Warning: Permanently added '10.128.0.183' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.537949] audit: type=1400 audit(1601886706.608:8): avc: denied { execmem } for pid=6366 comm="syz-executor573" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 32.547493] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 32.566196] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 32.578195] F2FS-fs (loop0): Fix alignment : done, start(4096) end(147456) block(12288) [ 32.587528] F2FS-fs (loop0): invalid crc value [ 32.594421] ================================================================== [ 32.601812] BUG: KASAN: slab-out-of-bounds in build_segment_manager+0x6464/0x7f40 [ 32.609411] Read of size 8 at addr ffff8880976d5ae8 by task syz-executor573/6366 [ 32.616913] [ 32.618516] CPU: 0 PID: 6366 Comm: syz-executor573 Not tainted 4.14.198-syzkaller #0 [ 32.626371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.635696] Call Trace: [ 32.638258] dump_stack+0x1b2/0x283 [ 32.641863] print_address_description.cold+0x54/0x1d3 [ 32.647110] kasan_report_error.cold+0x8a/0x194 [ 32.651754] ? build_segment_manager+0x6464/0x7f40 [ 32.656674] __asan_report_load8_noabort+0x68/0x70 [ 32.661578] ? build_segment_manager+0x6464/0x7f40 [ 32.666479] build_segment_manager+0x6464/0x7f40 [ 32.671256] ? flush_sit_entries+0x27d0/0x27d0 [ 32.675814] ? __raw_spin_lock_init+0x28/0x100 [ 32.680372] f2fs_fill_super+0x2e21/0x56a0 [ 32.684588] ? snprintf+0xa5/0xd0 [ 32.688015] ? f2fs_commit_super+0x3a0/0x3a0 [ 32.692400] ? ns_test_super+0x50/0x50 [ 32.696260] ? set_blocksize+0x125/0x380 [ 32.700296] mount_bdev+0x2b3/0x360 [ 32.703896] ? f2fs_commit_super+0x3a0/0x3a0 [ 32.708278] mount_fs+0x92/0x2a0 [ 32.711621] vfs_kern_mount.part.0+0x5b/0x470 [ 32.716089] do_mount+0xe53/0x2a00 [ 32.719607] ? copy_mount_string+0x40/0x40 [ 32.723815] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 32.728804] ? copy_mnt_ns+0xa30/0xa30 [ 32.732679] ? copy_mount_options+0x1fa/0x2f0 [ 32.737145] ? copy_mnt_ns+0xa30/0xa30 [ 32.741016] SyS_mount+0xa8/0x120 [ 32.744440] ? copy_mnt_ns+0xa30/0xa30 [ 32.748301] do_syscall_64+0x1d5/0x640 [ 32.752165] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.757325] RIP: 0033:0x446ffa [ 32.760489] RSP: 002b:00007fffb1582658 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5 [ 32.768188] RAX: ffffffffffffffda RBX: 00007fffb15826b0 RCX: 0000000000446ffa [ 32.775431] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fffb1582670 [ 32.782672] RBP: 00007fffb1582670 R08: 00007fffb15826b0 R09: 00007fff00000015 [ 32.790021] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000008 [ 32.797261] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 32.804509] [ 32.806110] Allocated by task 6366: [ 32.809722] kasan_kmalloc+0xeb/0x160 [ 32.813493] __kmalloc_node+0x4c/0x70 [ 32.817265] kvmalloc_node+0x46/0xd0 [ 32.820951] build_segment_manager+0x935/0x7f40 [ 32.825592] f2fs_fill_super+0x2e21/0x56a0 [ 32.829800] mount_bdev+0x2b3/0x360 [ 32.833400] mount_fs+0x92/0x2a0 [ 32.836737] vfs_kern_mount.part.0+0x5b/0x470 [ 32.841204] do_mount+0xe53/0x2a00 [ 32.844714] SyS_mount+0xa8/0x120 [ 32.848139] do_syscall_64+0x1d5/0x640 [ 32.851999] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.857157] [ 32.858757] Freed by task 0: [ 32.861753] (stack is not available) [ 32.865434] [ 32.867044] The buggy address belongs to the object at ffff8880976d5640 [ 32.867044] which belongs to the cache kmalloc-2048 of size 2048 [ 32.879844] The buggy address is located 1192 bytes inside of [ 32.879844] 2048-byte region [ffff8880976d5640, ffff8880976d5e40) [ 32.892002] The buggy address belongs to the page: [ 32.896911] page:ffffea00025db500 count:1 mapcount:0 mapping:ffff8880976d4540 index:0x0 compound_mapcount: 0 [ 32.906852] flags: 0xfffe0000008100(slab|head) [ 32.911406] raw: 00fffe0000008100 ffff8880976d4540 0000000000000000 0000000100000003 [ 32.919271] raw: ffffea00025da820 ffff88812fe51948 ffff88812fe50c40 0000000000000000 [ 32.927121] page dumped because: kasan: bad access detected [ 32.932887] [ 32.934484] Memory state around the buggy address: [ 32.939393] ffff8880976d5980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.946723] ffff8880976d5a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.954065] >ffff8880976d5a80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 32.961393] ^ [ 32.968126] ffff8880976d5b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.975456] ffff8880976d5b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.982786] ================================================================== [ 32.990115] Disabling lock debugging due to kernel taint [ 32.995625] Kernel panic - not syncing: panic_on_warn set ... [ 32.995625] [ 33.002977] CPU: 0 PID: 6366 Comm: syz-executor573 Tainted: G B 4.14.198-syzkaller #0 [ 33.012061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.021410] Call Trace: [ 33.023973] dump_stack+0x1b2/0x283 [ 33.027574] panic+0x1f9/0x42d [ 33.030912] ? add_taint.cold+0x16/0x16 [ 33.034870] ? ___preempt_schedule+0x16/0x18 [ 33.039252] kasan_end_report+0x43/0x49 [ 33.043197] kasan_report_error.cold+0xa7/0x194 [ 33.047847] ? build_segment_manager+0x6464/0x7f40 [ 33.052747] __asan_report_load8_noabort+0x68/0x70 [ 33.057647] ? build_segment_manager+0x6464/0x7f40 [ 33.062559] build_segment_manager+0x6464/0x7f40 [ 33.067289] ? flush_sit_entries+0x27d0/0x27d0 [ 33.071844] ? __raw_spin_lock_init+0x28/0x100 [ 33.076399] f2fs_fill_super+0x2e21/0x56a0 [ 33.080612] ? snprintf+0xa5/0xd0 [ 33.084034] ? f2fs_commit_super+0x3a0/0x3a0 [ 33.088414] ? ns_test_super+0x50/0x50 [ 33.092275] ? set_blocksize+0x125/0x380 [ 33.096305] mount_bdev+0x2b3/0x360 [ 33.099903] ? f2fs_commit_super+0x3a0/0x3a0 [ 33.104283] mount_fs+0x92/0x2a0 [ 33.107621] vfs_kern_mount.part.0+0x5b/0x470 [ 33.112091] do_mount+0xe53/0x2a00 [ 33.115603] ? copy_mount_string+0x40/0x40 [ 33.119809] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 33.124795] ? copy_mnt_ns+0xa30/0xa30 [ 33.128655] ? copy_mount_options+0x1fa/0x2f0 [ 33.133119] ? copy_mnt_ns+0xa30/0xa30 [ 33.136975] SyS_mount+0xa8/0x120 [ 33.140398] ? copy_mnt_ns+0xa30/0xa30 [ 33.144258] do_syscall_64+0x1d5/0x640 [ 33.148123] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 33.153289] RIP: 0033:0x446ffa [ 33.156448] RSP: 002b:00007fffb1582658 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5 [ 33.164137] RAX: ffffffffffffffda RBX: 00007fffb15826b0 RCX: 0000000000446ffa [ 33.171379] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fffb1582670 [ 33.178620] RBP: 00007fffb1582670 R08: 00007fffb15826b0 R09: 00007fff00000015 [ 33.185871] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000008 [ 33.193122] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 33.201721] Kernel Offset: disabled [ 33.205330] Rebooting in 86400 seconds..