Warning: Permanently added '10.128.0.193' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 42.942902] ================================================================== [ 42.950464] BUG: KASAN: use-after-free in udf_get_fileident+0x233/0x250 [ 42.957219] Read of size 2 at addr ffff8880a48edca4 by task syz-executor193/8101 [ 42.964745] [ 42.966356] CPU: 0 PID: 8101 Comm: syz-executor193 Not tainted 4.19.211-syzkaller #0 [ 42.974211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 42.983538] Call Trace: [ 42.986106] dump_stack+0x1fc/0x2ef [ 42.989716] print_address_description.cold+0x54/0x219 [ 42.994976] kasan_report_error.cold+0x8a/0x1b9 [ 42.999636] ? udf_get_fileident+0x233/0x250 [ 43.004050] __asan_report_load_n_noabort+0x8b/0xa0 [ 43.009052] ? udf_get_fileident+0x233/0x250 [ 43.013445] udf_get_fileident+0x233/0x250 [ 43.017672] udf_fileident_read+0x550/0x1930 [ 43.022066] ? deref_stack_reg+0x1d0/0x1d0 [ 43.026286] ? udf_get_fileident+0x250/0x250 [ 43.030673] ? mark_held_locks+0xf0/0xf0 [ 43.034718] ? check_preemption_disabled+0x41/0x280 [ 43.039716] ? udf_readdir+0x376/0x1350 [ 43.043716] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 43.048712] udf_readdir+0x559/0x1350 [ 43.052501] ? udf_new_block+0x490/0x490 [ 43.056543] ? kmem_cache_free+0x7f/0x260 [ 43.060680] ? aa_path_link+0x410/0x410 [ 43.064635] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.070066] ? mark_held_locks+0xf0/0xf0 [ 43.074105] ? mark_held_locks+0xf0/0xf0 [ 43.078149] ? debug_check_no_obj_freed+0x201/0x490 [ 43.083144] ? fsnotify+0x84e/0xe10 [ 43.086751] ? fsnotify_first_mark+0x200/0x200 [ 43.091311] ? trace_hardirqs_off+0x64/0x200 [ 43.095699] ? lock_acquire+0x170/0x3c0 [ 43.099659] ? iterate_dir+0xd2/0x5c0 [ 43.103443] iterate_dir+0x473/0x5c0 [ 43.107138] __se_sys_getdents+0x175/0x2d0 [ 43.111350] ? compat_fillonedir+0x390/0x390 [ 43.115738] ? __se_sys_old_readdir.constprop.0+0x180/0x180 [ 43.121438] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 43.126782] ? trace_hardirqs_off_caller+0x6e/0x210 [ 43.131778] ? do_syscall_64+0x21/0x620 [ 43.135732] do_syscall_64+0xf9/0x620 [ 43.139515] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.144685] RIP: 0033:0x7fa71948e5d9 [ 43.148378] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.172655] RSP: 002b:00007ffd864fcf38 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 43.180340] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa71948e5d9 [ 43.187586] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 43.194841] RBP: 00007fa71944dbb0 R08: 0000000000000000 R09: 0000000000000000 [ 43.202100] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa71944dc40 [ 43.209358] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 43.216626] [ 43.218237] Allocated by task 8081: [ 43.221846] __kmalloc_node_track_caller+0x4c/0x70 [ 43.226890] __alloc_skb+0xae/0x560 [ 43.230504] __napi_alloc_skb+0x74/0x300 [ 43.234642] page_to_skb+0x76/0xa70 [ 43.238286] receive_buf+0x2ab4/0x6780 [ 43.242156] virtnet_poll+0x568/0xe00 [ 43.245941] net_rx_action+0x4ac/0xfb0 [ 43.249806] __do_softirq+0x265/0x980 [ 43.253581] [ 43.255185] Freed by task 8081: [ 43.258443] kfree+0xcc/0x210 [ 43.261528] skb_release_data+0x6de/0x920 [ 43.265658] kfree_skb_partial+0x7e/0xa0 [ 43.269701] tcp_rcv_established+0x1b89/0x1ef0 [ 43.274259] tcp_v4_do_rcv+0x5d6/0x870 [ 43.278141] __release_sock+0x134/0x3a0 [ 43.282890] release_sock+0x54/0x1b0 [ 43.286595] tcp_sendmsg+0x36/0x40 [ 43.290124] inet_sendmsg+0x132/0x5a0 [ 43.293915] sock_sendmsg+0xc3/0x120 [ 43.297610] sock_write_iter+0x287/0x3c0 [ 43.301654] __vfs_write+0x51b/0x770 [ 43.305355] vfs_write+0x1f3/0x540 [ 43.308874] ksys_write+0x12b/0x2a0 [ 43.312481] do_syscall_64+0xf9/0x620 [ 43.316264] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.321428] [ 43.323036] The buggy address belongs to the object at ffff8880a48edac0 [ 43.323036] which belongs to the cache kmalloc-512 of size 512 [ 43.335672] The buggy address is located 484 bytes inside of [ 43.335672] 512-byte region [ffff8880a48edac0, ffff8880a48edcc0) [ 43.347523] The buggy address belongs to the page: [ 43.352433] page:ffffea0002923b40 count:1 mapcount:0 mapping:ffff88813bff0940 index:0xffff8880a48ed840 [ 43.361853] flags: 0xfff00000000100(slab) [ 43.366069] raw: 00fff00000000100 ffffea0002916088 ffffea000291bd88 ffff88813bff0940 [ 43.373928] raw: ffff8880a48ed840 ffff8880a48ed0c0 0000000100000004 0000000000000000 [ 43.381780] page dumped because: kasan: bad access detected [ 43.387460] [ 43.389064] Memory state around the buggy address: [ 43.394077] ffff8880a48edb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.401419] ffff8880a48edc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.408753] >ffff8880a48edc80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 43.416086] ^ [ 43.420471] ffff8880a48edd00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 43.427804] ffff8880a48edd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.435137] ================================================================== [ 43.442476] Disabling lock debugging due to kernel taint [ 43.449280] Kernel panic - not syncing: panic_on_warn set ... [ 43.449280] [ 43.456654] CPU: 0 PID: 8101 Comm: syz-executor193 Tainted: G B 4.19.211-syzkaller #0 [ 43.465914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 43.475260] Call Trace: [ 43.477859] dump_stack+0x1fc/0x2ef [ 43.481486] panic+0x26a/0x50e [ 43.484675] ? __warn_printk+0xf3/0xf3 [ 43.488590] ? preempt_schedule_common+0x45/0xc0 [ 43.493334] ? ___preempt_schedule+0x16/0x18 [ 43.497720] ? trace_hardirqs_on+0x55/0x210 [ 43.502027] kasan_end_report+0x43/0x49 [ 43.505985] kasan_report_error.cold+0xa7/0x1b9 [ 43.510629] ? udf_get_fileident+0x233/0x250 [ 43.515013] __asan_report_load_n_noabort+0x8b/0xa0 [ 43.520029] ? udf_get_fileident+0x233/0x250 [ 43.524417] udf_get_fileident+0x233/0x250 [ 43.528629] udf_fileident_read+0x550/0x1930 [ 43.533018] ? deref_stack_reg+0x1d0/0x1d0 [ 43.537231] ? udf_get_fileident+0x250/0x250 [ 43.542835] ? mark_held_locks+0xf0/0xf0 [ 43.546880] ? check_preemption_disabled+0x41/0x280 [ 43.551873] ? udf_readdir+0x376/0x1350 [ 43.555831] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 43.560911] udf_readdir+0x559/0x1350 [ 43.564697] ? udf_new_block+0x490/0x490 [ 43.568738] ? kmem_cache_free+0x7f/0x260 [ 43.572870] ? aa_path_link+0x410/0x410 [ 43.576827] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.582169] ? mark_held_locks+0xf0/0xf0 [ 43.586206] ? mark_held_locks+0xf0/0xf0 [ 43.590244] ? debug_check_no_obj_freed+0x201/0x490 [ 43.595237] ? fsnotify+0x84e/0xe10 [ 43.598843] ? fsnotify_first_mark+0x200/0x200 [ 43.603402] ? trace_hardirqs_off+0x64/0x200 [ 43.607786] ? lock_acquire+0x170/0x3c0 [ 43.611735] ? iterate_dir+0xd2/0x5c0 [ 43.615520] iterate_dir+0x473/0x5c0 [ 43.619212] __se_sys_getdents+0x175/0x2d0 [ 43.623423] ? compat_fillonedir+0x390/0x390 [ 43.627807] ? __se_sys_old_readdir.constprop.0+0x180/0x180 [ 43.633499] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 43.638840] ? trace_hardirqs_off_caller+0x6e/0x210 [ 43.643837] ? do_syscall_64+0x21/0x620 [ 43.647787] do_syscall_64+0xf9/0x620 [ 43.651566] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.656731] RIP: 0033:0x7fa71948e5d9 [ 43.660429] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.679311] RSP: 002b:00007ffd864fcf38 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 43.688995] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa71948e5d9 [ 43.696241] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 43.703491] RBP: 00007fa71944dbb0 R08: 0000000000000000 R09: 0000000000000000 [ 43.710736] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa71944dc40 [ 43.717982] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 43.725397] Kernel Offset: disabled [ 43.729008] Rebooting in 86400 seconds..