[ 18.614000][ T3641] 8021q: adding VLAN 0 to HW filter on device bond0 [ 18.621734][ T3641] eql: remember to turn off Van-Jacobson compression on your slave devices [ 18.659832][ T136] gvnic 0000:00:00.0 enp0s0: Device link is up. [ 18.663047][ T3273] IPv6: ADDRCONF(NETDEV_CHANGE): enp0s0: link becomes ready Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.27' (ED25519) to the list of known hosts. executing program syzkaller login: [ 36.080873][ T3972] loop0: detected capacity change from 0 to 8192 [ 36.086934][ T3972] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 36.089533][ T3972] REISERFS (device loop0): using ordered data mode [ 36.091220][ T3972] reiserfs: using flush barriers [ 36.093516][ T3972] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 36.098158][ T3972] REISERFS (device loop0): checking transaction log (loop0) [ 36.102193][ T3972] REISERFS (device loop0): Using tea hash to sort names [ 36.104322][ T3972] ================================================================== [ 36.106530][ T3972] BUG: KASAN: use-after-free in search_by_entry_key+0x45c/0xe88 [ 36.108513][ T3972] Read of size 4 at addr ffff0000dd702fc4 by task syz-executor194/3972 [ 36.110710][ T3972] [ 36.111323][ T3972] CPU: 0 PID: 3972 Comm: syz-executor194 Not tainted 5.15.131-syzkaller #0 [ 36.113658][ T3972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 36.116238][ T3972] Call trace: [ 36.117092][ T3972] dump_backtrace+0x0/0x530 [ 36.118269][ T3972] show_stack+0x2c/0x3c [ 36.119433][ T3972] dump_stack_lvl+0x108/0x170 [ 36.120628][ T3972] print_address_description+0x7c/0x3f0 [ 36.121994][ T3972] kasan_report+0x174/0x1e4 [ 36.123102][ T3972] __asan_report_load_n_noabort+0x40/0x4c [ 36.124636][ T3972] search_by_entry_key+0x45c/0xe88 [ 36.125964][ T3972] reiserfs_find_entry+0x2a8/0x1624 [ 36.127319][ T3972] reiserfs_lookup+0x184/0x3c4 [ 36.128620][ T3972] __lookup_slow+0x250/0x388 [ 36.129816][ T3972] lookup_one_len+0x178/0x28c [ 36.131088][ T3972] reiserfs_lookup_privroot+0x8c/0x204 [ 36.132549][ T3972] reiserfs_fill_super+0x1aec/0x1e8c [ 36.133964][ T3972] mount_bdev+0x274/0x370 [ 36.135066][ T3972] get_super_block+0x44/0x58 [ 36.136307][ T3972] legacy_get_tree+0xd4/0x16c [ 36.137546][ T3972] vfs_get_tree+0x90/0x274 [ 36.138717][ T3972] do_new_mount+0x25c/0x8c4 [ 36.139887][ T3972] path_mount+0x590/0x104c [ 36.141042][ T3972] __arm64_sys_mount+0x510/0x5e0 [ 36.142391][ T3972] invoke_syscall+0x98/0x2b8 [ 36.143650][ T3972] el0_svc_common+0x138/0x258 [ 36.144896][ T3972] do_el0_svc+0x58/0x14c [ 36.146027][ T3972] el0_svc+0x7c/0x1f0 [ 36.147136][ T3972] el0t_64_sync_handler+0x84/0xe4 [ 36.148419][ T3972] el0t_64_sync+0x1a0/0x1a4 [ 36.149609][ T3972] [ 36.150207][ T3972] The buggy address belongs to the page: [ 36.151715][ T3972] page:00000000b36bc107 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x11d702 [ 36.154469][ T3972] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 36.156349][ T3972] raw: 05ffc00000000000 fffffc000375c0c8 fffffc000375c048 0000000000000000 [ 36.158551][ T3972] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 36.160768][ T3972] page dumped because: kasan: bad access detected [ 36.162396][ T3972] [ 36.163029][ T3972] Memory state around the buggy address: [ 36.164513][ T3972] ffff0000dd702e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.166679][ T3972] ffff0000dd702f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.168738][ T3972] >ffff0000dd702f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.170953][ T3972] ^ [ 36.172646][ T3972] ffff0000dd703000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.174735][ T3972] ffff0000dd703080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.176909][ T3972] ================================================================== [ 36.178963][ T3972] Disabling lock debugging due to kernel taint [ 36.180968][ T3972] REISERFS warning (device loop0): jdm-13090 reiserfs_new_inode: ACLs aren't enabled in the fs, but vfs thinks they are! [ 36.184255][ T3972] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program