Warning: Permanently added '10.128.0.160' (ED25519) to the list of known hosts. executing program [ 178.963537][ T5076] loop0: detected capacity change from 0 to 2048 [ 178.976931][ T5076] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 178.992191][ T5076] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 179.227233][ T5075] ================================================================== [ 179.235342][ T5075] BUG: KASAN: slab-use-after-free in crc_itu_t+0x1d5/0x2a0 [ 179.242728][ T5075] Read of size 1 at addr ffff88801c3cf000 by task syz-executor427/5075 [ 179.250974][ T5075] [ 179.253321][ T5075] CPU: 1 PID: 5075 Comm: syz-executor427 Not tainted 6.7.0-rc1-syzkaller-00019-gc42d9eeef8e5 #0 [ 179.263747][ T5075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 179.273798][ T5075] Call Trace: [ 179.277077][ T5075] [ 179.280006][ T5075] dump_stack_lvl+0x1e7/0x2d0 [ 179.284743][ T5075] ? nf_tcp_handle_invalid+0x650/0x650 [ 179.290229][ T5075] ? panic+0x850/0x850 [ 179.294309][ T5075] ? _printk+0xd5/0x120 [ 179.298486][ T5075] print_report+0x163/0x540 [ 179.303011][ T5075] ? ktime_get_real_ts64+0x470/0x470 [ 179.308345][ T5075] ? __mutex_lock+0x2ee/0xd60 [ 179.313065][ T5075] ? time64_to_tm+0x331/0x4d0 [ 179.317750][ T5075] ? __virt_addr_valid+0x22f/0x2e0 [ 179.322870][ T5075] ? __phys_addr+0xba/0x170 [ 179.327371][ T5075] ? crc_itu_t+0x1d5/0x2a0 [ 179.331788][ T5075] kasan_report+0x142/0x170 [ 179.336291][ T5075] ? crc_itu_t+0x1d5/0x2a0 [ 179.340718][ T5075] crc_itu_t+0x1d5/0x2a0 [ 179.344963][ T5075] udf_sync_fs+0x1d2/0x380 [ 179.349395][ T5075] ? udf_put_super+0x160/0x160 [ 179.354204][ T5075] ? get_nr_dirty_inodes+0x1c7/0x210 [ 179.359502][ T5075] sync_filesystem+0xec/0x220 [ 179.364178][ T5075] generic_shutdown_super+0x72/0x2c0 [ 179.369463][ T5075] kill_block_super+0x44/0x90 [ 179.374151][ T5075] deactivate_locked_super+0xc1/0x130 [ 179.379543][ T5075] cleanup_mnt+0x426/0x4c0 [ 179.383963][ T5075] ? _raw_spin_unlock_irq+0x23/0x50 [ 179.389218][ T5075] task_work_run+0x24a/0x300 [ 179.393826][ T5075] ? task_work_cancel+0x2b0/0x2b0 [ 179.398859][ T5075] ? exit_to_user_mode_loop+0x39/0x100 [ 179.404318][ T5075] exit_to_user_mode_loop+0xde/0x100 [ 179.409602][ T5075] exit_to_user_mode_prepare+0xb1/0x150 [ 179.415160][ T5075] syscall_exit_to_user_mode+0x69/0x2a0 [ 179.420725][ T5075] do_syscall_64+0x52/0x110 [ 179.425229][ T5075] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 179.431174][ T5075] RIP: 0033:0x7f92d0c965c7 [ 179.435585][ T5075] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 179.455187][ T5075] RSP: 002b:00007ffe648d3268 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 179.463613][ T5075] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f92d0c965c7 [ 179.471580][ T5075] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffe648d3320 [ 179.479543][ T5075] RBP: 00007ffe648d3320 R08: 0000000000000000 R09: 0000000000000000 [ 179.487506][ T5075] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffe648d4390 [ 179.495473][ T5075] R13: 0000555555cb46c0 R14: 431bde82d7b634db R15: 00007ffe648d43b0 [ 179.503443][ T5075] [ 179.506453][ T5075] [ 179.508763][ T5075] Allocated by task 4513: [ 179.513078][ T5075] kasan_set_track+0x4f/0x70 [ 179.517673][ T5075] __kasan_slab_alloc+0x66/0x70 [ 179.522515][ T5075] slab_post_alloc_hook+0x6c/0x3c0 [ 179.527624][ T5075] kmem_cache_alloc+0x19e/0x2b0 [ 179.532476][ T5075] vm_area_dup+0x61/0x280 [ 179.536806][ T5075] copy_mm+0xcea/0x1f10 [ 179.540950][ T5075] copy_process+0x1d6f/0x3fb0 [ 179.545619][ T5075] kernel_clone+0x222/0x840 [ 179.550114][ T5075] __x64_sys_clone+0x258/0x2a0 [ 179.554877][ T5075] do_syscall_64+0x45/0x110 [ 179.559381][ T5075] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 179.565269][ T5075] [ 179.567579][ T5075] Freed by task 5059: [ 179.571545][ T5075] kasan_set_track+0x4f/0x70 [ 179.576128][ T5075] kasan_save_free_info+0x28/0x40 [ 179.581146][ T5075] ____kasan_slab_free+0xd6/0x120 [ 179.586163][ T5075] kmem_cache_free+0x299/0x470 [ 179.590927][ T5075] __vm_area_free+0xe0/0x110 [ 179.595519][ T5075] exit_mmap+0x6bf/0xc60 [ 179.599782][ T5075] __mmput+0x115/0x3c0 [ 179.603839][ T5075] exit_mm+0x21f/0x300 [ 179.607927][ T5075] do_exit+0x9b7/0x2750 [ 179.612081][ T5075] do_group_exit+0x206/0x2c0 [ 179.616669][ T5075] __x64_sys_exit_group+0x3f/0x40 [ 179.621690][ T5075] do_syscall_64+0x45/0x110 [ 179.626216][ T5075] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 179.632168][ T5075] [ 179.634482][ T5075] The buggy address belongs to the object at ffff88801c3cf000 [ 179.634482][ T5075] which belongs to the cache vma_lock of size 152 [ 179.648268][ T5075] The buggy address is located 0 bytes inside of [ 179.648268][ T5075] freed 152-byte region [ffff88801c3cf000, ffff88801c3cf098) [ 179.661886][ T5075] [ 179.664203][ T5075] The buggy address belongs to the physical page: [ 179.670606][ T5075] page:ffffea000070f3c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c3cf [ 179.680758][ T5075] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 179.688311][ T5075] page_type: 0xffffffff() [ 179.692652][ T5075] raw: 00fff00000000800 ffff888014e51c80 dead000000000122 0000000000000000 [ 179.701231][ T5075] raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000 [ 179.709802][ T5075] page dumped because: kasan: bad access detected [ 179.716221][ T5075] page_owner tracks the page as allocated [ 179.721937][ T5075] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 4513, tgid 4513 (udevd), ts 105928353823, free_ts 62180883887 [ 179.739737][ T5075] post_alloc_hook+0x1e6/0x210 [ 179.744503][ T5075] get_page_from_freelist+0x33ea/0x3570 [ 179.750047][ T5075] __alloc_pages+0x255/0x680 [ 179.754636][ T5075] alloc_pages_mpol+0x3de/0x640 [ 179.759481][ T5075] alloc_slab_page+0x6a/0x170 [ 179.764149][ T5075] new_slab+0x84/0x2f0 [ 179.768216][ T5075] ___slab_alloc+0xc8a/0x1330 [ 179.772894][ T5075] kmem_cache_alloc+0x1e9/0x2b0 [ 179.777746][ T5075] vm_area_dup+0x61/0x280 [ 179.782075][ T5075] copy_mm+0xcea/0x1f10 [ 179.786244][ T5075] copy_process+0x1d6f/0x3fb0 [ 179.790924][ T5075] kernel_clone+0x222/0x840 [ 179.795437][ T5075] __x64_sys_clone+0x258/0x2a0 [ 179.800222][ T5075] do_syscall_64+0x45/0x110 [ 179.804718][ T5075] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 179.810634][ T5075] page last free stack trace: [ 179.815298][ T5075] free_unref_page_prepare+0x931/0xa60 [ 179.820755][ T5075] free_unref_page+0x37/0x3f0 [ 179.825423][ T5075] __unfreeze_partials+0x1e0/0x220 [ 179.830526][ T5075] put_cpu_partial+0x17b/0x250 [ 179.835289][ T5075] __slab_free+0x2b6/0x390 [ 179.839701][ T5075] qlist_free_all+0x75/0xe0 [ 179.844204][ T5075] kasan_quarantine_reduce+0x14b/0x160 [ 179.849668][ T5075] __kasan_slab_alloc+0x23/0x70 [ 179.854517][ T5075] slab_post_alloc_hook+0x6c/0x3c0 [ 179.859639][ T5075] kmem_cache_alloc+0x19e/0x2b0 [ 179.864494][ T5075] getname_flags+0xbc/0x4f0 [ 179.868997][ T5075] vfs_fstatat+0x11c/0x190 [ 179.873409][ T5075] __x64_sys_newfstatat+0x117/0x190 [ 179.878608][ T5075] do_syscall_64+0x45/0x110 [ 179.883110][ T5075] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 179.889018][ T5075] [ 179.891331][ T5075] Memory state around the buggy address: [ 179.896950][ T5075] ffff88801c3cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 179.905001][ T5075] ffff88801c3cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 179.913052][ T5075] >ffff88801c3cf000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 179.921202][ T5075] ^ [ 179.925290][ T5075] ffff88801c3cf080: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb [ 179.933351][ T5075] ffff88801c3cf100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 179.941405][ T5075] ================================================================== [ 179.950061][ T5075] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 179.957276][ T5075] CPU: 1 PID: 5075 Comm: syz-executor427 Not tainted 6.7.0-rc1-syzkaller-00019-gc42d9eeef8e5 #0 [ 179.967700][ T5075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 179.977781][ T5075] Call Trace: [ 179.981079][ T5075] [ 179.984013][ T5075] dump_stack_lvl+0x1e7/0x2d0 [ 179.988705][ T5075] ? nf_tcp_handle_invalid+0x650/0x650 [ 179.994168][ T5075] ? panic+0x850/0x850 [ 179.998242][ T5075] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 180.004231][ T5075] ? vscnprintf+0x5d/0x80 [ 180.008578][ T5075] panic+0x349/0x850 [ 180.012509][ T5075] ? check_panic_on_warn+0x21/0xa0 [ 180.018122][ T5075] ? __memcpy_flushcache+0x2b0/0x2b0 [ 180.023433][ T5075] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 180.029441][ T5075] ? _raw_spin_unlock+0x40/0x40 [ 180.034308][ T5075] check_panic_on_warn+0x82/0xa0 [ 180.039259][ T5075] ? crc_itu_t+0x1d5/0x2a0 [ 180.043687][ T5075] end_report+0x6e/0x140 [ 180.047941][ T5075] kasan_report+0x153/0x170 [ 180.052458][ T5075] ? crc_itu_t+0x1d5/0x2a0 [ 180.056885][ T5075] crc_itu_t+0x1d5/0x2a0 [ 180.061134][ T5075] udf_sync_fs+0x1d2/0x380 [ 180.065556][ T5075] ? udf_put_super+0x160/0x160 [ 180.070328][ T5075] ? get_nr_dirty_inodes+0x1c7/0x210 [ 180.075634][ T5075] sync_filesystem+0xec/0x220 [ 180.080314][ T5075] generic_shutdown_super+0x72/0x2c0 [ 180.085688][ T5075] kill_block_super+0x44/0x90 [ 180.090367][ T5075] deactivate_locked_super+0xc1/0x130 [ 180.095746][ T5075] cleanup_mnt+0x426/0x4c0 [ 180.100165][ T5075] ? _raw_spin_unlock_irq+0x23/0x50 [ 180.105375][ T5075] task_work_run+0x24a/0x300 [ 180.109979][ T5075] ? task_work_cancel+0x2b0/0x2b0 [ 180.115015][ T5075] ? exit_to_user_mode_loop+0x39/0x100 [ 180.120476][ T5075] exit_to_user_mode_loop+0xde/0x100 [ 180.125761][ T5075] exit_to_user_mode_prepare+0xb1/0x150 [ 180.131317][ T5075] syscall_exit_to_user_mode+0x69/0x2a0 [ 180.136874][ T5075] do_syscall_64+0x52/0x110 [ 180.141386][ T5075] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 180.147289][ T5075] RIP: 0033:0x7f92d0c965c7 [ 180.151707][ T5075] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 180.171336][ T5075] RSP: 002b:00007ffe648d3268 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 180.179758][ T5075] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f92d0c965c7 [ 180.187730][ T5075] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffe648d3320 [ 180.195701][ T5075] RBP: 00007ffe648d3320 R08: 0000000000000000 R09: 0000000000000000 [ 180.203671][ T5075] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffe648d4390 [ 180.211644][ T5075] R13: 0000555555cb46c0 R14: 431bde82d7b634db R15: 00007ffe648d43b0 [ 180.219643][ T5075] [ 180.222752][ T5075] Kernel Offset: disabled [ 180.227086][ T5075] Rebooting in 86400 seconds..