[ 15.593524][ T5600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 15.605527][ T5600] eql: remember to turn off Van-Jacobson compression on your slave devices [ 15.649885][ T314] gvnic 0000:00:00.0 enp0s0: Device link is up. [ 15.653002][ T1558] IPv6: ADDRCONF(NETDEV_CHANGE): enp0s0: link becomes ready Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.60' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 36.658019][ T5926] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5926 'syz-executor315' [ 36.667401][ T5926] loop0: detected capacity change from 0 to 1024 [ 36.725180][ T9] ================================================================== [ 36.727188][ T9] BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0x9ec/0x112c [ 36.729463][ T9] Read of size 2048 at addr ffff0000d7157800 by task kworker/u4:0/9 [ 36.731528][ T9] [ 36.732091][ T9] CPU: 0 PID: 9 Comm: kworker/u4:0 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0 [ 36.734311][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 36.736760][ T9] Workqueue: loop0 loop_rootcg_workfn [ 36.738164][ T9] Call trace: [ 36.738990][ T9] dump_backtrace+0x1b8/0x1e4 [ 36.740083][ T9] show_stack+0x2c/0x44 [ 36.741077][ T9] dump_stack_lvl+0xd0/0x124 [ 36.742164][ T9] print_report+0x174/0x514 [ 36.743231][ T9] kasan_report+0xd4/0x130 [ 36.744279][ T9] kasan_check_range+0x264/0x2a4 [ 36.745430][ T9] __asan_memcpy+0x3c/0x84 [ 36.746408][ T9] copy_page_from_iter_atomic+0x9ec/0x112c [ 36.747837][ T9] generic_perform_write+0x2fc/0x55c [ 36.749155][ T9] __generic_file_write_iter+0x168/0x388 [ 36.750501][ T9] generic_file_write_iter+0xb8/0x2b4 [ 36.751837][ T9] do_iter_write+0x534/0x964 [ 36.752942][ T9] vfs_iter_write+0x88/0xac [ 36.754016][ T9] loop_process_work+0x15e0/0x2534 [ 36.755322][ T9] loop_rootcg_workfn+0x28/0x38 [ 36.756569][ T9] process_one_work+0x788/0x12d4 [ 36.757793][ T9] worker_thread+0x8e0/0xfe8 [ 36.758914][ T9] kthread+0x250/0x2d8 [ 36.759885][ T9] ret_from_fork+0x10/0x20 [ 36.760927][ T9] [ 36.761516][ T9] Allocated by task 5926: [ 36.762594][ T9] kasan_set_track+0x4c/0x7c [ 36.763711][ T9] kasan_save_alloc_info+0x24/0x30 [ 36.764965][ T9] __kasan_kmalloc+0xac/0xc4 [ 36.766067][ T9] __kmalloc+0xcc/0x1b8 [ 36.767065][ T9] hfsplus_read_wrapper+0x3ac/0xfcc [ 36.768330][ T9] hfsplus_fill_super+0x2f0/0x166c [ 36.769573][ T9] mount_bdev+0x26c/0x368 [ 36.770639][ T9] hfsplus_mount+0x44/0x58 [ 36.771703][ T9] legacy_get_tree+0xd4/0x16c [ 36.772864][ T9] vfs_get_tree+0x90/0x274 [ 36.773960][ T9] do_new_mount+0x25c/0x8c8 [ 36.775013][ T9] path_mount+0x590/0xe04 [ 36.776068][ T9] __arm64_sys_mount+0x45c/0x594 [ 36.777187][ T9] invoke_syscall+0x98/0x2c0 [ 36.778329][ T9] el0_svc_common+0x138/0x258 [ 36.779470][ T9] do_el0_svc+0x64/0x198 [ 36.780520][ T9] el0_svc+0x4c/0x15c [ 36.781462][ T9] el0t_64_sync_handler+0x84/0xf0 [ 36.782621][ T9] el0t_64_sync+0x190/0x194 [ 36.783735][ T9] [ 36.784263][ T9] The buggy address belongs to the object at ffff0000d7157800 [ 36.784263][ T9] which belongs to the cache kmalloc-512 of size 512 [ 36.787677][ T9] The buggy address is located 0 bytes inside of [ 36.787677][ T9] allocated 512-byte region [ffff0000d7157800, ffff0000d7157a00) [ 36.791153][ T9] [ 36.791722][ T9] The buggy address belongs to the physical page: [ 36.793199][ T9] page:0000000031659fe0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117154 [ 36.795728][ T9] head:0000000031659fe0 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.797942][ T9] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 36.800034][ T9] raw: 05ffc00000010200 ffff0000c0002600 dead000000000100 dead000000000122 [ 36.802137][ T9] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 36.804158][ T9] page dumped because: kasan: bad access detected [ 36.805756][ T9] [ 36.806306][ T9] Memory state around the buggy address: [ 36.807730][ T9] ffff0000d7157900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.809766][ T9] ffff0000d7157980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.811770][ T9] >ffff0000d7157a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.813621][ T9] ^ [ 36.814551][ T9] ffff0000d7157a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.816443][ T9] ffff0000d7157b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.818381][ T9] ================================================================== [ 36.820406][ T9] Disabling lock debugging due to kernel taint