Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.38' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.340659] hfsplus: request for non-existent node 184549376 in B*Tree [ 32.350253] hfsplus: request for non-existent node 184549376 in B*Tree [ 32.360076] ================================================================== [ 32.367545] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x19b/0x1b0 [ 32.374731] Read of size 8 at addr ffff8880abfd46b8 by task syz-executor141/8110 [ 32.382255] [ 32.383867] CPU: 0 PID: 8110 Comm: syz-executor141 Not tainted 4.19.211-syzkaller #0 [ 32.391721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 32.401051] Call Trace: [ 32.403631] dump_stack+0x1fc/0x2ef [ 32.407246] print_address_description.cold+0x54/0x219 [ 32.412506] kasan_report_error.cold+0x8a/0x1b9 [ 32.417153] ? hfsplus_bnode_read+0x19b/0x1b0 [ 32.421628] __asan_report_load8_noabort+0x88/0x90 [ 32.426548] ? hfsplus_bnode_read+0x19b/0x1b0 [ 32.431023] hfsplus_bnode_read+0x19b/0x1b0 [ 32.435324] hfsplus_bnode_dump+0x2c2/0x3a0 [ 32.439624] ? hfsplus_bnode_move+0xa40/0xa40 [ 32.444097] ? hfsplus_bnode_write_u16+0x80/0xb0 [ 32.448843] ? msi_domain_alloc_irqs+0x430/0xd20 [ 32.453582] ? hfsplus_bnode_move+0x26/0xa40 [ 32.458154] ? __mark_inode_dirty+0x23f/0x1140 [ 32.462726] hfsplus_brec_remove+0x3d7/0x4e0 [ 32.467119] __hfsplus_delete_attr+0x217/0x370 [ 32.471683] ? hfsplus_find_exit+0xc0/0xc0 [ 32.475904] ? hfsplus_part_find+0xbd0/0xbd0 [ 32.480295] ? hfsplus_find_init+0x91/0x220 [ 32.484597] hfsplus_delete_all_attrs+0x149/0x3f0 [ 32.489421] ? hfsplus_delete_attr+0x2c0/0x2c0 [ 32.493984] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 32.498979] ? __mark_inode_dirty+0xcf0/0x1140 [ 32.503542] hfsplus_delete_cat+0x824/0xe30 [ 32.507846] ? hfsplus_create_cat+0x1210/0x1210 [ 32.512497] ? mark_held_locks+0xf0/0xf0 [ 32.516540] ? common_perm+0x4be/0x800 [ 32.520410] hfsplus_unlink+0x1d2/0x820 [ 32.524371] ? hfsplus_symlink+0x2e0/0x2e0 [ 32.528594] ? lock_acquire+0x170/0x3c0 [ 32.532547] ? vfs_unlink+0xca/0x4e0 [ 32.536242] vfs_unlink+0x27d/0x4e0 [ 32.539855] do_unlinkat+0x3b8/0x660 [ 32.543546] ? __ia32_sys_rmdir+0x40/0x40 [ 32.547689] ? strncpy_from_user+0x2a2/0x350 [ 32.552092] ? getname_flags+0x25b/0x590 [ 32.556159] do_syscall_64+0xf9/0x620 [ 32.559956] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.565130] RIP: 0033:0x7f827d65d779 [ 32.568826] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 32.587721] RSP: 002b:00007fff50902a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 32.595411] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f827d65d779 [ 32.602667] RDX: 00007f827d61bdf3 RSI: 0000000000000000 RDI: 0000000020000140 [ 32.609918] RBP: 00007f827d61d010 R08: 00000000000005f0 R09: 0000000000000000 [ 32.617165] R10: 00007fff50902910 R11: 0000000000000246 R12: 00007f827d61d0a0 [ 32.624411] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 32.631677] [ 32.633288] Allocated by task 8110: [ 32.636946] __kmalloc+0x15a/0x3c0 [ 32.640475] __hfs_bnode_create+0x105/0xb60 [ 32.644779] hfsplus_bnode_find+0x2aa/0xb80 [ 32.649081] hfsplus_brec_find+0x2af/0x500 [ 32.653299] hfsplus_delete_all_attrs+0x2dd/0x3f0 [ 32.658132] hfsplus_delete_cat+0x824/0xe30 [ 32.662454] hfsplus_unlink+0x1d2/0x820 [ 32.666410] vfs_unlink+0x27d/0x4e0 [ 32.670017] do_unlinkat+0x3b8/0x660 [ 32.673712] do_syscall_64+0xf9/0x620 [ 32.677492] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.682655] [ 32.684261] Freed by task 6247: [ 32.687519] kfree+0xcc/0x210 [ 32.690604] kvfree+0x59/0x60 [ 32.693698] getxattr+0x1c7/0x2b0 [ 32.697157] path_getxattr+0xb6/0x150 [ 32.700938] do_syscall_64+0xf9/0x620 [ 32.704734] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.709898] [ 32.711508] The buggy address belongs to the object at ffff8880abfd4600 [ 32.711508] which belongs to the cache kmalloc-192 of size 192 [ 32.724142] The buggy address is located 184 bytes inside of [ 32.724142] 192-byte region [ffff8880abfd4600, ffff8880abfd46c0) [ 32.735994] The buggy address belongs to the page: [ 32.740902] page:ffffea0002aff500 count:1 mapcount:0 mapping:ffff88813bff0040 index:0xffff8880abfd4e00 [ 32.750322] flags: 0xfff00000000100(slab) [ 32.754449] raw: 00fff00000000100 ffffea0002d6ea88 ffffea0002d4b188 ffff88813bff0040 [ 32.762315] raw: ffff8880abfd4e00 ffff8880abfd4000 000000010000000c 0000000000000000 [ 32.770170] page dumped because: kasan: bad access detected [ 32.775850] [ 32.777451] Memory state around the buggy address: [ 32.782358] ffff8880abfd4580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.789694] ffff8880abfd4600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.797030] >ffff8880abfd4680: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.804360] ^ [ 32.809529] ffff8880abfd4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.816869] ffff8880abfd4780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.824204] ================================================================== [ 32.831539] Disabling lock debugging due to kernel taint [ 32.838173] Kernel panic - not syncing: panic_on_warn set ... [ 32.838173] [ 32.845554] CPU: 0 PID: 8110 Comm: syz-executor141 Tainted: G B 4.19.211-syzkaller #0 [ 32.854897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 32.864244] Call Trace: [ 32.866828] dump_stack+0x1fc/0x2ef [ 32.870449] panic+0x26a/0x50e [ 32.873617] ? __warn_printk+0xf3/0xf3 [ 32.877483] ? preempt_schedule_common+0x45/0xc0 [ 32.882217] ? ___preempt_schedule+0x16/0x18 [ 32.886602] ? trace_hardirqs_on+0x55/0x210 [ 32.890901] kasan_end_report+0x43/0x49 [ 32.894855] kasan_report_error.cold+0xa7/0x1b9 [ 32.899498] ? hfsplus_bnode_read+0x19b/0x1b0 [ 32.903968] __asan_report_load8_noabort+0x88/0x90 [ 32.908874] ? hfsplus_bnode_read+0x19b/0x1b0 [ 32.913344] hfsplus_bnode_read+0x19b/0x1b0 [ 32.917640] hfsplus_bnode_dump+0x2c2/0x3a0 [ 32.921937] ? hfsplus_bnode_move+0xa40/0xa40 [ 32.926408] ? hfsplus_bnode_write_u16+0x80/0xb0 [ 32.931138] ? msi_domain_alloc_irqs+0x430/0xd20 [ 32.935866] ? hfsplus_bnode_move+0x26/0xa40 [ 32.940253] ? __mark_inode_dirty+0x23f/0x1140 [ 32.944811] hfsplus_brec_remove+0x3d7/0x4e0 [ 32.949198] __hfsplus_delete_attr+0x217/0x370 [ 32.953755] ? hfsplus_find_exit+0xc0/0xc0 [ 32.957967] ? hfsplus_part_find+0xbd0/0xbd0 [ 32.962958] ? hfsplus_find_init+0x91/0x220 [ 32.967265] hfsplus_delete_all_attrs+0x149/0x3f0 [ 32.972085] ? hfsplus_delete_attr+0x2c0/0x2c0 [ 32.976645] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 32.981639] ? __mark_inode_dirty+0xcf0/0x1140 [ 32.986199] hfsplus_delete_cat+0x824/0xe30 [ 32.990498] ? hfsplus_create_cat+0x1210/0x1210 [ 32.995152] ? mark_held_locks+0xf0/0xf0 [ 32.999191] ? common_perm+0x4be/0x800 [ 33.003075] hfsplus_unlink+0x1d2/0x820 [ 33.007031] ? hfsplus_symlink+0x2e0/0x2e0 [ 33.011244] ? lock_acquire+0x170/0x3c0 [ 33.015198] ? vfs_unlink+0xca/0x4e0 [ 33.018889] vfs_unlink+0x27d/0x4e0 [ 33.022493] do_unlinkat+0x3b8/0x660 [ 33.026186] ? __ia32_sys_rmdir+0x40/0x40 [ 33.030572] ? strncpy_from_user+0x2a2/0x350 [ 33.034956] ? getname_flags+0x25b/0x590 [ 33.038997] do_syscall_64+0xf9/0x620 [ 33.042778] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.047943] RIP: 0033:0x7f827d65d779 [ 33.051635] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 33.070511] RSP: 002b:00007fff50902a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 33.078194] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f827d65d779 [ 33.085441] RDX: 00007f827d61bdf3 RSI: 0000000000000000 RDI: 0000000020000140 [ 33.092696] RBP: 00007f827d61d010 R08: 00000000000005f0 R09: 0000000000000000 [ 33.099940] R10: 00007fff50902910 R11: 0000000000000246 R12: 00007f827d61d0a0 [ 33.107187] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 33.114508] Kernel Offset: disabled [ 33.118116] Rebooting in 86400 seconds..