Warning: Permanently added '10.128.0.22' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 28.243635] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 28.270968] ================================================================== [ 28.278402] BUG: KASAN: use-after-free in udf_get_filelongad+0x111/0x120 [ 28.285231] Read of size 4 at addr ffff888094231a18 by task syz-executor833/7967 [ 28.292752] [ 28.294356] CPU: 1 PID: 7967 Comm: syz-executor833 Not tainted 4.14.300-syzkaller #0 [ 28.302208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 28.311542] Call Trace: [ 28.314107] dump_stack+0x1b2/0x281 [ 28.317709] print_address_description.cold+0x54/0x1d3 [ 28.322958] kasan_report_error.cold+0x8a/0x191 [ 28.327600] ? udf_get_filelongad+0x111/0x120 [ 28.332074] __asan_report_load_n_noabort+0x6b/0x80 [ 28.337064] ? udf_get_filelongad+0x111/0x120 [ 28.341530] udf_get_filelongad+0x111/0x120 [ 28.345826] udf_current_aext+0x183/0x8b0 [ 28.349960] udf_next_aext+0x1f5/0x360 [ 28.353833] udf_setsize+0x69f/0xe90 [ 28.357522] ? inode_bmap+0x730/0x730 [ 28.361298] ? current_time+0x16/0xb0 [ 28.365074] ? mark_held_locks+0xa6/0xf0 [ 28.369111] ? current_kernel_time64+0x17c/0x230 [ 28.373845] ? inode_newsize_ok+0x145/0x1c0 [ 28.378143] ? setattr_prepare+0xbe/0x530 [ 28.382267] ? udf_file_write_iter+0x470/0x470 [ 28.386820] udf_setattr+0xd2/0x130 [ 28.390420] notify_change+0x56b/0xd10 [ 28.394282] do_truncate+0xff/0x1a0 [ 28.397881] ? finish_open+0x170/0x170 [ 28.401746] ? apparmor_path_truncate+0x163/0x1d0 [ 28.406572] do_sys_ftruncate.constprop.0+0x3a3/0x480 [ 28.411735] ? compat_SyS_truncate+0x40/0x40 [ 28.416118] do_syscall_64+0x1d5/0x640 [ 28.419983] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 28.425148] [ 28.426748] Allocated by task 6061: [ 28.430355] kasan_kmalloc+0xeb/0x160 [ 28.434130] __kmalloc_node_track_caller+0x4c/0x70 [ 28.439032] __alloc_skb+0x96/0x510 [ 28.442630] kobject_uevent_env+0x882/0xf30 [ 28.446921] kobject_synth_uevent+0x5b6/0x6d0 [ 28.451387] uevent_store+0x21/0x60 [ 28.454983] dev_attr_store+0x56/0x80 [ 28.458761] sysfs_kf_write+0x106/0x160 [ 28.462704] kernfs_fop_write+0x289/0x440 [ 28.466827] __vfs_write+0xe4/0x630 [ 28.470424] vfs_write+0x17f/0x4d0 [ 28.473933] SyS_write+0xf2/0x210 [ 28.477359] do_syscall_64+0x1d5/0x640 [ 28.481216] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 28.486376] [ 28.487975] Freed by task 4628: [ 28.491232] kasan_slab_free+0xc3/0x1a0 [ 28.495175] kfree+0xc9/0x250 [ 28.498249] skb_release_data+0x5f6/0x820 [ 28.502367] consume_skb+0xe0/0x380 [ 28.505963] skb_free_datagram+0x16/0xe0 [ 28.510002] netlink_recvmsg+0x535/0xce0 [ 28.514033] sock_recvmsg+0xc0/0x100 [ 28.517714] ___sys_recvmsg+0x20b/0x4d0 [ 28.521658] __sys_recvmsg+0xa0/0x120 [ 28.525430] SyS_recvmsg+0x27/0x40 [ 28.528945] do_syscall_64+0x1d5/0x640 [ 28.532801] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 28.537956] [ 28.539557] The buggy address belongs to the object at ffff888094231840 [ 28.539557] which belongs to the cache kmalloc-512 of size 512 [ 28.552182] The buggy address is located 472 bytes inside of [ 28.552182] 512-byte region [ffff888094231840, ffff888094231a40) [ 28.564023] The buggy address belongs to the page: [ 28.568924] page:ffffea0002508c40 count:1 mapcount:0 mapping:ffff8880942310c0 index:0x0 [ 28.577034] flags: 0xfff00000000100(slab) [ 28.581152] raw: 00fff00000000100 ffff8880942310c0 0000000000000000 0000000100000006 [ 28.589001] raw: ffffea00028ec6e0 ffffea00028c3520 ffff88813fe74940 0000000000000000 [ 28.596849] page dumped because: kasan: bad access detected [ 28.602611] [ 28.604295] Memory state around the buggy address: [ 28.609282] ffff888094231900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.616622] ffff888094231980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.623958] >ffff888094231a00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.631393] ^ [ 28.635515] ffff888094231a80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 28.642845] ffff888094231b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.650172] ================================================================== [ 28.657497] Disabling lock debugging due to kernel taint [ 28.663445] Kernel panic - not syncing: panic_on_warn set ... [ 28.663445] [ 28.670794] CPU: 1 PID: 7967 Comm: syz-executor833 Tainted: G B 4.14.300-syzkaller #0 [ 28.679869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 28.689201] Call Trace: [ 28.691762] dump_stack+0x1b2/0x281 [ 28.695362] panic+0x1f9/0x42d [ 28.698527] ? add_taint.cold+0x16/0x16 [ 28.702475] ? ___preempt_schedule+0x16/0x18 [ 28.706854] kasan_end_report+0x43/0x49 [ 28.710798] kasan_report_error.cold+0xa7/0x191 [ 28.715441] ? udf_get_filelongad+0x111/0x120 [ 28.719907] __asan_report_load_n_noabort+0x6b/0x80 [ 28.724895] ? udf_get_filelongad+0x111/0x120 [ 28.729446] udf_get_filelongad+0x111/0x120 [ 28.733740] udf_current_aext+0x183/0x8b0 [ 28.737860] udf_next_aext+0x1f5/0x360 [ 28.741720] udf_setsize+0x69f/0xe90 [ 28.745408] ? inode_bmap+0x730/0x730 [ 28.749181] ? current_time+0x16/0xb0 [ 28.752953] ? mark_held_locks+0xa6/0xf0 [ 28.756984] ? current_kernel_time64+0x17c/0x230 [ 28.761752] ? inode_newsize_ok+0x145/0x1c0 [ 28.766047] ? setattr_prepare+0xbe/0x530 [ 28.770170] ? udf_file_write_iter+0x470/0x470 [ 28.774729] udf_setattr+0xd2/0x130 [ 28.778326] notify_change+0x56b/0xd10 [ 28.782191] do_truncate+0xff/0x1a0 [ 28.785788] ? finish_open+0x170/0x170 [ 28.789645] ? apparmor_path_truncate+0x163/0x1d0 [ 28.794456] do_sys_ftruncate.constprop.0+0x3a3/0x480 [ 28.799614] ? compat_SyS_truncate+0x40/0x40 [ 28.803994] do_syscall_64+0x1d5/0x640 [ 28.807853] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 28.813176] Kernel Offset: disabled [ 28.816778] Rebooting in 86400 seconds..