Warning: Permanently added '10.128.0.57' (ECDSA) to the list of known hosts. executing program [ 586.984393][ T3535] loop0: detected capacity change from 0 to 2048 [ 586.999677][ T3535] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) executing program [ 587.557565][ T3539] loop0: detected capacity change from 0 to 2048 [ 587.570480][ T3539] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) executing program [ 588.074221][ T3541] loop0: detected capacity change from 0 to 2048 [ 588.089512][ T3541] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 588.484734][ T3534] ================================================================== [ 588.493047][ T3534] BUG: KASAN: use-after-free in udf_close_lvid+0x6a4/0x9a0 [ 588.500422][ T3534] Write of size 1 at addr ffff8880b559b068 by task syz-executor817/3534 [ 588.508829][ T3534] [ 588.511276][ T3534] CPU: 0 PID: 3534 Comm: syz-executor817 Not tainted 5.15.112-syzkaller #0 [ 588.519853][ T3534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 [ 588.529897][ T3534] Call Trace: [ 588.533169][ T3534] [ 588.536091][ T3534] dump_stack_lvl+0x1e3/0x2cb [ 588.540859][ T3534] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 588.546501][ T3534] ? _printk+0xd1/0x111 [ 588.550657][ T3534] ? __wake_up_klogd+0xcc/0x100 [ 588.555553][ T3534] ? panic+0x84d/0x84d [ 588.559615][ T3534] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 588.565290][ T3534] print_address_description+0x63/0x3b0 [ 588.571039][ T3534] ? udf_close_lvid+0x6a4/0x9a0 [ 588.575887][ T3534] kasan_report+0x16b/0x1c0 [ 588.580385][ T3534] ? udf_close_lvid+0x6a4/0x9a0 [ 588.585233][ T3534] udf_close_lvid+0x6a4/0x9a0 [ 588.589907][ T3534] ? hook_inode_free_security+0xa0/0xa0 [ 588.596046][ T3534] ? udf_open_lvid+0x5a0/0x5a0 [ 588.600885][ T3534] ? iput+0x367/0x8b0 [ 588.604936][ T3534] ? clear_inode+0x150/0x150 [ 588.609533][ T3534] udf_put_super+0xc9/0x160 [ 588.614033][ T3534] ? udf_free_in_core_inode+0x20/0x20 [ 588.619413][ T3534] generic_shutdown_super+0x136/0x2c0 [ 588.624862][ T3534] kill_block_super+0x7a/0xe0 [ 588.629627][ T3534] deactivate_locked_super+0xa0/0x110 [ 588.634995][ T3534] cleanup_mnt+0x44e/0x500 [ 588.639439][ T3534] ? lockdep_hardirqs_on+0x94/0x130 [ 588.644638][ T3534] task_work_run+0x129/0x1a0 [ 588.649365][ T3534] exit_to_user_mode_loop+0x106/0x130 [ 588.654762][ T3534] exit_to_user_mode_prepare+0xb1/0x140 [ 588.660319][ T3534] syscall_exit_to_user_mode+0x5d/0x250 [ 588.665877][ T3534] do_syscall_64+0x49/0xb0 [ 588.670303][ T3534] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 588.676189][ T3534] RIP: 0033:0x7f2756b14007 [ 588.680599][ T3534] Code: 08 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 588.700205][ T3534] RSP: 002b:00007fffcef8eb58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 588.708617][ T3534] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2756b14007 [ 588.716579][ T3534] RDX: 00007fffcef8ec19 RSI: 000000000000000a RDI: 00007fffcef8ec10 [ 588.724543][ T3534] RBP: 00007fffcef8ec10 R08: 00000000ffffffff R09: 00007fffcef8e9f0 [ 588.732505][ T3534] R10: 000055555700e66b R11: 0000000000000202 R12: 00007fffcef8fc80 [ 588.740554][ T3534] R13: 000055555700e5f0 R14: 00007fffcef8eb80 R15: 0000000000000003 [ 588.748739][ T3534] [ 588.751746][ T3534] [ 588.754064][ T3534] The buggy address belongs to the page: [ 588.759677][ T3534] page:ffffea0002d566c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb559b [ 588.769828][ T3534] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 588.776931][ T3534] raw: 00fff00000000000 ffffea0002d566c8 ffffea0002d566c8 0000000000000000 [ 588.785500][ T3534] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 588.794062][ T3534] page dumped because: kasan: bad access detected [ 588.800494][ T3534] page_owner info is not present (never set?) [ 588.806542][ T3534] [ 588.808851][ T3534] Memory state around the buggy address: [ 588.814473][ T3534] ffff8880b559af00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 588.822519][ T3534] ffff8880b559af80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 588.830562][ T3534] >ffff8880b559b000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 588.838691][ T3534] ^ [ 588.846148][ T3534] ffff8880b559b080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 588.854195][ T3534] ffff8880b559b100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 588.862251][ T3534] ================================================================== [ 588.870289][ T3534] Disabling lock debugging due to kernel taint [ 588.877147][ T3534] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 588.884357][ T3534] CPU: 0 PID: 3534 Comm: syz-executor817 Tainted: G B 5.15.112-syzkaller #0 [ 588.894354][ T3534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 [ 588.904403][ T3534] Call Trace: [ 588.907686][ T3534] [ 588.910603][ T3534] dump_stack_lvl+0x1e3/0x2cb [ 588.915273][ T3534] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 588.920914][ T3534] ? panic+0x84d/0x84d [ 588.924997][ T3534] ? rcu_is_watching+0x11/0xa0 [ 588.929812][ T3534] ? preempt_schedule_common+0xa6/0xd0 [ 588.935264][ T3534] panic+0x318/0x84d [ 588.939177][ T3534] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 588.945363][ T3534] ? check_panic_on_warn+0x1d/0xa0 [ 588.950485][ T3534] ? fb_is_primary_device+0xcc/0xcc [ 588.955764][ T3534] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 588.961816][ T3534] ? _raw_spin_unlock+0x40/0x40 [ 588.966655][ T3534] check_panic_on_warn+0x7e/0xa0 [ 588.971580][ T3534] ? udf_close_lvid+0x6a4/0x9a0 [ 588.976419][ T3534] end_report+0x6d/0xf0 [ 588.980564][ T3534] kasan_report+0x18e/0x1c0 [ 588.985057][ T3534] ? udf_close_lvid+0x6a4/0x9a0 [ 588.989912][ T3534] udf_close_lvid+0x6a4/0x9a0 [ 588.994600][ T3534] ? hook_inode_free_security+0xa0/0xa0 [ 589.000149][ T3534] ? udf_open_lvid+0x5a0/0x5a0 [ 589.004906][ T3534] ? iput+0x367/0x8b0 [ 589.008907][ T3534] ? clear_inode+0x150/0x150 [ 589.013486][ T3534] udf_put_super+0xc9/0x160 [ 589.017978][ T3534] ? udf_free_in_core_inode+0x20/0x20 [ 589.023338][ T3534] generic_shutdown_super+0x136/0x2c0 [ 589.028718][ T3534] kill_block_super+0x7a/0xe0 [ 589.033383][ T3534] deactivate_locked_super+0xa0/0x110 [ 589.038741][ T3534] cleanup_mnt+0x44e/0x500 [ 589.043167][ T3534] ? lockdep_hardirqs_on+0x94/0x130 [ 589.048360][ T3534] task_work_run+0x129/0x1a0 [ 589.052943][ T3534] exit_to_user_mode_loop+0x106/0x130 [ 589.058302][ T3534] exit_to_user_mode_prepare+0xb1/0x140 [ 589.063835][ T3534] syscall_exit_to_user_mode+0x5d/0x250 [ 589.069387][ T3534] do_syscall_64+0x49/0xb0 [ 589.073790][ T3534] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 589.079670][ T3534] RIP: 0033:0x7f2756b14007 [ 589.084072][ T3534] Code: 08 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 589.103665][ T3534] RSP: 002b:00007fffcef8eb58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 589.112066][ T3534] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2756b14007 [ 589.120023][ T3534] RDX: 00007fffcef8ec19 RSI: 000000000000000a RDI: 00007fffcef8ec10 [ 589.127995][ T3534] RBP: 00007fffcef8ec10 R08: 00000000ffffffff R09: 00007fffcef8e9f0 [ 589.135976][ T3534] R10: 000055555700e66b R11: 0000000000000202 R12: 00007fffcef8fc80 [ 589.143944][ T3534] R13: 000055555700e5f0 R14: 00007fffcef8eb80 R15: 0000000000000003 [ 589.151917][ T3534] [ 589.155191][ T3534] Kernel Offset: disabled [ 589.159521][ T3534] Rebooting in 86400 seconds..