[ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.88' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 27.714516] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 27.724540] REISERFS (device loop0): using ordered data mode [ 27.731230] reiserfs: using flush barriers [ 27.736312] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 27.752441] REISERFS (device loop0): checking transaction log (loop0) [ 27.760267] REISERFS (device loop0): Using rupasov hash to sort names [ 27.767342] ================================================================== [ 27.774728] BUG: KASAN: out-of-bounds in leaf_paste_entries+0x44b/0x9b0 [ 27.781455] Read of size 18446744073709551584 at addr ffff88808e96afa4 by task syz-executor100/7991 [ 27.790608] [ 27.792216] CPU: 1 PID: 7991 Comm: syz-executor100 Not tainted 4.14.295-syzkaller #0 [ 27.800068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 27.809815] Call Trace: [ 27.812390] dump_stack+0x1b2/0x281 [ 27.816001] print_address_description.cold+0x54/0x1d3 [ 27.821290] kasan_report_error.cold+0x8a/0x191 [ 27.825944] ? leaf_paste_entries+0x44b/0x9b0 [ 27.830416] kasan_report+0x6f/0x80 [ 27.834025] ? leaf_paste_entries+0x44b/0x9b0 [ 27.838504] memmove+0x20/0x50 [ 27.841675] leaf_paste_entries+0x44b/0x9b0 [ 27.845973] balance_leaf+0x827e/0xba30 [ 27.849926] ? replace_key+0x150/0x150 [ 27.853790] do_balance+0x282/0x630 [ 27.857392] ? get_right_neighbor_position+0x160/0x160 [ 27.862641] ? __mutex_unlock_slowpath+0x75/0x770 [ 27.867460] ? memset+0x20/0x40 [ 27.870717] reiserfs_paste_into_item+0x569/0x6f0 [ 27.875545] ? reiserfs_delete_object+0x1e0/0x1e0 [ 27.880386] ? __mutex_unlock_slowpath+0x23/0x770 [ 27.885244] ? search_by_entry_key+0xf50/0xf50 [ 27.889805] ? make_cpu_key+0x22/0x2a0 [ 27.893669] reiserfs_add_entry+0x7d3/0xbc0 [ 27.897965] ? reiserfs_lookup+0x400/0x400 [ 27.902174] ? __mutex_unlock_slowpath+0x23/0x770 [ 27.906990] ? wait_for_completion_io+0x10/0x10 [ 27.911649] reiserfs_mkdir+0x5ca/0x8b0 [ 27.915598] ? reiserfs_mknod+0x690/0x690 [ 27.919728] reiserfs_xattr_init+0x393/0xa50 [ 27.924111] reiserfs_fill_super+0x1d4a/0x2990 [ 27.928670] ? reiserfs_remount+0x1390/0x1390 [ 27.933142] ? lock_downgrade+0x740/0x740 [ 27.937271] ? snprintf+0xa5/0xd0 [ 27.940703] mount_bdev+0x2b3/0x360 [ 27.944322] ? reiserfs_remount+0x1390/0x1390 [ 27.948805] mount_fs+0x92/0x2a0 [ 27.952148] vfs_kern_mount.part.0+0x5b/0x470 [ 27.956616] do_mount+0xe65/0x2a30 [ 27.960141] ? do_raw_spin_unlock+0x164/0x220 [ 27.964612] ? copy_mount_string+0x40/0x40 [ 27.968820] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 27.973811] ? copy_mnt_ns+0xa30/0xa30 [ 27.977672] ? copy_mount_options+0x1fa/0x2f0 [ 27.982140] ? copy_mnt_ns+0xa30/0xa30 [ 27.986004] SyS_mount+0xa8/0x120 [ 27.989432] ? copy_mnt_ns+0xa30/0xa30 [ 27.993295] do_syscall_64+0x1d5/0x640 [ 27.997162] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.002498] RIP: 0033:0x7f9c8a21437a [ 28.006184] RSP: 002b:00007ffd7300fd38 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 28.013866] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f9c8a21437a [ 28.021108] RDX: 0000000020000000 RSI: 0000000020000180 RDI: 00007ffd7300fd50 [ 28.028456] RBP: 00007ffd7300fd50 R08: 00007ffd7300fd90 R09: 00005555570762c0 [ 28.035714] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 28.042964] R13: 00007ffd7300fd90 R14: 0000000000000006 R15: 0000000020000290 [ 28.050216] [ 28.051818] The buggy address belongs to the page: [ 28.056723] page:ffffea00023a5a80 count:3 mapcount:0 mapping:ffff8880b1972aa8 index:0x213 [ 28.065018] flags: 0xfff00000001044(referenced|active|private) [ 28.070966] raw: 00fff00000001044 ffff8880b1972aa8 0000000000000213 00000003ffffffff [ 28.078832] raw: dead000000000100 dead000000000200 ffff88808deea2a0 ffff88823b3288c0 [ 28.086693] page dumped because: kasan: bad access detected [ 28.092376] page->mem_cgroup:ffff88823b3288c0 [ 28.096844] [ 28.098446] Memory state around the buggy address: [ 28.103352] ffff88808e96ae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.110685] ffff88808e96af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.118018] >ffff88808e96af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.125356] ^ [ 28.129737] ffff88808e96b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.137068] ffff88808e96b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.144398] ================================================================== [ 28.151727] Disabling lock debugging due to kernel taint [ 28.157637] Kernel panic - not syncing: panic_on_warn set ... [ 28.157637] [ 28.164992] CPU: 1 PID: 7991 Comm: syz-executor100 Tainted: G B 4.14.295-syzkaller #0 [ 28.174076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 28.183411] Call Trace: [ 28.185972] dump_stack+0x1b2/0x281 [ 28.189572] panic+0x1f9/0x42d [ 28.192735] ? add_taint.cold+0x16/0x16 [ 28.196682] ? ___preempt_schedule+0x16/0x18 [ 28.201063] kasan_end_report+0x43/0x49 [ 28.205010] kasan_report_error.cold+0xa7/0x191 [ 28.209653] ? leaf_paste_entries+0x44b/0x9b0 [ 28.214118] kasan_report+0x6f/0x80 [ 28.217718] ? leaf_paste_entries+0x44b/0x9b0 [ 28.222186] memmove+0x20/0x50 [ 28.225357] leaf_paste_entries+0x44b/0x9b0 [ 28.229654] balance_leaf+0x827e/0xba30 [ 28.233602] ? replace_key+0x150/0x150 [ 28.237463] do_balance+0x282/0x630 [ 28.241064] ? get_right_neighbor_position+0x160/0x160 [ 28.246331] ? __mutex_unlock_slowpath+0x75/0x770 [ 28.251145] ? memset+0x20/0x40 [ 28.254486] reiserfs_paste_into_item+0x569/0x6f0 [ 28.259299] ? reiserfs_delete_object+0x1e0/0x1e0 [ 28.264122] ? __mutex_unlock_slowpath+0x23/0x770 [ 28.268938] ? search_by_entry_key+0xf50/0xf50 [ 28.273492] ? make_cpu_key+0x22/0x2a0 [ 28.277350] reiserfs_add_entry+0x7d3/0xbc0 [ 28.281646] ? reiserfs_lookup+0x400/0x400 [ 28.285853] ? __mutex_unlock_slowpath+0x23/0x770 [ 28.290665] ? wait_for_completion_io+0x10/0x10 [ 28.295313] reiserfs_mkdir+0x5ca/0x8b0 [ 28.299264] ? reiserfs_mknod+0x690/0x690 [ 28.303387] reiserfs_xattr_init+0x393/0xa50 [ 28.307767] reiserfs_fill_super+0x1d4a/0x2990 [ 28.313277] ? reiserfs_remount+0x1390/0x1390 [ 28.317743] ? lock_downgrade+0x740/0x740 [ 28.321863] ? snprintf+0xa5/0xd0 [ 28.325288] mount_bdev+0x2b3/0x360 [ 28.328889] ? reiserfs_remount+0x1390/0x1390 [ 28.333354] mount_fs+0x92/0x2a0 [ 28.336692] vfs_kern_mount.part.0+0x5b/0x470 [ 28.341161] do_mount+0xe65/0x2a30 [ 28.344672] ? do_raw_spin_unlock+0x164/0x220 [ 28.349138] ? copy_mount_string+0x40/0x40 [ 28.353344] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 28.358335] ? copy_mnt_ns+0xa30/0xa30 [ 28.362195] ? copy_mount_options+0x1fa/0x2f0 [ 28.366661] ? copy_mnt_ns+0xa30/0xa30 [ 28.370521] SyS_mount+0xa8/0x120 [ 28.373943] ? copy_mnt_ns+0xa30/0xa30 [ 28.377803] do_syscall_64+0x1d5/0x640 [ 28.381663] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.386824] RIP: 0033:0x7f9c8a21437a [ 28.390505] RSP: 002b:00007ffd7300fd38 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 28.398183] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f9c8a21437a [ 28.405425] RDX: 0000000020000000 RSI: 0000000020000180 RDI: 00007ffd7300fd50 [ 28.412666] RBP: 00007ffd7300fd50 R08: 00007ffd7300fd90 R09: 00005555570762c0 [ 28.419906] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 28.427151] R13: 00007ffd7300fd90 R14: 0000000000000006 R15: 0000000020000290 [ 28.434618] Kernel Offset: disabled [ 28.438223] Rebooting in 86400 seconds..