[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.15.211' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 33.208123] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 96: 0x73 != 0x9b [ 33.217970] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 33.233844] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 33.250201] ================================================================== [ 33.257680] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x780/0x860 [ 33.264540] Write of size 4 at addr ffff8880b2f562f0 by task syz-executor394/8108 [ 33.272284] [ 33.273994] CPU: 0 PID: 8108 Comm: syz-executor394 Not tainted 4.19.211-syzkaller #0 [ 33.281853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 33.291186] Call Trace: [ 33.293760] dump_stack+0x1fc/0x2ef [ 33.297471] print_address_description.cold+0x54/0x219 [ 33.302751] kasan_report_error.cold+0x8a/0x1b9 [ 33.307408] ? udf_write_aext+0x780/0x860 [ 33.311575] __asan_report_store_n_noabort+0x8b/0xa0 [ 33.316670] ? udf_get_pblock_spar15+0x131/0x4a0 [ 33.321409] ? udf_write_aext+0x780/0x860 [ 33.325541] udf_write_aext+0x780/0x860 [ 33.329497] udf_add_entry+0xdab/0x2a20 [ 33.333463] ? udf_write_fi+0xf40/0xf40 [ 33.337430] ? udf_new_inode+0xa7b/0xf30 [ 33.341491] udf_mkdir+0x145/0x650 [ 33.345022] ? map_id_up+0x178/0x2f0 [ 33.348897] ? udf_create+0x180/0x180 [ 33.352688] ? putname+0xe1/0x120 [ 33.356126] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 33.361149] ? generic_permission+0x116/0x4d0 [ 33.365630] ? security_inode_permission+0xc5/0xf0 [ 33.370543] ? inode_permission.part.0+0x10c/0x450 [ 33.375473] vfs_mkdir+0x508/0x7a0 [ 33.379004] do_mkdirat+0x262/0x2d0 [ 33.382622] ? __ia32_sys_mknod+0x120/0x120 [ 33.386930] ? trace_hardirqs_off_caller+0x6e/0x210 [ 33.391997] ? do_syscall_64+0x21/0x620 [ 33.395974] do_syscall_64+0xf9/0x620 [ 33.399766] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.404940] RIP: 0033:0x7f64e3a77bd9 [ 33.408633] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 33.427581] RSP: 002b:00007ffe83f93db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 33.435273] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f64e3a77bd9 [ 33.442535] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000004 [ 33.450232] RBP: 00007f64e3a371e0 R08: 0000000000000000 R09: 0000000000000000 [ 33.462352] R10: 000000000000002e R11: 0000000000000246 R12: 00007f64e3a37270 [ 33.469624] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 33.476969] [ 33.478749] Allocated by task 1: [ 33.482109] kmem_cache_alloc_trace+0x12f/0x380 [ 33.486761] kernfs_fop_open+0x2b3/0xd20 [ 33.490814] do_dentry_open+0x4aa/0x1160 [ 33.494980] path_openat+0x793/0x2df0 [ 33.498852] do_filp_open+0x18c/0x3f0 [ 33.502637] do_sys_open+0x3b3/0x520 [ 33.506333] do_syscall_64+0xf9/0x620 [ 33.510203] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.515471] [ 33.517079] Freed by task 1: [ 33.520077] kfree+0xcc/0x210 [ 33.523162] kernfs_fop_release+0x120/0x190 [ 33.527459] __fput+0x2ce/0x890 [ 33.530718] task_work_run+0x148/0x1c0 [ 33.534582] exit_to_usermode_loop+0x251/0x2a0 [ 33.539155] do_syscall_64+0x538/0x620 [ 33.543024] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.548185] [ 33.549878] The buggy address belongs to the object at ffff8880b2f56080 [ 33.549878] which belongs to the cache kmalloc-512 of size 512 [ 33.562532] The buggy address is located 112 bytes to the right of [ 33.562532] 512-byte region [ffff8880b2f56080, ffff8880b2f56280) [ 33.574925] The buggy address belongs to the page: [ 33.580012] page:ffffea0002cbd580 count:1 mapcount:0 mapping:ffff88813bff0940 index:0xffff8880b2f56800 [ 33.589434] flags: 0xfff00000000100(slab) [ 33.593566] raw: 00fff00000000100 ffffea0002ad0748 ffffea0002c06348 ffff88813bff0940 [ 33.601428] raw: ffff8880b2f56800 ffff8880b2f56080 0000000100000003 0000000000000000 [ 33.609292] page dumped because: kasan: bad access detected [ 33.614973] [ 33.616578] Memory state around the buggy address: [ 33.621501] ffff8880b2f56180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.628838] ffff8880b2f56200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.636175] >ffff8880b2f56280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.643507] ^ [ 33.650593] ffff8880b2f56300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.657928] ffff8880b2f56380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.665260] ================================================================== [ 33.672591] Disabling lock debugging due to kernel taint [ 33.685864] Kernel panic - not syncing: panic_on_warn set ... [ 33.685864] [ 33.693252] CPU: 0 PID: 8108 Comm: syz-executor394 Tainted: G B 4.19.211-syzkaller #0 [ 33.702596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 33.711929] Call Trace: [ 33.714498] dump_stack+0x1fc/0x2ef [ 33.718109] panic+0x26a/0x50e [ 33.721278] ? __warn_printk+0xf3/0xf3 [ 33.725144] ? preempt_schedule_common+0x45/0xc0 [ 33.729893] ? ___preempt_schedule+0x16/0x18 [ 33.734468] ? trace_hardirqs_on+0x55/0x210 [ 33.738946] kasan_end_report+0x43/0x49 [ 33.742899] kasan_report_error.cold+0xa7/0x1b9 [ 33.747548] ? udf_write_aext+0x780/0x860 [ 33.751677] __asan_report_store_n_noabort+0x8b/0xa0 [ 33.756759] ? udf_get_pblock_spar15+0x131/0x4a0 [ 33.761489] ? udf_write_aext+0x780/0x860 [ 33.765616] udf_write_aext+0x780/0x860 [ 33.769565] udf_add_entry+0xdab/0x2a20 [ 33.773519] ? udf_write_fi+0xf40/0xf40 [ 33.777474] ? udf_new_inode+0xa7b/0xf30 [ 33.781512] udf_mkdir+0x145/0x650 [ 33.785043] ? map_id_up+0x178/0x2f0 [ 33.788734] ? udf_create+0x180/0x180 [ 33.792514] ? putname+0xe1/0x120 [ 33.795947] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 33.801202] ? generic_permission+0x116/0x4d0 [ 33.805676] ? security_inode_permission+0xc5/0xf0 [ 33.810673] ? inode_permission.part.0+0x10c/0x450 [ 33.815692] vfs_mkdir+0x508/0x7a0 [ 33.819212] do_mkdirat+0x262/0x2d0 [ 33.822813] ? __ia32_sys_mknod+0x120/0x120 [ 33.827115] ? trace_hardirqs_off_caller+0x6e/0x210 [ 33.832200] ? do_syscall_64+0x21/0x620 [ 33.836243] do_syscall_64+0xf9/0x620 [ 33.840023] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.845187] RIP: 0033:0x7f64e3a77bd9 [ 33.848881] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 33.867849] RSP: 002b:00007ffe83f93db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 33.875539] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f64e3a77bd9 [ 33.882791] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000004 [ 33.890042] RBP: 00007f64e3a371e0 R08: 0000000000000000 R09: 0000000000000000 [ 33.897289] R10: 000000000000002e R11: 0000000000000246 R12: 00007f64e3a37270 [ 33.904539] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 33.911868] Kernel Offset: disabled [ 33.915474] Rebooting in 86400 seconds..