Warning: Permanently added '10.128.1.15' (ECDSA) to the list of known hosts. executing program [ 51.990773][ T3541] loop0: detected capacity change from 0 to 2048 [ 52.006066][ T3541] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 52.085364][ T3540] ================================================================== [ 52.093449][ T3540] BUG: KASAN: use-after-free in udf_close_lvid+0x6a4/0x9a0 [ 52.100639][ T3540] Write of size 1 at addr ffff88805dc34b78 by task syz-executor153/3540 [ 52.108939][ T3540] [ 52.111246][ T3540] CPU: 0 PID: 3540 Comm: syz-executor153 Not tainted 6.1.33-syzkaller #0 [ 52.119632][ T3540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 52.129665][ T3540] Call Trace: [ 52.132929][ T3540] [ 52.135842][ T3540] dump_stack_lvl+0x1e3/0x2cb [ 52.140511][ T3540] ? irq_work_queue+0xc6/0x150 [ 52.145344][ T3540] ? nf_tcp_handle_invalid+0x642/0x642 [ 52.150784][ T3540] ? panic+0x75d/0x75d [ 52.154836][ T3540] ? _printk+0xd1/0x111 [ 52.158970][ T3540] ? _raw_spin_lock_irqsave+0xac/0x120 [ 52.164417][ T3540] print_report+0x15f/0x4f0 [ 52.168914][ T3540] ? hook_sb_delete+0x728/0xb30 [ 52.173748][ T3540] ? __virt_addr_valid+0x22b/0x2e0 [ 52.178840][ T3540] ? __phys_addr+0xb6/0x170 [ 52.183324][ T3540] ? udf_close_lvid+0x6a4/0x9a0 [ 52.188156][ T3540] kasan_report+0x136/0x160 [ 52.192646][ T3540] ? udf_close_lvid+0x6a4/0x9a0 [ 52.197479][ T3540] udf_close_lvid+0x6a4/0x9a0 [ 52.202148][ T3540] ? udf_open_lvid+0x5a0/0x5a0 [ 52.207082][ T3540] ? iput+0x3f7/0x980 [ 52.211051][ T3540] ? clear_inode+0x150/0x150 [ 52.215631][ T3540] ? module_put+0x15a/0x350 [ 52.220121][ T3540] udf_put_super+0xc9/0x160 [ 52.224605][ T3540] ? udf_free_in_core_inode+0x20/0x20 [ 52.229956][ T3540] generic_shutdown_super+0x130/0x340 [ 52.235313][ T3540] kill_block_super+0x7a/0xe0 [ 52.239969][ T3540] deactivate_locked_super+0xa0/0x110 [ 52.245323][ T3540] cleanup_mnt+0x490/0x520 [ 52.249719][ T3540] ? lockdep_hardirqs_on+0x94/0x130 [ 52.254902][ T3540] task_work_run+0x246/0x300 [ 52.259475][ T3540] ? task_work_cancel+0x2b0/0x2b0 [ 52.264483][ T3540] ? exit_to_user_mode_loop+0x39/0x100 [ 52.269924][ T3540] exit_to_user_mode_loop+0xd9/0x100 [ 52.275191][ T3540] exit_to_user_mode_prepare+0xb1/0x140 [ 52.280723][ T3540] syscall_exit_to_user_mode+0x60/0x270 [ 52.286259][ T3540] do_syscall_64+0x49/0xb0 [ 52.290655][ T3540] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.296530][ T3540] RIP: 0033:0x7f0c55d5b057 [ 52.300925][ T3540] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 52.320508][ T3540] RSP: 002b:00007ffd3d03a4d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 52.328904][ T3540] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f0c55d5b057 [ 52.336856][ T3540] RDX: 00007ffd3d03a599 RSI: 000000000000000a RDI: 00007ffd3d03a590 [ 52.344808][ T3540] RBP: 00007ffd3d03a590 R08: 00000000ffffffff R09: 00007ffd3d03a370 [ 52.352759][ T3540] R10: 000055555641066b R11: 0000000000000206 R12: 00007ffd3d03b600 [ 52.360711][ T3540] R13: 00005555564105f0 R14: 00007ffd3d03a500 R15: 0000000000000001 [ 52.368666][ T3540] [ 52.371666][ T3540] [ 52.373967][ T3540] The buggy address belongs to the physical page: [ 52.380352][ T3540] page:ffffea0001770d00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x5dc34 [ 52.390482][ T3540] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 52.397572][ T3540] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000 [ 52.406140][ T3540] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 52.414701][ T3540] page dumped because: kasan: bad access detected [ 52.421087][ T3540] page_owner tracks the page as freed [ 52.426431][ T3540] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 9796276131, free_ts 10790478036 [ 52.441250][ T3540] post_alloc_hook+0x18d/0x1b0 [ 52.445998][ T3540] split_map_pages+0x246/0x510 [ 52.450737][ T3540] isolate_freepages_range+0x47c/0x4e0 [ 52.456177][ T3540] alloc_contig_range+0x62a/0x990 [ 52.461189][ T3540] alloc_contig_pages+0x3f0/0x4e0 [ 52.466198][ T3540] debug_vm_pgtable_alloc_huge_page+0xb9/0x108 [ 52.472328][ T3540] init_args+0xa7d/0xda4 [ 52.476545][ T3540] debug_vm_pgtable+0xaa/0x46b [ 52.481283][ T3540] do_one_initcall+0x265/0x8f0 [ 52.486025][ T3540] do_initcall_level+0x157/0x207 [ 52.490941][ T3540] do_initcalls+0x49/0x86 [ 52.495255][ T3540] kernel_init_freeable+0x473/0x61f [ 52.500434][ T3540] kernel_init+0x19/0x290 [ 52.504748][ T3540] ret_from_fork+0x1f/0x30 [ 52.509230][ T3540] page last free stack trace: [ 52.513879][ T3540] free_unref_page_prepare+0xf63/0x1120 [ 52.519413][ T3540] free_unref_page+0x98/0x570 [ 52.524070][ T3540] free_contig_range+0x9a/0x150 [ 52.528901][ T3540] destroy_args+0xfe/0x997 [ 52.533296][ T3540] debug_vm_pgtable+0x416/0x46b [ 52.538128][ T3540] do_one_initcall+0x265/0x8f0 [ 52.542870][ T3540] do_initcall_level+0x157/0x207 [ 52.547791][ T3540] do_initcalls+0x49/0x86 [ 52.552101][ T3540] kernel_init_freeable+0x473/0x61f [ 52.557278][ T3540] kernel_init+0x19/0x290 [ 52.561634][ T3540] ret_from_fork+0x1f/0x30 [ 52.566032][ T3540] [ 52.568338][ T3540] Memory state around the buggy address: [ 52.573945][ T3540] ffff88805dc34a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.581984][ T3540] ffff88805dc34a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.590020][ T3540] >ffff88805dc34b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.598058][ T3540] ^ [ 52.606011][ T3540] ffff88805dc34b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.614049][ T3540] ffff88805dc34c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.622084][ T3540] ================================================================== [ 52.630411][ T3540] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 52.637613][ T3540] CPU: 0 PID: 3540 Comm: syz-executor153 Not tainted 6.1.33-syzkaller #0 [ 52.646020][ T3540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 52.656064][ T3540] Call Trace: [ 52.659330][ T3540] [ 52.662250][ T3540] dump_stack_lvl+0x1e3/0x2cb [ 52.666926][ T3540] ? nf_tcp_handle_invalid+0x642/0x642 [ 52.672376][ T3540] ? panic+0x75d/0x75d [ 52.676441][ T3540] ? preempt_schedule_common+0xa6/0xd0 [ 52.681892][ T3540] ? vscnprintf+0x59/0x80 [ 52.686223][ T3540] panic+0x318/0x75d [ 52.690108][ T3540] ? check_panic_on_warn+0x1d/0xa0 [ 52.695210][ T3540] ? memcpy_page_flushcache+0xfc/0xfc [ 52.700573][ T3540] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 52.706714][ T3540] ? _raw_spin_unlock+0x40/0x40 [ 52.711549][ T3540] ? print_report+0x4a3/0x4f0 [ 52.716222][ T3540] check_panic_on_warn+0x7e/0xa0 [ 52.721151][ T3540] ? udf_close_lvid+0x6a4/0x9a0 [ 52.725997][ T3540] end_report+0x66/0x110 [ 52.730232][ T3540] kasan_report+0x143/0x160 [ 52.734726][ T3540] ? udf_close_lvid+0x6a4/0x9a0 [ 52.739571][ T3540] udf_close_lvid+0x6a4/0x9a0 [ 52.744242][ T3540] ? udf_open_lvid+0x5a0/0x5a0 [ 52.748998][ T3540] ? iput+0x3f7/0x980 [ 52.752975][ T3540] ? clear_inode+0x150/0x150 [ 52.757552][ T3540] ? module_put+0x15a/0x350 [ 52.762043][ T3540] udf_put_super+0xc9/0x160 [ 52.766534][ T3540] ? udf_free_in_core_inode+0x20/0x20 [ 52.771896][ T3540] generic_shutdown_super+0x130/0x340 [ 52.777259][ T3540] kill_block_super+0x7a/0xe0 [ 52.781925][ T3540] deactivate_locked_super+0xa0/0x110 [ 52.787287][ T3540] cleanup_mnt+0x490/0x520 [ 52.791693][ T3540] ? lockdep_hardirqs_on+0x94/0x130 [ 52.796884][ T3540] task_work_run+0x246/0x300 [ 52.801466][ T3540] ? task_work_cancel+0x2b0/0x2b0 [ 52.806480][ T3540] ? exit_to_user_mode_loop+0x39/0x100 [ 52.811931][ T3540] exit_to_user_mode_loop+0xd9/0x100 [ 52.817204][ T3540] exit_to_user_mode_prepare+0xb1/0x140 [ 52.822828][ T3540] syscall_exit_to_user_mode+0x60/0x270 [ 52.828367][ T3540] do_syscall_64+0x49/0xb0 [ 52.832771][ T3540] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.838653][ T3540] RIP: 0033:0x7f0c55d5b057 [ 52.843053][ T3540] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 52.862644][ T3540] RSP: 002b:00007ffd3d03a4d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 52.871047][ T3540] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f0c55d5b057 [ 52.879006][ T3540] RDX: 00007ffd3d03a599 RSI: 000000000000000a RDI: 00007ffd3d03a590 [ 52.886966][ T3540] RBP: 00007ffd3d03a590 R08: 00000000ffffffff R09: 00007ffd3d03a370 [ 52.894924][ T3540] R10: 000055555641066b R11: 0000000000000206 R12: 00007ffd3d03b600 [ 52.902884][ T3540] R13: 00005555564105f0 R14: 00007ffd3d03a500 R15: 0000000000000001 [ 52.910850][ T3540] [ 52.914011][ T3540] Kernel Offset: disabled [ 52.918327][ T3540] Rebooting in 86400 seconds..