[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.238' (ECDSA) to the list of known hosts. syzkaller login: [ 35.861721] IPVS: ftp: loaded support on port[0] = 21 executing program [ 35.955606] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 35.967074] REISERFS (device loop0): using ordered data mode [ 35.973602] reiserfs: using flush barriers [ 35.978804] REISERFS (device loop0): journal params: device loop0, size 15748, journal first block 18, max trans len 1024, max batch 900, max commit age 0, max trans age 30 [ 35.997104] REISERFS (device loop0): checking transaction log (loop0) [ 36.005855] REISERFS (device loop0): Using r5 hash to sort names [ 36.012581] REISERFS (device loop0): using 3.5.x disk format [ 36.018617] ================================================================== [ 36.026032] BUG: KASAN: use-after-free in search_by_entry_key+0xc7e/0xf50 [ 36.032936] Read of size 4 at addr ffff88808d89efc4 by task syz-executor416/7974 [ 36.040442] [ 36.042053] CPU: 1 PID: 7974 Comm: syz-executor416 Not tainted 4.14.295-syzkaller #0 [ 36.049906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 36.059324] Call Trace: [ 36.061895] dump_stack+0x1b2/0x281 [ 36.065506] print_address_description.cold+0x54/0x1d3 [ 36.070772] kasan_report_error.cold+0x8a/0x191 [ 36.075507] ? search_by_entry_key+0xc7e/0xf50 [ 36.080085] __asan_report_load_n_noabort+0x6b/0x80 [ 36.085083] ? search_by_entry_key+0xc7e/0xf50 [ 36.089640] search_by_entry_key+0xc7e/0xf50 [ 36.094030] ? make_cpu_key+0x22/0x2a0 [ 36.097896] reiserfs_find_entry.part.0+0x138/0x11e0 [ 36.102975] ? reiserfs_write_lock+0x75/0xf0 [ 36.107365] ? add_lock_to_list.constprop.0+0x17d/0x330 [ 36.112704] ? save_trace+0xd6/0x290 [ 36.116396] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 36.121847] ? search_by_entry_key+0xf50/0xf50 [ 36.126430] reiserfs_lookup+0x1fd/0x400 [ 36.130473] ? reiserfs_unlink+0x6a0/0x6a0 [ 36.134688] ? fs_reclaim_release+0xd0/0x110 [ 36.139078] ? __d_alloc+0x2a/0xa20 [ 36.142683] ? d_alloc+0x1c7/0x240 [ 36.146209] ? _raw_spin_unlock+0x29/0x40 [ 36.150353] ? d_alloc+0x1cc/0x240 [ 36.153872] __lookup_hash+0x1bb/0x270 [ 36.157735] ? __inode_permission+0xcd/0x2f0 [ 36.162123] lookup_one_len+0x279/0x3a0 [ 36.166077] ? lookup_one_len_unlocked+0x410/0x410 [ 36.170996] reiserfs_lookup_privroot+0x92/0x270 [ 36.175736] reiserfs_fill_super+0x1772/0x2990 [ 36.180412] ? reiserfs_remount+0x1390/0x1390 [ 36.185226] ? lock_downgrade+0x740/0x740 [ 36.189420] ? snprintf+0xa5/0xd0 [ 36.192911] ? ns_test_super+0x50/0x50 [ 36.196787] ? set_blocksize+0x125/0x380 [ 36.200846] mount_bdev+0x2b3/0x360 [ 36.204471] ? reiserfs_remount+0x1390/0x1390 [ 36.209075] mount_fs+0x92/0x2a0 [ 36.212438] vfs_kern_mount.part.0+0x5b/0x470 [ 36.217305] do_mount+0xe65/0x2a30 [ 36.220933] ? retint_kernel+0x2d/0x2d [ 36.224844] ? copy_mount_string+0x40/0x40 [ 36.229072] ? memset+0x20/0x40 [ 36.232374] ? copy_mount_options+0x1fa/0x2f0 [ 36.236862] ? copy_mnt_ns+0xa30/0xa30 [ 36.240737] SyS_mount+0xa8/0x120 [ 36.244188] ? copy_mnt_ns+0xa30/0xa30 [ 36.248065] do_syscall_64+0x1d5/0x640 [ 36.251980] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 36.257153] RIP: 0033:0x7f652fe437fa [ 36.260855] RSP: 002b:00007ffffd567078 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 36.268557] RAX: ffffffffffffffda RBX: 00007ffffd5670d0 RCX: 00007f652fe437fa [ 36.275856] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffffd567090 [ 36.283416] RBP: 0000000000000003 R08: 00007ffffd5670d0 R09: 0000000000000000 [ 36.290670] R10: 0000000000010001 R11: 0000000000000286 R12: 00007ffffd567090 [ 36.298060] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000004 [ 36.306032] [ 36.307640] The buggy address belongs to the page: [ 36.312562] page:ffffea0002362780 count:0 mapcount:0 mapping: (null) index:0x1 [ 36.320826] flags: 0xfff00000000000() [ 36.324607] raw: 00fff00000000000 0000000000000000 0000000000000001 00000000ffffffff [ 36.332593] raw: ffffea00023627e0 ffff8880ba537bc8 0000000000000000 0000000000000000 [ 36.340585] page dumped because: kasan: bad access detected [ 36.346377] [ 36.347983] Memory state around the buggy address: [ 36.352892] ffff88808d89ee80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.360669] ffff88808d89ef00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.368091] >ffff88808d89ef80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.375430] ^ [ 36.380853] ffff88808d89f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.388201] ffff88808d89f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.395532] ================================================================== [ 36.402862] Disabling lock debugging due to kernel taint [ 36.410946] Kernel panic - not syncing: panic_on_warn set ... [ 36.410946] [ 36.418328] CPU: 0 PID: 7974 Comm: syz-executor416 Tainted: G B 4.14.295-syzkaller #0 [ 36.427414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 36.436753] Call Trace: [ 36.439319] dump_stack+0x1b2/0x281 [ 36.442926] panic+0x1f9/0x42d [ 36.446098] ? add_taint.cold+0x16/0x16 [ 36.450068] ? ___preempt_schedule+0x16/0x18 [ 36.454456] kasan_end_report+0x43/0x49 [ 36.458406] kasan_report_error.cold+0xa7/0x191 [ 36.463054] ? search_by_entry_key+0xc7e/0xf50 [ 36.467613] __asan_report_load_n_noabort+0x6b/0x80 [ 36.472618] ? search_by_entry_key+0xc7e/0xf50 [ 36.477180] search_by_entry_key+0xc7e/0xf50 [ 36.481565] ? make_cpu_key+0x22/0x2a0 [ 36.485434] reiserfs_find_entry.part.0+0x138/0x11e0 [ 36.490514] ? reiserfs_write_lock+0x75/0xf0 [ 36.494904] ? add_lock_to_list.constprop.0+0x17d/0x330 [ 36.500243] ? save_trace+0xd6/0x290 [ 36.503938] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 36.509363] ? search_by_entry_key+0xf50/0xf50 [ 36.513925] reiserfs_lookup+0x1fd/0x400 [ 36.517963] ? reiserfs_unlink+0x6a0/0x6a0 [ 36.522175] ? fs_reclaim_release+0xd0/0x110 [ 36.526561] ? __d_alloc+0x2a/0xa20 [ 36.530161] ? d_alloc+0x1c7/0x240 [ 36.533678] ? _raw_spin_unlock+0x29/0x40 [ 36.537800] ? d_alloc+0x1cc/0x240 [ 36.541316] __lookup_hash+0x1bb/0x270 [ 36.545178] ? __inode_permission+0xcd/0x2f0 [ 36.549561] lookup_one_len+0x279/0x3a0 [ 36.553533] ? lookup_one_len_unlocked+0x410/0x410 [ 36.558449] reiserfs_lookup_privroot+0x92/0x270 [ 36.563181] reiserfs_fill_super+0x1772/0x2990 [ 36.567755] ? reiserfs_remount+0x1390/0x1390 [ 36.572243] ? lock_downgrade+0x740/0x740 [ 36.576365] ? snprintf+0xa5/0xd0 [ 36.579793] ? ns_test_super+0x50/0x50 [ 36.583742] ? set_blocksize+0x125/0x380 [ 36.587792] mount_bdev+0x2b3/0x360 [ 36.591654] ? reiserfs_remount+0x1390/0x1390 [ 36.596126] mount_fs+0x92/0x2a0 [ 36.599472] vfs_kern_mount.part.0+0x5b/0x470 [ 36.603962] do_mount+0xe65/0x2a30 [ 36.607568] ? retint_kernel+0x2d/0x2d [ 36.611434] ? copy_mount_string+0x40/0x40 [ 36.615651] ? memset+0x20/0x40 [ 36.618906] ? copy_mount_options+0x1fa/0x2f0 [ 36.623375] ? copy_mnt_ns+0xa30/0xa30 [ 36.627246] SyS_mount+0xa8/0x120 [ 36.630691] ? copy_mnt_ns+0xa30/0xa30 [ 36.634555] do_syscall_64+0x1d5/0x640 [ 36.638442] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 36.643634] RIP: 0033:0x7f652fe437fa [ 36.647322] RSP: 002b:00007ffffd567078 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 36.655021] RAX: ffffffffffffffda RBX: 00007ffffd5670d0 RCX: 00007f652fe437fa [ 36.662285] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffffd567090 [ 36.669530] RBP: 0000000000000003 R08: 00007ffffd5670d0 R09: 0000000000000000 [ 36.676773] R10: 0000000000010001 R11: 0000000000000286 R12: 00007ffffd567090 [ 36.684017] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000004 [ 36.691446] Kernel Offset: disabled [ 36.695050] Rebooting in 86400 seconds..