Warning: Permanently added '10.128.1.124' (ED25519) to the list of known hosts. executing program [ 32.616508][ T4226] loop0: detected capacity change from 0 to 2048 [ 32.624672][ T4226] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 32.626495][ T4226] UDF-fs: Scanning with blocksize 512 failed [ 32.630078][ T4226] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 112: 0xb2 != 0xba [ 32.633173][ T4226] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 32.638620][ T4226] ================================================================== [ 32.640785][ T4226] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x578/0x668 [ 32.642768][ T4226] Write of size 4 at addr ffff0000d2e877f8 by task syz-executor348/4226 [ 32.644964][ T4226] [ 32.645571][ T4226] CPU: 1 PID: 4226 Comm: syz-executor348 Not tainted 6.1.75-syzkaller #0 [ 32.647814][ T4226] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 32.650317][ T4226] Call trace: [ 32.651180][ T4226] dump_backtrace+0x1c8/0x1f4 [ 32.652404][ T4226] show_stack+0x2c/0x3c [ 32.653529][ T4226] dump_stack_lvl+0x108/0x170 [ 32.654766][ T4226] print_report+0x174/0x4c0 [ 32.655944][ T4226] kasan_report+0xd4/0x130 [ 32.657125][ T4226] __asan_report_store_n_noabort+0x28/0x34 [ 32.658642][ T4226] udf_write_aext+0x578/0x668 [ 32.659874][ T4226] udf_add_entry+0x11e0/0x28b0 [ 32.661130][ T4226] udf_mkdir+0x158/0x7e0 [ 32.662209][ T4226] vfs_mkdir+0x334/0x4e4 [ 32.663326][ T4226] do_mkdirat+0x220/0x510 [ 32.664461][ T4226] __arm64_sys_mkdirat+0x90/0xa8 [ 32.665749][ T4226] invoke_syscall+0x98/0x2c0 [ 32.666950][ T4226] el0_svc_common+0x138/0x258 [ 32.668162][ T4226] do_el0_svc+0x64/0x218 [ 32.669267][ T4226] el0_svc+0x58/0x168 [ 32.670303][ T4226] el0t_64_sync_handler+0x84/0xf0 [ 32.671550][ T4226] el0t_64_sync+0x18c/0x190 [ 32.672732][ T4226] [ 32.673313][ T4226] Allocated by task 4226: [ 32.674462][ T4226] kasan_set_track+0x4c/0x80 [ 32.675611][ T4226] kasan_save_alloc_info+0x24/0x30 [ 32.676895][ T4226] __kasan_kmalloc+0xac/0xc4 [ 32.678102][ T4226] __kmalloc+0xd8/0x1c4 [ 32.679158][ T4226] __udf_iget+0x988/0x3134 [ 32.680273][ T4226] udf_fill_super+0xf9c/0x1a44 [ 32.681506][ T4226] mount_bdev+0x274/0x370 [ 32.682611][ T4226] udf_mount+0x44/0x58 [ 32.683661][ T4226] legacy_get_tree+0xd4/0x16c [ 32.684856][ T4226] vfs_get_tree+0x90/0x274 [ 32.685997][ T4226] do_new_mount+0x278/0x8fc [ 32.687182][ T4226] path_mount+0x590/0xe5c [ 32.688322][ T4226] __arm64_sys_mount+0x45c/0x594 [ 32.689570][ T4226] invoke_syscall+0x98/0x2c0 [ 32.690712][ T4226] el0_svc_common+0x138/0x258 [ 32.691943][ T4226] do_el0_svc+0x64/0x218 [ 32.693017][ T4226] el0_svc+0x58/0x168 [ 32.694052][ T4226] el0t_64_sync_handler+0x84/0xf0 [ 32.695336][ T4226] el0t_64_sync+0x18c/0x190 [ 32.696516][ T4226] [ 32.697141][ T4226] The buggy address belongs to the object at ffff0000d2e87000 [ 32.697141][ T4226] which belongs to the cache kmalloc-1k of size 1024 [ 32.700722][ T4226] The buggy address is located 1016 bytes to the right of [ 32.700722][ T4226] 1024-byte region [ffff0000d2e87000, ffff0000d2e87400) [ 32.704362][ T4226] [ 32.704953][ T4226] The buggy address belongs to the physical page: [ 32.706623][ T4226] page:00000000db7239fd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112e80 [ 32.709215][ T4226] head:00000000db7239fd order:3 compound_mapcount:0 compound_pincount:0 [ 32.711441][ T4226] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 32.713547][ T4226] raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002780 [ 32.715802][ T4226] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 32.717956][ T4226] page dumped because: kasan: bad access detected [ 32.719591][ T4226] [ 32.720173][ T4226] Memory state around the buggy address: [ 32.721630][ T4226] ffff0000d2e87680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.723695][ T4226] ffff0000d2e87700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.725814][ T4226] >ffff0000d2e87780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.727845][ T4226] ^ [ 32.729865][ T4226] ffff0000d2e87800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.731897][ T4226] ffff0000d2e87880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.734002][ T4226] ================================================================== [ 32.736220][ T4226] Disabling lock debugging due to kernel taint