Warning: Permanently added '10.128.10.44' (ED25519) to the list of known hosts. executing program [ 52.108081][ T3487] loop0: detected capacity change from 0 to 2048 [ 52.116433][ T3487] ======================================================= [ 52.116433][ T3487] WARNING: The mand mount option has been deprecated and [ 52.116433][ T3487] and is ignored by this kernel. Remove the mand [ 52.116433][ T3487] option from the mount to silence this warning. [ 52.116433][ T3487] ======================================================= [ 52.274820][ T3487] ================================================================== [ 52.283004][ T3487] BUG: KASAN: slab-out-of-bounds in udf_close_lvid+0x6a4/0x9a0 [ 52.290562][ T3487] Write of size 1 at addr ffff88807ef851d8 by task syz-executor340/3487 [ 52.298876][ T3487] [ 52.301216][ T3487] CPU: 1 PID: 3487 Comm: syz-executor340 Not tainted 5.15.125-syzkaller #0 [ 52.309796][ T3487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 52.319844][ T3487] Call Trace: [ 52.323121][ T3487] <TASK> [ 52.326044][ T3487] dump_stack_lvl+0x1e3/0x2cb [ 52.330724][ T3487] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 52.336353][ T3487] ? _printk+0xd1/0x111 [ 52.340510][ T3487] ? __wake_up_klogd+0xcc/0x100 [ 52.345355][ T3487] ? panic+0x84d/0x84d [ 52.349419][ T3487] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 52.354882][ T3487] print_address_description+0x63/0x3b0 [ 52.360431][ T3487] ? udf_close_lvid+0x6a4/0x9a0 [ 52.365286][ T3487] kasan_report+0x16b/0x1c0 [ 52.369786][ T3487] ? udf_close_lvid+0x6a4/0x9a0 [ 52.374632][ T3487] udf_close_lvid+0x6a4/0x9a0 [ 52.379313][ T3487] ? udf_open_lvid+0x5a0/0x5a0 [ 52.384101][ T3487] ? clear_inode+0x150/0x150 [ 52.388693][ T3487] udf_put_super+0xc9/0x160 [ 52.393191][ T3487] ? udf_free_in_core_inode+0x20/0x20 [ 52.398579][ T3487] generic_shutdown_super+0x136/0x2c0 [ 52.403953][ T3487] kill_block_super+0x7a/0xe0 [ 52.408627][ T3487] deactivate_locked_super+0xa0/0x110 [ 52.414000][ T3487] cleanup_mnt+0x44e/0x500 [ 52.418414][ T3487] ? lockdep_hardirqs_on+0x94/0x130 [ 52.423613][ T3487] task_work_run+0x129/0x1a0 [ 52.428209][ T3487] do_exit+0x6a3/0x2480 [ 52.432366][ T3487] ? put_task_struct+0x80/0x80 [ 52.437131][ T3487] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 52.443117][ T3487] ? vtime_user_exit+0x2d1/0x400 [ 52.448056][ T3487] do_group_exit+0x144/0x310 [ 52.452652][ T3487] __x64_sys_exit_group+0x3b/0x40 [ 52.457807][ T3487] do_syscall_64+0x3d/0xb0 [ 52.462226][ T3487] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.468123][ T3487] RIP: 0033:0x7f26cc7a8249 [ 52.472549][ T3487] Code: Unable to access opcode bytes at RIP 0x7f26cc7a821f. [ 52.479907][ T3487] RSP: 002b:00007ffc61553bb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 52.488320][ T3487] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f26cc7a8249 [ 52.496294][ T3487] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 52.504260][ T3487] RBP: 00007f26cc846390 R08: ffffffffffffffb8 R09: 0000000000000000 [ 52.512234][ T3487] R10: 0000000000000022 R11: 0000000000000246 R12: 00007f26cc846390 [ 52.520201][ T3487] R13: 0000000000000000 R14: 00007f26cc848160 R15: 00007f26cc776160 [ 52.528178][ T3487] </TASK> [ 52.531195][ T3487] [ 52.533511][ T3487] Allocated by task 3318: [ 52.537826][ T3487] ____kasan_kmalloc+0xba/0xf0 [ 52.542597][ T3487] __kmalloc+0x168/0x300 [ 52.546836][ T3487] tomoyo_realpath_from_path+0xd8/0x5e0 [ 52.552372][ T3487] tomoyo_init_log+0x10c7/0x1fe0 [ 52.557306][ T3487] tomoyo_supervisor+0x3b8/0x12c0 [ 52.562323][ T3487] tomoyo_env_perm+0x174/0x210 [ 52.567081][ T3487] tomoyo_find_next_domain+0x137e/0x1cf0 [ 52.572728][ T3487] tomoyo_bprm_check_security+0xdb/0x120 [ 52.578354][ T3487] security_bprm_check+0x5f/0xa0 [ 52.583290][ T3487] bprm_execve+0x84e/0x17c0 [ 52.587973][ T3487] do_execveat_common+0x583/0x720 [ 52.593010][ T3487] __x64_sys_execve+0x8e/0xa0 [ 52.597683][ T3487] do_syscall_64+0x3d/0xb0 [ 52.602115][ T3487] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.608019][ T3487] [ 52.610341][ T3487] Freed by task 3318: [ 52.614313][ T3487] kasan_set_track+0x4b/0x80 [ 52.618984][ T3487] kasan_set_free_info+0x1f/0x40 [ 52.623908][ T3487] ____kasan_slab_free+0xd8/0x120 [ 52.628928][ T3487] slab_free_freelist_hook+0xdd/0x160 [ 52.634290][ T3487] kfree+0xf1/0x270 [ 52.638098][ T3487] tomoyo_realpath_from_path+0x5ad/0x5e0 [ 52.643723][ T3487] tomoyo_init_log+0x10c7/0x1fe0 [ 52.648653][ T3487] tomoyo_supervisor+0x3b8/0x12c0 [ 52.653672][ T3487] tomoyo_env_perm+0x174/0x210 [ 52.658436][ T3487] tomoyo_find_next_domain+0x137e/0x1cf0 [ 52.664058][ T3487] tomoyo_bprm_check_security+0xdb/0x120 [ 52.669705][ T3487] security_bprm_check+0x5f/0xa0 [ 52.674639][ T3487] bprm_execve+0x84e/0x17c0 [ 52.679149][ T3487] do_execveat_common+0x583/0x720 [ 52.684164][ T3487] __x64_sys_execve+0x8e/0xa0 [ 52.688850][ T3487] do_syscall_64+0x3d/0xb0 [ 52.693271][ T3487] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.699158][ T3487] [ 52.701470][ T3487] The buggy address belongs to the object at ffff88807ef84000 [ 52.701470][ T3487] which belongs to the cache kmalloc-4k of size 4096 [ 52.715947][ T3487] The buggy address is located 472 bytes to the right of [ 52.715947][ T3487] 4096-byte region [ffff88807ef84000, ffff88807ef85000) [ 52.729841][ T3487] The buggy address belongs to the page: [ 52.735466][ T3487] page:ffffea0001fbe000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ef80 [ 52.745611][ T3487] head:ffffea0001fbe000 order:3 compound_mapcount:0 compound_pincount:0 [ 52.753932][ T3487] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 52.761913][ T3487] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011c42140 [ 52.770491][ T3487] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 52.779151][ T3487] page dumped because: kasan: bad access detected [ 52.785553][ T3487] page_owner tracks the page as allocated [ 52.791264][ T3487] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3318, ts 35817775771, free_ts 30712579378 [ 52.809577][ T3487] get_page_from_freelist+0x322a/0x33c0 [ 52.815125][ T3487] __alloc_pages+0x272/0x700 [ 52.819710][ T3487] new_slab+0xbb/0x4b0 [ 52.823776][ T3487] ___slab_alloc+0x6f6/0xe10 [ 52.828358][ T3487] __kmalloc+0x1c9/0x300 [ 52.832588][ T3487] tomoyo_realpath_from_path+0xd8/0x5e0 [ 52.838126][ T3487] tomoyo_init_log+0x10c7/0x1fe0 [ 52.843059][ T3487] tomoyo_supervisor+0x3b8/0x12c0 [ 52.848078][ T3487] tomoyo_env_perm+0x174/0x210 [ 52.852864][ T3487] tomoyo_find_next_domain+0x137e/0x1cf0 [ 52.858491][ T3487] tomoyo_bprm_check_security+0xdb/0x120 [ 52.864122][ T3487] security_bprm_check+0x5f/0xa0 [ 52.869055][ T3487] bprm_execve+0x84e/0x17c0 [ 52.873550][ T3487] do_execveat_common+0x583/0x720 [ 52.878572][ T3487] __x64_sys_execve+0x8e/0xa0 [ 52.883239][ T3487] do_syscall_64+0x3d/0xb0 [ 52.887660][ T3487] page last free stack trace: [ 52.892326][ T3487] free_unref_page_prepare+0xc34/0xcf0 [ 52.897778][ T3487] free_unref_page+0x95/0x2d0 [ 52.902461][ T3487] __unfreeze_partials+0x1b7/0x210 [ 52.907563][ T3487] put_cpu_partial+0x132/0x1a0 [ 52.912323][ T3487] ___cache_free+0xe3/0x100 [ 52.916819][ T3487] qlist_free_all+0x36/0x90 [ 52.921313][ T3487] kasan_quarantine_reduce+0x162/0x180 [ 52.926763][ T3487] __kasan_slab_alloc+0x2f/0xc0 [ 52.931606][ T3487] slab_post_alloc_hook+0x53/0x380 [ 52.936714][ T3487] kmem_cache_alloc+0xf3/0x280 [ 52.941470][ T3487] getname_flags+0xb8/0x4e0 [ 52.945967][ T3487] user_path_at_empty+0x2a/0x180 [ 52.950901][ T3487] vfs_statx+0x106/0x3b0 [ 52.955157][ T3487] __x64_sys_newfstatat+0x12c/0x1b0 [ 52.960346][ T3487] do_syscall_64+0x3d/0xb0 [ 52.964758][ T3487] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.970645][ T3487] [ 52.972960][ T3487] Memory state around the buggy address: [ 52.978577][ T3487] ffff88807ef85080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 52.986628][ T3487] ffff88807ef85100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 52.994681][ T3487] >ffff88807ef85180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.002737][ T3487] ^ [ 53.009657][ T3487] ffff88807ef85200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.017716][ T3487] ffff88807ef85280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.025765][ T3487] ================================================================== [ 53.033811][ T3487] Disabling lock debugging due to kernel taint [ 53.041223][ T3487] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 53.048448][ T3487] CPU: 1 PID: 3487 Comm: syz-executor340 Tainted: G B 5.15.125-syzkaller #0 [ 53.058449][ T3487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 53.068501][ T3487] Call Trace: [ 53.071776][ T3487] <TASK> [ 53.074707][ T3487] dump_stack_lvl+0x1e3/0x2cb [ 53.079470][ T3487] ? io_uring_drop_tctx_refs+0x19d/0x19d [ 53.085098][ T3487] ? panic+0x84d/0x84d [ 53.089160][ T3487] ? rcu_is_watching+0x11/0xa0 [ 53.093930][ T3487] ? preempt_schedule_common+0xa6/0xd0 [ 53.099394][ T3487] panic+0x318/0x84d [ 53.103284][ T3487] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 53.109431][ T3487] ? check_panic_on_warn+0x1d/0xa0 [ 53.114534][ T3487] ? fb_is_primary_device+0xcc/0xcc [ 53.119727][ T3487] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 53.125816][ T3487] ? _raw_spin_unlock+0x40/0x40 [ 53.130685][ T3487] check_panic_on_warn+0x7e/0xa0 [ 53.135635][ T3487] ? udf_close_lvid+0x6a4/0x9a0 [ 53.140486][ T3487] end_report+0x6d/0xf0 [ 53.144641][ T3487] kasan_report+0x18e/0x1c0 [ 53.149141][ T3487] ? udf_close_lvid+0x6a4/0x9a0 [ 53.154070][ T3487] udf_close_lvid+0x6a4/0x9a0 [ 53.158751][ T3487] ? udf_open_lvid+0x5a0/0x5a0 [ 53.163523][ T3487] ? clear_inode+0x150/0x150 [ 53.168115][ T3487] udf_put_super+0xc9/0x160 [ 53.172616][ T3487] ? udf_free_in_core_inode+0x20/0x20 [ 53.177979][ T3487] generic_shutdown_super+0x136/0x2c0 [ 53.183344][ T3487] kill_block_super+0x7a/0xe0 [ 53.188011][ T3487] deactivate_locked_super+0xa0/0x110 [ 53.193374][ T3487] cleanup_mnt+0x44e/0x500 [ 53.197785][ T3487] ? lockdep_hardirqs_on+0x94/0x130 [ 53.203060][ T3487] task_work_run+0x129/0x1a0 [ 53.207646][ T3487] do_exit+0x6a3/0x2480 [ 53.211799][ T3487] ? put_task_struct+0x80/0x80 [ 53.216581][ T3487] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 53.222644][ T3487] ? vtime_user_exit+0x2d1/0x400 [ 53.227616][ T3487] do_group_exit+0x144/0x310 [ 53.232205][ T3487] __x64_sys_exit_group+0x3b/0x40 [ 53.237238][ T3487] do_syscall_64+0x3d/0xb0 [ 53.241649][ T3487] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.247539][ T3487] RIP: 0033:0x7f26cc7a8249 [ 53.251943][ T3487] Code: Unable to access opcode bytes at RIP 0x7f26cc7a821f. [ 53.259291][ T3487] RSP: 002b:00007ffc61553bb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 53.267695][ T3487] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f26cc7a8249 [ 53.275665][ T3487] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 53.283627][ T3487] RBP: 00007f26cc846390 R08: ffffffffffffffb8 R09: 0000000000000000 [ 53.291589][ T3487] R10: 0000000000000022 R11: 0000000000000246 R12: 00007f26cc846390 [ 53.299550][ T3487] R13: 0000000000000000 R14: 00007f26cc848160 R15: 00007f26cc776160 [ 53.307518][ T3487] </TASK> [ 53.310713][ T3487] Kernel Offset: disabled [ 53.315031][ T3487] Rebooting in 86400 seconds..