Warning: Permanently added '10.128.0.3' (ECDSA) to the list of known hosts. executing program [ 36.635254] ================================================================== [ 36.642733] BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x7ad/0x880 [ 36.650084] Read of size 4 at addr ffff8801d7ad4914 by task syz-executor062/5391 [ 36.657598] [ 36.659214] CPU: 1 PID: 5391 Comm: syz-executor062 Not tainted 4.19.0-rc8+ #285 [ 36.666645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.675986] Call Trace: [ 36.678568] dump_stack+0x1c4/0x2b4 [ 36.682190] ? dump_stack_print_info.cold.2+0x52/0x52 [ 36.687372] ? printk+0xa7/0xcf [ 36.690657] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 36.695409] print_address_description.cold.8+0x9/0x1ff [ 36.700764] kasan_report.cold.9+0x242/0x309 [ 36.705161] ? fscache_alloc_cookie+0x7ad/0x880 [ 36.709819] __asan_report_load4_noabort+0x14/0x20 [ 36.714745] fscache_alloc_cookie+0x7ad/0x880 [ 36.719245] ? fscache_cookie_init_once+0x80/0x80 [ 36.724095] ? rpcauth_cache_shrink_scan+0x180/0x180 [ 36.729189] ? __kmalloc_track_caller+0x14a/0x750 [ 36.734020] ? kstrdup+0x39/0x70 [ 36.737377] ? nfs_alloc_client+0x383/0x760 [ 36.741682] ? nfs_get_client+0x8e8/0x14d0 [ 36.745905] ? nfs_init_server+0x357/0x1010 [ 36.750214] ? nfs_create_server+0x86/0x5f0 [ 36.754529] ? nfs_fs_mount+0x17f8/0x2f1c [ 36.758683] ? mount_fs+0xae/0x31d [ 36.762212] ? vfs_kern_mount.part.35+0xdc/0x4f0 [ 36.766957] ? do_mount+0x581/0x31f0 [ 36.770656] ? ksys_mount+0x12d/0x140 [ 36.774443] ? __x64_sys_mount+0xbe/0x150 [ 36.778581] ? do_syscall_64+0x1b9/0x820 [ 36.782648] __fscache_acquire_cookie+0x230/0xb60 [ 36.787499] ? fscache_cookie_put+0x880/0x880 [ 36.791995] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.797549] ? check_preemption_disabled+0x48/0x200 [ 36.802561] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 36.808085] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 36.813350] ? rcu_pm_notify+0xc0/0xc0 [ 36.817227] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.822769] nfs_fscache_get_client_cookie+0x463/0x600 [ 36.828035] ? nfs_readpage_from_fscache_complete+0x200/0x200 [ 36.833931] nfs_alloc_client+0x563/0x760 [ 36.838083] ? register_nfs_version+0x280/0x280 [ 36.842754] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 36.847346] nfs_get_client+0x8e8/0x14d0 [ 36.851398] ? kmem_cache_alloc_trace+0x152/0x750 [ 36.856251] ? mount_fs+0xae/0x31d [ 36.859787] ? nfs_put_client+0x30/0x30 [ 36.863761] ? nfs_alloc_server+0x5ca/0x730 [ 36.868087] ? depot_save_stack+0x292/0x470 [ 36.872398] ? nfs_wait_client_init_complete+0x210/0x210 [ 36.877842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.883372] ? check_preemption_disabled+0x48/0x200 [ 36.888389] ? check_preemption_disabled+0x48/0x200 [ 36.893395] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 36.898571] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 36.904099] nfs_init_server+0x357/0x1010 [ 36.908241] ? nfs_clone_server+0x920/0x920 [ 36.912553] ? nfs_alloc_fattr+0x48/0x1d0 [ 36.916699] ? rcu_read_lock_sched_held+0x108/0x120 [ 36.921730] nfs_create_server+0x86/0x5f0 [ 36.925876] nfs_try_mount+0x180/0xa80 [ 36.929762] ? lock_downgrade+0x900/0x900 [ 36.933901] ? nfs_request_mount.constprop.18+0x920/0x920 [ 36.939430] ? kasan_check_read+0x11/0x20 [ 36.943568] ? do_raw_spin_unlock+0xa7/0x2f0 [ 36.947965] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 36.952538] ? kasan_check_write+0x14/0x20 [ 36.956766] ? do_raw_spin_lock+0xc1/0x200 [ 36.960989] ? _raw_spin_unlock+0x2c/0x50 [ 36.965145] ? find_nfs_version+0x138/0x190 [ 36.969458] nfs_fs_mount+0x17f8/0x2f1c [ 36.973450] ? nfs_show_options+0x250/0x250 [ 36.977769] ? nfs_clone_super+0x420/0x420 [ 36.981990] ? nfs_parse_mount_options+0x2660/0x2660 [ 36.987083] ? lock_downgrade+0x900/0x900 [ 36.991223] mount_fs+0xae/0x31d [ 36.994592] vfs_kern_mount.part.35+0xdc/0x4f0 [ 36.999176] ? may_umount+0xb0/0xb0 [ 37.002790] ? _raw_read_unlock+0x2c/0x50 [ 37.006943] ? __get_fs_type+0x97/0xc0 [ 37.010824] do_mount+0x581/0x31f0 [ 37.014356] ? copy_mount_string+0x40/0x40 [ 37.018585] ? copy_mount_options+0x5f/0x380 [ 37.022985] ? rcu_read_lock_sched_held+0x108/0x120 [ 37.028010] ? kmem_cache_alloc_trace+0x353/0x750 [ 37.032845] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 37.038372] ? _copy_from_user+0xdf/0x150 [ 37.042514] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.048037] ? copy_mount_options+0x288/0x380 [ 37.052521] ksys_mount+0x12d/0x140 [ 37.056135] __x64_sys_mount+0xbe/0x150 [ 37.060104] do_syscall_64+0x1b9/0x820 [ 37.063980] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 37.069330] ? syscall_return_slowpath+0x5e0/0x5e0 [ 37.074252] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.079086] ? trace_hardirqs_on_caller+0x310/0x310 [ 37.084092] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 37.089095] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.094621] ? prepare_exit_to_usermode+0x291/0x3b0 [ 37.099628] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.104464] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 37.109655] RIP: 0033:0x440129 [ 37.112840] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 37.131746] RSP: 002b:00007fff15a74048 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 37.139447] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000440129 [ 37.146708] RDX: 000000002015bffc RSI: 0000000020343ff8 RDI: 00000000208deff8 [ 37.153971] RBP: 00000000006ca018 R08: 000000002000a000 R09: 0000000000000000 [ 37.161227] R10: 0000000000000000 R11: 0000000000000286 R12: 00000000004019b0 [ 37.168503] R13: 0000000000401a40 R14: 0000000000000000 R15: 0000000000000000 [ 37.175772] [ 37.177385] Allocated by task 5391: [ 37.181003] save_stack+0x43/0xd0 [ 37.184443] kasan_kmalloc+0xc7/0xe0 [ 37.188141] __kmalloc+0x14e/0x760 [ 37.191671] fscache_alloc_cookie+0x6f7/0x880 [ 37.196154] __fscache_acquire_cookie+0x230/0xb60 [ 37.200998] nfs_fscache_get_client_cookie+0x463/0x600 [ 37.206267] nfs_alloc_client+0x563/0x760 [ 37.210417] nfs_get_client+0x8e8/0x14d0 [ 37.214482] nfs_init_server+0x357/0x1010 [ 37.218619] nfs_create_server+0x86/0x5f0 [ 37.222760] nfs_try_mount+0x180/0xa80 [ 37.226635] nfs_fs_mount+0x17f8/0x2f1c [ 37.230594] mount_fs+0xae/0x31d [ 37.233952] vfs_kern_mount.part.35+0xdc/0x4f0 [ 37.238520] do_mount+0x581/0x31f0 [ 37.242046] ksys_mount+0x12d/0x140 [ 37.245673] __x64_sys_mount+0xbe/0x150 [ 37.249634] do_syscall_64+0x1b9/0x820 [ 37.253512] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 37.258685] [ 37.260309] Freed by task 1: [ 37.263315] save_stack+0x43/0xd0 [ 37.266751] __kasan_slab_free+0x102/0x150 [ 37.270977] kasan_slab_free+0xe/0x10 [ 37.274765] kfree+0xcf/0x230 [ 37.277865] acpi_ns_get_node_unlocked+0x2b9/0x309 [ 37.282792] acpi_ns_get_node+0x4d/0x6b [ 37.286753] acpi_ns_evaluate+0xf3/0x9bc [ 37.290802] acpi_ut_evaluate_object+0x12b/0x425 [ 37.295543] acpi_ut_execute_power_methods+0xf1/0x22a [ 37.300749] acpi_get_object_info+0x6ac/0xd1b [ 37.305243] acpi_init_device_object+0x12a0/0x1e20 [ 37.310160] acpi_add_single_object+0x1d2/0x1ed0 [ 37.314922] acpi_bus_check_add+0x5e0/0xb10 [ 37.319233] acpi_ns_walk_namespace+0x224/0x400 [ 37.323906] acpi_walk_namespace+0xf2/0x12c [ 37.328222] acpi_bus_scan+0x146/0x170 [ 37.332106] acpi_scan_init+0x403/0x8fe [ 37.336067] acpi_init+0x941/0xa19 [ 37.339593] do_one_initcall+0x145/0x957 [ 37.343641] kernel_init_freeable+0x4bb/0x5ae [ 37.348124] kernel_init+0x11/0x1b2 [ 37.351743] ret_from_fork+0x3a/0x50 [ 37.355438] [ 37.357056] The buggy address belongs to the object at ffff8801d7ad4900 [ 37.357056] which belongs to the cache kmalloc-32 of size 32 [ 37.369704] The buggy address is located 20 bytes inside of [ 37.369704] 32-byte region [ffff8801d7ad4900, ffff8801d7ad4920) [ 37.381402] The buggy address belongs to the page: [ 37.386320] page:ffffea00075eb500 count:1 mapcount:0 mapping:ffff8801da8001c0 index:0xffff8801d7ad4fc1 [ 37.395753] flags: 0x2fffc0000000100(slab) [ 37.399979] raw: 02fffc0000000100 ffffea00075ea688 ffff8801da801238 ffff8801da8001c0 [ 37.407867] raw: ffff8801d7ad4fc1 ffff8801d7ad4000 0000000100000038 0000000000000000 [ 37.415735] page dumped because: kasan: bad access detected [ 37.421442] [ 37.423052] Memory state around the buggy address: [ 37.427966] ffff8801d7ad4800: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 37.435311] ffff8801d7ad4880: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 37.442655] >ffff8801d7ad4900: 00 00 06 fc fc fc fc fc 01 fc fc fc fc fc fc fc [ 37.449997] ^ [ 37.453870] ffff8801d7ad4980: 01 fc fc fc fc fc fc fc 01 fc fc fc fc fc fc fc [ 37.461211] ffff8801d7ad4a00: 01 fc fc fc fc fc fc fc 04 fc fc fc fc fc fc fc [ 37.468551] ================================================================== [ 37.475906] Disabling lock debugging due to kernel taint [ 37.481721] Kernel panic - not syncing: panic_on_warn set ... [ 37.481721] [ 37.489133] CPU: 1 PID: 5391 Comm: syz-executor062 Tainted: G B 4.19.0-rc8+ #285 [ 37.497970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.507318] Call Trace: [ 37.509899] dump_stack+0x1c4/0x2b4 [ 37.513514] ? dump_stack_print_info.cold.2+0x52/0x52 [ 37.518694] panic+0x238/0x4e7 [ 37.521879] ? add_taint.cold.5+0x16/0x16 [ 37.526020] ? preempt_schedule+0x4d/0x60 [ 37.530154] ? ___preempt_schedule+0x16/0x18 [ 37.534549] ? trace_hardirqs_on+0xb4/0x310 [ 37.538872] kasan_end_report+0x47/0x4f [ 37.542849] kasan_report.cold.9+0x76/0x309 [ 37.547157] ? fscache_alloc_cookie+0x7ad/0x880 [ 37.551824] __asan_report_load4_noabort+0x14/0x20 [ 37.556764] fscache_alloc_cookie+0x7ad/0x880 [ 37.561267] ? fscache_cookie_init_once+0x80/0x80 [ 37.566099] ? rpcauth_cache_shrink_scan+0x180/0x180 [ 37.571189] ? __kmalloc_track_caller+0x14a/0x750 [ 37.576017] ? kstrdup+0x39/0x70 [ 37.579368] ? nfs_alloc_client+0x383/0x760 [ 37.583672] ? nfs_get_client+0x8e8/0x14d0 [ 37.587890] ? nfs_init_server+0x357/0x1010 [ 37.592193] ? nfs_create_server+0x86/0x5f0 [ 37.596499] ? nfs_fs_mount+0x17f8/0x2f1c [ 37.600632] ? mount_fs+0xae/0x31d [ 37.604169] ? vfs_kern_mount.part.35+0xdc/0x4f0 [ 37.608907] ? do_mount+0x581/0x31f0 [ 37.612602] ? ksys_mount+0x12d/0x140 [ 37.616384] ? __x64_sys_mount+0xbe/0x150 [ 37.620528] ? do_syscall_64+0x1b9/0x820 [ 37.624588] __fscache_acquire_cookie+0x230/0xb60 [ 37.629433] ? fscache_cookie_put+0x880/0x880 [ 37.633915] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.639455] ? check_preemption_disabled+0x48/0x200 [ 37.644461] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 37.649981] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 37.655248] ? rcu_pm_notify+0xc0/0xc0 [ 37.659140] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.664666] nfs_fscache_get_client_cookie+0x463/0x600 [ 37.669934] ? nfs_readpage_from_fscache_complete+0x200/0x200 [ 37.675810] nfs_alloc_client+0x563/0x760 [ 37.679953] ? register_nfs_version+0x280/0x280 [ 37.684709] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 37.689284] nfs_get_client+0x8e8/0x14d0 [ 37.693335] ? kmem_cache_alloc_trace+0x152/0x750 [ 37.698163] ? mount_fs+0xae/0x31d [ 37.701732] ? nfs_put_client+0x30/0x30 [ 37.705695] ? nfs_alloc_server+0x5ca/0x730 [ 37.709998] ? depot_save_stack+0x292/0x470 [ 37.714307] ? nfs_wait_client_init_complete+0x210/0x210 [ 37.719751] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.725275] ? check_preemption_disabled+0x48/0x200 [ 37.730291] ? check_preemption_disabled+0x48/0x200 [ 37.735291] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 37.740464] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 37.745999] nfs_init_server+0x357/0x1010 [ 37.750133] ? nfs_clone_server+0x920/0x920 [ 37.754438] ? nfs_alloc_fattr+0x48/0x1d0 [ 37.758569] ? rcu_read_lock_sched_held+0x108/0x120 [ 37.763574] nfs_create_server+0x86/0x5f0 [ 37.767708] nfs_try_mount+0x180/0xa80 [ 37.771590] ? lock_downgrade+0x900/0x900 [ 37.775730] ? nfs_request_mount.constprop.18+0x920/0x920 [ 37.781276] ? kasan_check_read+0x11/0x20 [ 37.785422] ? do_raw_spin_unlock+0xa7/0x2f0 [ 37.789828] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 37.794397] ? kasan_check_write+0x14/0x20 [ 37.798611] ? do_raw_spin_lock+0xc1/0x200 [ 37.802843] ? _raw_spin_unlock+0x2c/0x50 [ 37.806990] ? find_nfs_version+0x138/0x190 [ 37.811309] nfs_fs_mount+0x17f8/0x2f1c [ 37.815299] ? nfs_show_options+0x250/0x250 [ 37.819608] ? nfs_clone_super+0x420/0x420 [ 37.823825] ? nfs_parse_mount_options+0x2660/0x2660 [ 37.828928] ? lock_downgrade+0x900/0x900 [ 37.833064] mount_fs+0xae/0x31d [ 37.836419] vfs_kern_mount.part.35+0xdc/0x4f0 [ 37.840988] ? may_umount+0xb0/0xb0 [ 37.844600] ? _raw_read_unlock+0x2c/0x50 [ 37.848739] ? __get_fs_type+0x97/0xc0 [ 37.852611] do_mount+0x581/0x31f0 [ 37.856134] ? copy_mount_string+0x40/0x40 [ 37.860352] ? copy_mount_options+0x5f/0x380 [ 37.864754] ? rcu_read_lock_sched_held+0x108/0x120 [ 37.869757] ? kmem_cache_alloc_trace+0x353/0x750 [ 37.874615] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 37.880136] ? _copy_from_user+0xdf/0x150 [ 37.884284] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.889815] ? copy_mount_options+0x288/0x380 [ 37.894325] ksys_mount+0x12d/0x140 [ 37.897963] __x64_sys_mount+0xbe/0x150 [ 37.901926] do_syscall_64+0x1b9/0x820 [ 37.905799] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 37.911146] ? syscall_return_slowpath+0x5e0/0x5e0 [ 37.916060] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.920887] ? trace_hardirqs_on_caller+0x310/0x310 [ 37.925886] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 37.930887] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.936406] ? prepare_exit_to_usermode+0x291/0x3b0 [ 37.941411] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.946249] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 37.951437] RIP: 0033:0x440129 [ 37.954617] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 37.973516] RSP: 002b:00007fff15a74048 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 37.981214] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000440129 [ 37.988471] RDX: 000000002015bffc RSI: 0000000020343ff8 RDI: 00000000208deff8 [ 37.995728] RBP: 00000000006ca018 R08: 000000002000a000 R09: 0000000000000000 [ 38.003010] R10: 0000000000000000 R11: 0000000000000286 R12: 00000000004019b0 [ 38.010262] R13: 0000000000401a40 R14: 0000000000000000 R15: 0000000000000000 [ 38.018453] Kernel Offset: disabled [ 38.022079] Rebooting in 86400 seconds..