Warning: Permanently added '10.128.0.3' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 42.864339][ T3497] loop0: detected capacity change from 0 to 2048 [ 42.874102][ T3497] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 42.885527][ T3497] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 42.956550][ T3497] ================================================================== [ 42.964698][ T3497] BUG: KASAN: use-after-free in udf_close_lvid+0x6a4/0x9a0 [ 42.971898][ T3497] Write of size 1 at addr ffff8880b3b66980 by task syz-executor162/3497 [ 42.980192][ T3497] [ 42.982493][ T3497] CPU: 1 PID: 3497 Comm: syz-executor162 Not tainted 5.15.115-syzkaller #0 [ 42.991059][ T3497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 43.001089][ T3497] Call Trace: [ 43.004346][ T3497] [ 43.007254][ T3497] dump_stack_lvl+0x1e3/0x2cb [ 43.011907][ T3497] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 43.017520][ T3497] ? _printk+0xd1/0x111 [ 43.021647][ T3497] ? __wake_up_klogd+0xcc/0x100 [ 43.026470][ T3497] ? panic+0x84d/0x84d [ 43.030513][ T3497] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 43.035946][ T3497] print_address_description+0x63/0x3b0 [ 43.041469][ T3497] ? udf_close_lvid+0x6a4/0x9a0 [ 43.046293][ T3497] kasan_report+0x16b/0x1c0 [ 43.050772][ T3497] ? udf_close_lvid+0x6a4/0x9a0 [ 43.055692][ T3497] udf_close_lvid+0x6a4/0x9a0 [ 43.060346][ T3497] ? udf_open_lvid+0x5a0/0x5a0 [ 43.065091][ T3497] ? clear_inode+0x150/0x150 [ 43.069659][ T3497] udf_put_super+0xc9/0x160 [ 43.074141][ T3497] ? udf_free_in_core_inode+0x20/0x20 [ 43.079489][ T3497] generic_shutdown_super+0x136/0x2c0 [ 43.084834][ T3497] kill_block_super+0x7a/0xe0 [ 43.089488][ T3497] deactivate_locked_super+0xa0/0x110 [ 43.094847][ T3497] cleanup_mnt+0x44e/0x500 [ 43.099238][ T3497] ? lockdep_hardirqs_on+0x94/0x130 [ 43.104412][ T3497] task_work_run+0x129/0x1a0 [ 43.108983][ T3497] do_exit+0x6a3/0x2480 [ 43.113115][ T3497] ? put_task_struct+0x80/0x80 [ 43.117854][ T3497] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 43.123810][ T3497] ? vtime_user_exit+0x2d1/0x400 [ 43.128724][ T3497] do_group_exit+0x144/0x310 [ 43.133289][ T3497] __x64_sys_exit_group+0x3b/0x40 [ 43.138374][ T3497] do_syscall_64+0x3d/0xb0 [ 43.142764][ T3497] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.148628][ T3497] RIP: 0033:0x7eff21cadbf9 [ 43.153019][ T3497] Code: Unable to access opcode bytes at RIP 0x7eff21cadbcf. [ 43.160356][ T3497] RSP: 002b:00007ffc0c938698 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 43.168744][ T3497] RAX: ffffffffffffffda RBX: 00007eff21d42330 RCX: 00007eff21cadbf9 [ 43.176707][ T3497] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 43.185019][ T3497] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 0000000000000000 [ 43.192964][ T3497] R10: 0000000000000022 R11: 0000000000000246 R12: 00007eff21d42330 [ 43.201045][ T3497] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 43.208997][ T3497] [ 43.211997][ T3497] [ 43.214296][ T3497] The buggy address belongs to the page: [ 43.219894][ T3497] page:ffffea0002ced980 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb3b66 [ 43.230102][ T3497] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 43.237191][ T3497] raw: 00fff00000000000 ffffea0002ced988 ffffea0002ced988 0000000000000000 [ 43.245745][ T3497] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 43.254293][ T3497] page dumped because: kasan: bad access detected [ 43.260674][ T3497] page_owner info is not present (never set?) [ 43.266703][ T3497] [ 43.269003][ T3497] Memory state around the buggy address: [ 43.274601][ T3497] ffff8880b3b66880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 43.282631][ T3497] ffff8880b3b66900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 43.290680][ T3497] >ffff8880b3b66980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 43.298706][ T3497] ^ [ 43.302744][ T3497] ffff8880b3b66a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 43.310785][ T3497] ffff8880b3b66a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 43.318814][ T3497] ================================================================== [ 43.326840][ T3497] Disabling lock debugging due to kernel taint [ 43.333496][ T3497] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 43.340689][ T3497] CPU: 1 PID: 3497 Comm: syz-executor162 Tainted: G B 5.15.115-syzkaller #0 [ 43.350637][ T3497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 43.360662][ T3497] Call Trace: [ 43.363916][ T3497] [ 43.366821][ T3497] dump_stack_lvl+0x1e3/0x2cb [ 43.371473][ T3497] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 43.377078][ T3497] ? panic+0x84d/0x84d [ 43.381119][ T3497] ? rcu_is_watching+0x11/0xa0 [ 43.385852][ T3497] ? preempt_schedule_common+0xa6/0xd0 [ 43.391292][ T3497] panic+0x318/0x84d [ 43.395158][ T3497] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 43.401289][ T3497] ? check_panic_on_warn+0x1d/0xa0 [ 43.406371][ T3497] ? fb_is_primary_device+0xcc/0xcc [ 43.411552][ T3497] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 43.417501][ T3497] ? _raw_spin_unlock+0x40/0x40 [ 43.422324][ T3497] check_panic_on_warn+0x7e/0xa0 [ 43.427231][ T3497] ? udf_close_lvid+0x6a4/0x9a0 [ 43.432053][ T3497] end_report+0x6d/0xf0 [ 43.436182][ T3497] kasan_report+0x18e/0x1c0 [ 43.440658][ T3497] ? udf_close_lvid+0x6a4/0x9a0 [ 43.445480][ T3497] udf_close_lvid+0x6a4/0x9a0 [ 43.450132][ T3497] ? udf_open_lvid+0x5a0/0x5a0 [ 43.454870][ T3497] ? clear_inode+0x150/0x150 [ 43.459434][ T3497] udf_put_super+0xc9/0x160 [ 43.463915][ T3497] ? udf_free_in_core_inode+0x20/0x20 [ 43.469259][ T3497] generic_shutdown_super+0x136/0x2c0 [ 43.474604][ T3497] kill_block_super+0x7a/0xe0 [ 43.479262][ T3497] deactivate_locked_super+0xa0/0x110 [ 43.484606][ T3497] cleanup_mnt+0x44e/0x500 [ 43.488996][ T3497] ? lockdep_hardirqs_on+0x94/0x130 [ 43.494169][ T3497] task_work_run+0x129/0x1a0 [ 43.498734][ T3497] do_exit+0x6a3/0x2480 [ 43.502862][ T3497] ? put_task_struct+0x80/0x80 [ 43.507603][ T3497] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 43.513557][ T3497] ? vtime_user_exit+0x2d1/0x400 [ 43.518472][ T3497] do_group_exit+0x144/0x310 [ 43.523036][ T3497] __x64_sys_exit_group+0x3b/0x40 [ 43.528031][ T3497] do_syscall_64+0x3d/0xb0 [ 43.532424][ T3497] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.538288][ T3497] RIP: 0033:0x7eff21cadbf9 [ 43.542686][ T3497] Code: Unable to access opcode bytes at RIP 0x7eff21cadbcf. [ 43.550020][ T3497] RSP: 002b:00007ffc0c938698 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 43.558403][ T3497] RAX: ffffffffffffffda RBX: 00007eff21d42330 RCX: 00007eff21cadbf9 [ 43.566347][ T3497] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 43.574289][ T3497] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 0000000000000000 [ 43.582237][ T3497] R10: 0000000000000022 R11: 0000000000000246 R12: 00007eff21d42330 [ 43.590183][ T3497] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 43.598130][ T3497] [ 43.601193][ T3497] Kernel Offset: disabled [ 43.605500][ T3497] Rebooting in 86400 seconds..