[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.48' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 78.248418][ T6860] BTRFS: device fsid 8ae5b401-4ad8-4168-8672-01e7db0b90b5 devid 1 transid 5 /dev/loop5 scanned by syz-executor225 (6860) [ 78.266961][ T6861] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop1 [ 78.285431][ T6860] BTRFS info (device loop5): disk space caching is enabled [ 78.296412][ T6860] BTRFS info (device loop5): has skinny extents [ 78.329663][ T6862] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop0 executing program [ 78.371146][ T6859] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop2 executing program [ 78.410247][ T6865] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop4 executing program executing program executing program [ 78.568467][ T6864] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop3 executing program executing program [ 78.635604][ T7] BTRFS error (device loop5): bad tree block start, want 30425088 have 0 [ 78.650447][ T6873] BTRFS warning (device loop5): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop0 [ 78.664828][ T7] BTRFS error (device loop5): bad tree block start, want 30425088 have 0 [ 78.704461][ T6860] BTRFS warning (device loop5): failed to read root (objectid=7): -5 executing program executing program [ 78.782149][ T6904] BTRFS warning (device loop5): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop1 executing program executing program executing program [ 78.920110][ T6860] BTRFS error (device loop5): open_ctree failed [ 78.920667][ T6914] BTRFS: device fsid 8ae5b401-4ad8-4168-8672-01e7db0b90b5 devid 0 transid 5 /dev/loop0 scanned by syz-executor225 (6914) [ 78.944329][ T6926] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop4 [ 78.946250][ T6914] BTRFS error (device loop0): superblock checksum mismatch executing program executing program [ 78.991942][ T6928] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop5 new:/dev/loop2 executing program [ 79.059826][ T6914] BTRFS error (device loop0): open_ctree failed executing program [ 79.121392][ T6872] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop3 new:/dev/loop1 [ 79.136021][ T6937] BTRFS info (device loop3): disk space caching is enabled [ 79.151951][ T6937] BTRFS info (device loop3): has skinny extents executing program [ 79.163685][ T6945] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop3 new:/dev/loop5 [ 79.217012][ T6955] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop3 new:/dev/loop0 [ 79.250394][ T6937] BTRFS error (device loop3): super_num_devices 1 mismatch with num_devices 1 found here [ 79.260596][ T6937] BTRFS error (device loop3): failed to read chunk tree: -22 [ 79.270903][ T6959] BTRFS warning (device ): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop3 new:/dev/loop1 executing program executing program [ 79.329350][ T6937] BTRFS error (device loop3): open_ctree failed [ 79.339448][ T6928] BTRFS info (device loop3): disk space caching is enabled [ 79.350500][ T6928] BTRFS info (device loop3): has skinny extents executing program executing program executing program executing program [ 79.452762][ T7] BTRFS error (device loop3): bad tree block start, want 30425088 have 0 [ 79.469792][ T7] BTRFS error (device loop3): bad tree block start, want 30425088 have 0 [ 79.494782][ T6928] BTRFS warning (device loop3): failed to read root (objectid=7): -5 executing program executing program [ 79.548885][ T6928] BTRFS error (device loop3): open_ctree failed [ 79.562847][ T6945] BTRFS info (device loop3): disk space caching is enabled [ 79.572537][ T6945] BTRFS info (device loop3): has skinny extents executing program executing program [ 79.593678][ T7] BTRFS error (device loop3): bad tree block start, want 30425088 have 0 [ 79.613898][ T7] BTRFS error (device loop3): bad tree block start, want 30425088 have 0 [ 79.627754][ T6945] BTRFS warning (device loop3): failed to read root (objectid=7): -5 executing program [ 79.636879][ T7035] BTRFS warning (device loop3): duplicate device fsid:devid for 8ae5b401-4ad8-4168-8672-01e7db0b90b5:1 old:/dev/loop3 new:/dev/loop2 executing program [ 79.729734][ T6945] BTRFS error (device loop3): open_ctree failed [ 79.743133][ T6926] BTRFS info (device loop3): disk space caching is enabled executing program executing program [ 79.779466][ T6926] BTRFS info (device loop3): has skinny extents [ 79.801530][ T6926] BTRFS error (device loop3): super_num_devices 1 mismatch with num_devices 1 found here [ 79.822767][ T6926] BTRFS error (device loop3): failed to read chunk tree: -22 [ 79.836851][ T7068] ================================================================== [ 79.845136][ T7068] BUG: KASAN: use-after-free in btrfs_printk+0x3eb/0x435 [ 79.852166][ T7068] Read of size 8 at addr ffff8880878e06a8 by task syz-executor225/7068 [ 79.860402][ T7068] [ 79.862741][ T7068] CPU: 1 PID: 7068 Comm: syz-executor225 Not tainted 5.9.0-rc5-syzkaller #0 [ 79.871463][ T7068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 79.881571][ T7068] Call Trace: [ 79.884867][ T7068] dump_stack+0x1d6/0x29e [ 79.889199][ T7068] print_address_description+0x66/0x620 [ 79.894740][ T7068] ? printk+0x62/0x83 [ 79.898740][ T7068] ? _raw_spin_lock_irqsave+0x84/0xd0 [ 79.904125][ T7068] ? vprintk_emit+0x2f0/0x370 [ 79.908795][ T7068] kasan_report+0x132/0x1d0 [ 79.913325][ T7068] ? btrfs_printk+0x3eb/0x435 [ 79.918098][ T7068] btrfs_printk+0x3eb/0x435 [ 79.922615][ T7068] ? rcu_lock_acquire+0x5/0x30 [ 79.927372][ T7068] ? lock_is_held_type+0xb3/0xe0 [ 79.932284][ T7068] device_list_add+0x1a88/0x1d60 [ 79.937257][ T7068] btrfs_scan_one_device+0x196/0x490 [ 79.942547][ T7068] btrfs_mount_root+0x48f/0xb60 [ 79.947420][ T7068] ? vfs_parse_fs_string+0x150/0x1e0 [ 79.952724][ T7068] ? rcu_read_lock_sched_held+0x2f/0xa0 [ 79.958289][ T7068] ? trace_kfree+0xb2/0x100 [ 79.962818][ T7068] ? vfs_parse_fs_string+0x150/0x1e0 [ 79.968103][ T7068] legacy_get_tree+0xea/0x180 [ 79.972777][ T7068] ? btrfs_control_open+0x40/0x40 [ 79.977830][ T7068] vfs_get_tree+0x88/0x270 [ 79.982252][ T7068] vfs_kern_mount+0xc9/0x160 [ 79.986869][ T7068] btrfs_mount+0x33c/0xae0 [ 79.991291][ T7068] ? vfs_parse_fs_string+0x150/0x1e0 [ 79.996615][ T7068] ? rcu_read_lock_sched_held+0x2f/0xa0 [ 80.002157][ T7068] ? cap_capable+0x23f/0x280 [ 80.006753][ T7068] legacy_get_tree+0xea/0x180 [ 80.011455][ T7068] ? btrfs_resize_thread_pool+0x250/0x250 [ 80.017181][ T7068] vfs_get_tree+0x88/0x270 [ 80.021604][ T7068] path_mount+0x179d/0x29e0 [ 80.026141][ T7068] __se_sys_mount+0x126/0x180 [ 80.030831][ T7068] do_syscall_64+0x31/0x70 [ 80.035300][ T7068] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 80.041190][ T7068] RIP: 0033:0x44840a [ 80.045084][ T7068] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd a2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 aa a2 fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 80.064708][ T7068] RSP: 002b:00007ffedfffd608 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 80.073159][ T7068] RAX: ffffffffffffffda RBX: 00007ffedfffd670 RCX: 000000000044840a [ 80.081187][ T7068] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffedfffd630 [ 80.089169][ T7068] RBP: 00007ffedfffd630 R08: 00007ffedfffd670 R09: 0000000000000000 [ 80.097181][ T7068] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000001a [ 80.105163][ T7068] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 80.113189][ T7068] [ 80.115534][ T7068] Allocated by task 6945: [ 80.119874][ T7068] __kasan_kmalloc+0x100/0x130 [ 80.124642][ T7068] kvmalloc_node+0x81/0x110 [ 80.129148][ T7068] btrfs_mount_root+0xd0/0xb60 [ 80.133912][ T7068] legacy_get_tree+0xea/0x180 [ 80.138593][ T7068] vfs_get_tree+0x88/0x270 [ 80.143011][ T7068] vfs_kern_mount+0xc9/0x160 [ 80.147600][ T7068] btrfs_mount+0x33c/0xae0 [ 80.152029][ T7068] legacy_get_tree+0xea/0x180 [ 80.156706][ T7068] vfs_get_tree+0x88/0x270 [ 80.161121][ T7068] path_mount+0x179d/0x29e0 [ 80.165622][ T7068] __se_sys_mount+0x126/0x180 [ 80.170299][ T7068] do_syscall_64+0x31/0x70 [ 80.174714][ T7068] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 80.180595][ T7068] [ 80.182922][ T7068] Freed by task 6945: [ 80.186902][ T7068] kasan_set_track+0x3d/0x70 [ 80.191517][ T7068] kasan_set_free_info+0x17/0x30 [ 80.196458][ T7068] __kasan_slab_free+0xdd/0x110 [ 80.201334][ T7068] kfree+0x113/0x200 [ 80.205255][ T7068] deactivate_locked_super+0xa7/0xf0 [ 80.210539][ T7068] btrfs_mount_root+0x72b/0xb60 [ 80.215403][ T7068] legacy_get_tree+0xea/0x180 [ 80.220195][ T7068] vfs_get_tree+0x88/0x270 [ 80.224611][ T7068] vfs_kern_mount+0xc9/0x160 [ 80.229197][ T7068] btrfs_mount+0x33c/0xae0 [ 80.233611][ T7068] legacy_get_tree+0xea/0x180 [ 80.238284][ T7068] vfs_get_tree+0x88/0x270 [ 80.242696][ T7068] path_mount+0x179d/0x29e0 [ 80.247195][ T7068] __se_sys_mount+0x126/0x180 [ 80.251872][ T7068] do_syscall_64+0x31/0x70 [ 80.256287][ T7068] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 80.262191][ T7068] [ 80.264517][ T7068] The buggy address belongs to the object at ffff8880878e0000 [ 80.264517][ T7068] which belongs to the cache kmalloc-16k of size 16384 [ 80.278746][ T7068] The buggy address is located 1704 bytes inside of [ 80.278746][ T7068] 16384-byte region [ffff8880878e0000, ffff8880878e4000) [ 80.292308][ T7068] The buggy address belongs to the page: [ 80.298062][ T7068] page:0000000060704f30 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x878e0 [ 80.308203][ T7068] head:0000000060704f30 order:3 compound_mapcount:0 compound_pincount:0 [ 80.316521][ T7068] flags: 0xfffe0000010200(slab|head) [ 80.321810][ T7068] raw: 00fffe0000010200 ffffea00028e9a08 ffffea00021e3608 ffff8880aa440b00 [ 80.330392][ T7068] raw: 0000000000000000 ffff8880878e0000 0000000100000001 0000000000000000 [ 80.338967][ T7068] page dumped because: kasan: bad access detected [ 80.345395][ T7068] [ 80.347718][ T7068] Memory state around the buggy address: [ 80.353347][ T7068] ffff8880878e0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.361415][ T7068] ffff8880878e0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.369472][ T7068] >ffff8880878e0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb executing program [ 80.377526][ T7068] ^ [ 80.382896][ T7068] ffff8880878e0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.390982][ T7068] ffff8880878e0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.399035][ T7068] ================================================================== [ 80.407119][ T7068] Disabling lock debugging due to kernel taint [ 80.422378][ T7068] Kernel panic - not syncing: panic_on_warn set ... [ 80.428973][ T7068] CPU: 1 PID: 7068 Comm: syz-executor225 Tainted: G B 5.9.0-rc5-syzkaller #0 [ 80.439031][ T7068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 80.449084][ T7068] Call Trace: [ 80.452367][ T7068] dump_stack+0x1d6/0x29e [ 80.456689][ T7068] panic+0x2c0/0x800 [ 80.460583][ T7068] ? trace_hardirqs_on+0x30/0x80 [ 80.465512][ T7068] kasan_report+0x1c9/0x1d0 [ 80.469989][ T7068] ? btrfs_printk+0x3eb/0x435 [ 80.474637][ T7068] btrfs_printk+0x3eb/0x435 [ 80.479133][ T7068] ? rcu_lock_acquire+0x5/0x30 [ 80.483879][ T7068] ? lock_is_held_type+0xb3/0xe0 [ 80.488824][ T7068] device_list_add+0x1a88/0x1d60 [ 80.493760][ T7068] btrfs_scan_one_device+0x196/0x490 [ 80.499018][ T7068] btrfs_mount_root+0x48f/0xb60 [ 80.503856][ T7068] ? vfs_parse_fs_string+0x150/0x1e0 [ 80.509197][ T7068] ? rcu_read_lock_sched_held+0x2f/0xa0 [ 80.514713][ T7068] ? trace_kfree+0xb2/0x100 [ 80.519186][ T7068] ? vfs_parse_fs_string+0x150/0x1e0 [ 80.524457][ T7068] legacy_get_tree+0xea/0x180 [ 80.529104][ T7068] ? btrfs_control_open+0x40/0x40 [ 80.534099][ T7068] vfs_get_tree+0x88/0x270 [ 80.538493][ T7068] vfs_kern_mount+0xc9/0x160 [ 80.543054][ T7068] btrfs_mount+0x33c/0xae0 [ 80.547458][ T7068] ? vfs_parse_fs_string+0x150/0x1e0 [ 80.552719][ T7068] ? rcu_read_lock_sched_held+0x2f/0xa0 [ 80.558241][ T7068] ? cap_capable+0x23f/0x280 [ 80.562819][ T7068] legacy_get_tree+0xea/0x180 [ 80.567487][ T7068] ? btrfs_resize_thread_pool+0x250/0x250 [ 80.573187][ T7068] vfs_get_tree+0x88/0x270 [ 80.577586][ T7068] path_mount+0x179d/0x29e0 [ 80.582081][ T7068] __se_sys_mount+0x126/0x180 [ 80.586747][ T7068] do_syscall_64+0x31/0x70 [ 80.591133][ T7068] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 80.597011][ T7068] RIP: 0033:0x44840a [ 80.600879][ T7068] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd a2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 aa a2 fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 80.620646][ T7068] RSP: 002b:00007ffedfffd608 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 80.629059][ T7068] RAX: ffffffffffffffda RBX: 00007ffedfffd670 RCX: 000000000044840a [ 80.637004][ T7068] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffedfffd630 [ 80.644945][ T7068] RBP: 00007ffedfffd630 R08: 00007ffedfffd670 R09: 0000000000000000 [ 80.652918][ T7068] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000001a [ 80.660882][ T7068] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 80.669863][ T7068] Kernel Offset: disabled [ 80.674172][ T7068] Rebooting in 86400 seconds..