Warning: Permanently added '10.128.0.64' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 55.134183][ T8457] ================================================================== [ 55.142710][ T8457] BUG: KASAN: slab-out-of-bounds in squashfs_get_id+0x1ae/0x1d0 [ 55.150352][ T8457] Read of size 8 at addr ffff888014da0890 by task syz-executor820/8457 [ 55.158684][ T8457] [ 55.161028][ T8457] CPU: 1 PID: 8457 Comm: syz-executor820 Not tainted 5.10.0-rc7-syzkaller #0 [ 55.169968][ T8457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.180600][ T8457] Call Trace: [ 55.183899][ T8457] dump_stack+0x107/0x163 [ 55.188220][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.193145][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.198066][ T8457] print_address_description.constprop.0.cold+0xae/0x4c8 [ 55.205373][ T8457] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 55.210941][ T8457] ? vprintk_func+0x95/0x1e0 [ 55.215752][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.220920][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.226060][ T8457] kasan_report.cold+0x1f/0x37 [ 55.231033][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.235968][ T8457] squashfs_get_id+0x1ae/0x1d0 [ 55.240722][ T8457] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 55.247339][ T8457] ? squashfs_read_metadata+0x2f9/0x460 [ 55.252882][ T8457] squashfs_read_inode+0x1b4/0x1b40 [ 55.258070][ T8457] ? find_held_lock+0x2d/0x110 [ 55.262825][ T8457] ? squashfs_read_id_index_table+0x120/0x120 [ 55.269047][ T8457] ? new_inode+0x23b/0x2f0 [ 55.273441][ T8457] ? lock_downgrade+0x6d0/0x6d0 [ 55.278356][ T8457] ? do_raw_spin_lock+0x120/0x2b0 [ 55.283360][ T8457] ? rwlock_bug.part.0+0x90/0x90 [ 55.288275][ T8457] ? do_raw_spin_unlock+0x171/0x230 [ 55.293453][ T8457] ? _raw_spin_unlock+0x24/0x40 [ 55.298284][ T8457] ? new_inode+0x240/0x2f0 [ 55.302680][ T8457] squashfs_fill_super+0x1140/0x23b0 [ 55.308211][ T8457] get_tree_bdev+0x421/0x740 [ 55.313033][ T8457] ? init_once+0x20/0x20 [ 55.317383][ T8457] vfs_get_tree+0x89/0x2f0 [ 55.321780][ T8457] path_mount+0x13ad/0x20c0 [ 55.326271][ T8457] ? strncpy_from_user+0x2a0/0x3e0 [ 55.331526][ T8457] ? finish_automount+0xac0/0xac0 [ 55.336555][ T8457] ? getname_flags.part.0+0x1dd/0x4f0 [ 55.342065][ T8457] __x64_sys_mount+0x27f/0x300 [ 55.346832][ T8457] ? copy_mnt_ns+0xa60/0xa60 [ 55.351527][ T8457] ? syscall_enter_from_user_mode+0x1d/0x50 [ 55.357595][ T8457] do_syscall_64+0x2d/0x70 [ 55.362180][ T8457] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 55.368065][ T8457] RIP: 0033:0x446d1a [ 55.372130][ T8457] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 55.391854][ T8457] RSP: 002b:00007ffec71d7408 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 55.400370][ T8457] RAX: ffffffffffffffda RBX: 00007ffec71d7460 RCX: 0000000000446d1a [ 55.408424][ T8457] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffec71d7420 [ 55.416382][ T8457] RBP: 00007ffec71d7420 R08: 00007ffec71d7460 R09: 00007ffe00000015 [ 55.424475][ T8457] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 55.432532][ T8457] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 55.440528][ T8457] [ 55.442930][ T8457] Allocated by task 6443: [ 55.447536][ T8457] kasan_save_stack+0x1b/0x40 [ 55.452194][ T8457] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 55.457800][ T8457] security_prepare_creds+0x10e/0x190 [ 55.463572][ T8457] prepare_creds+0x4bd/0x6c0 [ 55.468137][ T8457] do_faccessat+0x3d7/0x820 [ 55.472644][ T8457] do_syscall_64+0x2d/0x70 [ 55.477275][ T8457] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 55.483143][ T8457] [ 55.485536][ T8457] The buggy address belongs to the object at ffff888014da0870 [ 55.485536][ T8457] which belongs to the cache kmalloc-8 of size 8 [ 55.500643][ T8457] The buggy address is located 24 bytes to the right of [ 55.500643][ T8457] 8-byte region [ffff888014da0870, ffff888014da0878) [ 55.514145][ T8457] The buggy address belongs to the page: [ 55.519754][ T8457] page:00000000ac3d44c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14da0 [ 55.529870][ T8457] flags: 0xfff00000000200(slab) [ 55.534696][ T8457] raw: 00fff00000000200 ffffea00006eb080 0000001700000017 ffff888010041c80 [ 55.543267][ T8457] raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 [ 55.551849][ T8457] page dumped because: kasan: bad access detected [ 55.558229][ T8457] [ 55.560557][ T8457] Memory state around the buggy address: [ 55.566218][ T8457] ffff888014da0780: fa fc fc fc fc fa fc fc fc fc fa fc fc fc fc 00 [ 55.574543][ T8457] ffff888014da0800: fc fc fc fc fa fc fc fc fc 00 fc fc fc fc fb fc [ 55.582665][ T8457] >ffff888014da0880: fc fc fc fa fc fc fc fc fb fc fc fc fc 00 fc fc [ 55.590784][ T8457] ^ [ 55.595346][ T8457] ffff888014da0900: fc fc fa fc fc fc fc fa fc fc fc fc 00 fc fc fc [ 55.603407][ T8457] ffff888014da0980: fc fb fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc [ 55.611640][ T8457] ================================================================== [ 55.619699][ T8457] Disabling lock debugging due to kernel taint [ 55.626262][ T8457] Kernel panic - not syncing: panic_on_warn set ... [ 55.632936][ T8457] CPU: 1 PID: 8457 Comm: syz-executor820 Tainted: G B 5.10.0-rc7-syzkaller #0 [ 55.643060][ T8457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.653088][ T8457] Call Trace: [ 55.656354][ T8457] dump_stack+0x107/0x163 [ 55.660681][ T8457] ? squashfs_get_id+0x190/0x1d0 [ 55.665593][ T8457] panic+0x306/0x73d [ 55.669463][ T8457] ? __warn_printk+0xf3/0xf3 [ 55.674055][ T8457] ? preempt_schedule_common+0x59/0xc0 [ 55.679670][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.684673][ T8457] ? preempt_schedule_thunk+0x16/0x18 [ 55.690193][ T8457] ? trace_hardirqs_on+0x51/0x1c0 [ 55.695362][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.700270][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.705493][ T8457] end_report+0x58/0x5e [ 55.709626][ T8457] kasan_report.cold+0xd/0x37 [ 55.714286][ T8457] ? squashfs_get_id+0x1ae/0x1d0 [ 55.719198][ T8457] squashfs_get_id+0x1ae/0x1d0 [ 55.723941][ T8457] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 55.730501][ T8457] ? squashfs_read_metadata+0x2f9/0x460 [ 55.736136][ T8457] squashfs_read_inode+0x1b4/0x1b40 [ 55.741773][ T8457] ? find_held_lock+0x2d/0x110 [ 55.746519][ T8457] ? squashfs_read_id_index_table+0x120/0x120 [ 55.752565][ T8457] ? new_inode+0x23b/0x2f0 [ 55.757133][ T8457] ? lock_downgrade+0x6d0/0x6d0 [ 55.761972][ T8457] ? do_raw_spin_lock+0x120/0x2b0 [ 55.767101][ T8457] ? rwlock_bug.part.0+0x90/0x90 [ 55.772014][ T8457] ? do_raw_spin_unlock+0x171/0x230 [ 55.777190][ T8457] ? _raw_spin_unlock+0x24/0x40 [ 55.782017][ T8457] ? new_inode+0x240/0x2f0 [ 55.786409][ T8457] squashfs_fill_super+0x1140/0x23b0 [ 55.791778][ T8457] get_tree_bdev+0x421/0x740 [ 55.796340][ T8457] ? init_once+0x20/0x20 [ 55.800583][ T8457] vfs_get_tree+0x89/0x2f0 [ 55.804972][ T8457] path_mount+0x13ad/0x20c0 [ 55.809450][ T8457] ? strncpy_from_user+0x2a0/0x3e0 [ 55.814536][ T8457] ? finish_automount+0xac0/0xac0 [ 55.819565][ T8457] ? getname_flags.part.0+0x1dd/0x4f0 [ 55.824967][ T8457] __x64_sys_mount+0x27f/0x300 [ 55.829713][ T8457] ? copy_mnt_ns+0xa60/0xa60 [ 55.834323][ T8457] ? syscall_enter_from_user_mode+0x1d/0x50 [ 55.840197][ T8457] do_syscall_64+0x2d/0x70 [ 55.844604][ T8457] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 55.850480][ T8457] RIP: 0033:0x446d1a [ 55.854357][ T8457] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 55.873950][ T8457] RSP: 002b:00007ffec71d7408 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 55.882379][ T8457] RAX: ffffffffffffffda RBX: 00007ffec71d7460 RCX: 0000000000446d1a [ 55.890337][ T8457] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffec71d7420 [ 55.898303][ T8457] RBP: 00007ffec71d7420 R08: 00007ffec71d7460 R09: 00007ffe00000015 [ 55.906264][ T8457] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 55.914227][ T8457] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 55.925782][ T8457] Kernel Offset: disabled [ 55.930339][ T8457] Rebooting in 86400 seconds..