[ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.126' (ECDSA) to the list of known hosts. syzkaller login: [ 32.334970] IPVS: ftp: loaded support on port[0] = 21 executing program [ 32.400155] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 32.413664] audit: type=1800 audit(1673188538.478:2): pid=8079 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor367" name="bus" dev="loop0" ino=1357 res=0 [ 32.413766] ====================================================== [ 32.413766] WARNING: the mand mount option is being deprecated and [ 32.413766] will be removed in v5.15! [ 32.413766] ====================================================== [ 32.494288] ================================================================== [ 32.501771] BUG: KASAN: slab-out-of-bounds in udf_close_lvid+0x67c/0x770 [ 32.508686] Write of size 1 at addr ffff8880b1a5efa0 by task syz-executor367/8079 [ 32.516312] [ 32.517941] CPU: 1 PID: 8079 Comm: syz-executor367 Not tainted 4.19.211-syzkaller #0 [ 32.525813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 32.535149] Call Trace: [ 32.537723] dump_stack+0x1fc/0x2ef [ 32.541337] print_address_description.cold+0x54/0x219 [ 32.546597] kasan_report_error.cold+0x8a/0x1b9 [ 32.551247] ? udf_close_lvid+0x67c/0x770 [ 32.555376] __asan_report_store1_noabort+0x88/0x90 [ 32.560372] ? udf_close_lvid+0x67c/0x770 [ 32.564503] udf_close_lvid+0x67c/0x770 [ 32.568456] ? evict_inodes+0x341/0x430 [ 32.572408] ? udf_open_lvid+0x4f0/0x4f0 [ 32.576445] ? dispose_list+0x1f0/0x1f0 [ 32.580397] ? iput+0x16/0x860 [ 32.583568] udf_put_super+0x217/0x290 [ 32.587434] ? udf_sb_free_partitions.isra.0+0xba0/0xba0 [ 32.592864] generic_shutdown_super+0x144/0x370 [ 32.597512] kill_block_super+0x97/0xf0 [ 32.601488] deactivate_locked_super+0x94/0x160 [ 32.606147] deactivate_super+0x174/0x1a0 [ 32.610289] ? deactivate_locked_super+0x160/0x160 [ 32.615205] ? dput+0x31/0x640 [ 32.618381] cleanup_mnt+0x1a8/0x290 [ 32.622094] task_work_run+0x148/0x1c0 [ 32.625962] do_exit+0xbf3/0x2be0 [ 32.629427] ? lock_downgrade+0x720/0x720 [ 32.633553] ? mm_update_next_owner+0x650/0x650 [ 32.638201] ? up_read+0x17/0x110 [ 32.641635] ? __do_page_fault+0x180/0xd60 [ 32.645849] do_group_exit+0x125/0x310 [ 32.649717] __x64_sys_exit_group+0x3a/0x50 [ 32.654017] do_syscall_64+0xf9/0x620 [ 32.657803] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.662974] RIP: 0033:0x7fea65218b59 [ 32.666785] Code: Bad RIP value. [ 32.670132] RSP: 002b:00007ffdd300e188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 32.677828] RAX: ffffffffffffffda RBX: 00007fea6528e350 RCX: 00007fea65218b59 [ 32.685148] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 32.692412] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007fea65288e40 [ 32.699675] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fea6528e350 [ 32.706931] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 32.714188] [ 32.715797] Allocated by task 1: [ 32.719147] kmem_cache_alloc+0x122/0x370 [ 32.723274] __d_alloc+0x2b/0xa10 [ 32.726728] d_alloc+0x4a/0x230 [ 32.729986] d_alloc_parallel+0xeb/0x19e0 [ 32.734237] __lookup_slow+0x18d/0x4a0 [ 32.738111] walk_component+0x7ac/0xda0 [ 32.742158] path_lookupat+0x1ff/0x8d0 [ 32.746029] filename_lookup+0x1ac/0x5a0 [ 32.750075] vfs_statx+0x113/0x210 [ 32.753594] __se_sys_newlstat+0x96/0x120 [ 32.757722] do_syscall_64+0xf9/0x620 [ 32.761500] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.766660] [ 32.768266] Freed by task 18: [ 32.771357] kmem_cache_free+0x7f/0x260 [ 32.775312] rcu_process_callbacks+0x8ff/0x18b0 [ 32.779959] __do_softirq+0x265/0x980 [ 32.783729] [ 32.785337] The buggy address belongs to the object at ffff8880b1a5ee00 [ 32.785337] which belongs to the cache dentry of size 288 [ 32.797536] The buggy address is located 128 bytes to the right of [ 32.797536] 288-byte region [ffff8880b1a5ee00, ffff8880b1a5ef20) [ 32.809902] The buggy address belongs to the page: [ 32.814818] page:ffffea0002c69780 count:1 mapcount:0 mapping:ffff88813be45200 index:0x0 [ 32.822942] flags: 0xfff00000000100(slab) [ 32.827071] raw: 00fff00000000100 ffffea0002c6a308 ffffea0002c6a348 ffff88813be45200 [ 32.834931] raw: 0000000000000000 ffff8880b1a5e040 000000010000000b 0000000000000000 [ 32.842792] page dumped because: kasan: bad access detected [ 32.848478] [ 32.850083] Memory state around the buggy address: [ 32.855012] ffff8880b1a5ee80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.862350] ffff8880b1a5ef00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 32.869702] >ffff8880b1a5ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.877035] ^ [ 32.881420] ffff8880b1a5f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.888753] ffff8880b1a5f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.896082] ================================================================== [ 32.903413] Disabling lock debugging due to kernel taint [ 32.909177] Kernel panic - not syncing: panic_on_warn set ... [ 32.909177] [ 32.916559] CPU: 1 PID: 8079 Comm: syz-executor367 Tainted: G B 4.19.211-syzkaller #0 [ 32.925823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 32.935176] Call Trace: [ 32.937761] dump_stack+0x1fc/0x2ef [ 32.941367] panic+0x26a/0x50e [ 32.944543] ? __warn_printk+0xf3/0xf3 [ 32.948405] ? preempt_schedule_common+0x45/0xc0 [ 32.953138] ? ___preempt_schedule+0x16/0x18 [ 32.957526] ? trace_hardirqs_on+0x55/0x210 [ 32.961826] kasan_end_report+0x43/0x49 [ 32.965781] kasan_report_error.cold+0xa7/0x1b9 [ 32.970427] ? udf_close_lvid+0x67c/0x770 [ 32.974562] __asan_report_store1_noabort+0x88/0x90 [ 32.979561] ? udf_close_lvid+0x67c/0x770 [ 32.983691] udf_close_lvid+0x67c/0x770 [ 32.987655] ? evict_inodes+0x341/0x430 [ 32.991614] ? udf_open_lvid+0x4f0/0x4f0 [ 32.995653] ? dispose_list+0x1f0/0x1f0 [ 32.999602] ? iput+0x16/0x860 [ 33.002773] udf_put_super+0x217/0x290 [ 33.006639] ? udf_sb_free_partitions.isra.0+0xba0/0xba0 [ 33.012067] generic_shutdown_super+0x144/0x370 [ 33.016716] kill_block_super+0x97/0xf0 [ 33.020667] deactivate_locked_super+0x94/0x160 [ 33.025358] deactivate_super+0x174/0x1a0 [ 33.029485] ? deactivate_locked_super+0x160/0x160 [ 33.034390] ? dput+0x31/0x640 [ 33.037562] cleanup_mnt+0x1a8/0x290 [ 33.041261] task_work_run+0x148/0x1c0 [ 33.045126] do_exit+0xbf3/0x2be0 [ 33.048555] ? lock_downgrade+0x720/0x720 [ 33.052686] ? mm_update_next_owner+0x650/0x650 [ 33.057334] ? up_read+0x17/0x110 [ 33.060767] ? __do_page_fault+0x180/0xd60 [ 33.065003] do_group_exit+0x125/0x310 [ 33.068882] __x64_sys_exit_group+0x3a/0x50 [ 33.073294] do_syscall_64+0xf9/0x620 [ 33.077078] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.082247] RIP: 0033:0x7fea65218b59 [ 33.085941] Code: Bad RIP value. [ 33.089279] RSP: 002b:00007ffdd300e188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 33.096964] RAX: ffffffffffffffda RBX: 00007fea6528e350 RCX: 00007fea65218b59 [ 33.104210] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 33.111459] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007fea65288e40 [ 33.118709] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007fea6528e350 [ 33.125963] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 33.133390] Kernel Offset: disabled [ 33.136998] Rebooting in 86400 seconds..