[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.71' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 34.261052] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 34.268051] UDF-fs: Scanning with blocksize 512 failed [ 34.274291] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 34.281331] UDF-fs: Scanning with blocksize 1024 failed [ 34.287098] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found [ 34.293874] UDF-fs: Scanning with blocksize 2048 failed [ 34.302097] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 34.312497] ================================================================== [ 34.319962] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x780/0x860 [ 34.326798] Write of size 4 at addr ffff8880b29d4330 by task syz-executor255/8077 [ 34.334406] [ 34.336034] CPU: 0 PID: 8077 Comm: syz-executor255 Not tainted 4.19.211-syzkaller #0 [ 34.343907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 34.353248] Call Trace: [ 34.355821] dump_stack+0x1fc/0x2ef [ 34.359431] print_address_description.cold+0x54/0x219 [ 34.364692] kasan_report_error.cold+0x8a/0x1b9 [ 34.369340] ? udf_write_aext+0x780/0x860 [ 34.373470] __asan_report_store_n_noabort+0x8b/0xa0 [ 34.378557] ? udf_get_pblock_spar15+0x131/0x4a0 [ 34.383298] ? udf_write_aext+0x780/0x860 [ 34.387426] udf_write_aext+0x780/0x860 [ 34.391383] udf_add_entry+0xdab/0x2a20 [ 34.395339] ? udf_write_fi+0xf40/0xf40 [ 34.399326] ? udf_new_inode+0xa7b/0xf30 [ 34.403372] udf_mkdir+0x145/0x650 [ 34.406891] ? map_id_up+0x178/0x2f0 [ 34.410582] ? udf_create+0x180/0x180 [ 34.414360] ? putname+0xe1/0x120 [ 34.417797] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 34.422797] ? generic_permission+0x116/0x4d0 [ 34.427272] ? security_inode_permission+0xc5/0xf0 [ 34.432181] ? inode_permission.part.0+0x10c/0x450 [ 34.437093] vfs_mkdir+0x508/0x7a0 [ 34.440614] do_mkdirat+0x262/0x2d0 [ 34.444220] ? __ia32_sys_mknod+0x120/0x120 [ 34.448525] ? trace_hardirqs_off_caller+0x6e/0x210 [ 34.453520] ? do_syscall_64+0x21/0x620 [ 34.457481] do_syscall_64+0xf9/0x620 [ 34.461418] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.466594] RIP: 0033:0x7f03a3ec2e47 [ 34.470289] Code: ff ff ff ff c3 66 0f 1f 44 00 00 48 c7 c0 c0 ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 34.489171] RSP: 002b:00007fffdd052c18 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 [ 34.496859] RAX: ffffffffffffffda RBX: 0000555555f182c0 RCX: 00007f03a3ec2e47 [ 34.504109] RDX: 0000000000008000 RSI: 00000000000001ff RDI: 0000000020000000 [ 34.511362] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 34.518616] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000000 [ 34.525879] R13: 0000000020000040 R14: 0000000000000000 R15: 00007fffdd052cb0 [ 34.533136] [ 34.534741] Allocated by task 8077: [ 34.538349] __kmalloc+0x15a/0x3c0 [ 34.541872] udf_new_inode+0x220/0xf30 [ 34.545745] udf_mkdir+0xa8/0x650 [ 34.549183] vfs_mkdir+0x508/0x7a0 [ 34.552705] do_mkdirat+0x262/0x2d0 [ 34.556318] do_syscall_64+0xf9/0x620 [ 34.560106] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.565360] [ 34.566968] Freed by task 6226: [ 34.570232] kfree+0xcc/0x210 [ 34.573320] kvfree+0x59/0x60 [ 34.576407] single_release+0x75/0xb0 [ 34.580196] close_pdeo.part.0+0xda/0x2f0 [ 34.584320] proc_reg_release+0x21e/0x270 [ 34.588450] __fput+0x2ce/0x890 [ 34.591707] task_work_run+0x148/0x1c0 [ 34.595573] exit_to_usermode_loop+0x251/0x2a0 [ 34.600145] do_syscall_64+0x538/0x620 [ 34.604010] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.609172] [ 34.610778] The buggy address belongs to the object at ffff8880b29d4340 [ 34.610778] which belongs to the cache kmalloc-4096 of size 4096 [ 34.623584] The buggy address is located 16 bytes to the left of [ 34.623584] 4096-byte region [ffff8880b29d4340, ffff8880b29d5340) [ 34.635871] The buggy address belongs to the page: [ 34.640784] page:ffffea0002ca7500 count:1 mapcount:0 mapping:ffff88813bff0dc0 index:0x0 compound_mapcount: 0 [ 34.650735] flags: 0xfff00000008100(slab|head) [ 34.655296] raw: 00fff00000008100 ffffea0002c55e88 ffffea0002c97508 ffff88813bff0dc0 [ 34.663152] raw: 0000000000000000 ffff8880b29d4340 0000000100000001 0000000000000000 [ 34.671004] page dumped because: kasan: bad access detected [ 34.676685] [ 34.678286] Memory state around the buggy address: [ 34.683190] ffff8880b29d4200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.690527] ffff8880b29d4280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.697863] >ffff8880b29d4300: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 34.705192] ^ [ 34.710097] ffff8880b29d4380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.717432] ffff8880b29d4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.724764] ================================================================== [ 34.732094] Disabling lock debugging due to kernel taint [ 34.737976] Kernel panic - not syncing: panic_on_warn set ... [ 34.737976] [ 34.745345] CPU: 0 PID: 8077 Comm: syz-executor255 Tainted: G B 4.19.211-syzkaller #0 [ 34.754603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 34.763951] Call Trace: [ 34.766534] dump_stack+0x1fc/0x2ef [ 34.770153] panic+0x26a/0x50e [ 34.773325] ? __warn_printk+0xf3/0xf3 [ 34.777189] ? preempt_schedule_common+0x45/0xc0 [ 34.781921] ? ___preempt_schedule+0x16/0x18 [ 34.786310] ? trace_hardirqs_on+0x55/0x210 [ 34.790611] kasan_end_report+0x43/0x49 [ 34.794564] kasan_report_error.cold+0xa7/0x1b9 [ 34.799214] ? udf_write_aext+0x780/0x860 [ 34.803339] __asan_report_store_n_noabort+0x8b/0xa0 [ 34.808417] ? udf_get_pblock_spar15+0x131/0x4a0 [ 34.813146] ? udf_write_aext+0x780/0x860 [ 34.817271] udf_write_aext+0x780/0x860 [ 34.821237] udf_add_entry+0xdab/0x2a20 [ 34.825189] ? udf_write_fi+0xf40/0xf40 [ 34.829146] ? udf_new_inode+0xa7b/0xf30 [ 34.833183] udf_mkdir+0x145/0x650 [ 34.836699] ? map_id_up+0x178/0x2f0 [ 34.840394] ? udf_create+0x180/0x180 [ 34.844169] ? putname+0xe1/0x120 [ 34.847667] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 34.852680] ? generic_permission+0x116/0x4d0 [ 34.857172] ? security_inode_permission+0xc5/0xf0 [ 34.862083] ? inode_permission.part.0+0x10c/0x450 [ 34.866995] vfs_mkdir+0x508/0x7a0 [ 34.870519] do_mkdirat+0x262/0x2d0 [ 34.874134] ? __ia32_sys_mknod+0x120/0x120 [ 34.878434] ? trace_hardirqs_off_caller+0x6e/0x210 [ 34.883430] ? do_syscall_64+0x21/0x620 [ 34.887380] do_syscall_64+0xf9/0x620 [ 34.891157] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.896322] RIP: 0033:0x7f03a3ec2e47 [ 34.900015] Code: ff ff ff ff c3 66 0f 1f 44 00 00 48 c7 c0 c0 ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 34.918893] RSP: 002b:00007fffdd052c18 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 [ 34.926580] RAX: ffffffffffffffda RBX: 0000555555f182c0 RCX: 00007f03a3ec2e47 [ 34.933914] RDX: 0000000000008000 RSI: 00000000000001ff RDI: 0000000020000000 [ 34.941162] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 34.948415] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000000 [ 34.955668] R13: 0000000020000040 R14: 0000000000000000 R15: 00007fffdd052cb0 [ 34.963093] Kernel Offset: disabled [ 34.966704] Rebooting in 86400 seconds..