ 68.391090][ T8480] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 68.397517][ T8480] ? squashfs_read_metadata+0x2f9/0x460 [ 68.403944][ T8480] squashfs_read_inode+0x1b4/0x1b40 [ 68.409160][ T8480] ? find_held_lock+0x2d/0x110 [ 68.413936][ T8480] ? squashfs_read_id_index_table+0x120/0x120 [ 68.420002][ T8480] ? new_inode+0x23b/0x2f0 [ 68.424435][ T8480] ? lock_downgrade+0x6d0/0x6d0 [ 68.429277][ T8480] ? do_raw_spin_lock+0x120/0x2b0 [ 68.434294][ T8480] ? rwlock_bug.part.0+0x90/0x90 [ 68.439226][ T8480] ? do_raw_spin_unlock+0x171/0x230 [ 68.444509][ T8480] ? _raw_spin_unlock+0x24/0x40 [ 68.449357][ T8480] ? new_inode+0x240/0x2f0 [ 68.453772][ T8480] squashfs_fill_super+0x1140/0x23b0 [ 68.459063][ T8480] get_tree_bdev+0x421/0x740 [ 68.463647][ T8480] ? init_once+0x20/0x20 [ 68.467883][ T8480] vfs_get_tree+0x89/0x2f0 [ 68.472292][ T8480] path_mount+0x12ae/0x1e70 [ 68.476790][ T8480] ? strncpy_from_user+0x2a0/0x3e0 [ 68.481897][ T8480] ? finish_automount+0xac0/0xac0 [ 68.486916][ T8480] ? getname_flags.part.0+0x1dd/0x4f0 [ 68.492287][ T8480] __x64_sys_mount+0x27f/0x300 [ 68.497047][ T8480] ? copy_mnt_ns+0xae0/0xae0 [ 68.501635][ T8480] ? syscall_enter_from_user_mode+0x1d/0x50 [ 68.507529][ T8480] do_syscall_64+0x2d/0x70 [ 68.511946][ T8480] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.517846][ T8480] RIP: 0033:0x446d2a [ 68.521754][ T8480] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 68.541373][ T8480] RSP: 002b:00007fff297de278 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 68.549788][ T8480] RAX: ffffffffffffffda RBX: 00007fff297de2d0 RCX: 0000000000446d2a [ 68.557765][ T8480] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff297de290 [ 68.565752][ T8480] RBP: 00007fff297de290 R08: 00007fff297de2d0 R09: 00007fff00000015 [ 68.573734][ T8480] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 68.581701][ T8480] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 68.590139][ T8480] Kernel Offset: disabled [ 68.594505][ T8480] Rebooting in 86400 seconds..