[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.223' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 35.187298] ====================================================== [ 35.187298] WARNING: the mand mount option is being deprecated and [ 35.187298] will be removed in v5.15! [ 35.187298] ====================================================== [ 35.212927] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 96: 0x73 != 0x9b [ 35.223419] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 35.234856] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 35.245714] ================================================================== [ 35.253175] BUG: KASAN: slab-out-of-bounds in udf_write_aext+0x780/0x860 [ 35.260013] Write of size 4 at addr ffff888095abe570 by task syz-executor157/8108 [ 35.267623] [ 35.269256] CPU: 1 PID: 8108 Comm: syz-executor157 Not tainted 4.19.211-syzkaller #0 [ 35.277127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 35.286477] Call Trace: [ 35.289082] dump_stack+0x1fc/0x2ef [ 35.292705] print_address_description.cold+0x54/0x219 [ 35.297963] kasan_report_error.cold+0x8a/0x1b9 [ 35.302610] ? udf_write_aext+0x780/0x860 [ 35.306738] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.311819] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.316565] ? udf_write_aext+0x780/0x860 [ 35.320695] udf_write_aext+0x780/0x860 [ 35.324661] udf_add_entry+0xdab/0x2a20 [ 35.328625] ? udf_write_fi+0xf40/0xf40 [ 35.332587] ? udf_new_inode+0xa7b/0xf30 [ 35.336648] udf_mkdir+0x145/0x650 [ 35.340170] ? map_id_up+0x178/0x2f0 [ 35.343862] ? udf_create+0x180/0x180 [ 35.347639] ? putname+0xe1/0x120 [ 35.351071] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 35.356086] ? generic_permission+0x116/0x4d0 [ 35.360565] ? security_inode_permission+0xc5/0xf0 [ 35.365477] ? inode_permission.part.0+0x10c/0x450 [ 35.370406] vfs_mkdir+0x508/0x7a0 [ 35.373927] do_mkdirat+0x262/0x2d0 [ 35.377533] ? __ia32_sys_mknod+0x120/0x120 [ 35.381836] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.386837] ? do_syscall_64+0x21/0x620 [ 35.390800] do_syscall_64+0xf9/0x620 [ 35.394599] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.399777] RIP: 0033:0x7f0fd2d6de37 [ 35.403479] Code: ff ff ff ff c3 66 0f 1f 44 00 00 48 c7 c0 c0 ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.422361] RSP: 002b:00007ffc5e7f0828 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 [ 35.430047] RAX: ffffffffffffffda RBX: 00005555574972c0 RCX: 00007f0fd2d6de37 [ 35.437296] RDX: 0000000001280000 RSI: 00000000000001ff RDI: 0000000020000080 [ 35.444546] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 35.451802] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000080 [ 35.459056] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc5e7f08c0 [ 35.466310] [ 35.467914] Allocated by task 8094: [ 35.471524] __kmalloc_node_track_caller+0x4c/0x70 [ 35.476430] __alloc_skb+0xae/0x560 [ 35.480035] __napi_alloc_skb+0x74/0x300 [ 35.484078] page_to_skb+0x76/0xa70 [ 35.487684] receive_buf+0x2ab4/0x6780 [ 35.491557] virtnet_poll+0x568/0xe00 [ 35.495332] net_rx_action+0x4ac/0xfb0 [ 35.499196] __do_softirq+0x265/0x980 [ 35.502968] [ 35.504573] Freed by task 8094: [ 35.507828] kfree+0xcc/0x210 [ 35.510913] skb_release_data+0x6de/0x920 [ 35.515035] kfree_skb_partial+0x7e/0xa0 [ 35.519088] tcp_rcv_established+0x1b89/0x1ef0 [ 35.523647] tcp_v4_do_rcv+0x5d6/0x870 [ 35.527508] tcp_v4_rcv+0x2c03/0x3b80 [ 35.531287] ip_local_deliver_finish+0x495/0xc00 [ 35.536020] ip_local_deliver+0x188/0x500 [ 35.540142] ip_rcv_finish+0x1ca/0x2e0 [ 35.544005] ip_rcv+0xca/0x3c0 [ 35.547177] __netif_receive_skb_one_core+0x114/0x180 [ 35.552344] __netif_receive_skb+0x27/0x1c0 [ 35.556641] netif_receive_skb_internal+0xf0/0x3f0 [ 35.561546] napi_gro_receive+0x2e6/0x450 [ 35.565673] receive_buf+0xc2c/0x6780 [ 35.569449] virtnet_poll+0x568/0xe00 [ 35.573225] net_rx_action+0x4ac/0xfb0 [ 35.577089] __do_softirq+0x265/0x980 [ 35.580862] [ 35.582468] The buggy address belongs to the object at ffff888095abe300 [ 35.582468] which belongs to the cache kmalloc-512 of size 512 [ 35.595131] The buggy address is located 112 bytes to the right of [ 35.595131] 512-byte region [ffff888095abe300, ffff888095abe500) [ 35.607500] The buggy address belongs to the page: [ 35.612406] page:ffffea000256af80 count:1 mapcount:0 mapping:ffff88813bff0940 index:0x0 [ 35.620521] flags: 0xfff00000000100(slab) [ 35.624648] raw: 00fff00000000100 ffffea0002cda6c8 ffffea000256a248 ffff88813bff0940 [ 35.632505] raw: 0000000000000000 ffff888095abe080 0000000100000006 0000000000000000 [ 35.640360] page dumped because: kasan: bad access detected [ 35.646039] [ 35.647643] Memory state around the buggy address: [ 35.652547] ffff888095abe400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.659882] ffff888095abe480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.667214] >ffff888095abe500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.674548] ^ [ 35.682669] ffff888095abe580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.690004] ffff888095abe600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.697335] ================================================================== [ 35.704668] Disabling lock debugging due to kernel taint [ 35.713703] Kernel panic - not syncing: panic_on_warn set ... [ 35.713703] [ 35.721087] CPU: 0 PID: 8108 Comm: syz-executor157 Tainted: G B 4.19.211-syzkaller #0 [ 35.730345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 35.739683] Call Trace: [ 35.742257] dump_stack+0x1fc/0x2ef [ 35.745861] panic+0x26a/0x50e [ 35.749029] ? __warn_printk+0xf3/0xf3 [ 35.752897] ? preempt_schedule_common+0x45/0xc0 [ 35.757634] ? ___preempt_schedule+0x16/0x18 [ 35.762025] ? trace_hardirqs_on+0x55/0x210 [ 35.766328] kasan_end_report+0x43/0x49 [ 35.770283] kasan_report_error.cold+0xa7/0x1b9 [ 35.774931] ? udf_write_aext+0x780/0x860 [ 35.779059] __asan_report_store_n_noabort+0x8b/0xa0 [ 35.784142] ? udf_get_pblock_spar15+0x131/0x4a0 [ 35.788876] ? udf_write_aext+0x780/0x860 [ 35.793001] udf_write_aext+0x780/0x860 [ 35.796951] udf_add_entry+0xdab/0x2a20 [ 35.800908] ? udf_write_fi+0xf40/0xf40 [ 35.804862] ? udf_new_inode+0xa7b/0xf30 [ 35.808903] udf_mkdir+0x145/0x650 [ 35.812419] ? map_id_up+0x178/0x2f0 [ 35.816111] ? udf_create+0x180/0x180 [ 35.819888] ? putname+0xe1/0x120 [ 35.823319] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 35.828316] ? generic_permission+0x116/0x4d0 [ 35.832790] ? security_inode_permission+0xc5/0xf0 [ 35.837700] ? inode_permission.part.0+0x10c/0x450 [ 35.842606] vfs_mkdir+0x508/0x7a0 [ 35.846124] do_mkdirat+0x262/0x2d0 [ 35.849729] ? __ia32_sys_mknod+0x120/0x120 [ 35.854038] ? trace_hardirqs_off_caller+0x6e/0x210 [ 35.859033] ? do_syscall_64+0x21/0x620 [ 35.862983] do_syscall_64+0xf9/0x620 [ 35.866763] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 35.871929] RIP: 0033:0x7f0fd2d6de37 [ 35.875624] Code: ff ff ff ff c3 66 0f 1f 44 00 00 48 c7 c0 c0 ff ff ff 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 35.894677] RSP: 002b:00007ffc5e7f0828 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 [ 35.902364] RAX: ffffffffffffffda RBX: 00005555574972c0 RCX: 00007f0fd2d6de37 [ 35.909609] RDX: 0000000001280000 RSI: 00000000000001ff RDI: 0000000020000080 [ 35.916854] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 35.924117] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000080 [ 35.931370] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc5e7f08c0 [ 35.938816] Kernel Offset: disabled [ 35.942430] Rebooting in 86400 seconds..