[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.122' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 35.153432] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 35.167872] ================================================================== [ 35.175314] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x780/0x860 [ 35.182156] Write of size 4 at addr ffff8880a0603830 by task syz-executor201/8108 [ 35.189752] [ 35.191363] CPU: 0 PID: 8108 Comm: syz-executor201 Not tainted 4.19.211-syzkaller #0 [ 35.199220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 35.208674] Call Trace: [ 35.211252] dump_stack+0x1fc/0x2ef [ 35.214865] print_address_description.cold+0x54/0x219 [ 35.220124] kasan_report_error.cold+0x8a/0x1b9 [ 35.224777] ? udf_write_aext+0x780/0x860 [ 35.228909] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.233993] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.238729] ? udf_write_aext+0x780/0x860 [ 35.242861] udf_write_aext+0x780/0x860 [ 35.246817] udf_add_entry+0xdab/0x2a20 [ 35.250943] ? udf_write_fi+0xf40/0xf40 [ 35.254896] ? udf_new_inode+0xa7b/0xf30 [ 35.258942] udf_mkdir+0x145/0x650 [ 35.262461] ? map_id_up+0x178/0x2f0 [ 35.266240] ? udf_create+0x180/0x180 [ 35.270018] ? putname+0xe1/0x120 [ 35.273447] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 35.278443] ? generic_permission+0x116/0x4d0 [ 35.282916] ? security_inode_permission+0xc5/0xf0 [ 35.287826] ? inode_permission.part.0+0x10c/0x450 [ 35.292737] vfs_mkdir+0x508/0x7a0 [ 35.296259] do_mkdirat+0x262/0x2d0 [ 35.299864] ? __ia32_sys_mknod+0x120/0x120 [ 35.304177] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.309183] ? do_syscall_64+0x21/0x620 [ 35.313260] do_syscall_64+0xf9/0x620 [ 35.317054] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.322227] RIP: 0033:0x7f6108feab59 [ 35.325919] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.344800] RSP: 002b:00007ffc47de85c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 35.352485] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6108feab59 [ 35.359739] RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000004 [ 35.367076] RBP: 00007f6108faa160 R08: 0000000000000000 R09: 0000000000000000 [ 35.374321] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6108faa1f0 [ 35.381565] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 35.388815] [ 35.390420] Allocated by task 8094: [ 35.394029] __kmalloc_node_track_caller+0x4c/0x70 [ 35.398951] __alloc_skb+0xae/0x560 [ 35.402569] __napi_alloc_skb+0x74/0x300 [ 35.406607] page_to_skb+0x76/0xa70 [ 35.410211] receive_buf+0x2ab4/0x6780 [ 35.414162] virtnet_poll+0x568/0xe00 [ 35.417938] net_rx_action+0x4ac/0xfb0 [ 35.421803] __do_softirq+0x265/0x980 [ 35.425571] [ 35.427175] Freed by task 8094: [ 35.430432] kfree+0xcc/0x210 [ 35.433513] skb_release_data+0x6de/0x920 [ 35.437639] kfree_skb_partial+0x7e/0xa0 [ 35.441677] tcp_rcv_established+0x1b89/0x1ef0 [ 35.446236] tcp_v4_do_rcv+0x5d6/0x870 [ 35.450098] tcp_v4_rcv+0x2c03/0x3b80 [ 35.453877] ip_local_deliver_finish+0x495/0xc00 [ 35.458610] ip_local_deliver+0x188/0x500 [ 35.462736] ip_rcv_finish+0x1ca/0x2e0 [ 35.466598] ip_rcv+0xca/0x3c0 [ 35.469769] __netif_receive_skb_one_core+0x114/0x180 [ 35.474933] __netif_receive_skb+0x27/0x1c0 [ 35.479230] netif_receive_skb_internal+0xf0/0x3f0 [ 35.484138] napi_gro_receive+0x2e6/0x450 [ 35.488262] receive_buf+0xc2c/0x6780 [ 35.492038] virtnet_poll+0x568/0xe00 [ 35.495818] net_rx_action+0x4ac/0xfb0 [ 35.499687] __do_softirq+0x265/0x980 [ 35.503457] [ 35.505063] The buggy address belongs to the object at ffff8880a06035c0 [ 35.505063] which belongs to the cache kmalloc-512 of size 512 [ 35.517694] The buggy address is located 112 bytes to the right of [ 35.517694] 512-byte region [ffff8880a06035c0, ffff8880a06037c0) [ 35.530234] The buggy address belongs to the page: [ 35.535149] page:ffffea00028180c0 count:1 mapcount:0 mapping:ffff88813bff0940 index:0x0 [ 35.543265] flags: 0xfff00000000100(slab) [ 35.547392] raw: 00fff00000000100 ffffea00028638c8 ffffea000285f808 ffff88813bff0940 [ 35.555338] raw: 0000000000000000 ffff8880a06030c0 0000000100000006 0000000000000000 [ 35.563189] page dumped because: kasan: bad access detected [ 35.568870] [ 35.570470] Memory state around the buggy address: [ 35.575375] ffff8880a0603700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.582710] ffff8880a0603780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 35.590048] >ffff8880a0603800: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 35.597379] ^ [ 35.602281] ffff8880a0603880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.609619] ffff8880a0603900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.616951] ================================================================== [ 35.624283] Disabling lock debugging due to kernel taint [ 35.643346] Kernel panic - not syncing: panic_on_warn set ... [ 35.643346] [ 35.650730] CPU: 1 PID: 8108 Comm: syz-executor201 Tainted: G B 4.19.211-syzkaller #0 [ 35.659984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 35.669313] Call Trace: [ 35.671882] dump_stack+0x1fc/0x2ef [ 35.675489] panic+0x26a/0x50e [ 35.678660] ? __warn_printk+0xf3/0xf3 [ 35.682527] ? preempt_schedule_common+0x45/0xc0 [ 35.687258] ? ___preempt_schedule+0x16/0x18 [ 35.691646] ? trace_hardirqs_on+0x55/0x210 [ 35.695955] kasan_end_report+0x43/0x49 [ 35.699919] kasan_report_error.cold+0xa7/0x1b9 [ 35.704578] ? udf_write_aext+0x780/0x860 [ 35.708710] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.713802] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.718540] ? udf_write_aext+0x780/0x860 [ 35.722687] udf_write_aext+0x780/0x860 [ 35.726642] udf_add_entry+0xdab/0x2a20 [ 35.730615] ? udf_write_fi+0xf40/0xf40 [ 35.734571] ? udf_new_inode+0xa7b/0xf30 [ 35.738612] udf_mkdir+0x145/0x650 [ 35.742131] ? map_id_up+0x178/0x2f0 [ 35.745822] ? udf_create+0x180/0x180 [ 35.749608] ? putname+0xe1/0x120 [ 35.753038] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 35.758033] ? generic_permission+0x116/0x4d0 [ 35.762507] ? security_inode_permission+0xc5/0xf0 [ 35.767413] ? inode_permission.part.0+0x10c/0x450 [ 35.772318] vfs_mkdir+0x508/0x7a0 [ 35.775833] do_mkdirat+0x262/0x2d0 [ 35.779436] ? __ia32_sys_mknod+0x120/0x120 [ 35.783734] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.788725] ? do_syscall_64+0x21/0x620 [ 35.792676] do_syscall_64+0xf9/0x620 [ 35.796455] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.801621] RIP: 0033:0x7f6108feab59 [ 35.805313] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.824190] RSP: 002b:00007ffc47de85c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 35.831879] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6108feab59 [ 35.839125] RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000004 [ 35.846386] RBP: 00007f6108faa160 R08: 0000000000000000 R09: 0000000000000000 [ 35.853671] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6108faa1f0 [ 35.860919] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 35.868264] Kernel Offset: disabled [ 35.871874] Rebooting in 86400 seconds..