Warning: Permanently added '10.128.0.24' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 34.509964] ================================================================== [ 34.517464] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x847/0x860 [ 34.524317] Write of size 4 at addr ffff8880954080b8 by task syz-executor381/8104 [ 34.532018] [ 34.533655] CPU: 1 PID: 8104 Comm: syz-executor381 Not tainted 4.19.211-syzkaller #0 [ 34.541539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 34.551014] Call Trace: [ 34.553594] dump_stack+0x1fc/0x2ef [ 34.557219] print_address_description.cold+0x54/0x219 [ 34.562487] kasan_report_error.cold+0x8a/0x1b9 [ 34.567147] ? udf_write_aext+0x847/0x860 [ 34.571283] __asan_report_store_n_noabort+0x8b/0xa0 [ 34.576393] ? udf_get_pblock_spar15+0x131/0x4a0 [ 34.581130] ? udf_write_aext+0x847/0x860 [ 34.585260] udf_write_aext+0x847/0x860 [ 34.589223] udf_add_entry+0xdab/0x2a20 [ 34.593191] ? udf_write_fi+0xf40/0xf40 [ 34.597184] ? udf_new_inode+0xa7b/0xf30 [ 34.601228] ? userns_put+0xb0/0xb0 [ 34.604835] ? apparmor_capable+0x147/0x750 [ 34.609136] udf_mkdir+0x145/0x650 [ 34.612664] ? udf_create+0x180/0x180 [ 34.616449] ? capable_wrt_inode_uidgid+0x1d2/0x220 [ 34.621444] ? generic_permission+0x116/0x4d0 [ 34.625920] ? security_inode_permission+0xc5/0xf0 [ 34.630836] ? inode_permission.part.0+0x10c/0x450 [ 34.635750] vfs_mkdir+0x508/0x7a0 [ 34.639274] do_mkdirat+0x262/0x2d0 [ 34.642879] ? __ia32_sys_mknod+0x120/0x120 [ 34.647180] ? trace_hardirqs_off_caller+0x6e/0x210 [ 34.652287] ? do_syscall_64+0x21/0x620 [ 34.656240] do_syscall_64+0xf9/0x620 [ 34.660023] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.665190] RIP: 0033:0x7fc656f3f519 [ 34.668885] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 34.687770] RSP: 002b:00007ffc6151b488 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 34.695456] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc656f3f519 [ 34.702708] RDX: 00000000000001ff RSI: 0000000020000000 RDI: ffffffffffffff9c [ 34.709985] RBP: 00007fc656efeaf0 R08: 00007ffc6151b360 R09: 0000000000000000 [ 34.717249] R10: 00007ffc6151b350 R11: 0000000000000246 R12: 00007fc656efeb80 [ 34.724500] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 34.731755] [ 34.733362] Allocated by task 8104: [ 34.736971] __kmalloc+0x15a/0x3c0 [ 34.740495] udf_new_inode+0x220/0xf30 [ 34.744369] udf_mkdir+0xa8/0x650 [ 34.747804] vfs_mkdir+0x508/0x7a0 [ 34.751321] do_mkdirat+0x262/0x2d0 [ 34.754930] do_syscall_64+0xf9/0x620 [ 34.758726] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.763889] [ 34.765492] Freed by task 6267: [ 34.768749] kfree+0xcc/0x210 [ 34.771844] kernfs_fop_release+0x120/0x190 [ 34.776230] __fput+0x2ce/0x890 [ 34.779491] task_work_run+0x148/0x1c0 [ 34.783356] exit_to_usermode_loop+0x251/0x2a0 [ 34.787917] do_syscall_64+0x538/0x620 [ 34.791794] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.796963] [ 34.798572] The buggy address belongs to the object at ffff8880954080c0 [ 34.798572] which belongs to the cache kmalloc-512 of size 512 [ 34.811208] The buggy address is located 8 bytes to the left of [ 34.811208] 512-byte region [ffff8880954080c0, ffff8880954082c0) [ 34.823317] The buggy address belongs to the page: [ 34.828223] page:ffffea0002550200 count:1 mapcount:0 mapping:ffff88813bff0940 index:0x0 [ 34.836606] flags: 0xfff00000000100(slab) [ 34.840739] raw: 00fff00000000100 ffffea000277b688 ffffea0002ca7988 ffff88813bff0940 [ 34.848600] raw: 0000000000000000 ffff8880954080c0 0000000100000006 0000000000000000 [ 34.856460] page dumped because: kasan: bad access detected [ 34.862144] [ 34.863747] Memory state around the buggy address: [ 34.868655] ffff888095407f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.875993] ffff888095408000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.883349] >ffff888095408080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 34.890686] ^ [ 34.895854] ffff888095408100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.903191] ffff888095408180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.910524] ================================================================== [ 34.917862] Disabling lock debugging due to kernel taint [ 34.929056] Kernel panic - not syncing: panic_on_warn set ... [ 34.929056] [ 34.937225] CPU: 0 PID: 8104 Comm: syz-executor381 Tainted: G B 4.19.211-syzkaller #0 [ 34.946483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 34.955826] Call Trace: [ 34.958397] dump_stack+0x1fc/0x2ef [ 34.962009] panic+0x26a/0x50e [ 34.965179] ? __warn_printk+0xf3/0xf3 [ 34.969045] ? preempt_schedule_common+0x45/0xc0 [ 34.973785] ? ___preempt_schedule+0x16/0x18 [ 34.978177] ? trace_hardirqs_on+0x55/0x210 [ 34.982476] kasan_end_report+0x43/0x49 [ 34.986429] kasan_report_error.cold+0xa7/0x1b9 [ 34.991079] ? udf_write_aext+0x847/0x860 [ 34.995205] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.000287] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.005030] ? udf_write_aext+0x847/0x860 [ 35.009155] udf_write_aext+0x847/0x860 [ 35.013113] udf_add_entry+0xdab/0x2a20 [ 35.017069] ? udf_write_fi+0xf40/0xf40 [ 35.021024] ? udf_new_inode+0xa7b/0xf30 [ 35.025066] ? userns_put+0xb0/0xb0 [ 35.028675] ? apparmor_capable+0x147/0x750 [ 35.032976] udf_mkdir+0x145/0x650 [ 35.036493] ? udf_create+0x180/0x180 [ 35.040297] ? capable_wrt_inode_uidgid+0x1d2/0x220 [ 35.045292] ? generic_permission+0x116/0x4d0 [ 35.049781] ? security_inode_permission+0xc5/0xf0 [ 35.054697] ? inode_permission.part.0+0x10c/0x450 [ 35.059608] vfs_mkdir+0x508/0x7a0 [ 35.063125] do_mkdirat+0x262/0x2d0 [ 35.066740] ? __ia32_sys_mknod+0x120/0x120 [ 35.071231] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.076238] ? do_syscall_64+0x21/0x620 [ 35.080190] do_syscall_64+0xf9/0x620 [ 35.083968] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.089134] RIP: 0033:0x7fc656f3f519 [ 35.092827] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.111705] RSP: 002b:00007ffc6151b488 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 35.119390] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc656f3f519 [ 35.126639] RDX: 00000000000001ff RSI: 0000000020000000 RDI: ffffffffffffff9c [ 35.133886] RBP: 00007fc656efeaf0 R08: 00007ffc6151b360 R09: 0000000000000000 [ 35.141133] R10: 00007ffc6151b350 R11: 0000000000000246 R12: 00007fc656efeb80 [ 35.148379] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 35.155809] Kernel Offset: disabled [ 35.159423] Rebooting in 86400 seconds..