[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.246' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 29.538722] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 29.547255] REISERFS (device loop0): using ordered data mode [ 29.553290] reiserfs: using flush barriers [ 29.558375] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 29.574224] REISERFS (device loop0): checking transaction log (loop0) [ 29.615728] REISERFS (device loop0): Using r5 hash to sort names [ 29.622382] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 29.631681] ================================================================== [ 29.639144] BUG: KASAN: use-after-free in strlen+0x79/0x90 [ 29.644759] Read of size 1 at addr ffff88808b4be9cc by task syz-executor261/7951 [ 29.652279] [ 29.653906] CPU: 1 PID: 7951 Comm: syz-executor261 Not tainted 4.14.300-syzkaller #0 [ 29.661774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 29.671100] Call Trace: [ 29.673663] dump_stack+0x1b2/0x281 [ 29.677267] print_address_description.cold+0x54/0x1d3 [ 29.682519] kasan_report_error.cold+0x8a/0x191 [ 29.687160] ? strlen+0x79/0x90 [ 29.690411] __asan_report_load1_noabort+0x68/0x70 [ 29.695341] ? strlen+0x79/0x90 [ 29.698678] strlen+0x79/0x90 [ 29.701844] search_by_entry_key+0x8b8/0xf50 [ 29.706229] reiserfs_readdir_inode+0x232/0x12a0 [ 29.711072] ? save_trace+0xd6/0x290 [ 29.714761] ? reiserfs_dir_fsync+0x140/0x140 [ 29.719235] ? debug_check_no_obj_freed+0x2c0/0x680 [ 29.724225] ? trace_hardirqs_on+0x10/0x10 [ 29.728436] ? aa_path_link+0x3a0/0x3a0 [ 29.732398] ? __fsnotify_inode_delete+0x20/0x20 [ 29.737133] iterate_dir+0x1a0/0x5e0 [ 29.740821] SyS_getdents64+0x125/0x230 [ 29.744776] ? SyS_getdents+0x240/0x240 [ 29.748724] ? filldir+0x390/0x390 [ 29.752250] ? do_syscall_64+0x4c/0x640 [ 29.756220] ? SyS_getdents+0x240/0x240 [ 29.760167] do_syscall_64+0x1d5/0x640 [ 29.764039] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 29.769216] [ 29.770816] The buggy address belongs to the page: [ 29.775721] page:ffffea00022d2f80 count:0 mapcount:0 mapping: (null) index:0x1 [ 29.783836] flags: 0xfff00000000000() [ 29.787610] raw: 00fff00000000000 0000000000000000 0000000000000001 00000000ffffffff [ 29.795473] raw: ffffea00022d2f60 ffffea00022d2fe0 0000000000000000 0000000000000000 [ 29.803324] page dumped because: kasan: bad access detected [ 29.809005] [ 29.810603] Memory state around the buggy address: [ 29.815504] ffff88808b4be880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.822837] ffff88808b4be900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.830167] >ffff88808b4be980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.837499] ^ [ 29.843181] ffff88808b4bea00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.850534] ffff88808b4bea80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.857864] ================================================================== [ 29.865192] Disabling lock debugging due to kernel taint [ 29.870944] Kernel panic - not syncing: panic_on_warn set ... [ 29.870944] [ 29.878304] CPU: 1 PID: 7951 Comm: syz-executor261 Tainted: G B 4.14.300-syzkaller #0 [ 29.887384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 29.896725] Call Trace: [ 29.899294] dump_stack+0x1b2/0x281 [ 29.902893] panic+0x1f9/0x42d [ 29.906061] ? add_taint.cold+0x16/0x16 [ 29.910013] ? ___preempt_schedule+0x16/0x18 [ 29.914396] kasan_end_report+0x43/0x49 [ 29.918346] kasan_report_error.cold+0xa7/0x191 [ 29.922991] ? strlen+0x79/0x90 [ 29.926247] __asan_report_load1_noabort+0x68/0x70 [ 29.931147] ? strlen+0x79/0x90 [ 29.934401] strlen+0x79/0x90 [ 29.937482] search_by_entry_key+0x8b8/0xf50 [ 29.941864] reiserfs_readdir_inode+0x232/0x12a0 [ 29.946599] ? save_trace+0xd6/0x290 [ 29.950287] ? reiserfs_dir_fsync+0x140/0x140 [ 29.954758] ? debug_check_no_obj_freed+0x2c0/0x680 [ 29.959747] ? trace_hardirqs_on+0x10/0x10 [ 29.963957] ? aa_path_link+0x3a0/0x3a0 [ 29.967910] ? __fsnotify_inode_delete+0x20/0x20 [ 29.972642] iterate_dir+0x1a0/0x5e0 [ 29.976328] SyS_getdents64+0x125/0x230 [ 29.980272] ? SyS_getdents+0x240/0x240 [ 29.984218] ? filldir+0x390/0x390 [ 29.987730] ? do_syscall_64+0x4c/0x640 [ 29.991675] ? SyS_getdents+0x240/0x240 [ 29.995623] do_syscall_64+0x1d5/0x640 [ 29.999499] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 30.004847] Kernel Offset: disabled [ 30.008455] Rebooting in 86400 seconds..