Warning: Permanently added '10.128.10.52' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 34.644693] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 34.651475] UDF-fs: Scanning with blocksize 512 failed [ 34.661427] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 34.668966] UDF-fs: Scanning with blocksize 1024 failed [ 34.675082] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 34.681735] UDF-fs: Scanning with blocksize 2048 failed [ 34.689547] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 34.707310] ================================================================== [ 34.714781] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x847/0x860 [ 34.721622] Write of size 4 at addr ffff888094c62af8 by task syz-executor254/8102 [ 34.729235] [ 34.730847] CPU: 0 PID: 8102 Comm: syz-executor254 Not tainted 4.19.211-syzkaller #0 [ 34.738704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 34.748038] Call Trace: [ 34.750614] dump_stack+0x1fc/0x2ef [ 34.754237] print_address_description.cold+0x54/0x219 [ 34.759506] kasan_report_error.cold+0x8a/0x1b9 [ 34.764172] ? udf_write_aext+0x847/0x860 [ 34.768302] __asan_report_store_n_noabort+0x8b/0xa0 [ 34.773388] ? udf_get_pblock_spar15+0x131/0x4a0 [ 34.778123] ? udf_write_aext+0x847/0x860 [ 34.782338] udf_write_aext+0x847/0x860 [ 34.786294] udf_add_entry+0xdab/0x2a20 [ 34.790395] ? udf_write_fi+0xf40/0xf40 [ 34.794351] ? udf_new_inode+0xa7b/0xf30 [ 34.798398] udf_mkdir+0x145/0x650 [ 34.801927] ? map_id_up+0x178/0x2f0 [ 34.805625] ? udf_create+0x180/0x180 [ 34.809429] ? putname+0xe1/0x120 [ 34.812860] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 34.817886] ? generic_permission+0x116/0x4d0 [ 34.822368] ? security_inode_permission+0xc5/0xf0 [ 34.827277] ? inode_permission.part.0+0x10c/0x450 [ 34.832196] vfs_mkdir+0x508/0x7a0 [ 34.835719] do_mkdirat+0x262/0x2d0 [ 34.839346] ? __ia32_sys_mknod+0x120/0x120 [ 34.843654] ? trace_hardirqs_off_caller+0x6e/0x210 [ 34.848649] ? do_syscall_64+0x21/0x620 [ 34.852606] do_syscall_64+0xf9/0x620 [ 34.856393] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.861560] RIP: 0033:0x7f3ba877cad9 [ 34.865263] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 34.884142] RSP: 002b:00007ffeac158948 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 34.891843] RAX: ffffffffffffffda RBX: 2f30656c69662f2e RCX: 00007f3ba877cad9 [ 34.899098] RDX: 0000000000000030 RSI: 0000000000000101 RDI: 0000000020000040 [ 34.906344] RBP: 00007f3ba873c0e0 R08: 0000000000000000 R09: 0000000000000000 [ 34.913596] R10: 00000000000018a0 R11: 0000000000000246 R12: 00007f3ba873c170 [ 34.920843] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 34.928096] [ 34.929704] Allocated by task 8102: [ 34.933313] __kmalloc+0x15a/0x3c0 [ 34.936833] udf_new_inode+0xbb3/0xf30 [ 34.940699] udf_mkdir+0xa8/0x650 [ 34.944131] vfs_mkdir+0x508/0x7a0 [ 34.947667] do_mkdirat+0x262/0x2d0 [ 34.951273] do_syscall_64+0xf9/0x620 [ 34.955051] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.960212] [ 34.961829] Freed by task 6367: [ 34.965097] kfree+0xcc/0x210 [ 34.968181] kvfree+0x59/0x60 [ 34.971267] single_release+0x75/0xb0 [ 34.975047] close_pdeo.part.0+0xda/0x2f0 [ 34.979171] proc_reg_release+0x21e/0x270 [ 34.983301] __fput+0x2ce/0x890 [ 34.986559] task_work_run+0x148/0x1c0 [ 34.990424] exit_to_usermode_loop+0x251/0x2a0 [ 34.994985] do_syscall_64+0x538/0x620 [ 34.998853] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.004015] [ 35.005633] The buggy address belongs to the object at ffff888094c62b00 [ 35.005633] which belongs to the cache kmalloc-4096 of size 4096 [ 35.018441] The buggy address is located 8 bytes to the left of [ 35.018441] 4096-byte region [ffff888094c62b00, ffff888094c63b00) [ 35.030635] The buggy address belongs to the page: [ 35.035540] page:ffffea0002531880 count:1 mapcount:0 mapping:ffff88813bff0dc0 index:0x0 compound_mapcount: 0 [ 35.045481] flags: 0xfff00000008100(slab|head) [ 35.050047] raw: 00fff00000008100 ffffea0002c14a88 ffffea000254ca88 ffff88813bff0dc0 [ 35.057905] raw: 0000000000000000 ffff888094c62b00 0000000100000001 0000000000000000 [ 35.065755] page dumped because: kasan: bad access detected [ 35.071436] [ 35.073036] Memory state around the buggy address: [ 35.077941] ffff888094c62980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.085276] ffff888094c62a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.092613] >ffff888094c62a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.099946] ^ [ 35.107191] ffff888094c62b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.114524] ffff888094c62b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.121852] ================================================================== [ 35.129187] Disabling lock debugging due to kernel taint [ 35.139099] Kernel panic - not syncing: panic_on_warn set ... [ 35.139099] [ 35.146481] CPU: 0 PID: 8102 Comm: syz-executor254 Tainted: G B 4.19.211-syzkaller #0 [ 35.155743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 35.165081] Call Trace: [ 35.167646] dump_stack+0x1fc/0x2ef [ 35.171251] panic+0x26a/0x50e [ 35.174422] ? __warn_printk+0xf3/0xf3 [ 35.178288] ? preempt_schedule_common+0x45/0xc0 [ 35.183023] ? ___preempt_schedule+0x16/0x18 [ 35.187409] ? trace_hardirqs_on+0x55/0x210 [ 35.191711] kasan_end_report+0x43/0x49 [ 35.195666] kasan_report_error.cold+0xa7/0x1b9 [ 35.200314] ? udf_write_aext+0x847/0x860 [ 35.204439] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.209517] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.214251] ? udf_write_aext+0x847/0x860 [ 35.218404] udf_write_aext+0x847/0x860 [ 35.222356] udf_add_entry+0xdab/0x2a20 [ 35.226308] ? udf_write_fi+0xf40/0xf40 [ 35.230259] ? udf_new_inode+0xa7b/0xf30 [ 35.234297] udf_mkdir+0x145/0x650 [ 35.237820] ? map_id_up+0x178/0x2f0 [ 35.241535] ? udf_create+0x180/0x180 [ 35.245313] ? putname+0xe1/0x120 [ 35.248742] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 35.253750] ? generic_permission+0x116/0x4d0 [ 35.258224] ? security_inode_permission+0xc5/0xf0 [ 35.263131] ? inode_permission.part.0+0x10c/0x450 [ 35.268036] vfs_mkdir+0x508/0x7a0 [ 35.271551] do_mkdirat+0x262/0x2d0 [ 35.275155] ? __ia32_sys_mknod+0x120/0x120 [ 35.279452] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.284460] ? do_syscall_64+0x21/0x620 [ 35.288502] do_syscall_64+0xf9/0x620 [ 35.292375] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.297540] RIP: 0033:0x7f3ba877cad9 [ 35.301231] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.320123] RSP: 002b:00007ffeac158948 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 35.327808] RAX: ffffffffffffffda RBX: 2f30656c69662f2e RCX: 00007f3ba877cad9 [ 35.335057] RDX: 0000000000000030 RSI: 0000000000000101 RDI: 0000000020000040 [ 35.342305] RBP: 00007f3ba873c0e0 R08: 0000000000000000 R09: 0000000000000000 [ 35.349557] R10: 00000000000018a0 R11: 0000000000000246 R12: 00007f3ba873c170 [ 35.356819] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 35.364242] Kernel Offset: disabled [ 35.367848] Rebooting in 86400 seconds..