[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.34' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 34.999613] ================================================================== [ 35.007111] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x847/0x860 [ 35.013947] Write of size 4 at addr ffff88809b694cf8 by task syz-executor221/8107 [ 35.021547] [ 35.023159] CPU: 0 PID: 8107 Comm: syz-executor221 Not tainted 4.19.211-syzkaller #0 [ 35.031015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 35.040349] Call Trace: [ 35.042921] dump_stack+0x1fc/0x2ef [ 35.046535] print_address_description.cold+0x54/0x219 [ 35.051795] kasan_report_error.cold+0x8a/0x1b9 [ 35.056448] ? udf_write_aext+0x847/0x860 [ 35.060618] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.065705] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.070549] ? udf_write_aext+0x847/0x860 [ 35.074684] udf_write_aext+0x847/0x860 [ 35.078643] udf_add_entry+0xdab/0x2a20 [ 35.082603] ? udf_write_fi+0xf40/0xf40 [ 35.086564] ? udf_new_inode+0xa7b/0xf30 [ 35.090611] ? userns_put+0xb0/0xb0 [ 35.094220] ? apparmor_capable+0x147/0x750 [ 35.098527] udf_mkdir+0x145/0x650 [ 35.102048] ? udf_create+0x180/0x180 [ 35.105834] ? capable_wrt_inode_uidgid+0x1d2/0x220 [ 35.110835] ? generic_permission+0x116/0x4d0 [ 35.115311] ? security_inode_permission+0xc5/0xf0 [ 35.120223] ? inode_permission.part.0+0x10c/0x450 [ 35.125138] vfs_mkdir+0x508/0x7a0 [ 35.128672] do_mkdirat+0x262/0x2d0 [ 35.132283] ? __ia32_sys_mknod+0x120/0x120 [ 35.136593] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.141597] ? do_syscall_64+0x21/0x620 [ 35.145554] do_syscall_64+0xf9/0x620 [ 35.149340] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.154512] RIP: 0033:0x7f204edea489 [ 35.158206] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.177611] RSP: 002b:00007ffd569e47b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 35.186082] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f204edea489 [ 35.193525] RDX: 00007f204eda8793 RSI: 0000000000000000 RDI: 0000000020000000 [ 35.200860] RBP: 00007f204eda9a60 R08: 00007ffd569e46a0 R09: 0000000000000000 [ 35.208111] R10: 00007ffd569e4680 R11: 0000000000000246 R12: 00007f204eda9af0 [ 35.215377] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 35.222645] [ 35.224257] Allocated by task 8093: [ 35.227875] __kmalloc_node_track_caller+0x4c/0x70 [ 35.232787] __alloc_skb+0xae/0x560 [ 35.236482] __napi_alloc_skb+0x74/0x300 [ 35.240525] page_to_skb+0x76/0xa70 [ 35.244138] receive_buf+0x2ab4/0x6780 [ 35.248007] virtnet_poll+0x568/0xe00 [ 35.251789] net_rx_action+0x4ac/0xfb0 [ 35.255657] __do_softirq+0x265/0x980 [ 35.259432] [ 35.261037] Freed by task 8089: [ 35.264299] kfree+0xcc/0x210 [ 35.268034] skb_release_data+0x6de/0x920 [ 35.272167] kfree_skb_partial+0x7e/0xa0 [ 35.276304] tcp_rcv_established+0x1b89/0x1ef0 [ 35.280871] tcp_v4_do_rcv+0x5d6/0x870 [ 35.284745] __release_sock+0x134/0x3a0 [ 35.288998] release_sock+0x54/0x1b0 [ 35.292704] tcp_recvmsg+0xa94/0x2a90 [ 35.296497] inet_recvmsg+0x124/0x5c0 [ 35.300282] sock_read_iter+0x339/0x470 [ 35.304238] __vfs_read+0x518/0x750 [ 35.307844] vfs_read+0x194/0x3c0 [ 35.311277] ksys_read+0x12b/0x2a0 [ 35.314796] do_syscall_64+0xf9/0x620 [ 35.318580] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.323743] [ 35.325355] The buggy address belongs to the object at ffff88809b694a80 [ 35.325355] which belongs to the cache kmalloc-512 of size 512 [ 35.337990] The buggy address is located 120 bytes to the right of [ 35.337990] 512-byte region [ffff88809b694a80, ffff88809b694c80) [ 35.350364] The buggy address belongs to the page: [ 35.355273] page:ffffea00026da500 count:1 mapcount:0 mapping:ffff88813bff0940 index:0x0 [ 35.363480] flags: 0xfff00000000100(slab) [ 35.367611] raw: 00fff00000000100 ffffea0002925f48 ffffea0002a57008 ffff88813bff0940 [ 35.375471] raw: 0000000000000000 ffff88809b694080 0000000100000006 0000000000000000 [ 35.383327] page dumped because: kasan: bad access detected [ 35.389009] [ 35.390616] Memory state around the buggy address: [ 35.395524] ffff88809b694b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.402869] ffff88809b694c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.410294] >ffff88809b694c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.417628] ^ [ 35.424882] ffff88809b694d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.432221] ffff88809b694d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.439575] ================================================================== [ 35.446912] Disabling lock debugging due to kernel taint [ 35.452924] Kernel panic - not syncing: panic_on_warn set ... [ 35.452924] [ 35.460292] CPU: 0 PID: 8107 Comm: syz-executor221 Tainted: G B 4.19.211-syzkaller #0 [ 35.469557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 35.478906] Call Trace: [ 35.481492] dump_stack+0x1fc/0x2ef [ 35.485119] panic+0x26a/0x50e [ 35.488308] ? __warn_printk+0xf3/0xf3 [ 35.492194] ? preempt_schedule_common+0x45/0xc0 [ 35.496944] ? ___preempt_schedule+0x16/0x18 [ 35.501333] ? trace_hardirqs_on+0x55/0x210 [ 35.505639] kasan_end_report+0x43/0x49 [ 35.509596] kasan_report_error.cold+0xa7/0x1b9 [ 35.514245] ? udf_write_aext+0x847/0x860 [ 35.518392] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.523472] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.528209] ? udf_write_aext+0x847/0x860 [ 35.532354] udf_write_aext+0x847/0x860 [ 35.536319] udf_add_entry+0xdab/0x2a20 [ 35.540277] ? udf_write_fi+0xf40/0xf40 [ 35.544232] ? udf_new_inode+0xa7b/0xf30 [ 35.548272] ? userns_put+0xb0/0xb0 [ 35.551877] ? apparmor_capable+0x147/0x750 [ 35.556181] udf_mkdir+0x145/0x650 [ 35.559714] ? udf_create+0x180/0x180 [ 35.563497] ? capable_wrt_inode_uidgid+0x1d2/0x220 [ 35.568494] ? generic_permission+0x116/0x4d0 [ 35.572968] ? security_inode_permission+0xc5/0xf0 [ 35.577877] ? inode_permission.part.0+0x10c/0x450 [ 35.582787] vfs_mkdir+0x508/0x7a0 [ 35.586338] do_mkdirat+0x262/0x2d0 [ 35.589943] ? __ia32_sys_mknod+0x120/0x120 [ 35.594246] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.599242] ? do_syscall_64+0x21/0x620 [ 35.603196] do_syscall_64+0xf9/0x620 [ 35.606980] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.612147] RIP: 0033:0x7f204edea489 [ 35.615844] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.634725] RSP: 002b:00007ffd569e47b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 35.642410] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f204edea489 [ 35.649657] RDX: 00007f204eda8793 RSI: 0000000000000000 RDI: 0000000020000000 [ 35.656905] RBP: 00007f204eda9a60 R08: 00007ffd569e46a0 R09: 0000000000000000 [ 35.664154] R10: 00007ffd569e4680 R11: 0000000000000246 R12: 00007f204eda9af0 [ 35.671399] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 35.678858] Kernel Offset: disabled [ 35.682466] Rebooting in 86400 seconds..