Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.171' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 27.434632] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 27.444672] REISERFS (device loop0): using ordered data mode [ 27.450698] reiserfs: using flush barriers [ 27.455812] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 27.471636] REISERFS (device loop0): checking transaction log (loop0) [ 27.479576] REISERFS (device loop0): Using rupasov hash to sort names [ 27.486578] ================================================================== [ 27.493982] BUG: KASAN: out-of-bounds in leaf_paste_entries+0x44b/0x9b0 [ 27.500711] Read of size 18446744073709551585 at addr ffff88808e0cdfa4 by task syz-executor277/7951 [ 27.509865] [ 27.511552] CPU: 0 PID: 7951 Comm: syz-executor277 Not tainted 4.14.294-syzkaller #0 [ 27.519522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 27.528855] Call Trace: [ 27.531424] dump_stack+0x1b2/0x281 [ 27.535039] print_address_description.cold+0x54/0x1d3 [ 27.540297] kasan_report_error.cold+0x8a/0x191 [ 27.544942] ? leaf_paste_entries+0x44b/0x9b0 [ 27.549411] kasan_report+0x6f/0x80 [ 27.553026] ? leaf_paste_entries+0x44b/0x9b0 [ 27.557509] memmove+0x20/0x50 [ 27.560695] leaf_paste_entries+0x44b/0x9b0 [ 27.565081] balance_leaf+0x827e/0xba30 [ 27.569034] ? replace_key+0x150/0x150 [ 27.572903] do_balance+0x282/0x630 [ 27.576517] ? get_right_neighbor_position+0x160/0x160 [ 27.581791] ? __mutex_unlock_slowpath+0x75/0x770 [ 27.586610] ? memset+0x20/0x40 [ 27.589865] reiserfs_paste_into_item+0x569/0x6f0 [ 27.594682] ? reiserfs_delete_object+0x1e0/0x1e0 [ 27.599519] ? wait_for_common_io.constprop.0+0x363/0x390 [ 27.605059] ? search_by_entry_key+0xf50/0xf50 [ 27.609626] ? make_cpu_key+0x22/0x2a0 [ 27.613494] reiserfs_add_entry+0x7d3/0xbc0 [ 27.617797] ? reiserfs_lookup+0x400/0x400 [ 27.622014] ? wait_for_common_io.constprop.0+0x363/0x390 [ 27.627525] ? wait_for_completion_io+0x10/0x10 [ 27.632409] reiserfs_mkdir+0x5ca/0x8b0 [ 27.636362] ? reiserfs_mknod+0x690/0x690 [ 27.640490] reiserfs_xattr_init+0x393/0xa50 [ 27.644877] reiserfs_fill_super+0x1d4a/0x2990 [ 27.649460] ? reiserfs_remount+0x1390/0x1390 [ 27.653942] ? lock_downgrade+0x740/0x740 [ 27.658070] ? snprintf+0xa5/0xd0 [ 27.661503] mount_bdev+0x2b3/0x360 [ 27.665108] ? reiserfs_remount+0x1390/0x1390 [ 27.669597] mount_fs+0x92/0x2a0 [ 27.672942] vfs_kern_mount.part.0+0x5b/0x470 [ 27.677419] do_mount+0xe65/0x2a30 [ 27.680938] ? do_raw_spin_unlock+0x164/0x220 [ 27.685410] ? copy_mount_string+0x40/0x40 [ 27.689623] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 27.694623] ? copy_mnt_ns+0xa30/0xa30 [ 27.698489] ? copy_mount_options+0x1fa/0x2f0 [ 27.702972] ? copy_mnt_ns+0xa30/0xa30 [ 27.706839] SyS_mount+0xa8/0x120 [ 27.710270] ? copy_mnt_ns+0xa30/0xa30 [ 27.714136] do_syscall_64+0x1d5/0x640 [ 27.718008] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 27.723172] RIP: 0033:0x7fd4ff5cc37a [ 27.726949] RSP: 002b:00007fff15a2cb38 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 27.734638] RAX: ffffffffffffffda RBX: 00007fff15a2cb90 RCX: 00007fd4ff5cc37a [ 27.741885] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff15a2cb50 [ 27.749130] RBP: 00007fff15a2cb50 R08: 00007fff15a2cb90 R09: 0000000000000000 [ 27.756376] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000290 [ 27.763622] R13: 0000000000000003 R14: 0000000000000004 R15: 0000000000000006 [ 27.770878] [ 27.772481] The buggy address belongs to the page: [ 27.777393] page:ffffea0002383340 count:3 mapcount:0 mapping:ffff8880b1e89aa8 index:0x213 [ 27.785699] flags: 0xfff00000001044(referenced|active|private) [ 27.791646] raw: 00fff00000001044 ffff8880b1e89aa8 0000000000000213 00000003ffffffff [ 27.799500] raw: dead000000000100 dead000000000200 ffff88808d2a0bd0 ffff88823b3288c0 [ 27.807352] page dumped because: kasan: bad access detected [ 27.813035] page->mem_cgroup:ffff88823b3288c0 [ 27.817500] [ 27.819102] Memory state around the buggy address: [ 27.824009] ffff88808e0cde80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.831429] ffff88808e0cdf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.838764] >ffff88808e0cdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.846094] ^ [ 27.850479] ffff88808e0ce000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.857816] ffff88808e0ce080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.865146] ================================================================== [ 27.872485] Disabling lock debugging due to kernel taint [ 27.878476] Kernel panic - not syncing: panic_on_warn set ... [ 27.878476] [ 27.885844] CPU: 0 PID: 7951 Comm: syz-executor277 Tainted: G B 4.14.294-syzkaller #0 [ 27.894929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 27.904270] Call Trace: [ 27.906876] dump_stack+0x1b2/0x281 [ 27.910480] panic+0x1f9/0x42d [ 27.913649] ? add_taint.cold+0x16/0x16 [ 27.917600] ? ___preempt_schedule+0x16/0x18 [ 27.921987] kasan_end_report+0x43/0x49 [ 27.925949] kasan_report_error.cold+0xa7/0x191 [ 27.930610] ? leaf_paste_entries+0x44b/0x9b0 [ 27.935077] kasan_report+0x6f/0x80 [ 27.938707] ? leaf_paste_entries+0x44b/0x9b0 [ 27.943193] memmove+0x20/0x50 [ 27.946361] leaf_paste_entries+0x44b/0x9b0 [ 27.950662] balance_leaf+0x827e/0xba30 [ 27.954616] ? replace_key+0x150/0x150 [ 27.958478] do_balance+0x282/0x630 [ 27.962098] ? get_right_neighbor_position+0x160/0x160 [ 27.967366] ? __mutex_unlock_slowpath+0x75/0x770 [ 27.972183] ? memset+0x20/0x40 [ 27.975436] reiserfs_paste_into_item+0x569/0x6f0 [ 27.980254] ? reiserfs_delete_object+0x1e0/0x1e0 [ 27.985099] ? wait_for_common_io.constprop.0+0x363/0x390 [ 27.990611] ? search_by_entry_key+0xf50/0xf50 [ 27.995168] ? make_cpu_key+0x22/0x2a0 [ 27.999030] reiserfs_add_entry+0x7d3/0xbc0 [ 28.003325] ? reiserfs_lookup+0x400/0x400 [ 28.007534] ? wait_for_common_io.constprop.0+0x363/0x390 [ 28.013046] ? wait_for_completion_io+0x10/0x10 [ 28.017709] reiserfs_mkdir+0x5ca/0x8b0 [ 28.021659] ? reiserfs_mknod+0x690/0x690 [ 28.025808] reiserfs_xattr_init+0x393/0xa50 [ 28.030191] reiserfs_fill_super+0x1d4a/0x2990 [ 28.034748] ? reiserfs_remount+0x1390/0x1390 [ 28.039218] ? lock_downgrade+0x740/0x740 [ 28.043340] ? snprintf+0xa5/0xd0 [ 28.046784] mount_bdev+0x2b3/0x360 [ 28.050392] ? reiserfs_remount+0x1390/0x1390 [ 28.054860] mount_fs+0x92/0x2a0 [ 28.058206] vfs_kern_mount.part.0+0x5b/0x470 [ 28.062764] do_mount+0xe65/0x2a30 [ 28.066280] ? do_raw_spin_unlock+0x164/0x220 [ 28.070836] ? copy_mount_string+0x40/0x40 [ 28.075048] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 28.080039] ? copy_mnt_ns+0xa30/0xa30 [ 28.083898] ? copy_mount_options+0x1fa/0x2f0 [ 28.088366] ? copy_mnt_ns+0xa30/0xa30 [ 28.092243] SyS_mount+0xa8/0x120 [ 28.095671] ? copy_mnt_ns+0xa30/0xa30 [ 28.099533] do_syscall_64+0x1d5/0x640 [ 28.103399] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.108564] RIP: 0033:0x7fd4ff5cc37a [ 28.112249] RSP: 002b:00007fff15a2cb38 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 28.119929] RAX: ffffffffffffffda RBX: 00007fff15a2cb90 RCX: 00007fd4ff5cc37a [ 28.127173] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff15a2cb50 [ 28.134435] RBP: 00007fff15a2cb50 R08: 00007fff15a2cb90 R09: 0000000000000000 [ 28.141680] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000290 [ 28.148923] R13: 0000000000000003 R14: 0000000000000004 R15: 0000000000000006 [ 28.156351] Kernel Offset: disabled [ 28.159976] Rebooting in 86400 seconds..