DUID 00:04:4b:a6:d8:97:08:21:27:2e:fd:cf:3e:39:f6:c0:7f:1f
forked to background, child pid 3213
[   35.031871][ T3214] 8021q: adding VLAN 0 to HW filter on device bond0
[   35.043317][ T3214] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.163' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   60.985394][ T3543] loop0: detected capacity change from 0 to 2048
[   60.992988][ T3543] =======================================================
[   60.992988][ T3543] WARNING: The mand mount option has been deprecated and
[   60.992988][ T3543]          and is ignored by this kernel. Remove the mand
[   60.992988][ T3543]          option from the mount to silence this warning.
[   60.992988][ T3543] =======================================================
[   61.031254][ T3543] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[   61.043472][ T3543] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[   61.063636][   T27] audit: type=1800 audit(1687087822.996:2): pid=3543 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor277" name="bus" dev="loop0" ino=1367 res=0 errno=0
[   61.246569][ T3542] ==================================================================
[   61.254677][ T3542] BUG: KASAN: use-after-free in crc_itu_t+0x218/0x2a0
[   61.261481][ T3542] Read of size 1 at addr ffff88806fdca000 by task syz-executor277/3542
[   61.269711][ T3542] 
[   61.272027][ T3542] CPU: 0 PID: 3542 Comm: syz-executor277 Not tainted 6.1.34-syzkaller #0
[   61.280455][ T3542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[   61.290773][ T3542] Call Trace:
[   61.294045][ T3542]  <TASK>
[   61.296968][ T3542]  dump_stack_lvl+0x1e3/0x2cb
[   61.301662][ T3542]  ? irq_work_queue+0xc6/0x150
[   61.306431][ T3542]  ? nf_tcp_handle_invalid+0x642/0x642
[   61.311985][ T3542]  ? panic+0x75d/0x75d
[   61.316065][ T3542]  ? _printk+0xd1/0x111
[   61.320227][ T3542]  ? _raw_spin_lock_irqsave+0xac/0x120
[   61.325688][ T3542]  print_report+0x15f/0x4f0
[   61.330206][ T3542]  ? time64_to_tm+0x32d/0x4d0
[   61.334889][ T3542]  ? __virt_addr_valid+0x22b/0x2e0
[   61.340017][ T3542]  ? __phys_addr+0xb6/0x170
[   61.344528][ T3542]  ? crc_itu_t+0x218/0x2a0
[   61.348951][ T3542]  kasan_report+0x136/0x160
[   61.353482][ T3542]  ? crc_itu_t+0x218/0x2a0
[   61.357916][ T3542]  crc_itu_t+0x218/0x2a0
[   61.362175][ T3542]  udf_sync_fs+0x1ce/0x380
[   61.366602][ T3542]  ? udf_put_super+0x160/0x160
[   61.371372][ T3542]  ? get_nr_dirty_inodes+0x2ab/0x2e0
[   61.376665][ T3542]  sync_filesystem+0xe8/0x220
[   61.381349][ T3542]  generic_shutdown_super+0x6b/0x340
[   61.386638][ T3542]  kill_block_super+0x7a/0xe0
[   61.391321][ T3542]  deactivate_locked_super+0xa0/0x110
[   61.396875][ T3542]  cleanup_mnt+0x490/0x520
[   61.401305][ T3542]  ? lockdep_hardirqs_on+0x94/0x130
[   61.406523][ T3542]  task_work_run+0x246/0x300
[   61.411123][ T3542]  ? task_work_cancel+0x2b0/0x2b0
[   61.416164][ T3542]  ? exit_to_user_mode_loop+0x39/0x100
[   61.421630][ T3542]  exit_to_user_mode_loop+0xd9/0x100
[   61.427004][ T3542]  exit_to_user_mode_prepare+0xb1/0x140
[   61.432554][ T3542]  syscall_exit_to_user_mode+0x60/0x270
[   61.438101][ T3542]  do_syscall_64+0x49/0xb0
[   61.442520][ T3542]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   61.448416][ T3542] RIP: 0033:0x7ff83ef6d177
[   61.452833][ T3542] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   61.472451][ T3542] RSP: 002b:00007fffe9a06ad8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[   61.480871][ T3542] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007ff83ef6d177
[   61.488845][ T3542] RDX: 00007fffe9a06b99 RSI: 000000000000000a RDI: 00007fffe9a06b90
[   61.496828][ T3542] RBP: 00007fffe9a06b90 R08: 00000000ffffffff R09: 00007fffe9a06970
[   61.504802][ T3542] R10: 0000555557067683 R11: 0000000000000206 R12: 00007fffe9a07c00
[   61.512778][ T3542] R13: 00005555570675f0 R14: 00007fffe9a06b00 R15: 0000000000000001
[   61.520756][ T3542]  </TASK>
[   61.523792][ T3542] 
[   61.526118][ T3542] The buggy address belongs to the physical page:
[   61.532604][ T3542] page:ffffea0001bf7280 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6fdca
[   61.542752][ T3542] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   61.549869][ T3542] raw: 00fff00000000000 ffffea0001bf72c8 ffffea0001c1dec8 0000000000000000
[   61.558455][ T3542] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[   61.567031][ T3542] page dumped because: kasan: bad access detected
[   61.573439][ T3542] page_owner tracks the page as freed
[   61.578798][ T3542] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 3534, tgid 3534 (sshd), ts 53823096621, free_ts 53888333213
[   61.596769][ T3542]  post_alloc_hook+0x18d/0x1b0
[   61.601543][ T3542]  get_page_from_freelist+0x32ed/0x3480
[   61.607111][ T3542]  __alloc_pages+0x28d/0x770
[   61.611699][ T3542]  __folio_alloc+0xf/0x30
[   61.616023][ T3542]  vma_alloc_folio+0x486/0x990
[   61.620799][ T3542]  handle_mm_fault+0x2e85/0x5330
[   61.625736][ T3542]  exc_page_fault+0x58d/0x790
[   61.630420][ T3542]  asm_exc_page_fault+0x22/0x30
[   61.635272][ T3542] page last free stack trace:
[   61.639933][ T3542]  free_unref_page_prepare+0xf63/0x1120
[   61.645486][ T3542]  free_unref_page_list+0x107/0x810
[   61.650708][ T3542]  release_pages+0x2836/0x2b40
[   61.655478][ T3542]  tlb_flush_mmu+0xfc/0x210
[   61.660086][ T3542]  tlb_finish_mmu+0xce/0x1f0
[   61.664692][ T3542]  unmap_region+0x29f/0x2f0
[   61.669222][ T3542]  do_mas_align_munmap+0xe98/0x15e0
[   61.674427][ T3542]  do_mas_munmap+0x246/0x2b0
[   61.679018][ T3542]  __vm_munmap+0x268/0x370
[   61.683440][ T3542]  __x64_sys_munmap+0x5c/0x70
[   61.688117][ T3542]  do_syscall_64+0x3d/0xb0
[   61.692538][ T3542]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   61.698435][ T3542] 
[   61.700758][ T3542] Memory state around the buggy address:
[   61.706379][ T3542]  ffff88806fdc9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   61.714436][ T3542]  ffff88806fdc9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   61.722503][ T3542] >ffff88806fdca000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   61.730562][ T3542]                    ^
[   61.734632][ T3542]  ffff88806fdca080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   61.742696][ T3542]  ffff88806fdca100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   61.750758][ T3542] ==================================================================
[   61.759319][ T3542] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   61.766543][ T3542] CPU: 1 PID: 3542 Comm: syz-executor277 Not tainted 6.1.34-syzkaller #0
[   61.774971][ T3542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[   61.785027][ T3542] Call Trace:
[   61.788308][ T3542]  <TASK>
[   61.791321][ T3542]  dump_stack_lvl+0x1e3/0x2cb
[   61.796006][ T3542]  ? nf_tcp_handle_invalid+0x642/0x642
[   61.801465][ T3542]  ? panic+0x75d/0x75d
[   61.805535][ T3542]  ? preempt_schedule_common+0xa6/0xd0
[   61.810999][ T3542]  ? vscnprintf+0x59/0x80
[   61.815326][ T3542]  panic+0x318/0x75d
[   61.819239][ T3542]  ? check_panic_on_warn+0x1d/0xa0
[   61.824363][ T3542]  ? memcpy_page_flushcache+0xfc/0xfc
[   61.829745][ T3542]  ? _raw_spin_unlock_irqrestore+0x128/0x130
[   61.835725][ T3542]  ? _raw_spin_unlock+0x40/0x40
[   61.840582][ T3542]  ? print_report+0x4a3/0x4f0
[   61.845275][ T3542]  check_panic_on_warn+0x7e/0xa0
[   61.850227][ T3542]  ? crc_itu_t+0x218/0x2a0
[   61.854654][ T3542]  end_report+0x66/0x110
[   61.858896][ T3542]  kasan_report+0x143/0x160
[   61.863411][ T3542]  ? crc_itu_t+0x218/0x2a0
[   61.867863][ T3542]  crc_itu_t+0x218/0x2a0
[   61.872112][ T3542]  udf_sync_fs+0x1ce/0x380
[   61.876556][ T3542]  ? udf_put_super+0x160/0x160
[   61.881322][ T3542]  ? get_nr_dirty_inodes+0x2ab/0x2e0
[   61.886611][ T3542]  sync_filesystem+0xe8/0x220
[   61.891440][ T3542]  generic_shutdown_super+0x6b/0x340
[   61.896723][ T3542]  kill_block_super+0x7a/0xe0
[   61.901400][ T3542]  deactivate_locked_super+0xa0/0x110
[   61.906771][ T3542]  cleanup_mnt+0x490/0x520
[   61.911203][ T3542]  ? lockdep_hardirqs_on+0x94/0x130
[   61.916414][ T3542]  task_work_run+0x246/0x300
[   61.921009][ T3542]  ? task_work_cancel+0x2b0/0x2b0
[   61.926041][ T3542]  ? exit_to_user_mode_loop+0x39/0x100
[   61.931602][ T3542]  exit_to_user_mode_loop+0xd9/0x100
[   61.936892][ T3542]  exit_to_user_mode_prepare+0xb1/0x140
[   61.942439][ T3542]  syscall_exit_to_user_mode+0x60/0x270
[   61.947983][ T3542]  do_syscall_64+0x49/0xb0
[   61.952401][ T3542]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   61.958302][ T3542] RIP: 0033:0x7ff83ef6d177
[   61.962720][ T3542] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   61.982344][ T3542] RSP: 002b:00007fffe9a06ad8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[   61.990760][ T3542] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007ff83ef6d177
[   61.998732][ T3542] RDX: 00007fffe9a06b99 RSI: 000000000000000a RDI: 00007fffe9a06b90
[   62.006699][ T3542] RBP: 00007fffe9a06b90 R08: 00000000ffffffff R09: 00007fffe9a06970
[   62.014681][ T3542] R10: 0000555557067683 R11: 0000000000000206 R12: 00007fffe9a07c00
[   62.022647][ T3542] R13: 00005555570675f0 R14: 00007fffe9a06b00 R15: 0000000000000001
[   62.030619][ T3542]  </TASK>
[   62.033888][ T3542] Kernel Offset: disabled
[   62.038250][ T3542] Rebooting in 86400 seconds..