Warning: Permanently added '10.128.0.133' (ED25519) to the list of known hosts. executing program [ 42.139974][ T3965] loop0: detected capacity change from 0 to 2048 [ 42.149559][ T3965] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 42.151211][ T3965] UDF-fs: Scanning with blocksize 512 failed [ 42.156324][ T3965] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 112: 0xb2 != 0xba [ 42.159386][ T3965] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 42.172981][ T3965] ================================================================== [ 42.174718][ T3965] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x578/0x668 [ 42.176332][ T3965] Write of size 4 at addr ffff0000c8d4aff8 by task syz-executor508/3965 [ 42.178070][ T3965] [ 42.178567][ T3965] CPU: 0 PID: 3965 Comm: syz-executor508 Not tainted 5.15.134-syzkaller #0 [ 42.180360][ T3965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 42.182657][ T3965] Call trace: [ 42.183376][ T3965] dump_backtrace+0x0/0x530 [ 42.184369][ T3965] show_stack+0x2c/0x3c [ 42.185299][ T3965] dump_stack_lvl+0x108/0x170 [ 42.186297][ T3965] print_address_description+0x7c/0x3f0 [ 42.187480][ T3965] kasan_report+0x174/0x1e4 [ 42.188441][ T3965] __asan_report_store_n_noabort+0x40/0x4c [ 42.189764][ T3965] udf_write_aext+0x578/0x668 [ 42.190775][ T3965] udf_add_entry+0x11e0/0x28b0 [ 42.191757][ T3965] udf_mkdir+0x158/0x7e0 [ 42.192698][ T3965] vfs_mkdir+0x350/0x514 [ 42.193652][ T3965] do_mkdirat+0x20c/0x610 [ 42.194594][ T3965] __arm64_sys_mkdirat+0x90/0xa8 [ 42.195638][ T3965] invoke_syscall+0x98/0x2b8 [ 42.196638][ T3965] el0_svc_common+0x138/0x258 [ 42.197658][ T3965] do_el0_svc+0x58/0x14c [ 42.198553][ T3965] el0_svc+0x7c/0x1f0 [ 42.199441][ T3965] el0t_64_sync_handler+0x84/0xe4 [ 42.200555][ T3965] el0t_64_sync+0x1a0/0x1a4 [ 42.201500][ T3965] [ 42.201949][ T3965] Allocated by task 3965: [ 42.202835][ T3965] ____kasan_kmalloc+0xbc/0xfc [ 42.203855][ T3965] __kasan_kmalloc+0x10/0x1c [ 42.204840][ T3965] __kmalloc+0x29c/0x4c8 [ 42.205748][ T3965] __udf_iget+0x988/0x3134 [ 42.206690][ T3965] udf_fill_super+0xfbc/0x1a7c [ 42.207686][ T3965] mount_bdev+0x274/0x370 [ 42.208673][ T3965] udf_mount+0x44/0x58 [ 42.209590][ T3965] legacy_get_tree+0xd4/0x16c [ 42.210665][ T3965] vfs_get_tree+0x90/0x274 [ 42.211576][ T3965] do_new_mount+0x25c/0x8c4 [ 42.212496][ T3965] path_mount+0x594/0x101c [ 42.213430][ T3965] __arm64_sys_mount+0x510/0x5e0 [ 42.214571][ T3965] invoke_syscall+0x98/0x2b8 [ 42.215528][ T3965] el0_svc_common+0x138/0x258 [ 42.216542][ T3965] do_el0_svc+0x58/0x14c [ 42.217432][ T3965] el0_svc+0x7c/0x1f0 [ 42.218291][ T3965] el0t_64_sync_handler+0x84/0xe4 [ 42.219355][ T3965] el0t_64_sync+0x1a0/0x1a4 [ 42.220378][ T3965] [ 42.220873][ T3965] The buggy address belongs to the object at ffff0000c8d4a800 [ 42.220873][ T3965] which belongs to the cache kmalloc-1k of size 1024 [ 42.223959][ T3965] The buggy address is located 1016 bytes to the right of [ 42.223959][ T3965] 1024-byte region [ffff0000c8d4a800, ffff0000c8d4ac00) [ 42.226922][ T3965] The buggy address belongs to the page: [ 42.228157][ T3965] page:00000000e82ce958 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108d48 [ 42.230431][ T3965] head:00000000e82ce958 order:3 compound_mapcount:0 compound_pincount:0 [ 42.232083][ T3965] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 42.233748][ T3965] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002780 [ 42.235527][ T3965] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 42.237396][ T3965] page dumped because: kasan: bad access detected [ 42.238882][ T3965] [ 42.239404][ T3965] Memory state around the buggy address: [ 42.240602][ T3965] ffff0000c8d4ae80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.242276][ T3965] ffff0000c8d4af00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.244006][ T3965] >ffff0000c8d4af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.245800][ T3965] ^ [ 42.247542][ T3965] ffff0000c8d4b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.249366][ T3965] ffff0000c8d4b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.251066][ T3965] ================================================================== [ 42.252743][ T3965] Disabling lock debugging due to kernel taint