Warning: Permanently added '10.128.1.110' (ECDSA) to the list of known hosts. executing program executing program [ 552.040676] ================================================================== [ 552.048162] BUG: KASAN: slab-out-of-bounds in memcpy_from_page+0x8c/0x120 [ 552.055084] Read of size 2048 at addr ffff8880ac5ce080 by task loop0/8111 [ 552.062074] [ 552.063700] CPU: 0 PID: 8111 Comm: loop0 Not tainted 4.19.211-syzkaller #0 [ 552.070797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 [ 552.080242] Call Trace: [ 552.082821] dump_stack+0x1fc/0x2ef [ 552.086533] print_address_description.cold+0x54/0x219 [ 552.091798] kasan_report_error.cold+0x8a/0x1b9 [ 552.096447] ? memcpy_from_page+0x8c/0x120 [ 552.100922] kasan_report+0x8f/0xa0 [ 552.104551] ? memcpy_from_page+0x8c/0x120 [ 552.108805] memcpy+0x20/0x50 [ 552.111898] memcpy_from_page+0x8c/0x120 [ 552.115945] iov_iter_copy_from_user_atomic+0x701/0xaa0 [ 552.121319] generic_perform_write+0x265/0x4d0 [ 552.125898] ? __mnt_drop_write_file+0x6f/0xa0 [ 552.130478] ? filemap_page_mkwrite+0x2f0/0x2f0 [ 552.135150] ? current_time+0x1c0/0x1c0 [ 552.139118] ? lock_acquire+0x170/0x3c0 [ 552.143178] __generic_file_write_iter+0x24b/0x610 [ 552.148120] generic_file_write_iter+0x3f8/0x730 [ 552.153464] ? common_file_perm+0x4e5/0x850 [ 552.157766] do_iter_readv_writev+0x668/0x790 [ 552.162242] ? clone_verify_area+0x240/0x240 [ 552.166631] ? lock_acquire+0x170/0x3c0 [ 552.170586] ? security_file_permission+0x1c0/0x220 [ 552.175669] do_iter_write+0x182/0x5d0 [ 552.179539] vfs_iter_write+0x70/0xa0 [ 552.183321] lo_write_bvec+0x141/0x370 [ 552.187189] ? lo_rw_aio_do_completion+0xb0/0xb0 [ 552.191930] loop_queue_work+0xa1c/0x20c0 [ 552.196080] ? finish_task_switch+0x146/0x760 [ 552.200572] ? finish_task_switch+0x118/0x760 [ 552.205138] ? switch_mm_irqs_off+0x2e5/0x1340 [ 552.209703] ? lo_fallocate.isra.0+0x170/0x170 [ 552.214268] ? kthread_worker_fn+0x217/0x730 [ 552.218660] ? lock_downgrade+0x720/0x720 [ 552.222788] ? lock_acquire+0x170/0x3c0 [ 552.226743] ? kthread_worker_fn+0x3e4/0x730 [ 552.231132] ? _raw_spin_unlock_irq+0x24/0x80 [ 552.235606] kthread_worker_fn+0x292/0x730 [ 552.239831] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 552.244395] ? __kthread_init_worker+0xf0/0xf0 [ 552.248957] ? __kthread_parkme+0x133/0x1e0 [ 552.253358] ? loop_info64_to_compat+0x5e0/0x5e0 [ 552.258094] kthread+0x33f/0x460 [ 552.261452] ? kthread_park+0x180/0x180 [ 552.265421] ret_from_fork+0x24/0x30 [ 552.269114] [ 552.270720] Allocated by task 8110: [ 552.274340] __kmalloc+0x15a/0x3c0 [ 552.277859] hfsplus_read_wrapper+0x2c7/0xf00 [ 552.282345] hfsplus_fill_super+0x30a/0x19e0 [ 552.286732] mount_bdev+0x2fc/0x3b0 [ 552.290333] mount_fs+0xa3/0x310 [ 552.293680] vfs_kern_mount.part.0+0x68/0x470 [ 552.298156] do_mount+0x115c/0x2f50 [ 552.301761] ksys_mount+0xcf/0x130 [ 552.305282] __x64_sys_mount+0xba/0x150 [ 552.309237] do_syscall_64+0xf9/0x620 [ 552.313019] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 552.318279] [ 552.319885] Freed by task 6374: [ 552.323252] kfree+0xcc/0x210 [ 552.326339] kernfs_fop_release+0x120/0x190 [ 552.330641] __fput+0x2ce/0x890 [ 552.333899] task_work_run+0x148/0x1c0 [ 552.337788] exit_to_usermode_loop+0x251/0x2a0 [ 552.342626] do_syscall_64+0x538/0x620 [ 552.346501] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 552.351670] [ 552.353285] The buggy address belongs to the object at ffff8880ac5ce080 [ 552.353285] which belongs to the cache kmalloc-512 of size 512 [ 552.365929] The buggy address is located 0 bytes inside of [ 552.365929] 512-byte region [ffff8880ac5ce080, ffff8880ac5ce280) [ 552.377610] The buggy address belongs to the page: [ 552.382522] page:ffffea0002b17380 count:1 mapcount:0 mapping:ffff88813bff0940 index:0xffff8880ac5ce800 [ 552.392057] flags: 0xfff00000000100(slab) [ 552.396280] raw: 00fff00000000100 ffffea0002bb28c8 ffffea0002b0d6c8 ffff88813bff0940 [ 552.405376] raw: ffff8880ac5ce800 ffff8880ac5ce080 0000000100000005 0000000000000000 [ 552.413237] page dumped because: kasan: bad access detected [ 552.418925] [ 552.420534] Memory state around the buggy address: [ 552.425449] ffff8880ac5ce180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 552.432806] ffff8880ac5ce200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 552.440153] >ffff8880ac5ce280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 552.447665] ^ [ 552.451027] ffff8880ac5ce300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 552.458565] ffff8880ac5ce380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 552.465911] ================================================================== [ 552.473273] Disabling lock debugging due to kernel taint [ 552.478815] Kernel panic - not syncing: panic_on_warn set ... [ 552.478815] [ 552.486268] CPU: 0 PID: 8111 Comm: loop0 Tainted: G B 4.19.211-syzkaller #0 [ 552.494672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 [ 552.504107] Call Trace: [ 552.506694] dump_stack+0x1fc/0x2ef [ 552.510327] panic+0x26a/0x50e [ 552.513548] ? __warn_printk+0xf3/0xf3 [ 552.517423] ? retint_kernel+0x2d/0x2d [ 552.521300] ? trace_hardirqs_on+0x55/0x210 [ 552.525611] kasan_end_report+0x43/0x49 [ 552.529588] kasan_report_error.cold+0xa7/0x1b9 [ 552.534237] ? memcpy_from_page+0x8c/0x120 [ 552.538458] kasan_report+0x8f/0xa0 [ 552.542084] ? memcpy_from_page+0x8c/0x120 [ 552.546385] memcpy+0x20/0x50 [ 552.549569] memcpy_from_page+0x8c/0x120 [ 552.553710] iov_iter_copy_from_user_atomic+0x701/0xaa0 [ 552.559067] generic_perform_write+0x265/0x4d0 [ 552.563717] ? __mnt_drop_write_file+0x6f/0xa0 [ 552.568278] ? filemap_page_mkwrite+0x2f0/0x2f0 [ 552.572942] ? current_time+0x1c0/0x1c0 [ 552.576994] ? lock_acquire+0x170/0x3c0 [ 552.580946] __generic_file_write_iter+0x24b/0x610 [ 552.586128] generic_file_write_iter+0x3f8/0x730 [ 552.590873] ? common_file_perm+0x4e5/0x850 [ 552.595187] do_iter_readv_writev+0x668/0x790 [ 552.599669] ? clone_verify_area+0x240/0x240 [ 552.604063] ? lock_acquire+0x170/0x3c0 [ 552.608016] ? security_file_permission+0x1c0/0x220 [ 552.613026] do_iter_write+0x182/0x5d0 [ 552.617177] vfs_iter_write+0x70/0xa0 [ 552.620963] lo_write_bvec+0x141/0x370 [ 552.624833] ? lo_rw_aio_do_completion+0xb0/0xb0 [ 552.629571] loop_queue_work+0xa1c/0x20c0 [ 552.633900] ? finish_task_switch+0x146/0x760 [ 552.638383] ? finish_task_switch+0x118/0x760 [ 552.642859] ? switch_mm_irqs_off+0x2e5/0x1340 [ 552.647430] ? lo_fallocate.isra.0+0x170/0x170 [ 552.652022] ? kthread_worker_fn+0x217/0x730 [ 552.656549] ? lock_downgrade+0x720/0x720 [ 552.660806] ? lock_acquire+0x170/0x3c0 [ 552.664772] ? kthread_worker_fn+0x3e4/0x730 [ 552.669377] ? _raw_spin_unlock_irq+0x24/0x80 [ 552.673859] kthread_worker_fn+0x292/0x730 [ 552.678107] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 552.682910] ? __kthread_init_worker+0xf0/0xf0 [ 552.687491] ? __kthread_parkme+0x133/0x1e0 [ 552.691797] ? loop_info64_to_compat+0x5e0/0x5e0 [ 552.697505] kthread+0x33f/0x460 [ 552.700960] ? kthread_park+0x180/0x180 [ 552.705096] ret_from_fork+0x24/0x30 [ 552.709144] Kernel Offset: disabled [ 552.712753] Rebooting in 86400 seconds..