[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.239' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 30.030627] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 30.039476] REISERFS (device loop0): using ordered data mode [ 30.045268] reiserfs: using flush barriers [ 30.051754] REISERFS (device loop0): journal params: device loop0, size 15748, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30 [ 30.069631] REISERFS (device loop0): checking transaction log (loop0) [ 31.053957] REISERFS (device loop0): Using r5 hash to sort names [ 31.060292] REISERFS (device loop0): using 3.5.x disk format [ 31.066549] ================================================================== [ 31.073976] BUG: KASAN: use-after-free in leaf_paste_entries+0x421/0x9b0 [ 31.080790] Read of size 18446744073709549059 at addr ffff8880839eb9bf by task syz-executor691/8006 [ 31.089946] [ 31.091553] CPU: 0 PID: 8006 Comm: syz-executor691 Not tainted 4.14.209-syzkaller #0 [ 31.099405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.108734] Call Trace: [ 31.111299] dump_stack+0x1b2/0x283 [ 31.114907] print_address_description.cold+0x54/0x1d3 [ 31.120158] kasan_report_error.cold+0x8a/0x194 [ 31.124800] ? leaf_paste_entries+0x421/0x9b0 [ 31.129304] kasan_report+0x6f/0x7b [ 31.132910] ? leaf_paste_entries+0x421/0x9b0 [ 31.137379] memmove+0x20/0x50 [ 31.140591] leaf_paste_entries+0x421/0x9b0 [ 31.144901] balance_leaf+0x8298/0xbaa0 [ 31.148888] ? reiserfs_prepare_for_journal+0xd5/0x150 [ 31.154580] ? replace_key+0x150/0x150 [ 31.158445] do_balance+0x27e/0x630 [ 31.162046] ? get_right_neighbor_position+0x160/0x160 [ 31.167295] ? __mutex_unlock_slowpath+0x75/0x770 [ 31.172149] ? memset+0x20/0x40 [ 31.175407] reiserfs_paste_into_item+0x569/0x6f0 [ 31.180234] ? reiserfs_delete_object+0x1e0/0x1e0 [ 31.185082] ? __mutex_unlock_slowpath+0x23/0x770 [ 31.189905] ? search_by_entry_key+0xf70/0xf70 [ 31.194459] ? r5_hash+0x8f/0xb0 [ 31.197799] ? make_cpu_key+0x22/0x2a0 [ 31.201659] reiserfs_add_entry+0x7d3/0xbc0 [ 31.205966] ? reiserfs_lookup+0x400/0x400 [ 31.210174] ? __mutex_unlock_slowpath+0x23/0x770 [ 31.215003] ? wait_for_completion_io+0x10/0x10 [ 31.219659] reiserfs_mkdir+0x5ca/0x8b0 [ 31.223605] ? reiserfs_mknod+0x690/0x690 [ 31.227734] reiserfs_xattr_init+0x393/0xa49 [ 31.232116] reiserfs_fill_super+0x1b18/0x28be [ 31.236673] ? reiserfs_remount+0x1390/0x1390 [ 31.241142] ? lock_downgrade+0x740/0x740 [ 31.245265] ? snprintf+0xa5/0xd0 [ 31.248698] mount_bdev+0x2b3/0x360 [ 31.252320] ? reiserfs_remount+0x1390/0x1390 [ 31.256801] mount_fs+0x92/0x2a0 [ 31.260142] vfs_kern_mount.part.0+0x5b/0x470 [ 31.264612] do_mount+0xe53/0x2a00 [ 31.268127] ? do_raw_spin_unlock+0x164/0x220 [ 31.272608] ? copy_mount_string+0x40/0x40 [ 31.276816] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 31.281804] ? copy_mnt_ns+0xa30/0xa30 [ 31.285666] ? copy_mount_options+0x1fa/0x2f0 [ 31.290133] ? copy_mnt_ns+0xa30/0xa30 [ 31.293992] SyS_mount+0xa8/0x120 [ 31.297417] ? copy_mnt_ns+0xa30/0xa30 [ 31.301279] do_syscall_64+0x1d5/0x640 [ 31.305142] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 31.310304] RIP: 0033:0x44706a [ 31.313466] RSP: 002b:00007ffd8d257f68 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5 [ 31.321146] RAX: ffffffffffffffda RBX: 00007ffd8d257fc0 RCX: 000000000044706a [ 31.328390] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd8d257f80 [ 31.335635] RBP: 00007ffd8d257f80 R08: 00007ffd8d257fc0 R09: 00007ffd00000015 [ 31.342882] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000006 [ 31.350125] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 31.357373] [ 31.358974] The buggy address belongs to the page: [ 31.363886] page:ffffea00020e7ac0 count:0 mapcount:0 mapping: (null) index:0x1 [ 31.372012] flags: 0xfff00000000000() [ 31.375786] raw: 00fff00000000000 0000000000000000 0000000000000001 00000000ffffffff [ 31.383649] raw: ffffea00020e7b20 ffff8880ba42dac8 0000000000000000 0000000000000000 [ 31.391498] page dumped because: kasan: bad access detected [ 31.397176] [ 31.398788] Memory state around the buggy address: [ 31.403705] ffff8880839eb880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.411047] ffff8880839eb900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.418378] >ffff8880839eb980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.425722] ^ [ 31.430883] ffff8880839eba00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.438215] ffff8880839eba80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.445542] ================================================================== [ 31.452875] Disabling lock debugging due to kernel taint [ 31.458842] Kernel panic - not syncing: panic_on_warn set ... [ 31.458842] [ 31.466241] CPU: 0 PID: 8006 Comm: syz-executor691 Tainted: G B 4.14.209-syzkaller #0 [ 31.475321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.484657] Call Trace: [ 31.487221] dump_stack+0x1b2/0x283 [ 31.490821] panic+0x1f9/0x42d [ 31.493986] ? add_taint.cold+0x16/0x16 [ 31.497932] ? ___preempt_schedule+0x16/0x18 [ 31.502314] kasan_end_report+0x43/0x49 [ 31.506272] kasan_report_error.cold+0xa7/0x194 [ 31.510917] ? leaf_paste_entries+0x421/0x9b0 [ 31.515438] kasan_report+0x6f/0x7b [ 31.519074] ? leaf_paste_entries+0x421/0x9b0 [ 31.523543] memmove+0x20/0x50 [ 31.526709] leaf_paste_entries+0x421/0x9b0 [ 31.531006] balance_leaf+0x8298/0xbaa0 [ 31.535077] ? reiserfs_prepare_for_journal+0xd5/0x150 [ 31.540330] ? replace_key+0x150/0x150 [ 31.544228] do_balance+0x27e/0x630 [ 31.547841] ? get_right_neighbor_position+0x160/0x160 [ 31.553092] ? __mutex_unlock_slowpath+0x75/0x770 [ 31.557906] ? memset+0x20/0x40 [ 31.561161] reiserfs_paste_into_item+0x569/0x6f0 [ 31.565975] ? reiserfs_delete_object+0x1e0/0x1e0 [ 31.570812] ? __mutex_unlock_slowpath+0x23/0x770 [ 31.575629] ? search_by_entry_key+0xf70/0xf70 [ 31.580192] ? r5_hash+0x8f/0xb0 [ 31.583549] ? make_cpu_key+0x22/0x2a0 [ 31.587408] reiserfs_add_entry+0x7d3/0xbc0 [ 31.591702] ? reiserfs_lookup+0x400/0x400 [ 31.596021] ? __mutex_unlock_slowpath+0x23/0x770 [ 31.600836] ? wait_for_completion_io+0x10/0x10 [ 31.605483] reiserfs_mkdir+0x5ca/0x8b0 [ 31.609430] ? reiserfs_mknod+0x690/0x690 [ 31.613552] reiserfs_xattr_init+0x393/0xa49 [ 31.617955] reiserfs_fill_super+0x1b18/0x28be [ 31.622510] ? reiserfs_remount+0x1390/0x1390 [ 31.626978] ? lock_downgrade+0x740/0x740 [ 31.631097] ? snprintf+0xa5/0xd0 [ 31.634525] mount_bdev+0x2b3/0x360 [ 31.638122] ? reiserfs_remount+0x1390/0x1390 [ 31.642604] mount_fs+0x92/0x2a0 [ 31.645943] vfs_kern_mount.part.0+0x5b/0x470 [ 31.650407] do_mount+0xe53/0x2a00 [ 31.653923] ? do_raw_spin_unlock+0x164/0x220 [ 31.658389] ? copy_mount_string+0x40/0x40 [ 31.662609] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 31.667601] ? copy_mnt_ns+0xa30/0xa30 [ 31.671459] ? copy_mount_options+0x1fa/0x2f0 [ 31.675964] ? copy_mnt_ns+0xa30/0xa30 [ 31.679822] SyS_mount+0xa8/0x120 [ 31.683270] ? copy_mnt_ns+0xa30/0xa30 [ 31.687165] do_syscall_64+0x1d5/0x640 [ 31.691037] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 31.696237] RIP: 0033:0x44706a [ 31.699402] RSP: 002b:00007ffd8d257f68 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5 [ 31.707083] RAX: ffffffffffffffda RBX: 00007ffd8d257fc0 RCX: 000000000044706a [ 31.714341] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd8d257f80 [ 31.721670] RBP: 00007ffd8d257f80 R08: 00007ffd8d257fc0 R09: 00007ffd00000015 [ 31.728915] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000006 [ 31.736164] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 31.744148] Kernel Offset: disabled [ 31.747752] Rebooting in 86400 seconds..